Verify declared upstream sources and SHA-256 digests.