update_responses script generates incorrect hashes

While testing TB 4.0a2 -> 4.0a3 updates, brade and I discovered that the SHA512 hashes generated by the update_responses script (for the update manifest XML files) are incorrect. The file path is being hashed rather than its contents.

I have a rough patch that seems to work; it may need some polish.