In the manifest line, flags are put directly after the hash, so the
parser has been guessing the presence of flags based on the length of
the hash. Replace this assumption by an enumeration of the valid flags
and removing them from the hash first as they are distinct input values.
Consistently handle the expected 256bit length of the SHA1-replacement
in the pure Python prser as well. Check that setting flags will use one
of the blessed values.