and the sha256sums of the .origs,
against the handoff email.
+Confirm that the sponsee has not made
+a debian/1.2.3-1 tag.
+If they have,
+it is best to ask them to delete it now,
+as it can cause confusion later when dgit push produces its own tag.
+
Now you can check out the branch tip,
and do your substantive review.