Thanks!

sha256sum doesn't match the one available here: https://pypi.org/project/sqlmap/
Not sure why upstream is distributing two different tarballs, but the only difference is some .git metadata. OK!