PUP-1840 allows users to specify the digest algorithm to use for file bucketing and the file checksum parameter. However, if you reconfigure the master to use SHA256:
Then it will reject file bucket requests from agents that haven't switched over:
Specifically, if you are using puppet to manage its own puppet.conf, then the agent will try to file bucket the old puppet.conf before overwriting it. Since it's using the old digest algorithm, it will fail the catalog run, without making the change.
The workaround is to disable filebuckets globally, then apply the digest_algorithm change.
To provide an upgrade path, the master should warn if it receives a file bucket request for a checksum type it doesn't support, and ignore the request.