Requirement R-130206 contains wrong reference to ETSI NFV SOL004.
Current Description:

"If the VNF or PNF CSAR Package utilizes Option 2 for package security, then the complete CSAR file MUST contain a Digest (a.k.a. hash) for each of the components of the VNF or PNF package."

Actually, the description refers to Option 1 for package security.
Please have a look at ETSI NFV SOL004, ver 2.5.1, chapter 5.1 VNF package authenticity and integrity:

"Option 1: The VNF package shall contain a Digest (a.k.a. hash) for each of the components of the VNF package. The table of hashes is included in the manifest file"

The description need to be updated - and it should mention option 1, in case of R-130206 requirement.