--- a/roundup/rest.py	Mon Mar 25 19:46:20 2019 +0100
+++ b/roundup/rest.py	Mon Mar 25 19:47:29 2019 +0100
@@ -132,7 +132,7 @@
     '''
 
     items = node.items(protected=True) # include every item
-    etag = md5(bs2b(repr(items))).hexdigest()
+    etag = md5(bs2b(repr(sorted(items)))).hexdigest()
     logger.debug("object=%s%s; tag=%s; repr=%s", classname, id,
                  etag, repr(node.items(protected=True)))
     return etag
@@ -1336,7 +1336,7 @@
             summary.setdefault(status_name, []).append(issue_object)
             messages.append((num, issue_object))
 
-        messages.sort(reverse=True)
+        sorted(messages, key=lambda tup: tup[0], reverse=True)
 
         result = {
             'created': created,
@@ -1450,7 +1450,7 @@
             output = RoundupJSONEncoder(indent=indent).encode(output)
         elif data_type.lower() == "xml" and dicttoxml:
             self.client.setHeader("Content-Type", "application/xml")
-            output = dicttoxml(output, root=False)
+            output = b2s(dicttoxml(output, root=False))
         else:
             self.client.response_code = 406
             output = "Content type is not accepted by client"