cmake,make-dist: use sha256 instead of md5 for checksum

the boost's download page offers the SHA256 hash, so it'd be easier to
verify the hash this way.

Signed-off-by: Kefu Chai <kchai@redhat.com>

cmake/modules/BuildBoost.cmake

@@ -140,7 +140,7 @@ function(do_build_boost version)
     # NOTE: If you change this version number make sure the package is available
     # at the three URLs below (may involve uploading to download.ceph.com)
     set(boost_version 1.67.0)
-    set(boost_md5 ced776cb19428ab8488774e1415535ab)
+    set(boost_sha256 2684c972994ee57fc5632e03bf044746f6eb45d4920c343937a465fd67a5adba)
     string(REPLACE "." "_" boost_version_underscore ${boost_version} )
     set(boost_url 
       https://dl.bintray.com/boostorg/release/${boost_version}/source/boost_${boost_version_underscore}.tar.bz2)
@@ -152,7 +152,7 @@ function(do_build_boost version)
     endif()
     set(source_dir
       URL ${boost_url}
-      URL_MD5 ${boost_md5})
+      URL_HASH SHA256=${boost_sha256})
     if(CMAKE_VERSION VERSION_GREATER 3.1)
       list(APPEND source_dir DOWNLOAD_NO_PROGRESS 1)
     endif()

make-dist

@@ -23,7 +23,7 @@ fi
 download_boost() {
     boost_version=$1
     shift
-    boost_md5=$1
+    boost_sha256=$1
     shift
     boost_version_underscore=$(echo $boost_version | sed 's/\./_/g')
     boost_fname=boost_${boost_version_underscore}.tar.bz2
@@ -39,8 +39,8 @@ download_boost() {
         wget -c --no-verbose -O $boost_fname $url
         if [ $? != 0 -o ! -e $boost_fname ]; then
             echo "Download of $url failed"
-        elif [ $(md5sum $boost_fname | awk '{print $1}') != $boost_md5 ]; then
-            echo "Error: failed to download boost: MD5 mismatch."
+        elif [ $(sha256sum $boost_fname | awk '{print $1}') != $boost_sha256 ]; then
+            echo "Error: failed to download boost: SHA256 mismatch."
         else
             break
         fi
@@ -131,7 +131,7 @@ tar cvf $outfile.version.tar $outfile/src/.git_version $outfile/ceph.spec $outfi
 # NOTE: If you change this version number make sure the package is available
 # at the three URLs referenced below (may involve uploading to download.ceph.com)
 boost_version=1.67.0
-download_boost $boost_version ced776cb19428ab8488774e1415535ab \
+download_boost $boost_version 2684c972994ee57fc5632e03bf044746f6eb45d4920c343937a465fd67a5adba \
                https://dl.bintray.com/boostorg/release/$boost_version/source \
                https://downloads.sourceforge.net/project/boost/boost/$boost_version \
                https://download.ceph.com/qa