port lint should complain about using only md5 or sha1 checksums

[ryandesign (Ryan Carsten Schmidt)]

port lint should issue a warning if any distfile or patchfile is listed with only an md5 or sha1 checksum, since md5 is a broken algorithm and sha1 is also kind of old by now. The warning message should encourage portfile authors to use both rmd160 and sha256 checksums on each file, like we show in the guide.

[afb@…]

There is no real reason to prefer rmd160 over sha1, though. Might as well use sha256 only, if updating them.

[ryandesign (Ryan Carsten Schmidt)]

We want to use at least two checksum types for each distfile, so that we never again have a problem if hash algorithm is later found to be deficient in some way. We have for some time already recommended the use of the rmd160 and sha256 pair.

[herbygillot (Herby Gillot)]

This can probably now be closed as per:

• ​https://github.com/macports/macports-base/pull/105

-and-

• ​https://github.com/macports/macports-base/commit/1dcfc29f0aeb58da68dd1fcc796194a8b5c18549