tinyxml: use sha1, :build depend on cmake

Fixes #3