Prefer to SHA1 other than MD5 in third-party downloads

If CMake version is less than 2.8.11, fallback to MD5
Merge pull request #1414 from xu-cheng/sha1_md5

Prefer to SHA1 other than MD5 in third-party downloads
job: Only force-close stdout/stderr when the job exits

stdout/stderr should only be closed after the job truly exits, or else we can
lose data sent by it.