[RFC] Let homebrew handle external resources download

@fwalch @tarruda

Close #1388
> we could just use MD5 in homebrew for now
:-1: for this. We shouldn't let more people become vulnerable.

Let's do as @fwalch's way. Use sha1 and make md5 as a fallback. Since it's kind unrelated to this PR. Maybe an separate PR?