Use an SHA-256 check for xz compression.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>