BUG: Fix seg fault converting empty string to object
DOC: add 4722 fix and order by importance
Merge pull request #4953 from juliantaylor/backports-1.8

Backports 1.8
BLD: compute sha256 sums of build artifacts

Using a secure hash allows verifying ther binaries from a gpg signed
README.txt.
MD5 just kept for legacy users who may not be able to obtain a sha256
utility.
REL: Release 1.8.2