Update Cardo to sha256 checksums