Report SHA-256 hash (instead of SHA-1) if checksum is missing.

I accidentally missed this in #2719.
Merge pull request #2840 from lgarron/sha-256-if-missing-hash

Report SHA-256 hash (instead of SHA-1) if checksum is missing.