pear/pear-core — pull request #21 by slusarz (2013-11-05 22:07:15+00:00)
Title: Add SHA-1 verification of package contents

MD5 has been proven to be insecure, so it is fairly useless for serving
as the basis of a verification system.

This adds a sha1sum attribute, which is preferentially used if it is available in the package.xml file. Falls back to md5sum for backwards-compatibility.