Use sha256 digests for rpm packages