We should move to something more secure than md5 for the uploaded sources.
This patch series implements the client-side part of this change.
We might want to drop the md5 fallback once we have migrated completely, that
is when:
1. all archives on the lookaside have been moved to a stronger hash
2. the "sources" file in all git repos has been updated to the same hash
https://fedorahosted.org/rel-eng/ticket/5846