Comment 3 for bug 522513

Well, the sha256 parser has been merged but the code only checks md5 if present (if so, sha256 is skipped)

The question is whether it should change to checking sha256 first, otherwise sha1 and lastly fall back to md5.

This was suggested for 1.2, but postponed for performance reasons (I think ?).

Each checksum is about 2 times slower, so checking sha256 takes 4x of md5.