For reasons that I am not understand yet, using the libmd version of
SHA256 would make libarchive based application to give:

archive_read_extract(): Lzma library error: Corrupted input data

(Internally this is LZMA_DATA_ERR)

However, the libmd version of SHA256 is supposed to give same result
as the bundled version do, and xz(1) is not affected.

As a precaution, revert the SHA256 portion of r281316 for now until
we figure out why it breaks libarchive interoperability as we can't
yet rule out this change have introduced an ABI breakage.