Opkg switched to it (reportedly for security reasons, which makes no
sense), so stay compatible.

Also, use internal hash computation instead of calling external scripts.