Use crypto-hash to calculate SHA256

[equal-l2]

crypto-hash is an abstraction library for native hash libraries.
It uses CryptoAPI on Windows, CommonCrypto on macOS, and OpenSSL on *nix.

This PR will also remove openssl and advapi32-sys from dependencies since they are only used for calculating SHA256, which is superseded by crypto-hash.
(crypto-hash itself uses openssl and advapi32-sys though)

[rust-highfive]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @matklad (or someone else) soon.

If any changes to this PR are deemed necessary, please add them as extra commits. This ensures that the reviewer can see what has changed since they last reviewed the code. Due to the way GitHub handles out-of-date commits, this should also make it reasonably obvious what issues have or haven't been addressed. Large or tricky changes may require several passes of review and changes.

Please see the contribution instructions for more information.

[matklad]

@alexcrichton could we use a pure rust crate for SHA256 calculations? It seems like there's little reason to use native libraries for hashes specifically.

[matklad]

I believe https://github.com/RustCrypto/hashes computes sha256 natively.

[equal-l2]

Since I made this PR to reduce OpenSSL dependency on macOS, pure-rust implementation is also fine to me.
I'll wait for decision anyway.

[alexcrichton]

Thanks for the PR! It seems like the only major change here though is to not use OpenSSL on OSX? I think that we still have to pull it in anyway because of libssh2, right?

[equal-l2]

@alexcrichton Yes, we'll still need OpenSSL for libssh2, but I want this change so that we can remove OpenSSL dependency on macOS once libssh2 supports macOS' Security Framework in future.

[equal-l2]

@alexcrichton How do you think about pure-rust implementation for SHA256?

[matklad]

alexcrichton How do you think about pure-rust implementation for SHA256?

@equal-l2 let's not wait on alexcrichton and just use the sha2 crate from https://github.com/RustCrypto :) It's the thing that is used by rustup, so it should be good for Cargo as well! :)

[equal-l2]

@matklad OK, then should I do that in new PR?

[matklad]

OK, then should I do that in new PR?

You can create a new PR, or force push this one, either is fine!

[equal-l2]

You can create a new PR, or force push this one, either is fine!

Then I will create a new PR soon.

[equal-l2]

Created new PR
#4545

[alexcrichton]

@bors: r+

[bors]

📌 Commit 8346104 has been approved by alexcrichton

[bors]

⌛ Testing commit 8346104 with merge 0ac5362...

[bors]

☀️ Test successful - status-appveyor, status-travis
Approved by: alexcrichton
Pushing 0ac5362 to master...