Use sha2 to calculate SHA256

[equal-l2]

Supersedes #4542.

This PR will replace FFI libraries for SHA256 calculation with pure-rust implementation.
openssl and advapi32-sys will be removed from dependencies since they are only used for calculating SHA256.

[rust-highfive]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @alexcrichton (or someone else) soon.

If any changes to this PR are deemed necessary, please add them as extra commits. This ensures that the reviewer can see what has changed since they last reviewed the code. Due to the way GitHub handles out-of-date commits, this should also make it reasonably obvious what issues have or haven't been addressed. Large or tricky changes may require several passes of review and changes.

Please see the contribution instructions for more information.

[alexcrichton]

Thanks again for the PR! Sorry I didn't quite have enough time to respond on #4542, but I wonder if it'd be possible to just vendor an implementation using common crypto on OSX? I'm somewhat hesitant to move to a Rust-based solution just yet when we've got other crypto libraries in the binary doing it already :(

[equal-l2]

@alexcrichton
I think #4542 is suitable then.
crypto-hash should provide same functionality as current implementation using native crypto libraries including CommonCrypto.
(CommonCrypto support can be implemented with rust-commoncrypto(by crypto-hash's author) if you want, though)

CC: @matklad

[alexcrichton]

It looks like crypto-hash was mostly just a thin layer over what we're already doing, so it seems fine by me to include it. One less thing to worry about depending on openssl!

[matklad]

I'm somewhat hesitant to move to a Rust-based solution just yet when we've got other crypto libraries in the binary doing it already :(

Rustup uses both ssh2 crate and openssl, so it's fine with me to do the same and just include ssh and suffer a small increase in binary size for the sake of "one more pure Rust thing" (esp. given that ssh2 is small, because it's only hash functions). But yeah, saving a couple of bytes is a nice thing too, so I am fine either way :)

I definitely want to get rid of manual implementation inside the Cargo itself though! :)

[equal-l2]

I've reopened #4542.

[alexcrichton]

Ok I'm gonna close this in favor of #4542, thanks @equal-l2!