The sums for binutils and gcc are based on an HTTPS download (instead
of the default HTTP).
newlib doesn't seem to be available with any kind of signature, so I
compared a tarball and CVS checkout; let's hope they weren't both
Signed-off-by: Ben Hutchings <firstname.lastname@example.org>