look for SHA256SUMS instead of MD5SUMS, which is not published anymore

the code still calls everything "md5" but it's not md5 anymore, that
should be updated everywhere.

Signed-off-by: Mattia Rizzolo <mapreri@ubuntu.com>