build: use mkhash to replace various quirky md5sum/openssl calls