The sums for binutils and gcc are based on an HTTPS download (instead
of the default HTTP).
newlib doesn't seem to be available with any kind of signature, so I
compared a tarball and CVS checkout; let's hope they weren't both
compromised.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Ben Hutchings