Use `port-sha256' and `open-sha256-port'.

* guix/derivations.scm (derivation-hash): Add comment as to why we keep
  the plain `sha256' call.
* guix/scripts/download.scm (guix-download): Use `port-sha256' instead
  of (compose sha256 get-bytevector-all).
* guix/scripts/refresh.scm (update-package): Likewise.

guix/derivations.scm

@@ -469,6 +469,10 @@ in SIZE bytes."
                            inputs))
               (drv    (make-derivation outputs inputs sources
                                        system builder args env-vars)))
+
+         ;; XXX: At this point this remains faster than `port-sha256', because
+         ;; the SHA256 port's `write' method gets called for every single
+         ;; character.
          (sha256
           (with-fluids ((%default-port-encoding "UTF-8"))
             (string->utf8 (call-with-output-string

guix/scripts/download.scm

@@ -116,7 +116,7 @@ Supported formats: 'nix-base32' (default), 'base32', and 'base16'
                       (or path
                           (leave (_ "~a: download failed~%")
                                  arg))
-                    (compose sha256 get-bytevector-all)))
+                    port-sha256))
            (fmt   (assq-ref opts 'format)))
       (format #t "~a~%~a~%" path (fmt hash))
       #t)))

guix/scripts/refresh.scm

@@ -137,7 +137,7 @@ values: 'interactive' (default), 'always', and 'never'."
                     (package-name package)
                     (package-version package) version)
             (let ((hash (call-with-input-file tarball
-                          (compose sha256 get-bytevector-all))))
+                          port-sha256)))
               (update-package-source package version hash)))
           (warning (_ "~a: version ~a could not be \
 downloaded and authenticated; not updating")