* guix/derivations.scm (derivation-hash): Add comment as to why we keep
the plain `sha256' call.
* guix/scripts/download.scm (guix-download): Use `port-sha256' instead
of (compose sha256 get-bytevector-all).
* guix/scripts/refresh.scm (update-package): Likewise.