Use port-sha256' and open-sha256-port'.

* guix/derivations.scm (derivation-hash): Add comment as to why we keep
  the plain `sha256' call.
* guix/scripts/download.scm (guix-download): Use `port-sha256' instead
  of (compose sha256 get-bytevector-all).
* guix/scripts/refresh.scm (update-package): Likewise.

guix/derivations.scm

@@ -469,6 +469,10 @@ (define derivation-hash            ; `hashDerivationModulo' in derivations.cc
                            inputs))
               (drv    (make-derivation outputs inputs sources
                                        system builder args env-vars)))
+
+         ;; XXX: At this point this remains faster than `port-sha256', because
+         ;; the SHA256 port's `write' method gets called for every single
+         ;; character.
          (sha256
           (with-fluids ((%default-port-encoding "UTF-8"))
             (string->utf8 (call-with-output-string

guix/scripts/download.scm

@@ -116,7 +116,7 @@ (define (parse-options)
                       (or path
                           (leave (_ "~a: download failed~%")
                                  arg))
-                    (compose sha256 get-bytevector-all)))
+                    port-sha256))
            (fmt   (assq-ref opts 'format)))
       (format #t "~a~%~a~%" path (fmt hash))
       #t)))

guix/scripts/refresh.scm

@@ -137,7 +137,7 @@ (define* (update-package store package #:key (key-download 'interactive))
                     (package-name package)
                     (package-version package) version)
             (let ((hash (call-with-input-file tarball
-                          (compose sha256 get-bytevector-all))))
+                          port-sha256)))
               (update-package-source package version hash)))
           (warning (_ "~a: version ~a could not be \
 downloaded and authenticated; not updating")