The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".

Signed-off-by: Sven Eckelmann <sven@narfation.org>

Build timestamps prevent reproducible builds [0].

[0] https://reproducible-builds.org/docs/timestamps/

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>

fix Makefile chmod (644)
replace MD5SUM with HASH
add PKG_MIRROR_HASH when PKG_SOURCE_PROTO:=git

(PKG_SOURCE_PROTO:=svn tarballs are not reproducible for now)

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

Signed-off-by: Emil 'Skeen' Madsen <sovende@gmail.com>