Found with -Wformat.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".

Signed-off-by: Sven Eckelmann <sven@narfation.org>

fix Makefile chmod (644)
replace MD5SUM with HASH
add PKG_MIRROR_HASH when PKG_SOURCE_PROTO:=git

(PKG_SOURCE_PROTO:=svn tarballs are not reproducible for now)

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

Signed-off-by: Hsing-Wang Liao <kuoruan@gmail.com>