Imbo uses md5 / md5_file for checksums in the database. This should be replaced with hash_file('sha256', ...). The data stored in the databased should also be prefixed with the algorithm itself, for instance:

sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Whenever a value does not contain : we can assume it's an old hash (using MD5).