The hash covers the exact text in the box, including spaces and line breaks, encoded as UTF-8. A different line ending changes the digest.
MD5 and SHA-1 are broken for collision resistance. Use them to match a legacy checksum, not to sign something new. SHA-256, SHA-384, and SHA-512 are the stronger choices on this page.