use sha256 checksums not sha1