use shasum instead, heh
check for https