use shasum instead of md5sum