un-gzip before checking Sha256