Verify hash after downloading source package