Add sha1 checking to downloaded dependencies

In the absence of code signing, sha1 checking is the next best thing.