update, only download is broken. no HMAC