Add SHA-1 verification of package contents

MD5 has been proven to be insecure, so it is fairly useless for serving
as the basis of a verification system.
Merge pull request #21 from slusarz/sha1

Add SHA-1 verification of package contents