look for shasum/sha1sum, not just the first one