verify checksums of downloads