check SHASUM of downloaded tarball

This is just one extra task to check the SHASUM of the downloaded tarball to make sure it's not corrupted.