Check for package corruption.

Fixes #26 by checking the sha1 hash every time a package is requested. Might be a bit heavy, but fixes the problem.