Add sha checksum functionality

As a developer
I would like to know that software I’m downloading is what I expect
So that I am confident I’m not installing any old rubbish