checksum needs to be done as root (same as fetch)