added hashing for downloaded dependencies