"kpm restore" verify SHA values before unpacking