check shas

for #17 should at least prevent us from caching invalid ones