Make SHA verification handle multiple versions of same package