download: add sha checksum support