New feature: support sha256 checksums for sources