tarsnapper: add sha256 to fix fetchgit assertion