if we already have the file (SHA-1 checksum), don't download it