xact — moved sha256 underneath version, at top, so it's clearer what needs updating