accept file uploads, verify repo and md5hash