validate checksums on downloads