add SHA256 support for downloaded source