actually verify checksum/hash