each of these is verified: the current sha1 and the new sha256 are both correct for the given download.
closes #1239 Signed-off-by: phinze <paul.t.hinze@gmail.com>