check: use sha256 checksum