We should have the checksums in the release JSON files now shouldn't we? Or we can use a convention of <filename>.sha256 or whatever to try to see if it exists when download files? Hard-coding is a bit annoying/rubbish. Anyway, conversation for another issue/PR.