diff --git a/SHA256SUMS.sources b/SHA256SUMS.sources
new file mode 100644
index 0000000..cf3486e
--- /dev/null
+++ b/SHA256SUMS.sources
@@ -0,0 +1,14 @@
+c6c37e888b136ccefab903c51149f4b7bd659d69d4aea21245f61053a57aa60a  tar-1.12.tar.gz
+4d2ce9f314f39c9575f913503b0178d6fb2c92920db8e7b7b176b7bab7980fe6  gzip-1.2.4.tar
+ecb5c6469d732bcf01d6ec1afe9e64f1668caba5bfdb103c28d7f537ba3cdb8a  patch-2.5.9.tar.gz
+64b30b41fde2ebf669e6af489883fb1df6a06ac30555a96cfa3c39ecce7267dd  make-3.80.tar.gz
+ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269  bzip2-1.0.8.tar.gz
+c25b36b8af6e0ad2a875daf4d6196bd0df28a62be7dd252e5f99a4d5d7288d95  coreutils-5.0.tar.bz2
+9f233d8b78e4351fe9dd2d50d83958a0e5af36f54e9818521458a08e058691ba  heirloom-devtools-070527.tar.bz2
+ba03d412998cc54bd0b0f2d6c32100967d3137098affdc2d32e6e7c11b163fe4  bash-2.05b.tar.gz
+a116c52d314c8e3365756cb1e14c6b460d6bd28769121f92373a362497359d88  m4-1.4.4.tar.gz
+bc79b890f35ca38d66ff89a6e3758226131e51ccbd10ef78d5ff150b7bd73689  flex-2.5.11.tar.gz
+1370c9a812b2cf2a7d92802510cca0058cc37e66a7bedd70051f0a34015022a3  musl-1.1.24.tar.gz
+e87aae032bf07c26f85ac0ed3250998c37621d95f8bd748b31f15b33c45ee995  flex-2.6.4.tar.gz
+a32032bab36208509466654df12f507600dfe0313feebbcd218c32a70bf72a16  grep-2.4.tar.gz
+d5f2489c4056a31528e3ada4adacc23d498532b0af1a980f2f76158162b139d6  diffutils-2.7.tar.gz
diff --git a/rootfs.sh b/rootfs.sh
index 33098a6..8ec4736 100755
--- a/rootfs.sh
+++ b/rootfs.sh
@@ -4,6 +4,12 @@ set -ex
 QEMU_CMD="${1:-qemu-system-x86_64}"	# or 'chroot' or 'minikernel'
 QEMU_RAM="${2:-8G}"
 
+GITDIR="$PWD/$(dirname "$0")"
+if [ ! -f 'rootfs.sh' ]; then
+	echo 'must be run from base of repo'
+	exit 1
+fi
+
 pushd sysa
 
 # SYSTEM A
@@ -14,6 +20,35 @@ sudo mount -t tmpfs -o size=8G tmpfs tmp
 
 LOGFILE="$PWD/tmp/bootstrap.log"
 
+wget()
+{
+	local url="$1"
+	local dir="${CACHEDIR:-$GITDIR/sources}"
+	local file
+
+	file=$(basename "$url")
+	mkdir -p "$dir"
+
+	test -s "$dir/$file" || command wget -O "$dir/$file" "$url"
+	cp -v "$dir/$file" .
+	checksum_do "$dir" "$file"
+}
+
+checksum_do()
+{
+	local dir="$1"
+	local file="$2"
+	local line
+	local store="$GITDIR/SHA256SUMS.sources"
+
+	if line=$(grep "[[:space:]][[:space:]]$file"$ "$store"); then
+		(cd "$dir" && echo "$line" | sha256sum -c)
+	else
+		echo 'Checksum mismatch or not found!'
+		exit 1
+	fi
+}
+
 # base: mescc-tools-seed
 # copy in all the mescc-tools-seed stuff
 cp -r mescc-tools-seed/src/mescc-tools-seed/x86/* tmp