Unfortunatley the sha2 project does not have versioned releases so we
use the latest commit.
We have also manually added a frontend to sha-2 to allow us to invoke
it from the command line, thanks bittrof for the help!
overload 'wget' with a function,
so all wget downloads are cached in
ether 'sources' or ENV defined using $CACHEDIR.
directory 'sources' is already in .gitignore
checksum store is in root-dir of repo
and can be manually checked with:
( cd sources && sha256sum -c ../SHA256SUMS.sources )
introducing '$GITDIR' and enforce run in this dir.