verify package hashes when importing via http