check the sha1 checksum of the downloaded bootstrapfs tarball to protect ourselves...