bootstrap: Check SHA256 checksums for tarball downloads