Check the hash of tools when they are downloaded beyond just pinning a version