This is more reproducible than most things people come up with ad-hoc, it insists upon the hash of the thing it downloads.