Record the hashes for the downloaded packages.

[nmahendru]

This change although not cleaned up will record the shasum value. Now we have to take a decision to write it back to the hcl files or create a new file.

[alecthomas]

Seems like a good first step to return the computed hash. Clean up the PR and we can get it in.