Comment 1 for bug 1513625

does it not already do this (note that this bug is several years old now), but IME, if the metadata has a sha256sum in it, sstream-mirror does sha256sum checking on the downloaded images.