diff --git a/build b/build
index 1a591a8c..39daaedd 100755
--- a/build
+++ b/build
@@ -9,7 +9,7 @@ if [ -n "${ZSH_VERSION:-}" ]; then
   emulate sh -o err_exit -o no_unset
 fi
 
-usage="$(cat <<\END
+usage="$(command cat <<\END
 Usage: build [-m ARCH] [-c CPU] [-d CMD] [-i IMAGE] [-s] [-w]
 
 Options:
@@ -32,18 +32,18 @@ Options:
 END
 )"
 
-build="$(cat <<\END
-outdir="$(pwd)"
+build="$(command cat <<\END
+outdir="$(command pwd)"
 
 if command -v mktemp >/dev/null 2>&1; then
-  workdir="$(mktemp -d "${TMPDIR:-/tmp}"/gitstatus-build.XXXXXXXXXX)"
+  workdir="$(command mktemp -d "${TMPDIR:-/tmp}"/gitstatus-build.XXXXXXXXXX)"
 else
   workdir="${TMPDIR:-/tmp}/gitstatus-build.tmp.$$"
-  mkdir -- "$workdir"
+  command mkdir -- "$workdir"
 fi
 
 cd -- "$workdir"
-workdir="$(pwd)"
+workdir="$(command pwd)"
 
 narg() { echo $#; }
 
@@ -57,22 +57,22 @@ libgit2_tmp="$outdir"/deps/"$appname".libgit2.tmp
 
 cleanup() {
   cd /
-  rm -rf -- "$workdir" "$outdir"/usrbin/"$appname".tmp "$libgit2_tmp"
-  trap - INT QUIT TERM EXIT ILL PIPE
+  command rm -rf -- "$workdir" "$outdir"/usrbin/"$appname".tmp "$libgit2_tmp"
+  trap - INT QUIT TERM ILL PIPE
 }
-trap cleanup INT QUIT TERM EXIT ILL PIPE
+trap cleanup INT QUIT TERM ILL PIPE
 
 if [ -n "$gitstatus_install_tools" ]; then
   case "$gitstatus_kernel" in
     linux)
-      apk update
-      apk add binutils cmake gcc g++ git make musl-dev
+      command apk update
+      command apk add binutils cmake gcc g++ git make musl-dev perl-utils
     ;;
     freebsd)
-      pkg install -y cmake gmake binutils gcc git
+      command pkg install -y cmake gmake binutils gcc git perl5
     ;;
     netbsd)
-      pkgin -y install cmake gmake binutils git
+      command pkgin -y install cmake gmake binutils git
     ;;
     darwin)
       if ! command -v make >/dev/null 2>&1 || ! command -v gcc >/dev/null 2>&1; then
@@ -84,16 +84,16 @@ if [ -n "$gitstatus_install_tools" ]; then
         exit 1
       fi
       for formula in libiconv cmake git wget; do
-        if brew list "$formula" &>/dev/null; then
-          brew upgrade "$formula"
+        if command brew list "$formula" &>/dev/null; then
+          command brew upgrade "$formula"
         else
-          brew install "$formula"
+          command brew install "$formula"
         fi
       done
     ;;
     msys*|mingw*)
-      pacman -Syu --noconfirm
-      pacman -S --needed --noconfirm binutils cmake gcc git make
+      command pacman -Syu --noconfirm
+      command pacman -S --needed --noconfirm binutils cmake gcc git make perl
     ;;
     *)
       >&2 echo "[internal error] unhandled kernel: $gitstatus_kernel"
@@ -102,7 +102,9 @@ if [ -n "$gitstatus_install_tools" ]; then
   esac
 fi
 
-cpus="$(getconf _NPROCESSORS_ONLN)" || cpus="$(sysctl -n hw.ncpu)" || cpus=8
+cpus="$(command getconf _NPROCESSORS_ONLN 2>/dev/null)" ||
+  cpus="$(command sysctl -n hw.ncpu 2>/dev/null)" ||
+  cpus=8
 
 libgit2_cmake_flags=
 libgit2_cflags="-march=$gitstatus_cpu"
@@ -126,8 +128,8 @@ case "$gitstatus_kernel" in
     gitstatus_ldflags="$gitstatus_ldflags -static"
   ;;
   darwin)
-    mkdir -- "$workdir"/lib
-    ln -s -- /usr/local/opt/libiconv/lib/libiconv.a "$workdir"/lib
+    command mkdir -- "$workdir"/lib
+    command ln -s -- /usr/local/opt/libiconv/lib/libiconv.a "$workdir"/lib
     libgit2_cmake_flags="$libgit2_cmake_flags -DUSE_ICONV=ON"
     libgit2_cflags="$libgit2_cflags -I/usr/local/opt/libiconv/include"
     gitstatus_cxxflags="$gitstatus_cxxflags -I/usr/local/opt/libiconv/include"
@@ -146,7 +148,7 @@ case "$gitstatus_kernel" in
   ;;
 esac
 
-for cmd in cmake gcc g++ git ld "$gitstatus_make" wget; do
+for cmd in cat cmake gcc g++ git ld ln mkdir rm strip tar "$gitstatus_make"; do
   if ! command -v "$cmd" >/dev/null 2>&1; then
     if [ -n "$gitstatus_install_tools" ]; then
       >&2 echo "[internal error] $cmd not found"
@@ -159,45 +161,89 @@ for cmd in cmake gcc g++ git ld "$gitstatus_make" wget; do
 done
 
 . "$outdir"/build.info
-if [ -z "$libgit2_version" ]; then
+if [ -z "${libgit2_version:-}" ]; then
   >&2 echo "[internal error] libgit2_version not set"
   exit 1
 fi
+if [ -z "${libgit2_sha256:-}" ]; then
+  >&2 echo "[internal error] libgit2_sha256 not set"
+  exit 1
+fi
 libgit2_tarball="$outdir"/deps/libgit2-"$libgit2_version".tar.gz
 if [ ! -e "$libgit2_tarball" ]; then
   if [ -n "$gitstatus_download_deps" ]; then
+    if ! command -v wget >/dev/null 2>&1; then
+      if [ -n "$gitstatus_install_tools" ]; then
+        >&2 echo "[internal error] wget not found"
+        exit 1
+      else
+        >&2 echo "[error] command not found: wget"
+        exit 1
+      fi
+    fi
     libgit2_url=https://github.com/romkatv/libgit2/archive/"$libgit2_version".tar.gz
-    wget -O "$libgit2_tmp" -- "$libgit2_url"
-    mv -f -- "$libgit2_tmp" "$libgit2_tarball"
+    command wget -O "$libgit2_tmp" -- "$libgit2_url"
+    command mv -f -- "$libgit2_tmp" "$libgit2_tarball"
   else
     >&2 echo "[error] file not found: deps/libgit2-"$libgit2_version".tar.gz"
     exit 1
   fi
 fi
 
+libgit2_actual_sha256=
+if command -v shasum >/dev/null 2>/dev/null; then
+  libgit2_actual_sha256="$(command shasum -b -a 256 -- "$libgit2_tarball")"
+  libgit2_actual_sha256="${libgit2_actual_sha256%% *}"
+elif command -v sha256sum >/dev/null 2>/dev/null; then
+  libgit2_actual_sha256="$(command sha256sum -b -- "$libgit2_tarball")"
+  libgit2_actual_sha256="${libgit2_actual_sha256%% *}"
+elif command -v sha256 >/dev/null 2>/dev/null; then
+  libgit2_actual_sha256="$(command sha256 -- "$libgit2_tarball" </dev/null)"
+  # Ignore sha256 output if it's from hashalot. It's incompatible.
+  if [ ${#libgit2_actual_sha256} -lt 64 ]; then
+    libgit2_actual_sha256=
+  else
+    libgit2_actual_sha256="${libgit2_actual_sha256##* }"
+  fi
+fi
+
+if [ -z "$libgit2_actual_sha256" ]; then
+  >&2 echo "[error] command not found: shasum or sha256sum"
+  exit 1
+fi
+
+if [ "$libgit2_actual_sha256" != "$libgit2_sha256" ]; then
+  >&2 echo "[error] sha256 mismatch"
+  >&2 echo ""
+  >&2 echo "  file    : deps/libgit2-$libgit2_version.tar.gz"
+  >&2 echo "  expected: $libgit2_sha256"
+  >&2 echo "  actual  : $libgit2_actual_sha256"
+  exit 1
+fi
+
 cd -- "$workdir"
-tar -xzf "$libgit2_tarball"
-mv -- libgit2-"$libgit2_version" libgit2
-mkdir libgit2/build
+command tar -xzf "$libgit2_tarball"
+command mv -- libgit2-"$libgit2_version" libgit2
+command mkdir libgit2/build
 cd libgit2/build
 
-CFLAGS="$libgit2_cflags" cmake     \
-  -DCMAKE_BUILD_TYPE=Release       \
-  -DZERO_NSEC=ON                   \
-  -DTHREADSAFE=ON                  \
-  -DUSE_BUNDLED_ZLIB=ON            \
-  -DREGEX_BACKEND=builtin          \
-  -DUSE_HTTP_PARSER=builtin        \
-  -DUSE_SSH=OFF                    \
-  -DUSE_HTTPS=OFF                  \
-  -DBUILD_CLAR=OFF                 \
-  -DUSE_GSSAPI=OFF                 \
-  -DUSE_NTLMCLIENT=OFF             \
-  -DBUILD_SHARED_LIBS=OFF          \
-  -DENABLE_REPRODUCIBLE_BUILDS=OFF \
-  $libgit2_cmake_flags             \
+CFLAGS="$libgit2_cflags" command cmake \
+  -DCMAKE_BUILD_TYPE=Release           \
+  -DZERO_NSEC=ON                       \
+  -DTHREADSAFE=ON                      \
+  -DUSE_BUNDLED_ZLIB=ON                \
+  -DREGEX_BACKEND=builtin              \
+  -DUSE_HTTP_PARSER=builtin            \
+  -DUSE_SSH=OFF                        \
+  -DUSE_HTTPS=OFF                      \
+  -DBUILD_CLAR=OFF                     \
+  -DUSE_GSSAPI=OFF                     \
+  -DUSE_NTLMCLIENT=OFF                 \
+  -DBUILD_SHARED_LIBS=OFF              \
+  -DENABLE_REPRODUCIBLE_BUILDS=OFF     \
+  $libgit2_cmake_flags                 \
   ..
-make -j "$cpus" VERBOSE=1
+command make -j "$cpus" VERBOSE=1
 
 APPNAME="$appname".tmp           \
   OBJDIR="$workdir"/gitstatus    \
@@ -205,16 +251,16 @@ APPNAME="$appname".tmp           \
   CXXFLAGS="$gitstatus_cxxflags" \
   LDFLAGS="$gitstatus_ldflags"   \
   LDLIBS="$gitstatus_ldlibs"     \
-  "$gitstatus_make" -C "$outdir" -j "$cpus"
+  command "$gitstatus_make" -C "$outdir" -j "$cpus"
 
 app="$outdir"/usrbin/"$appname"
 
-strip "$app".tmp
+command strip "$app".tmp
 
-mkdir -- "$workdir"/repo
-git -C "$workdir"/repo init --
-git -C "$workdir"/repo config user.email "you@example.com"
-git -C "$workdir"/repo commit --allow-empty --allow-empty-message -m ''
+command mkdir -- "$workdir"/repo
+command git -C "$workdir"/repo init --
+command git -C "$workdir"/repo config user.email "you@example.com"
+command git -C "$workdir"/repo commit --allow-empty --allow-empty-message -m ''
 
 resp="$(printf "hello\037$workdir/repo\036" | "$app".tmp)"
 [ -n "$resp" -a -z "${resp##hello*1*$workdir/repo*master*}" ]
@@ -222,11 +268,11 @@ resp="$(printf "hello\037$workdir/repo\036" | "$app".tmp)"
 resp="$(printf 'hello\037\036' | "$app".tmp)"
 [ -n "$resp" -a -z "${resp##hello*0*}" ]
 
-mv -f -- "$app".tmp "$app"
+command mv -f -- "$app".tmp "$app"
 
 cleanup
 
-cat >&2 <<-END
+command cat >&2 <<-END
 	-------------------------------------------------
 	SUCCESS: created usrbin/$appname
 	END
diff --git a/build.info b/build.info
index b38192c5..80dbc452 100644
--- a/build.info
+++ b/build.info
@@ -5,8 +5,8 @@
 # ./install) when gitstatusd is from ./usrbin.
 gitstatus_version="v1.0.0"
 
-# libgit2 is a build time dependency of gitstatusd. The value of
-# libgit2_version is read by ./build.
+# libgit2 is a build time dependency of gitstatusd. The values of
+# libgit2_version and libgit2_sha256 are read by ./build.
 #
 # If ./deps/libgit2-${libgit2_version}.tar.gz doesn't exist, build
 # downloads it from the following location:
@@ -15,4 +15,8 @@ gitstatus_version="v1.0.0"
 #
 # Once downloaded, the tarball is stored at the path indicated
 # above so that repeated builds don't consume network bandwidth.
+#
+# If sha256 of ./deps/libgit2-${libgit2_version}.tar.gz doesn't match,
+# build gets aborted.
 libgit2_version="tag-005f77dca6dbe8788e55139fa1199fc94cc04f9a"
+libgit2_sha256="6af7c839640ed5474fef9761a80b5c24bcdd87abc771406e31d5c2bf27f48be5"
diff --git a/gitstatus.plugin.sh b/gitstatus.plugin.sh
index c05f6cca..4c9b70f0 100644
--- a/gitstatus.plugin.sh
+++ b/gitstatus.plugin.sh
@@ -69,7 +69,7 @@ function gitstatus_start() {
     local gitstatus_plugin_dir="$PWD"
   fi
 
-  local req_fifo resp_fifo
+  local tmpdir req_fifo resp_fifo
 
   function gitstatus_start_impl() {
     local log_level="${GITSTATUS_LOG_LEVEL:-}"
@@ -104,20 +104,22 @@ function gitstatus_start() {
       --dirty-max-index-size="$max_dirty"
       $extra_flags)
 
+    tmpdir="$(mktemp -d "${TMPDIR:-/tmp}"/gitstatus.bash.$$.XXXXXXXXXX)" || return
+
     if [[ -n "$log_level" ]]; then
-      GITSTATUS_DAEMON_LOG=$(mktemp "${TMPDIR:-/tmp}"/gitstatus.$$.log.XXXXXXXXXX) || return
+      GITSTATUS_DAEMON_LOG="$tmpdir"/daemon.log
       [[ "$log_level" == INFO ]] || daemon_args+=(--log-level="$log_level")
     else
       GITSTATUS_DAEMON_LOG=/dev/null
     fi
 
-    req_fifo=$(mktemp -u "${TMPDIR:-/tmp}"/gitstatus.$$.pipe.req.XXXXXXXXXX)   || return
-    resp_fifo=$(mktemp -u "${TMPDIR:-/tmp}"/gitstatus.$$.pipe.resp.XXXXXXXXXX) || return
-    mkfifo "$req_fifo" "$resp_fifo"                                            || return
+    req_fifo="$tmpdir"/req.fifo
+    resp_fifo="$tmpdir"/resp.fifo
+    mkfifo -- "$req_fifo" "$resp_fifo" || return
 
     {
       (
-        trap '' INT
+        trap '' INT QUIT TSTP
         [[ "$GITSTATUS_DAEMON_LOG" == /dev/null ]] || set -x
         builtin cd /
 
@@ -142,7 +144,7 @@ function gitstatus_start() {
           [[ -n "$_gitstatus_bash_version" ]]         || return
           [[ "$_gitstatus_bash_downloaded" == [01] ]] || return
 
-          local sig=(QUIT TERM EXIT ILL PIPE)
+          local sig=(TERM ILL PIPE)
 
           if [[ -x "$_gitstatus_bash_daemon" ]]; then
             "$_gitstatus_bash_daemon" \
@@ -166,7 +168,7 @@ function gitstatus_start() {
           _gitstatus_bash_daemon=
           _gitstatus_bash_version=
           _gitstatus_bash_downloaded=
-          source "$gitstatus_plugin_dir"/install  || return
+          source "$gitstatus_plugin_dir"/install   || return
           [[ -n "$_gitstatus_bash_daemon" ]]       || return
           [[ -n "$_gitstatus_bash_version" ]]      || return
           [[ "$_gitstatus_bash_downloaded" == 1 ]] || return
@@ -180,13 +182,14 @@ function gitstatus_start() {
           echo -nE $'bye\x1f0\x1e' >&"$fd_out"
         ) & disown
       ) & disown
-    } 0</dev/null &>$GITSTATUS_DAEMON_LOG
+    } 0</dev/null &>"$GITSTATUS_DAEMON_LOG"
 
-    exec {_GITSTATUS_REQ_FD}>"$req_fifo" {_GITSTATUS_RESP_FD}<"$resp_fifo" || return
-    command rm "$req_fifo" "$resp_fifo"                                    || return
+    exec {_GITSTATUS_REQ_FD}>"$req_fifo" {_GITSTATUS_RESP_FD}<"$resp_fifo"   || return
+    command rm -f -- "$req_fifo" "$resp_fifo"                                || return
+    [[ "$GITSTATUS_DAEMON_LOG" != /dev/null ]] || command rmdir -- "$tmpdir" 2>/dev/null
 
     IFS='' read -r -u $_GITSTATUS_RESP_FD GITSTATUS_DAEMON_PID || return
-    [[ $GITSTATUS_DAEMON_PID == [1-9]* ]] || return
+    [[ "$GITSTATUS_DAEMON_PID" == [1-9]* ]] || return
 
     local reply
     echo -nE $'hello\x1f\x1e' >&$_GITSTATUS_REQ_FD                     || return
diff --git a/install b/install
index cc408354..126b8339 100755
--- a/install
+++ b/install
@@ -159,10 +159,14 @@ END
     line="${line###*}"
     [ -n "$line" ] || continue
 
-    local uname_s_glob= uname_m_glob= file= version=
+    local uname_s_glob= uname_m_glob= file= version= sha256=
     eval "$line" || return
 
-    if [ -z "$uname_s_glob" -o -z "$uname_m_glob" -o -z "$file" -o -z "$version" ]; then
+    if [ -z "$uname_s_glob" -o \
+         -z "$uname_m_glob" -o \
+         -z "$file"         -o \
+         -z "$version"      -o \
+         -z "$sha256" ]; then
       >&2 echo "[gitstatus] internal error: invalid install.info line: $line"
       return 1
     fi
@@ -216,7 +220,20 @@ END
     fi
     [ -d "$cache_dir" ] || mkdir -p -- "$cache_dir" || return
 
+    local tmpdir
+    if ! command -v mktemp >/dev/null 2>&1 ||
+        ! tmpdir="$(command mktemp -d "${TMPDIR:-/tmp}"/gitstatus-install.XXXXXXXXXX)"; then
+      tmpdir="${TMPDIR:-/tmp}/gitstatus-install.tmp.$$"
+      mkdir -p -- "$tmpdir" || return
+    fi
+
     (
+      if [ -n "${ZSH_VERSION:-}" ]; then
+        builtin cd -q -- "$tmpdir" || exit
+      else
+        cd -- "$tmpdir" || exit
+      fi
+
       local fetch
       if command -v curl >/dev/null 2>&1; then
         fetch="command curl -fsSLo"
@@ -229,19 +246,26 @@ END
 
       local url1="https://github.com/romkatv/gitstatus/releases/download/$version/$file.tar.gz"
       local url2="https://gitee.com/romkatv/gitstatus/raw/release-$version/release/$file.tar.gz"
-      local tmp="$file".tmp.$$
 
-      if [ -n "${ZSH_VERSION:-}" ]; then
-        builtin cd -q -- "$cache_dir" || exit
-      else
-        cd -- "$cache_dir" || exit
-      fi
-
-      cleanup() {
-        local n
-        for n in "$@"; do
-          command rm -rf -- "$tmp"."$n".tar.gz "$tmp"."$n".status || return
-        done
+      check_sha256() {
+        local file="$1".tar.gz
+        local hash=
+        if command -v shasum >/dev/null 2>/dev/null; then
+          hash="$(command shasum -b -a 256 -- "$file")" || hash=
+          hash="${hash%% *}"
+        elif command -v sha256sum >/dev/null 2>/dev/null; then
+          hash="$(command sha256sum -b -- "$file")" || hash=
+          hash="${hash%% *}"
+        elif command -v sha256 >/dev/null 2>/dev/null; then
+          hash="$(command sha256 -- "$file" </dev/null)" || hash=
+          # Ignore sha256 output if it's from hashalot. It's incompatible.
+          if [ ${#hash} -lt 64 ]; then
+            hash=
+          else
+            hash="${hash##* }"
+          fi
+        fi
+        [ "$1" = 1 -a -z "$hash" -o "$hash" = "$sha256" ]
       }
 
       local sig='INT QUIT TERM ILL PIPE'
@@ -249,19 +273,17 @@ END
       fetch() {
         local trapped=
         trap 'trapped=1' $sig
-        # TODO: enable this after adding sha256 verification.
-        [ "$1" = 1 ] || return
         if [ "$1" != 1 ] && command -v sleep >/dev/null 2>/dev/null; then
           sleep "$1"
         fi
-        $fetch "$tmp"."$1".tar.gz -- "$2" 2>/dev/null &
+        $fetch "$1".tar.gz -- "$2" 2>/dev/null &
         local pid=$!
-        local die="trap - $sig; kill -- $pid 2>/dev/null; cleanup $1; exit 1"
+        local die="trap - $sig; kill -- $pid 2>/dev/null; exit 1"
         trap "$die" $sig
         [ -z "$trapped" ] || eval "$die"
-        wait -- "$pid" 2>/dev/null
+        wait -- "$pid" 2>/dev/null && check_sha256 "$1"
         local ret="$?"
-        echo -n >"$tmp"."$1".status
+        echo -n >"$1".status
         trap - $sig
         return "$ret"
       }
@@ -273,7 +295,7 @@ END
       fetch 2 "$url2" & 
       local pid2=$!
 
-      local die="trap - $sig; kill -- $pid1 $pid2 2>/dev/null; cleanup 1 2; exit 1"
+      local die="trap - $sig; kill -- $pid1 $pid2 2>/dev/null; exit 1"
       trap "$die" $sig
       [ -z "$trapped" ] || eval "$die"
 
@@ -285,7 +307,7 @@ END
         elif command -v true >/dev/null 2>/dev/null; then
           command true
         fi
-        if [ -n "$pid1" -a -e "$tmp".1.status ]; then
+        if [ -n "$pid1" -a -e 1.status ]; then
           wait -- "$pid1" 2>/dev/null
           local ret="$?"
           pid1=
@@ -296,7 +318,7 @@ END
           elif [ -z "$pid2" ]; then
             break
           fi
-        elif [ -n "$pid2" -a -e "$tmp".2.status ]; then
+        elif [ -n "$pid2" -a -e 2.status ]; then
           wait -- "$pid2" 2>/dev/null
           local ret="$?"
           pid2=
@@ -317,36 +339,28 @@ END
         >&2 echo ""
         >&2 echo "  1. $url1"
         >&2 echo "  2. $url2"
-        cleanup 1 2
         exit 1
       fi
 
-      local old=
-      if [ -e "$daemon" ]; then
-        local i=1
-        while :; do
-          old="$daemon"."$i"
-          [ -e "$old" ] || break
-          i="$((i+1))"
-        done
-        if ! command mv -f -- "$daemon" "$old"; then
-          cleanup 1 2
-          exit 1
-        fi
-      fi
+      command tar -xzf "$n".tar.gz || exit
 
-      command tar -xzf "$tmp"."$n".tar.gz
-      local ret=$?
-      cleanup 1 2
-      if [ -n "$old" ]; then
-        if [ "$ret" = 0 ]; then
-          command rm -f -- "$old" 2>/dev/null
-        else
-          command mv -f -- "$old" "$daemon"
-        fi
+      local tmpfile
+      if ! command -v mktemp >/dev/null 2>&1 ||
+         ! tmpfile="$(command mktemp "$cache_dir"/gitstatusd.XXXXXXXXXX)"; then
+        tmpfile="$cache_dir"/gitstatusd.tmp.$$
       fi
-      exit "$ret"
-    ) || return
+
+      command mv -f -- gitstatusd-* "$tmpfile" || exit
+      command mv -f -- "$tmpfile" "$cache_dir"/"$file" && exit
+      command rm -f -- "$cache_dir"/"$file"
+      command mv -f -- "$tmpfile" "$cache_dir"/"$file" && exit
+      command rm -f -- "$tmpfile"
+      exit 1
+    )
+
+    local ret=$?
+    command rm -rf -- "$tmpdir"
+    [ "$ret" = 0 ] || return
 
     [ $# = 0 ] || "$@" "$daemon" "$version" 1
     return
diff --git a/install.info b/install.info
index 96458f0d..35260b7f 100644
--- a/install.info
+++ b/install.info
@@ -6,24 +6,24 @@
 # be updated whenever the content of this file changes.
 
 # Official gitstatusd binaries.
-uname_s_glob="cygwin_nt-10.0"; uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="cygwin_nt-10.0"; uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="darwin";         uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="freebsd";        uname_m_glob="amd64";   file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="linux";          uname_m_glob="aarch64"; file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="linux";          uname_m_glob="armv6l";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="linux";          uname_m_glob="armv7l";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="linux";          uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="linux";          uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="msys_nt-10.0";   uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
-uname_s_glob="msys_nt-10.0";   uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0";
+uname_s_glob="cygwin_nt-10.0"; uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="c38342c7a70842067074710250fd8cebea87ae111f032277c2c70a77179b5355";
+uname_s_glob="cygwin_nt-10.0"; uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="d30b455e371cd0895c9bd1ff87b8a27e6c3f3c2970b4e993e93fe1a6943962ad";
+uname_s_glob="darwin";         uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="c71b30027b3c763faa3ff7ad09d66c84403851fafcf798bf5e629b98c2b8384a";
+uname_s_glob="freebsd";        uname_m_glob="amd64";   file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="a72d4c5da2f9594bf1c4153d841bf61a35cbcbb8b74818649b1375902e9d9534";
+uname_s_glob="linux";          uname_m_glob="aarch64"; file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="eb7f125d43c29f955239ef4014ab652b9162bbbb6c81c40f1d5ead46a209866e";
+uname_s_glob="linux";          uname_m_glob="armv6l";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="051a9448d9cb4bb1d95e93cff51a6ab48a085465ec30eec40046977d4213feff";
+uname_s_glob="linux";          uname_m_glob="armv7l";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="adaa47c8e8dec1e1e8686c3044ee0f45afda15deaa8388efcb4952747b66246e";
+uname_s_glob="linux";          uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="c80355664e7361e11215e64b523ed75a3d39f72393fa2204fefa85eae0342a67";
+uname_s_glob="linux";          uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="e33867063f091d3c31ede9916fef079ff8cd6fdcc70d051914f962ab3b8f36fd";
+uname_s_glob="msys_nt-10.0";   uname_m_glob="i686";    file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="2cf6ff92a5c50e4181ceb402217162bebd5e52144eb52eacfef2f6d47d5c20d4";
+uname_s_glob="msys_nt-10.0";   uname_m_glob="x86_64";  file="gitstatusd-${uname_s}-${uname_m}";     version="v1.0.0"; sha256="960c3d9d90d7b96257a9746f7168faffdf9b5fbda464e354e7b14c42cc473f15";
 
 # Fallbacks to official gitstatusd binaries.
-uname_s_glob="cygwin_nt-*";    uname_m_glob="i686";    file="gitstatusd-cygwin_nt-10.0-${uname_m}"; version="v1.0.0";
-uname_s_glob="cygwin_nt-*";    uname_m_glob="x86_64";  file="gitstatusd-cygwin_nt-10.0-${uname_m}"; version="v1.0.0";
-uname_s_glob="mingw32_nt-*";   uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
-uname_s_glob="mingw32_nt-*";   uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
-uname_s_glob="mingw64_nt-*";   uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
-uname_s_glob="mingw64_nt-*";   uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
-uname_s_glob="msys_nt-*";      uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
-uname_s_glob="msys_nt-*";      uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0";
+uname_s_glob="cygwin_nt-*";    uname_m_glob="i686";    file="gitstatusd-cygwin_nt-10.0-${uname_m}"; version="v1.0.0"; sha256="c38342c7a70842067074710250fd8cebea87ae111f032277c2c70a77179b5355";
+uname_s_glob="cygwin_nt-*";    uname_m_glob="x86_64";  file="gitstatusd-cygwin_nt-10.0-${uname_m}"; version="v1.0.0"; sha256="d30b455e371cd0895c9bd1ff87b8a27e6c3f3c2970b4e993e93fe1a6943962ad";
+uname_s_glob="mingw32_nt-*";   uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="2cf6ff92a5c50e4181ceb402217162bebd5e52144eb52eacfef2f6d47d5c20d4";
+uname_s_glob="mingw32_nt-*";   uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="960c3d9d90d7b96257a9746f7168faffdf9b5fbda464e354e7b14c42cc473f15";
+uname_s_glob="mingw64_nt-*";   uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="2cf6ff92a5c50e4181ceb402217162bebd5e52144eb52eacfef2f6d47d5c20d4";
+uname_s_glob="mingw64_nt-*";   uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="960c3d9d90d7b96257a9746f7168faffdf9b5fbda464e354e7b14c42cc473f15";
+uname_s_glob="msys_nt-*";      uname_m_glob="i686";    file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="2cf6ff92a5c50e4181ceb402217162bebd5e52144eb52eacfef2f6d47d5c20d4";
+uname_s_glob="msys_nt-*";      uname_m_glob="x86_64";  file="gitstatusd-msys_nt-10.0-${uname_m}";   version="v1.0.0"; sha256="960c3d9d90d7b96257a9746f7168faffdf9b5fbda464e354e7b14c42cc473f15";
diff --git a/mbuild b/mbuild
index a1a8cda8..c5d5c87f 100755
--- a/mbuild
+++ b/mbuild
@@ -46,7 +46,7 @@
 #     ps> C:\msys64\autorebase.bat
 # - Install 64-bit and 32-bit cygwin: https://cygwin.com/install.html.
 #   - Choose to install 32-bit to c:/cygwin32 instead of the default c:/cygwin.
-#   - Select these packages: binutils, cmake, gcc-core, gcc-g++, git, make, wget.
+#   - Select these packages: binutils, cmake, gcc-core, gcc-g++, git, make, perl, wget.
 #
 # IMPORTANT: Install msys2 and cygwin one at a time.
 #