diff --git a/doc/build_system.md b/doc/build_system.md
index cdb2ea3..efd0027 100644
--- a/doc/build_system.md
+++ b/doc/build_system.md
@@ -1,4 +1,4 @@
-# FOSS-VG Buils System
+# FOSS-VG Build System
 
 Yeah, I was annoyed at make. Sorry. -BodgeMaster
 
@@ -24,21 +24,27 @@ Provided aliases:
 
 ## setup_project
 
-Cleans the project and its dependencies first, ensuring the project is in a known state, then downloads and extracts dependencies.
+Cleans the project and its dependencies first, ensuring the project is in
+a known state, then downloads and extracts dependencies.
 
-This will probably do more in the future (for example compile dependencies that need to be compiled).
+This will probably do more in the future (for example compile dependencies
+that need to be compiled).
 
 
 # build
 
-Builds the project. This will compile all the things in `src/` except for what is in `src/test/`.
+Builds the project. This will compile all the things in `src/` except for
+what is in `src/test/`.
 
-Checks for endianness if endianness header is missing. Builds the endianness check if that is missing as well.
+Checks for endianness if endianness header is missing.
+Builds the endianness check if that is missing as well.
 
 Accepted environment variables:
 - `CXX`: override the default compiler
-- `CXXFLAGS`: override the default compiler flags, must at least specify the C++ version
-- `SINGLE`: if set to `yes`, causes the build script to run in single-threaded mode
+- `CXXFLAGS`: override the default compiler flags, must at least specify
+   the C++ version
+- `SINGLE`: if set to `yes`, causes the build script to run in
+   single-threaded mode
 
 
 # test / run_tests
@@ -47,14 +53,16 @@ Builds and runs the unit tests.
 
 Accepted environment variables:
 - `CXX`: override the default compiler
-- `CXXFLAGS`: override the default compiler flags, must at least specify the C++ version
+- `CXXFLAGS`: override the default compiler flags, must at least specify
+   the C++ version
 
 
 # clean
 
-Removes and re-creates `bin/`. Also removes the endianness header and the endianness check.
+Removes and re-creates `bin/`. Also removes the endianness header and
+the endianness check binary.
 
 
 # clean_dependencies
 
-Removes and re-created `dependencies/`.
+Removes and re-creates `dependencies/`.
diff --git a/scripts/setup_project.sh b/scripts/setup_project.sh
index 763f7f7..587d7cd 100755
--- a/scripts/setup_project.sh
+++ b/scripts/setup_project.sh
@@ -32,13 +32,22 @@ fi
 function download {
     URL="$1"
     DESTINATION="$2"
+    SHA256SUM="$3 *$2"
     echo -n "Downloading $URL to $DESTINATION... "
     if [ $USE_WGET = yes ]; then
         wget -O "$DESTINATION" "$URL" >/dev/null 2>&1
     else
         curl -L "$URL" --output "$DESTINATION" >/dev/null 2>&1
     fi
-    echo "done."
+    if sha256sum --check <<< $SHA256SUM >/dev/null 2>&1; then
+        echo "done."
+        return 0
+    else
+        echo "error."
+        echo "Checksum verification failed. Your download is either corrupted or the file has been altered."
+        rm -v "$DESTINATION"
+        return 1
+    fi
 }
 
 echo "Cleaning build files..."
@@ -47,8 +56,7 @@ echo "Cleaning dependencies..."
 scripts/clean_dependencies.sh
 
 mkdir -v dependencies/tmp
-download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz
-#TODO: verify the files we have downloaded
+download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz 8e3f61651909c9f3105d3501932a96aa65733127fb6e7cf94cb1b0a2dff42c8f
 #TODO: keep the files somewhere else as a cache and only download the ones
 #      we don't have or that got corrupted
 #TODO: once we cache files properly, have clean_dependencies.sh prune