diff --git a/scripts/setup_project.sh b/scripts/setup_project.sh
index 763f7f7..587d7cd 100755
--- a/scripts/setup_project.sh
+++ b/scripts/setup_project.sh
@@ -32,13 +32,22 @@ fi
 function download {
     URL="$1"
     DESTINATION="$2"
+    SHA256SUM="$3 *$2"
     echo -n "Downloading $URL to $DESTINATION... "
     if [ $USE_WGET = yes ]; then
         wget -O "$DESTINATION" "$URL" >/dev/null 2>&1
     else
         curl -L "$URL" --output "$DESTINATION" >/dev/null 2>&1
     fi
-    echo "done."
+    if sha256sum --check <<< $SHA256SUM >/dev/null 2>&1; then
+        echo "done."
+        return 0
+    else
+        echo "error."
+        echo "Checksum verification failed. Your download is either corrupted or the file has been altered."
+        rm -v "$DESTINATION"
+        return 1
+    fi
 }
 
 echo "Cleaning build files..."
@@ -47,8 +56,7 @@ echo "Cleaning dependencies..."
 scripts/clean_dependencies.sh
 
 mkdir -v dependencies/tmp
-download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz
-#TODO: verify the files we have downloaded
+download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz 8e3f61651909c9f3105d3501932a96aa65733127fb6e7cf94cb1b0a2dff42c8f
 #TODO: keep the files somewhere else as a cache and only download the ones
 #      we don't have or that got corrupted
 #TODO: once we cache files properly, have clean_dependencies.sh prune