diff --git a/scripts/clean_dependencies.sh b/scripts/clean_dependencies.sh
index 5b0ef39..a5bc3db 100755
--- a/scripts/clean_dependencies.sh
+++ b/scripts/clean_dependencies.sh
@@ -17,6 +17,7 @@
 
 source scripts/lib.sh
 
+#TODO: move this to download.sh
 echo ">>> Checking download cache for unneeded or corrupted files..."
 for file in $(ls .download_cache); do
     #TODO: remove if unknown shasum
diff --git a/scripts/download.sh b/scripts/download.sh
new file mode 100755
index 0000000..3d6940a
--- /dev/null
+++ b/scripts/download.sh
@@ -0,0 +1,61 @@
+if [ "$#" -lt 3 -o "$#" -gt 3 ]; then
+    echo "Usage: $0 URL DESTINATION SHA256SUM"
+    exit 1
+fi
+
+source scripts/lib.sh
+
+URL="$1"
+DESTINATION="$2"
+SHA256SUM="$3"
+
+if command -v wget >/dev/null 2>&1; then
+    USE_WGET=yes
+else
+    if command -v curl >/dev/null 2>&1; then
+        USE_WGET=no
+    else
+        echo "Found neither wget nor curl. Aborting."
+        exit 1
+    fi
+fi
+
+if [ ! -d .download_cache ]; then
+    echo "Cache directory missing."
+    create_directory .download_cache
+fi
+
+#TODO: keep track of which cached file is downloaded to which destination
+#TODO: when downloading a file with a new hash to the same destination, mark the old one as no longer in use
+#TODO: if there is an even older one for the same download path, delete it
+#TODO: remove cache maintenance from clean_dependencies
+
+if [ -f ".download_cache/$SHA256SUM" ]; then
+    if check_sha256 ".download_cache/$SHA256SUM" "$SHA256SUM"; then
+        echo "Using locally cached file for $DESTINATION"
+        cp ".download_cache/$SHA256SUM" "$DESTINATION"
+        exit 0
+    else
+        echo "Locally cached file for $DESTINATION is corrupted."
+        rm ".download_cache/$SHA256SUM"
+        $0 "$URL" "$DESTINATION" "$SHA256SUM"
+        exit $?
+    fi
+else
+    echo -n "Downloading $URL to $DESTINATION... "
+    if [ $USE_WGET = yes ]; then
+        wget -O ".download_cache/$SHA256SUM" "$URL" >/dev/null 2>&1
+    else
+        curl -L "$URL" --output ".download_cache/$SHA256SUM" >/dev/null 2>&1
+    fi
+    if check_sha256 ".download_cache/$SHA256SUM" "$SHA256SUM"; then
+        cp ".download_cache/$SHA256SUM" "$DESTINATION"
+        echo "done."
+        exit 0
+    else
+        echo "error."
+        echo "Checksum verification failed. Your download is either corrupted or the file has been altered. Removing file."
+        rm ".download_cache/$SHA256SUM"
+        exit 1
+    fi
+fi
diff --git a/scripts/setup_project.sh b/scripts/setup_project.sh
index b079399..bf9b8f3 100755
--- a/scripts/setup_project.sh
+++ b/scripts/setup_project.sh
@@ -17,74 +17,19 @@
 
 source scripts/lib.sh
 
-echo -n "Wget or curl? "
-if command -v wget >/dev/null 2>&1; then
-    USE_WGET=yes
-    echo "wget"
-else
-    if command -v curl >/dev/null 2>&1; then
-        USE_WGET=no
-        echo "curl"
-    else
-        echo "Found neither wget nor curl. Aborting."
-        exit 1
-    fi
-fi
-
-function download {
-    URL="$1"
-    DESTINATION="$2"
-    SHA256SUM="$3"
-
-    if [ ! -d .download_cache ]; then
-        echo "Cache directory missing."
-        create_directory .download_cache
-    fi
-
-    if [ -f ".download_cache/$SHA256SUM" ]; then
-        if check_sha256 ".download_cache/$SHA256SUM" "$SHA256SUM"; then
-            echo "Using locally cached file for $DESTINATION"
-            cp ".download_cache/$SHA256SUM" "$DESTINATION"
-            return 0
-        else
-            echo "Locally cached file for $DESTINATION is corrupted."
-            rm ".download_cache/$SHA256SUM"
-            download "$URL" "$DESTINATION" "$SHA256SUM"
-            return $?
-        fi
-    else
-        echo -n "Downloading $URL to $DESTINATION... "
-        if [ $USE_WGET = yes ]; then
-            wget -O ".download_cache/$SHA256SUM" "$URL" >/dev/null 2>&1
-        else
-            curl -L "$URL" --output ".download_cache/$SHA256SUM" >/dev/null 2>&1
-        fi
-        if check_sha256 ".download_cache/$SHA256SUM" "$SHA256SUM"; then
-            cp ".download_cache/$SHA256SUM" "$DESTINATION"
-            echo "done."
-            return 0
-        else
-            echo "error."
-            echo "Checksum verification failed. Your download is either corrupted or the file has been altered. Removing file."
-            rm ".download_cache/$SHA256SUM"
-            return 1
-        fi
-    fi
-}
-
 scripts/clean.sh
 scripts/clean_dependencies.sh
 
 set -e # failures are not acceptable here
 create_directory dependencies/tmp
-download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz 8e3f61651909c9f3105d3501932a96aa65733127fb6e7cf94cb1b0a2dff42c8f
-download https://github.com/fpagliughi/sockpp/archive/refs/tags/v0.8.1.tar.gz dependencies/tmp/sockpp.tar.gz a8aedff8bd8c1da530b91be650352008fddabc9f1df0d19701d76cbc359c8651
-download https://www.zlib.net/zlib-1.3.1.tar.xz dependencies/tmp/zlib.tar.xz 38ef96b8dfe510d42707d9c781877914792541133e1870841463bfa73f883e32
+scripts/download.sh https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz 8e3f61651909c9f3105d3501932a96aa65733127fb6e7cf94cb1b0a2dff42c8f
+scripts/download.sh https://github.com/fpagliughi/sockpp/archive/refs/tags/v0.8.1.tar.gz dependencies/tmp/sockpp.tar.gz a8aedff8bd8c1da530b91be650352008fddabc9f1df0d19701d76cbc359c8651
+scripts/download.sh https://www.zlib.net/zlib-1.3.1.tar.xz dependencies/tmp/zlib.tar.xz 38ef96b8dfe510d42707d9c781877914792541133e1870841463bfa73f883e32
 
 #TODO: figure out how to cache shaderc
 #also TODO: target a specific commit
 git clone --branch known-good https://github.com/google/shaderc.git dependencies/tmp/shaderc
-#download https://github.com/google/shaderc/archive/refs/tags/v2023.7.tar.gz dependencies/tmp/shaderc.tar.gz 681e1340726a0bf46bea7e31f10cbfe78e01e4446a35d90fedc2b78d400fcdeb
+#scripts/download.sh https://github.com/google/shaderc/archive/refs/tags/v2023.7.tar.gz dependencies/tmp/shaderc.tar.gz 681e1340726a0bf46bea7e31f10cbfe78e01e4446a35d90fedc2b78d400fcdeb
 
 echo -n ">>> Extracting tiny-utf8... "
 gzip -d dependencies/tmp/tiny-utf8.tar.gz