lib/updater: fix invalid hash check for SHA256

This is major problem as packages were not verified thanks to this
error.

This also adds warning for packages not correctly verified.
6 jobs for 3x-fix-invalid-hash in 2 minutes and 58 seconds (queued for 9 seconds)