sha256: fix verify failure