I think the SHA should be in version control. The file should be reproducibly built [1], then cached on a central server.
This means that a build target like a system image could be satisfied by downloading the complete image and no intermediate files. And a change to one file in one binary will result in only a small number of intermediate files being downloaded or reproducibly built to chain up to the new system image.
This is something that's really lacking in, for example, Git.