diff --git a/000.fetch_git.build b/000.fetch_git.build
index d51583c..d8a891a 100644
--- a/000.fetch_git.build
+++ b/000.fetch_git.build
@@ -1,5 +1,5 @@
 # Git clone what we need.
-fetch_git cbb-gcc-${GCC_VERSION}	"${GITROOT}/cbb/cbb-gcc-${GCC_VERSION}";
+fetch_git cbb-gcc-${PKG_GCC_VERSION}	"${GITROOT}/cbb/cbb-gcc-${PKG_GCC_VERSION}";
 fetch_git lazy				"${GITROOT}/lazy";
 fetch_git mmglue			"${GITROOT}/mmglue";
 fetch_git portage			"${GITROOT}/ports/portage";
diff --git a/006.musl.build b/006.musl.build
index 8868c63..b3b9ec6 100644
--- a/006.musl.build
+++ b/006.musl.build
@@ -5,23 +5,24 @@ if is_build_script_done finished; then
 elif [ "x${3}" = "xno-complex" ]; then
 	# Musl: build (no-complex)
 	_install="install_no_complex";
-	set_build_dir "musl-${MUSL_VERSION}" "${TARGET}-${3}";
-	fetch "http://www.musl-libc.org/releases/musl-${MUSL_VERSION}.tar.gz";
+	set_build_dir "musl-${PKG_MUSL_VERSION}" "${TARGET}-${3}";
+	fetch "http://www.musl-libc.org/releases/musl-${PKG_MUSL_VERSION}.tar.gz"	\
+		"${PKG_MUSL_SHA256SUM}";
 	if ! is_build_script_done extracted; then
-		rm_if_exists "musl-${MUSL_VERSION}";
-		tar -xf "musl-${MUSL_VERSION}.tar.gz";
-		cp -R mmglue/* "musl-${MUSL_VERSION}/";
+		rm_if_exists "musl-${PKG_MUSL_VERSION}";
+		tar -xf "musl-${PKG_MUSL_VERSION}.tar.gz";
+		cp -R mmglue/* "musl-${PKG_MUSL_VERSION}/";
 		set_build_script_done extracted -configured;
 	fi;
 elif [ "x${3}" = "xnative" ]; then
 	# Musl: build (full)
 	_destdir="${PREFIX_NATIVE}";
 	_install="install";
-	set_build_dir "musl-${MUSL_VERSION}" "${3}";
+	set_build_dir "musl-${PKG_MUSL_VERSION}" "${3}";
 else
 	# Musl: build (full)
 	_install="install";
-	set_build_dir "musl-${MUSL_VERSION}" "${TARGET}";
+	set_build_dir "musl-${PKG_MUSL_VERSION}" "${TARGET}";
 fi;
 if ! is_build_script_done configured; then
 	rm_if_exists -m -c "${_build_dir}";
@@ -30,7 +31,7 @@ if ! is_build_script_done configured; then
 		-c gcc					\
 		-f "${_destdir:-${PREFIX_TARGET}}"	\
 		-n musl					\
-		-p "../musl-${MUSL_VERSION}"		\
+		-p "../musl-${PKG_MUSL_VERSION}"	\
 		-t "${lz_target}"			\
 		-x config;
 	set_build_script_done configured -built;
diff --git a/007.gcc.full.build b/007.gcc.full.build
index ea9a3bc..c3343fe 100644
--- a/007.gcc.full.build
+++ b/007.gcc.full.build
@@ -5,7 +5,7 @@ if is_build_script_done finished; then
 elif [ "x${3}" = "xruntime" ]\
 ||   [ "x${3}" = "xfull" ]; then
 	export CFLAGS="${GCCFLAGS}" CXXFLAGS="${GCCFLAGS}";
-	set_build_dir "cbb-gcc-${GCC_VERSION}" "${TARGET}";
+	set_build_dir "cbb-gcc-${PKG_GCC_VERSION}" "${TARGET}";
 	cd "${_build_dir}";
 	if [ "x${3}" = "xruntime" ]; then
 		# GCC, compiler runtime.
@@ -39,7 +39,7 @@ elif [ "x${3}" = "xruntime" ]\
 else
 	if [ "x${3}" = "xstage1" ]; then
 		# GCC, stage1.
-		set_build_dir "cbb-gcc-${GCC_VERSION}" "${TARGET}";
+		set_build_dir "cbb-gcc-${PKG_GCC_VERSION}" "${TARGET}";
 		export	cbb_ldflags_for_target="--sysroot=${PREFIX_TARGET}"	\
 			cbb_sysroot_for_libgcc="${PREFIX_TARGET}"		\
 			cbb_target="${TARGET}"					\
@@ -48,14 +48,14 @@ else
 		GCCTARGET_FLAGS="-DIN_TARGET_LIBRARY_BUILD --sysroot=${PREFIX_TARGET}";
 	elif [ "x${3}" = "xnative" ]; then
 		# GCC, native.
-		set_build_dir "cbb-gcc-${GCC_VERSION}" "native";
+		set_build_dir "cbb-gcc-${PKG_GCC_VERSION}" "native";
 		export 	cbb_ldflags_for_target="--sysroot=${PREFIX_NATIVE}"	\
 			cbb_sysroot_for_libgcc="${PREFIX_NATIVE}"		\
 			cbb_target="${TARGET}"					\
 			cbb_xgcc_for_specs="${TARGET}-gcc";
 		GCCTARGET_FLAGS="-DIN_TARGET_LIBRARY_BUILD --sysroot=${PREFIX_NATIVE}";
 	fi;
-	GCCFLAGS="${CFLAGS:+${CFLAGS} }--include $(readlink -f ${WORKDIR}/cbb-gcc-${GCC_VERSION}/libc/cbb-musl-pe.h)";
+	GCCFLAGS="${CFLAGS:+${CFLAGS} }--include $(readlink -f ${WORKDIR}/cbb-gcc-${PKG_GCC_VERSION}/libc/cbb-musl-pe.h)";
 	set_env_vars "${GCCFLAGS}" CFLAGS CFLAGS_FOR_BUILD CPPFLAGS_FOR_BUILD CXXFLAGS CXXFLAGS_FOR_BUILD;
 	set_env_vars "${CFLAGS_FOR_BUILD}" cbb_cflags_for_stage1 cbb_cflags_for_stage2 cbb_cflags_for_stage3 cbb_cflags_for_stage4;
 	set_env_vars "${GCCTARGET_FLAGS}" CFLAGS_FOR_TARGET CPPFLAGS_FOR_TARGET CXXFLAGS_FOR_TARGET LIBCFLAGS_FOR_TARGET XGCC_FLAGS_FOR_TARGET;
@@ -81,7 +81,7 @@ else
 				--with-sysroot=";
 		fi;
 		rm_if_exists -m -c "${_build_dir}";
-		"../cbb-gcc-${GCC_VERSION}/configure"		\
+		"../cbb-gcc-${PKG_GCC_VERSION}/configure"	\
 			--disable-bootstrap			\
 			--disable-libmudflap			\
 			--disable-multilib			\
diff --git a/101.gmp.build b/101.gmp.build
index abbdafb..67b2e51 100644
--- a/101.gmp.build
+++ b/101.gmp.build
@@ -10,21 +10,21 @@ libelf_install_post() {
 };
 
 parse_with_pkg_name "${2}" 										\
-	"https://gmplib.org/download/gmp/gmp-${GMP_VERSION}.tar.bz2"					\
+	"https://gmplib.org/download/gmp/gmp-${PKG_GMP_VERSION}.tar.bz2"				\
 		"_configure_extra_args=--disable-assembly:_prefix_extra=${PREFIX_TARGET}"		\
-	"ftp://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VERSION}.tar.bz2"					\
+	"ftp://ftp.gnu.org/gnu/mpfr/mpfr-${PKG_MPFR_VERSION}.tar.bz2"					\
 		"_configure_extra_args=--with-gmp=${PREFIX_NATIVE}:_prefix_extra=${PREFIX_TARGET}"	\
-	"ftp://ftp.gnu.org/gnu/mpc/mpc-${MPC_VERSION}.tar.gz"						\
+	"ftp://ftp.gnu.org/gnu/mpc/mpc-${PKG_MPC_VERSION}.tar.gz"					\
 		"_configure_extra_args=--with-gmp=${PREFIX_NATIVE},--with-mpfr=${PREFIX_NATIVE}:_prefix_extra=${PREFIX_TARGET}"\
-	"http://www.mr511.de/software/libelf-${LIBELF_VERSION}.tar.gz"					\
+	"http://www.mr511.de/software/libelf-${PKG_LIBELF_VERSION}.tar.gz"				\
 		"_no_libtool_midipix=1:_prefix=${PREFIX_NATIVE}:CC=${HOST_NATIVE}-gcc:DESTDIR="		\
-	"ftp://sourceware.org/pub/binutils/snapshots/binutils-${BINUTILS_VERSION}.tar.bz2"		\
+	"ftp://sourceware.org/pub/binutils/snapshots/binutils-${PKG_BINUTILS_VERSION}.tar.bz2"		\
 		"_configure_extra_args=--with-libelf=${PREFIX_NATIVE},--with-gmp=${PREFIX_NATIVE},--with-mpc=${PREFIX_NATIVE},--with-mpfr=${PREFIX_NATIVE},--with-sysroot=/";
 
 if is_build_script_done finished; then
         exit 212;
 else
-	fetch "${_pkg_url}";
+	fetch "${_pkg_url}" "${_pkg_sha256sum}";
 fi;
 if ! is_build_script_done extracted; then
 	rm_if_exists "${_pkg_subdir}";
diff --git a/200.coreutils.build b/200.coreutils.build
index 8e809e2..4a43e3b 100644
--- a/200.coreutils.build
+++ b/200.coreutils.build
@@ -1,23 +1,22 @@
 export CFLAGS="${CFLAGS_PACKAGES}";
 parse_with_pkg_name "${2}"								\
-	"https://ftp.gnu.org/gnu/coreutils/coreutils-${COREUTILS_VERSION}.tar.xz" ""	\
-	"https://ftp.gnu.org/gnu/diffutils/diffutils-${DIFFUTILS_VERSION}.tar.xz" ""	\
-	"https://alpha.gnu.org/gnu/findutils/findutils-${FINDUTILS_VERSION}.tar.gz"	\
-		"CFLAGS=${CFLAGS:+${CFLAGS} }-Dendpwent=setpwent"			\
-	"https://ftp.gnu.org/gnu/patch/patch-${PATCH_VERSION}.tar.gz" ""		\
-	"https://ftp.gnu.org/gnu/gawk/gawk-${GAWK_VERSION}.tar.xz" ""			\
-	"https://ftp.gnu.org/gnu/bash/bash-${BASH_VERSION}.tar.gz"			\
-		"_configure_extra_args=--without-bash-malloc"				\
-	"https://ftp.gnu.org/gnu/make/make-${MAKE_VERSION}.tar.bz2" ""			\
-	"https://ftp.gnu.org/gnu/grep/grep-${GREP_VERSION}.tar.xz" ""			\
-	"https://ftp.gnu.org/gnu/grep/grep-${GREP_VERSION}.tar.xz" ""			\
-	"https://ftp.gnu.org/gnu/sed/sed-${SED_VERSION}.tar.bz2" ""			\
-	"ftp://sourceware.org/pub/binutils/snapshots/binutils-${BINUTILS_VERSION}.tar.bz2" "";
+	"https://ftp.gnu.org/gnu/coreutils/coreutils-${PKG_COREUTILS_VERSION}.tar.xz" ""	\
+	"https://ftp.gnu.org/gnu/diffutils/diffutils-${PKG_DIFFUTILS_VERSION}.tar.xz" ""	\
+	"http://alpha.gnu.org/gnu/findutils/findutils-${PKG_FINDUTILS_VERSION}.tar.gz"		\
+		"CFLAGS=${CFLAGS:+${CFLAGS} }-Dendpwent=setpwent"				\
+	"https://ftp.gnu.org/gnu/patch/patch-${PKG_PATCH_VERSION}.tar.gz" ""			\
+	"https://ftp.gnu.org/gnu/gawk/gawk-${PKG_GAWK_VERSION}.tar.xz" ""			\
+	"https://ftp.gnu.org/gnu/bash/bash-${PKG_BASH_VERSION}.tar.gz"				\
+		"_configure_extra_args=--without-bash-malloc"					\
+	"https://ftp.gnu.org/gnu/make/make-${PKG_MAKE_VERSION}.tar.bz2" ""			\
+	"https://ftp.gnu.org/gnu/grep/grep-${PKG_GREP_VERSION}.tar.xz" ""			\
+	"https://ftp.gnu.org/gnu/sed/sed-${PKG_SED_VERSION}.tar.bz2" ""				\
+	"ftp://sourceware.org/pub/binutils/snapshots/binutils-${PKG_BINUTILS_VERSION}.tar.bz2" "";
 
 if is_build_script_done finished; then
         exit 212;
 else
-	fetch "${_pkg_url}";
+	fetch "${_pkg_url}" "${_pkg_sha256sum}";
 	if [ "${_pkg_name}" = "binutils" ]\
 	&& [ "${3}" = "host" ]; then
 		_configure_args="--disable-werror,--prefix=${PREFIX},--with-sysroot=${PREFIX_TARGET}";
diff --git a/207.libz.build b/207.libz.build
index 416acdf..231baf2 100644
--- a/207.libz.build
+++ b/207.libz.build
@@ -1,15 +1,17 @@
 if is_build_script_done finished; then
         exit 212;
 elif [ "x${2}" = "xlibz" ]; then
-	_pkg_url="https://sortix.org/libz/release/libz-${LIBZ_VERSION}.tar.gz";
+	_pkg_url="https://sortix.org/libz/release/libz-${PKG_LIBZ_VERSION}.tar.gz";
 	_pkg_fname="${_pkg_url##*/}";
-	_pkg_subdir="${2}-${LIBZ_VERSION}";
+	_pkg_sha256sum="${PKG_LIBZ_SHA256SUM}";
+	_pkg_subdir="${2}-${PKG_LIBZ_VERSION}";
 elif [ "x${2}" = "xgzip" ]; then
-	_pkg_url="https://ftp.gnu.org/gnu/gzip/gzip-${GZIP_VERSION}.tar.gz";
+	_pkg_url="https://ftp.gnu.org/gnu/gzip/gzip-${PKG_GZIP_VERSION}.tar.gz";
 	_pkg_fname="${_pkg_url##*/}";
-	_pkg_subdir="${2}-${GZIP_VERSION}";
+	_pkg_sha256sum="${PKG_GZIP_SHA256SUM}";
+	_pkg_subdir="${2}-${PKG_GZIP_VERSION}";
 fi;
-fetch "${_pkg_url}";
+fetch "${_pkg_url}" "${_pkg_sha256sum}";
 if ! is_build_script_done extracted; then
 	rm_if_exists "${_pkg_fname%%.tar*}";
 	tar -axf "${_pkg_fname}";
diff --git a/build.subr b/build.subr
index feba77e..492706d 100644
--- a/build.subr
+++ b/build.subr
@@ -3,7 +3,7 @@ TIMESTAMP_FMT="${TIMESTAMP_FMT:-"%Y/%m/%d %H:%M:%S"}";
 check_prereqs() {
 	for _cmd in "$@"; do
 		if ! command -v "${_cmd}" >/dev/null; then
-			echo "Error: missing prerequisite command \`${_cmd}" >&2;
+			log_msg fail "Error: missing prerequisite command \`${_cmd}";
 			exit 1;
 		fi;
 	done; unset _cmd;
@@ -14,7 +14,12 @@ date() {
 };
 
 fetch() {
-	wget --no-check-certificate -N "${@}";
+	wget --no-check-certificate -N "${1}";
+	if [ $# -eq 2 ]\
+	&& ! printf "${2} ${1##*/}\n" | sha256sum -c --status; then
+		log_msg fail "Error: sha256sum mismatch for URL \`${1##*/}'.";
+		exit 1;
+	fi;
 };
 
 fetch_git() {
@@ -72,9 +77,10 @@ parse_with_pkg_name() {
 			_IFS="${IFS}"; IFS=:;
 			for _envv in ${_envvs}; do
 				export ${_envv};
-			done; IFS="${_IFS}";
+			done; IFS="${_IFS}"; unset _envvs _envv;
 			_pkg_subdir="${_pkg_fname%%.tar*}";
-			unset _envvs _envv;
+			eval _pkg_sha256sum=\""\${PKG_$(echo "${_pkg_name}" |\
+				tr a-z A-Z)_SHA256SUM}"\";
 			return;
 		fi; shift 2;
 	done;
diff --git a/build.vars b/build.vars
index a96e70e..02337b2 100644
--- a/build.vars
+++ b/build.vars
@@ -4,25 +4,42 @@
 : ${HOST_NATIVE:=x86_64-nt64-midipix};
 : ${TARGET:=x86_64-nt64-midipix};
 
-: ${BASH_VERSION:=4.3};
-: ${BINUTILS_VERSION:=2.24.51};
-: ${CBB_VERSION:=cbb-gcc-4.6.4};
-: ${COREUTILS_VERSION:=8.23};
-: ${DIFFUTILS_VERSION:=3.3};
-: ${FINDUTILS_VERSION:=4.5.14};
-: ${GAWK_VERSION:=4.1.3};
-: ${GCC_VERSION:=4.6.4};
-: ${GMP_VERSION:=5.1.3};
-: ${GREP_VERSION:=2.22};
-: ${GZIP_VERSION:=1.2.4};
-: ${LIBELF_VERSION:=0.8.13};
-: ${LIBZ_VERSION:=1.2.8.2015.05.20};
-: ${MAKE_VERSION:=3.81};
-: ${MPC_VERSION:=1.0.1};
-: ${MPFR_VERSION:=3.1.2};
-: ${MUSL_VERSION:=1.1.12};
-: ${PATCH_VERSION:=2.7};
-: ${SED_VERSION:=4.2.2};
+: ${PKG_BASH_SHA256SUM:=afc687a28e0e24dc21b988fa159ff9dbcf6b7caa92ade8645cc6d5605cd024d4};
+: ${PKG_BASH_VERSION:=4.3};
+: ${PKG_BINUTILS_SHA256SUM:=250d3b2925c6b211fb16173b0b25bc091c58829fbcad3eb849645e0af52cf7fa};
+: ${PKG_BINUTILS_VERSION:=2.24.51};
+: ${PKG_CBB_VERSION:=cbb-gcc-4.6.4};
+: ${PKG_COREUTILS_SHA256SUM:=ec43ca5bcfc62242accb46b7f121f6b684ee21ecd7d075059bf650ff9e37b82d};
+: ${PKG_COREUTILS_VERSION:=8.23};
+: ${PKG_DIFFUTILS_SHA256SUM:=a25e89a8ab65fded1731e4186be1bb25cda967834b6df973599cdcd5abdfc19c};
+: ${PKG_DIFFUTILS_VERSION:=3.3};
+: ${PKG_FINDUTILS_SHA256SUM:=0de3cf625a5c9f154eee3171e072515ffdde405244dd00502af617ac57b73ae2};
+: ${PKG_FINDUTILS_VERSION:=4.5.14};
+: ${PKG_GAWK_SHA256SUM:=e3cf55e91e31ea2845f8338bedd91e40671fc30e4d82ea147d220e687abda625};
+: ${PKG_GAWK_VERSION:=4.1.3};
+: ${PKG_GCC_VERSION:=4.6.4};
+: ${PKG_GMP_SHA256SUM:=752079520b4690531171d0f4532e40f08600215feefede70b24fabdc6f1ab160};
+: ${PKG_GMP_VERSION:=5.1.3};
+: ${PKG_GREP_SHA256SUM:=ca91d22f017bfcb503d4bc3b44295491c89a33a3df0c3d8b8614f2d3831836eb};
+: ${PKG_GREP_VERSION:=2.22};
+: ${PKG_GZIP_SHA256SUM:=1ca41818a23c9c59ef1d5e1d00c0d5eaa2285d931c0fb059637d7c0cc02ad967};
+: ${PKG_GZIP_VERSION:=1.2.4};
+: ${PKG_LIBELF_SHA256SUM:=591a9b4ec81c1f2042a97aa60564e0cb79d041c52faa7416acb38bc95bd2c76d};
+: ${PKG_LIBELF_VERSION:=0.8.13};
+: ${PKG_LIBZ_SHA256SUM:=33e65f22ec3d3e3f87436e53f82eb114054cd3aa373dc0480625dd92806fd9a0};
+: ${PKG_LIBZ_VERSION:=1.2.8.2015.05.20};
+: ${PKG_MAKE_SHA256SUM:=f3e69023771e23908f5d5592954d8271d3d6af09693cecfd29cee6fde8550dc8};
+: ${PKG_MAKE_VERSION:=3.81};
+: ${PKG_MPC_SHA256SUM:=ed5a815cfea525dc778df0cb37468b9c1b554aaf30d9328b1431ca705b7400ff};
+: ${PKG_MPC_VERSION:=1.0.1};
+: ${PKG_MPFR_SHA256SUM:=79c73f60af010a30a5c27a955a1d2d01ba095b72537dab0ecaad57f5a7bb1b6b};
+: ${PKG_MPFR_VERSION:=3.1.2};
+: ${PKG_MUSL_SHA256SUM:=720b83c7e276b4b679c0bffe9509340d5f81fd601508e607e708177df0d31c0e};
+: ${PKG_MUSL_VERSION:=1.1.12};
+: ${PKG_PATCH_SHA256SUM:=59c29f56faa0a924827e6a60c6accd6e2900eae5c6aaa922268c717f06a62048};
+: ${PKG_PATCH_VERSION:=2.7};
+: ${PKG_SED_SHA256SUM:=f048d1838da284c8bc9753e4506b85a1e0cc1ea8999d36f6995bcb9460cddbd7};
+: ${PKG_SED_VERSION:=4.2.2};
 
 : ${PREFIX:=${HOME}/midipix};
 : ${PREFIX_NATIVE:=${PREFIX}/native};