code: func UnmarshalWithSHA256(buf []byte, pm proto.Message) error {
  	envelope := messages.BlobWithSHA256{}
  	if err := proto.Unmarshal(buf, &envelope); err != nil {
  		return err
  	}
  	if len(envelope.Sha256) == 0 {
  		return ErrUnknownSHA256
  	}
  	sum := sha256.Sum256(envelope.Blob)
  	if !bytes.Equal(sum[:], envelope.Sha256) {
  		return errors.New("sha256 of the file is invalid, it is probably corrupted")
  	}
  	return proto.Unmarshal(envelope.Blob, pm)
  }
docs: // UnmarshalWithSHA256 is reverse of MarshalWithSHA256.
  //
  // It checks SHA256 checksum and deserializes the object if it matches the blob.
  //
  // If the expected SHA256 is not available in 'buf', returns ErrUnknownSHA256.
  // This can happen when reading blobs in old format that used SHA1.