There is a /raw endpoint to make it easy. On a released pok you can do curl <pok-url>/raw | sha256sum