When verifying image integrity, first check the image file size against the one from the manifest. If they are different, fail immediately, without computing the SHA-256 hash of the image since we know it will be wrong.
Unfortunately, there is no speed gain to expect from this optimization in the common case, since the uncompressed size of the image rarely change between builds. However, in cases where there are remains of a partially downloaded image, a new download will be attempted almost immediately.