def METHOD_NAME(self, base_url):
    _, file = tempfile.mkstemp()
    url = base_url + self.url
    subprocess.run(["curl", "-o", file, url], check=True)
    # Ensure there are no hash mismatches
    with open(file, "rb") as f:
        sha1 = hashlib.sha1(f.read()).hexdigest()
        if sha1 != self.sha1:
            raise RuntimeError(
                "hash mismatch for package " + self.path + ": " +
                sha1 + " vs " + self.sha1 + " (known good)"
            )
    return file