diff --git a/CMakeModules/CPMUtil.cmake b/CMakeModules/CPMUtil.cmake
index 0721644f01..0e8d4662be 100644
--- a/CMakeModules/CPMUtil.cmake
+++ b/CMakeModules/CPMUtil.cmake
@@ -305,13 +305,16 @@ function(AddJsonPackage)
 
     if(ci)
         AddCIPackage(
-            VERSION ${version}
-            NAME ${name}
-            REPO ${repo}
-            PACKAGE ${package}
-            EXTENSION ${extension}
-            MIN_VERSION ${min_version}
-            DISABLED_PLATFORMS ${disabled_platforms}
+            VERSION "${version}"
+            NAME "${name}"
+            REPO "${repo}"
+            PACKAGE "${package}"
+            EXTENSION "${extension}"
+            MIN_VERSION "${min_version}"
+            DISABLED_PLATFORMS "${disabled_platforms}"
+
+            GIT_HOST "${git_host}"
+
             ${EXTRA_ARGS})
     else()
         if (NOT DEFINED JSON_FORCE_BUNDLED_PACKAGE)
@@ -337,6 +340,7 @@ function(AddJsonPackage)
 
             ARTIFACT "${artifact}"
             TAG "${tag}"
+
             ${EXTRA_ARGS})
     endif()
 
@@ -580,7 +584,8 @@ function(AddCIPackage)
         REPO
         PACKAGE
         EXTENSION
-        MIN_VERSION)
+        MIN_VERSION
+        GIT_HOST)
 
     set(multiValueArgs DISABLED_PLATFORMS)
 
@@ -618,6 +623,12 @@ function(AddCIPackage)
         set(ARTIFACT_EXT ${PKG_ARGS_EXTENSION})
     endif()
 
+    if (NOT DEFINED PKG_ARGS_GIT_HOST)
+        set(ARTIFACT_GIT_HOST "github.com")
+    else()
+        set(ARTIFACT_GIT_HOST "${PKG_ARGS_GIT_HOST}")
+    endif()
+
     if(DEFINED PKG_ARGS_MIN_VERSION)
         set(ARTIFACT_MIN_VERSION ${PKG_ARGS_MIN_VERSION})
     endif()
@@ -680,15 +691,33 @@ function(AddCIPackage)
             set(EXTRA_ARGS MODULE_PATH)
         endif()
 
+        # download sha512sum file
+        # TODO:
+        set(sha512sum_url
+            "https://${ARTIFACT_GIT_HOST}/${ARTIFACT_REPO}/releases/download/v${ARTIFACT_VERSION}/${ARTIFACT}.sha512sum")
+        set(sha512sum_file
+            "${CMAKE_CURRENT_BINARY_DIR}/.cpmutil_${ARTIFACT}_sha512sum")
+
+        file(DOWNLOAD "${sha512sum_url}" "${sha512sum_file}"
+            STATUS sha512sum_status)
+        list(GET sha512sum_status 0 sha512sum_error)
+
+        if(sha512sum_error)
+            message(FATAL_ERROR "[CPMUtil] Failed to download sha512sum "
+                "for ${ARTIFACT_NAME} from ${sha512sum_url}")
+        endif()
+
+        file(READ "${sha512sum_file}" sha512sum_hash)
+        string(STRIP "${sha512sum_hash}" sha512sum_hash)
+        file(REMOVE "${sha512sum_file}")
+
         AddPackage(
             NAME ${ARTIFACT_PACKAGE}
             REPO ${ARTIFACT_REPO}
             TAG "v${ARTIFACT_VERSION}"
             MIN_VERSION ${ARTIFACT_VERSION}
             ARTIFACT ${ARTIFACT}
-
-            KEY "${pkgname}-${ARTIFACT_VERSION}"
-            HASH_SUFFIX sha512sum
+            HASH ${sha512sum_hash}
             FORCE_BUNDLED_PACKAGE ON
             ${EXTRA_ARGS})
 
diff --git a/cpmfile.json b/cpmfile.json
index ab255b5f25..e6b51d35e9 100644
--- a/cpmfile.json
+++ b/cpmfile.json
@@ -21,7 +21,7 @@
     },
     "boost_headers": {
         "bundled": true,
-        "hash": "8a07d7a6f0065587d3005a83481a794704ae22e773b9f336fbd89ed230aaa7b4c86c03edcbae30bba8b3e20839c3131eaa2dceac037ef811533ef4eadc53b15b",
+        "hash": "4ef845775e2277a8104ded6ddf749aa262ce52cf8438042869a048f9a0156dd772fbbcfa74efa1378fecef339b7286f6fe4b4feb5c45d49966b35d08e3e83507",
         "repo": "boostorg/headers",
         "tag": "boost-%VERSION%",
         "version": "1.90.0"
diff --git a/tools/cpm/common.sh b/tools/cpm/common.sh
index 50a9a88bb1..2844c1e5f5 100755
--- a/tools/cpm/common.sh
+++ b/tools/cpm/common.sh
@@ -12,11 +12,6 @@ must_install() {
 
 must_install jq find mktemp tar 7z unzip sha512sum git patch curl
 
-PACKAGES=$(jq -s 'reduce .[] as $item ({}; . * $item)' cpmfile.json)
+LIBS=$(jq -j 'keys_unsorted | join(" ")' cpmfile.json)
 
-LIBS=$(echo "$PACKAGES" | jq -j 'keys_unsorted | join(" ")')
-
-export PACKAGES
 export LIBS
-export DIRS
-export MAXDEPTH
diff --git a/tools/cpm/package/download.sh b/tools/cpm/package/download.sh
index 2a6125e74d..61cfaaefae 100755
--- a/tools/cpm/package/download.sh
+++ b/tools/cpm/package/download.sh
@@ -33,8 +33,9 @@ done
 [ -n "$packages" ] || usage
 
 for pkg in $packages; do
-	PACKAGE="$pkg"
-	export PACKAGE
+	unset JSON
+	export PACKAGE="$pkg"
+
 	# shellcheck disable=SC1091
 	. "$SCRIPTS"/vars.sh
 
diff --git a/tools/cpm/package/fetch.sh b/tools/cpm/package/fetch.sh
index 24cd1b9c5f..1aa90257ab 100755
--- a/tools/cpm/package/fetch.sh
+++ b/tools/cpm/package/fetch.sh
@@ -22,7 +22,7 @@ download_package() {
 
 	curl "$DOWNLOAD" -sS -L -o "$OUTFILE"
 
-	ACTUAL_HASH=$("${HASH_ALGO}"sum "$OUTFILE" | cut -d" " -f1)
+	ACTUAL_HASH=$(sha512sum "$OUTFILE" | cut -d" " -f1)
 	[ "$ACTUAL_HASH" != "$HASH" ] && echo "!! $FILENAME did not match expected hash; expected $HASH but got $ACTUAL_HASH" && exit 1
 
 	TMPDIR="$TMP/extracted"
@@ -100,11 +100,7 @@ ci_package() {
 		OUTDIR="${CPM_SOURCE_CACHE}/${LOWER_PACKAGE}/${KEY}"
 		[ -d "$OUTDIR" ] && continue
 
-		HASH_ALGO=$(echo "$JSON" | jq -r ".hash_algo")
-		[ "$HASH_ALGO" != null ] || HASH_ALGO=sha512
-
-		HASH_SUFFIX="${HASH_ALGO}sum"
-		HASH_URL="${DOWNLOAD}.${HASH_SUFFIX}"
+		HASH_URL="${DOWNLOAD}.sha512sum"
 
 		HASH=$(curl "$HASH_URL" -sS -q -L -o -)
 
@@ -140,7 +136,9 @@ done
 [ -n "$packages" ] || usage
 
 for PACKAGE in $packages; do
+	unset JSON
 	export PACKAGE
+
 	# shellcheck disable=SC1091
 	. "$SCRIPTS"/vars.sh
 
diff --git a/tools/cpm/package/hash.sh b/tools/cpm/package/hash.sh
index 57bc1fee10..bce46ecd6c 100755
--- a/tools/cpm/package/hash.sh
+++ b/tools/cpm/package/hash.sh
@@ -59,8 +59,33 @@ done
 export UPDATE
 
 for pkg in $packages; do
+	unset JSON
 	echo "-- Package $pkg"
-	"$SCRIPTS"/util/fix-hash.sh "$pkg" || RETURN=1
+
+	export PACKAGE="$pkg"
+
+	# shellcheck disable=SC1091
+	. "$SCRIPTS"/vars.sh
+
+	[ "$CI" = null ] || continue
+
+	ACTUAL=$("$SCRIPTS"/util/url-hash.sh "$DOWNLOAD")
+
+	if [ "$ACTUAL" != "$HASH" ] && [ "$QUIET" != true ]; then
+		echo "-- * Expected $HASH"
+		echo "-- * Got      $ACTUAL"
+
+		if [ "$UPDATE" != "true" ]; then
+			RETURN=1
+			continue
+		fi
+	fi
+
+	if [ "$UPDATE" = "true" ] && [ "$ACTUAL" != "$HASH" ]; then
+		NEW_JSON=$(echo "$JSON" | jq ".hash = \"$ACTUAL\"")
+
+		"$SCRIPTS"/util/replace.sh "$PACKAGE" "$NEW_JSON"
+	fi
 done
 
 exit $RETURN
diff --git a/tools/cpm/package/update.sh b/tools/cpm/package/update.sh
index e73cb40454..96e143f662 100755
--- a/tools/cpm/package/update.sh
+++ b/tools/cpm/package/update.sh
@@ -63,8 +63,9 @@ done
 [ -n "$packages" ] || usage
 
 for pkg in $packages; do
-	PACKAGE="$pkg"
-	export PACKAGE
+	unset JSON
+	export PACKAGE="$pkg"
+
 	# shellcheck disable=SC1091
 	. "$SCRIPTS"/vars.sh
 
diff --git a/tools/cpm/package/util/fix-hash.sh b/tools/cpm/package/util/fix-hash.sh
index 58d13f4613..476b15af89 100755
--- a/tools/cpm/package/util/fix-hash.sh
+++ b/tools/cpm/package/util/fix-hash.sh
@@ -9,9 +9,6 @@
 
 # re-read json files
 # shellcheck disable=SC2016
-PACKAGES=$(jq -s 'reduce .[] as $item ({}; . * $item)' cpmfile.json)
-export PACKAGES
-
 . "$SCRIPTS"/vars.sh
 
 [ "$CI" = null ] || exit 0
diff --git a/tools/cpm/package/vars.sh b/tools/cpm/package/vars.sh
index cdbdc8ac3f..32161e4454 100755
--- a/tools/cpm/package/vars.sh
+++ b/tools/cpm/package/vars.sh
@@ -13,7 +13,7 @@ if [ -z "$JSON" ]; then
 	[ -n "$PACKAGE" ] || { echo "Package was not specified" && exit 0; }
 
 	# shellcheck disable=SC2153
-	JSON=$(echo "$PACKAGES" | jq -r ".\"$PACKAGE\" | select( . != null )")
+	JSON=$(jq -r ".\"$PACKAGE\" | select( . != null )" cpmfile.json)
 
 	if [ -z "$JSON" ]; then
 		echo "!! No cpmfile definition for $PACKAGE" >&2