Docstring should mention that it iterates over the files and the hashes.
Maybe explain the 40 number and/or reuse from a constant?
Possibly this indexing could panic in the case of corrupted data, maybe we should have a more explicit panic message. I'm not certain as doing this everywhere would probably not be worth it. What do you think?