1. Yes, you have to make all the SOAP calls (iirc 3?) and the upload call to do each one. The calls can be captured with Fiddler or any web debugging proxy. You can also cheat and upload a zip file to Public resources then use execCommand() to unpack it, which is what I normally do since it's faster than figuring out the calls.
2. Sounds like a bug? File check should be on checksum, md5 in old builds sha in new ones. There's a checkbox in Public resources that controls this, 'Unique file name' in Advanced parameters, though prob not relevant here.