Need to checksum downloaded packages

[Michael Twomey]

The cache should verify checksums (and signatures if possible) all downloaded packages, to ensure that partial and corrupted downloads don't wind up in the cache.