check checksum are being verified to avoid inocmplete/invalid data

[maxandersen]

noticed that by adding //REPO <somerespondingbutnotmavenurl jbang happily downloaded withuot verifying checksum etc. causing builds to fail.

should consider enabling checksum checking by default