Currently cerbero fetch simply check if the file exist to determine if a archive has been downloaded or not. This is a little fragile, as it won't guaranty we are building against the "real" repository. It will also not try to re-download if the file is truncated or corrupted.

I'd like to propose as a future enhancement, to introduce tarball hash, so cerbero could check against the hash to reduce the risk of using the wrong file, or a corrupted file.