Verify the checksum for the downloaded components

[yanghua]

Sometimes, the download actions for some components are not successful due to network issues. However, the broken files have existed. So, when we invoke the download command once again, the command would skip these broken files.

IMO, it would be better to verify the checksum for the downloaded components to make sure the files are completed.

[yanghua]

@pan3793 WDYT?

[pan3793]

I have thought, but this may increase the cost for users who want to use their custom version components. But it's OK if we can have a switch(maybe an env var named CHECKSUM_ENABLED) to allow user to disable it.

[pan3793]

I found a common case in daily usage, the wrongly assembled URL would produce a zero size download/foo.tgz, and then cause the foo.tgz to be skipped to download in the next round even with the corrected URL

wget -O download/foo.tgz https://wrong/path/foo.tgz

fb43115 added a simple mechanism to auto delete zero size file in download_if_not_exists