Support for adding checksum for sources

[smuzaffar]

Previously, In order to use non-github sources (e.g. binary files of CUDA/Rocm, PyPi etc.) we had added sources: and patches: support. This allowed us to download these sources and apply patches. This feature was missing the checking of checksum of downloaded sources.

@akritkbehera , is working on to add such support. Idea is to provide the checksum of each source along with the source url e.g.

sources:
- http:/foo/bar/1.2.tar.gz&bits_checksum=1275234
- http:/foo/bla/2.0.tar.gz&bits_checksum=1435434

as for sources we have a separate download() implementation , so there we can make sure that the download file matches the checksum provided via URL. In case of checksum failure it can print the downloaded checksum of the file so that one can easily update it on first download.

I am opening this issue here to get your feedback and to see if you have a better idea to do this.

Note that, we do not need this feature for non-sources tag ( i.e. source ) as there the commit sha is already unique but if source allows the checkout of tag then if there any protection against moving of tag?

[pbuncic]

If we allow the source to be downloadable files or archives, we need to provide a mechanism to verify checksums so, go ahead.