builder: Check md5 sums of downloaded patches

The previous version allowed to continue when the md5 sum of patch
downloaded from upstream did not agree with the one recorded in spec.