should we perhaps move this into the `fetch`, so that when I need to use `resource('foo').fetch` directly it is also verified?
(I had one formula that needs only the zip of lapack, not the extracted sources)