more error reporting on checksum mismatches, and fix a bug that found where we were not always decompressing sources