I agree.  The server-reported 'file_length' may either not be set or set incorrectly.  We also have a more secure way of verifying files through metadata.  Perhaps we could still inspect 'Content-Length' and raise a warning if it contains an unexpected value.  A server reporting an invalid 'Content-Length' might be something the client or the updater should know.  It is also wise to verify the repository is correctly following communication protocols.