install-script: only fetch files when needed, and verify them

Signed-off-by: Steve Markgraf <steve@steve-m.de>