download.sh: store the role under the right directory and check md5 sum after download