Fetch and verify sources from an rpm specfile