(GH-426) list perf improvements
(GH-374) Cleanup download statement

This originally was based on GH-375, but this closes GH-375.

Nobody really needs to know where the file was downloaded to unless they are
debugging the output, only where the file is coming from. And cleaning up in
the same way that Redsandro suggested.
(maint) Cleanup source args
(GH-427) add config for checksum on or off
(GH-427) Use remote checksums if available

Verify remote checksum for X-Checksum-Sha1 if it is available.
(maint) filter empty package sources

We already filter out disabled sources but we need to filter out empty sources
as well.
(maint) throw no package found

Instead of an empty message when no package has been found.
(GH-200) Changing structure of virus check function
(GH-428) Do not download already cached files

If the file exists and it is the size we expect it to be, don't download the
file again.
(GH-429) Validate downloaded size is correct

When downloading files, we need to make sure the file we download is the size
we expect it to be.