Allow specifying a registry to fetch attachments from

Some of the dist.tarball urls in the actual database are madness.
don't freak out on sha mismatches, just omit the file
v0.1.5