fix bugs where invalid checksum/signatures didn't cause update failure. add tests for almost all public APIs in update package