oh boy.  github changed their systems backing raw downloads and it's less tolerant of extra slashies in urls.
update to pulling the latest version of mdm.  skip the second download for the jar since we packaged better again.
verify integrity of the mdm binary if fetched during bootstrap and abort immediately if someone on the internet is nasty.  you can now trust bootstrapping as long as this config is connected to some source of trust (like your source repo) by a hash itself (a git submodule will do nicely).