client/restricted-packages: fail download if checksum does not match