wmf: allow external/unverified tarballs

Change-Id: I19f11841f560fe10aeabfddf5011cac224098e2a