remove unneeded argument
proper staticmethod
use the flag we've already got
proper url for package download
tone down fingerprint

 - save off and check against jobs sha1 and individual packages