verify signatures and run as USER leinuser

[Quantisan]

Fixes #4 by:

1. run as USER leinuser
2. verifying download signatures

And, use lein-pkg instead of lein script as it should.

[ToBeReplaced]

Nice one! This alleviates all of my concerns.

[md5]

It would probably be good to combine some of the RUN statements. I just built this image at it looks like it currently has ~30 layers, which is getting perilously close to the 42 layer limit in older versions of AUFS (cf. moby/moby#1171). That limit is 127 layers in newer versions of AUFS as I understand it, but I assume there are still a lot of AUFS-based systems dealing with the older limit. The java:7 image itself is 8 layers (not counting scratch) and another instruction was recently added to the Dockerfile in docker-library/openjdk#34 that will be pushed live soon.

[lvh]

This looks good to me, but I too think it'd be a good idea to merge some of those RUNs :)