Dockerfile should do checksum verification on CLI files

[MichaelSimons]

Dockerfile should do a checksum verification on the CLI files downloaded.

[MichaelSimons]

@friism, In #9 you made the suggestion

It'd be nice if you published and checked checksums for the .tar.gz

Upon thinking about this further, I feel like I am missing the purpose of this. The file is being downloaded via https, what is the value in using a checksum in this scenario?

[friism]

@MichaelSimons I agree that it's probably not that important, but it is a convention on the UNIX side (check out some of the Linux Dockerfiles).

The check makes sure that the download is not corrupted. But notably, the government can still MITM you because they can serve both the download artifact and an md5 hash that matches.

[MichaelSimons]

This is being tracked with dotnet/dotnet-docker#43. Closing