Verify checksums for pull requests from other people

This has the CI step verify the checksums for URLs that might have been
added or edited to build definitions in a pull request.

script/mirror

@@ -64,6 +64,19 @@ update() {
   done
 }
 
+verify() {
+  local url
+  local checksum
+  local file
+  for url in $(potentially_new_packages "$1"); do
+    checksum="${url#*#}"
+    url="${url%#*}"
+    echo "Verifying checksum for $url"
+    file="${TMPDIR:-/tmp}/$checksum"
+    download_and_verify "$url" "$file" "$checksum"
+  done
+}
+
 stats() {
   local packages=( $(extract_urls ./share/ruby-build/*) )
   local total="${#packages[@]}"

script/test

@@ -8,6 +8,8 @@ bats -t test || STATUS="$?"
 
 if [ "$TRAVIS_SECURE_ENV_VARS" = "true" ]; then
   ./script/mirror update "$TRAVIS_COMMIT_RANGE"
+elif [ "$TRAVIS_PULL_REQUEST" != "false" ]; then
+  ./script/mirror verify "$TRAVIS_COMMIT_RANGE"
 fi
 
 exit "$STATUS"