skip downloading if sha1sum matches
* apply integrity check for index (fix #2340)
* some small improvements to fetcher
  * fix: check write access to destination file 
    if it already exists (permissions may change)