slapos.recipe.build verifies signatures of downloaded files and can also use
buildout cache or download from shacache, which

This introduces a new download-plugins.cfg, containing the URLs of
extensions and their md5sum signatures. This profile is extended by
software.cfg and there's a section using slapos.recipe.build to actually
download extensions.

A generate_download_plugins_cfg.py python script is also included, to be
run by software release maintainers to update download-plugins.cfg using the
list of plugins included in generate_download_plugins_cfg.py