* verify md5 hashes before using files for gbuild

docker/gitian-bitcoin-host/build-bitcoin.sh

@@ -21,7 +21,10 @@ while read -r URL FNAME; do
 		continue
 	fi
 	wget --no-check-certificate "$URL" -O "$FNAME" || exit $?
-done < ../input-sources/${VERSION}.txt || exit $?
+done < ../../input-sources/${VERSION}.txt || exit $?
+
+## verify that all sources are correct before continuing
+md5sum -c < ../../input-sources/${VERSION}.txt.md5 || exit $?
 
 cd ..
 ./bin/gbuild ../bitcoin/contrib/gitian-descriptors/boost-linux.yml || exit $?

docker/gitian-bitcoin-host/input-sources/0.9.1.txt.md5

@@ -0,0 +1,9 @@
+d6eef4b4cacb2183f2bf265a5a03a354  boost_1_55_0.tar.bz2
+a14a5486d6b4891d2434039a0ed4c5b7  db-4.8.30.NC.tar.gz
+29b7065906e2551508a0d7eacd19174e  libpng-1.6.8.tar.gz
+065bf20a20ebe605c675b7a5aaef340a  miniupnpc-1.8.tar.gz
+de62b43dfcd858e66a74bee1c834e959  openssl-1.0.1g.tar.gz
+a72001a9067a4c2c4e0e836d0f92ece4  protobuf-2.5.0.tar.bz2
+89a90a3b8cbca60ac412b2e0e0c776e7  qrencode-3.4.3.tar.bz2
+228b6384dfd7272de00fd8b2c144fecd  qt-everywhere-opensource-src-5.2.0.tar.gz
+44d667c142d7cda120332623eab69f40  zlib-1.2.8.tar.gz