Function check_download 

pub fn check_download(
    zip: &[u8],
    entry: &CatalogEntry,
) -> Result<(TempDir, PathBuf), String>

Checks a downloaded zip against its entry: the zip’s SHA-256, then, unpacked, the package’s content hash and its author’s signature. Returns the unpacked package’s folder (in the returned temp dir).