always verify sha1sum if nocheck not specified (SOFTWARE-3787)
always verify sha1sum if nocheck not specified (SOFTWARE-3787)

this has the effect of making sha1sum mandatory for non-scratch builds
with cached upstream sources

opensciencegrid/osg-build,matyasselmeci/osg-build,opensciencegrid/osg-build,matyasselmeci/osg-build