In Che stacks dockerfiles some packages (e.g maven) are downloaded using wget without checking for the checksum. A control should be added at least for centos based stacks (centos_jdk8, vertx, spring-boot, wildfly-swarm, nodejs4, etc...)