We ought to have some sort of maven-based verification test that can unpack the update site zip and installer, and verify that the p2 metadata doesn't reference any unexpected 3rd party URLs.