Make missing package hash fatal error
To ensure that packages are verified we should check and not install package if there was no hash verification in place.
To enable override of this we should add unsecure
extra option for package list to allow no hash verification optionally (such as for localrepo).