>>vagab0+(OP)
I actually wrote an even better way to do this, since my build system drops network access after downloading SHA-256 validated source (to ensure that source can't go out and fetch more things during build):
https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...