Running check-channel-news before authenticating the repository could
result in running unauthenticated code; the attached patch switches the
order they are run in.

live well,
  vagrant