Base Maven Dockerfile is Insecure

[shamiq]

hi! https://github.com/groupon/DotCi/blob/master/Dockerfile is based on maven:3, which from Dockerhub (https://hub.docker.com/_/maven/) is this Dockerfile:
https://github.com/carlossg/docker-maven/blob/882a21728d702dad08279afe6b6bf9fa4b8bfe18/jdk-8/Dockerfile

This base file is curling over an insecure connection, and piping it to tar without any verification (of either the download or the checksum). The rest of the chain of dockerfiles looks reasonable!