files) are now referenced using their cryptographic hashes.
This ensures that if two package descriptors have the same contents,
then they describe the same package. This property is not as
trivial as it sounds: generally import relations cause this property
not to hold w.r.t. temporality. But since imports also use hashes
to reference other packages, equality follows by induction.