Instead of the sha256 + name + ... of all the files of a package.
This will be needed to transition to ExtID, as we can't reasonably write
this large set in the ExtID storage; and the sha256 of the .dsc is good
enough, as the .dsc contains hashes and names of other files.