For now, those can be faulty as the manifest is missing 'critical' information about how
to recompute the hash (e.g. fs layout, executable bit, ...).
The problem has been reported upstream [1]. In the meantime, this looks like a good way
to avoid injecting noise within the archive.