Comment by cordite

Just a thought, why not have fingerprints be like a Merkle tree?

A (naive) example: a built package has the hash derived from the package identity and all dependency hashes at compile / link time.