calculate hash of the tarball, not the base64 encoded tarball
v0.3.1