Fix component packages

- Source packages needed "reference" key, not "sha"