now, you can upload a package
add reserved names
use sha1 instead of md5