Make the fields of 'SandboxPackageInfo' strict.
Skip the timestamp check for add-source deps that are not installed.