introduce alternatives for md5/sha256sum
store sigpath inside the package data