more work towards package dependency integrity checks