I'm pretty sure `:metadata` is treated like a `:path` location, so storing the sha would be unnecessary - you always get the latest version. There is no "locking".