shasum check for uploaded tarballs
unlink directory when package is unpublished