Fingerprint the lock file, not gemfile