use tree hash instead of tarball hash

less sensitive to mtime, uid, etc