bugfix: always export a sha256 sum for packages

There is corner-cases where packages don't have a sha256 sum registered. It may happen if the user creates packages via tools like fpm.

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>