Tarball sha, not git sha