passes SHA sizes to packages