"kpm pack" writes SHAs of packages into global.json