made package and upstream tarball deterministic