Base get_fingerprint on a PackageId

The fingerprinting code was erroneously using all sources from a manifest when
calculating the fingerprint which meant that sources not yet downloaded were
attempted to be fingerprinted.

The correct source to fingerprint is located in the SourceId field of the
resolved PackageId.

Closes #259
I wonder, is it bad practice to use other domains like `foo.com`?