this is the signature of the deb archive, not a git sha