do not use existing packages/jobs during release upload that have same sha1; only use fingerprints

Signed-off-by: dmitriy kalinin <dmitriy@pivotallabs.com>