[bugfix] Package repository: when uploading a package, we strip sensitive install information (default password) from the package descriptors. This information needs to be restored when the package is synched back to disk, otherwise permissions may be wrong during next install.