mtimes are working here but I agree sha1's would be the best way to do it.  I'm not certain of the best way to faithfully generate these however and wanted to check if there's a dulwich way rather than embark on it for this isolated case.

If it's all the same however it appears mtimes are sufficient.