The fingerprinting for publish is custom - predates payloads and IIRC fingerprints the whole BUILD file owning 3rdparty deps you use