Yeah, we've been working around this downstream the most hacky way possible (doing an MD5 hash of a directory's contents and strictly enforcing that nothing can depend on stuff outside that directory)