Use source checksums for new packages