Checksum of a binary package against checksum of a reproducible build?