So, while I'm discussing this: why aren't symlinks checksummed in the manifest? (My current tool works on pkg files, and so it determines what is different by comparing the entries. Symlinks have "" as a hash, which means that it's not possible to tell if it's changed between the two versions.)