don't warn about backup SHA1 when the providing package has changed