[jffry]

> Anyway didn't this replace versions, so locking won't have helped either?

The lockfile includes a hash of the tarball, doesn't it?

[Already__Taken]

It does, the answer to my question was no.