The dependency hash wasn't being generated in a consistent way: when
read from .spec file in the install directory, the spec DAG was not
normalized, but when generated on install, it was. Thus the same
spec can have two possible hashes, which is obviously not good.
In this commit:
- Added a dep_hash function to spec, which should be used to get the
dependency hash in all cases. This function normalizes the spec
before generating the hash.
- removed sha1 functions from Spec and DependencyHash. The one on
Spec is not needed and is confusing (it hashed the whole spec, not
just hash the deps) and the one on DependencyHash wasn't guaranteed
to be safe because it can't normalize its parent spec before
hashing.
Hopefully this makes things consistent and easy.
50f74c117e