Good question... Let me try a new iteration of the idea please.

Here is what I _think_ I want:

- For each package in the Catalog, the list of mcz files it requires to install.

- For each mcz file, its expected sha256 hash and a basically stable download URL.

So if I would use this algorithm:

Then I should be able to work out every mcz file required by each package, and I should be able to calculate the sha256 hashes of those mcz files too, but will I be able to determine a suitable download URL? I don't immediately see how and so one alternative would be to manufacture a URL by mirroring the file somewhere.