packaging: workaround: force v0.0.2 hash