The hash is computed over everything: the package itself but also all its dependencies.

When a dependency is updated, the package gets rebuilt to a new store item.

-- 
Pierre Neidhardt
https://ambrevar.xyz/