* fix hash mismatch during installation with `no-binary` option for packages that provide suitable wheels * do not skip hash check for sdists * write hash for sdists in direct_url.json
