TODO

* upload a hash at the same time as package, and pass that through to setup.ini
* mksetupini should have an okmissing option for override.hint which names non-existent versions
* use ./setup.hint inside the tar file, avoiding all the hint/tar coherence problems
* mksetupini should write to stdout if --inifile not specified
* check packages for path collisions
* mksetupini should be able to verify requires: contains valid package names using a provided list of packages (or a cygwin-pkg-maint file?)
* make override.hint (optionally?) apply recursively?
* atomically update .ini/.sig (rename of containing directory, if we put release/ was somewhere else?)
* report changes in override.hint like we used to for setup.hint
* empty install packages should only come in two variants: no dependencies and in _obsolete category, or with dependencies and in 'meta' category