The assertion that all TeX Live packages have a fixed hash is time consuming and should only be checked when running tests.