Comment 2 for bug 1405312

Doing a bit more investigating I think the packages with the duplicate sha1s were installed via sdists and not wheels. Which seems to make sense under the above theory.

I think the pbr egg info writer will need to be more discerning at install time about when it writes pbr.json files.