Thats why nix unpacks the archives first and then hashes them.