Curious, what is your software doing that it depends on specific metadata in your dependencies? What metadata do you require? Most files metadata is stuff like created timestamp, last edit timestamp, read/write/execute permissions..

I'm just trying to think of a case where metadata would be relevant in a dependency?

It's a checksum not the content itself