It depends, for the most part, we're just using the identity to disambiguate inside a particular package graph. We have CanonicalPackageLocation and CanonicalPackageURL as identifiers for situation where we need something more "global", e.g. for the shared cache of git checkouts.