url would be more useful than file+urlmd5
(slapos.buildout will be changed this way)

However, prevent the user from passing empty metadata inadvertently.
Of course, that won't reject dummy information but it's unlikely there's
nothing useful to add.