This is included in #5582, but I'm PRing separately because it is a badly needed fix. It also needs backport to 0.10. Unfortunately, this will force all dependencies to be rebuilt. I'll accept lashings as penance...
Will rebase #5882 after merge.
Broken hash logic caused all depends on some platforms (osx at least) to end up with the same build-id. Without this fix, nothing will be rebuilt when recipes or dependencies change. The 'cut' was put in the wrong place, so rather than hashing the hashes, it hashed the filename which was always "-" (stdin). Probably a stupid c/p mistake.