I think that either one or both need to be provided. But putting a checksum into a file that is being checksum'ed itself does not make sense. So, opting to leave them out at the moment.
Yes to containing a location, no to containing a checksum (because the package instance data file cannot contain a checksum, unless the description is modified to indicate that it must not be used).
I think that either one or both need to be provided. But putting a checksum into a file that is being checksum'ed itself does not make sense. So, opting to leave them out at the moment.