Concatenating a hash function for generating one hash for multiple files
Assuming the hash is collision-resistant (which SHA-256 is believed to be), the proposed practice of hashing the concatenation of a sorted list of hash of files is demonstrably secure against collision (argument: a collision in the final result implies a collision in the last step or/and for some file); so is the practice of hierarchically hashing a binary tree. There's no meaningful difference in security (arguably, accidental collision is more likely in the later; but that's immaterial).

Notice that the proposed practice will give the same hash if files are reordered (which clearly is intentional), or if the content of two files is exchanged while they keep their name (which could be a serious security issue: two packages with the same hash, and the same filenames, can do entirely different things when run).