First, a description of how the system actually works in vanilla.
First, a S48ResourcePackSend packet is sent to the client containing two string values:
- The URL to the resource pack.
- A 'hash' value.

While the URL is fairly self-explanatory, the hash is not.

The hash is not generated whatsoever in vanilla, and is instead a field 'resource-pack-hash' in server.properties. That field is sent to the client if it exists. If it doesn't an empty string is sent.

When the client receives the hash, it checks if is a valid SHA hash. If it is, the client uses it to check the integrity of the file it tries to download. If it is not, however, it replaces it with a value that is the filename of the resource pack with all non-word (\W) characters removed. This 'new' hash, whichever form is then sent back to the server in a C19PacketResourcePackStatus packet with an Action of either ACCEPTED or DECLINED. If it is ACCEPTED, another C19PacketResourcePackStatus is sent with either the value FAILED_DOWNLOAD, which actually is only sent when the downloaded file is not a .zip, or the Action SUCCESSFULLY_LOADED, which is sent when anything else happens, including 404s, etc. -- oddly enough. The information sent back in the C19PacketResourcePackStatus is not used in vanilla, however it is useful to Sponge. It allows us to wrap the C19PacketResourcePackStatus in the PlayerResourcePackStatus event. In sponge, using ResourcePackFactory, calling fromURL(URL url), will set the ID of the resource pack to a SHA hash of the file at the URL. fromURLUnchecked(URL url) should set the ID of the resource pack to the minecraft-filename-hash-thing.