That's the good one! Maybe Roku can reverse-engineer the pkg file, otherwise you're out of luck for not following any business standard backup option. We keep copies in three locations, of all revisions of code and packages as well as full mirrors of content with SVN and Git with realtime mirrored/sync copies. So such an issue would never affect us.