Package cache cleanup

* make sure we unlock only once
* unlock method is not needed, can just unlock the
  lock object returned by lock().