Yes, package GUID you are seeing both in the OSD's CODEBASE element as well as in SQL database is also stored inside corresponding SFT file, and it's the way for client to "know" which OSD(s) relate to what SFT file.
In fact, package GUID is also decisive factor for Management Server -based infrastructure on how RTSP/RTSPS based streaming works: client requests SFT's contents by supplying package GUID to server and server looks at the database to see what physical SFT and which version maps to it.
There's also other GUID in the OSD file (in SOFTPKG element) which, by my knowledge, isn't actually used for anything inside App-V. And finally, third "well-known" GUID can be found inside the SFT file which changes for each version of the same SFT, this is used for tracking linearity of SFT history which prevents you from accidentally branching SFT when publishing new version through Management Console and also as basis for Active Upgrade.
/Kalle
