If a repo wants to disinherit package.mask entries from a master repo, then it currently has to that with a separate -atom line for each line for each atom that it wants to negate. Supporting -* for package.mask files in the grabfile_package function would allow for some flexibility here (currently the function discards -* in package.mask because it treats it as an invalid atom).