These are actually all zip files.  The reason for the non-reproducibility is
that something copies the contents from the source to a mktemp'ed directory
without preserving timestamps.  Then this directory is zipped up.

So the zip file now contains non-constant timestamps.

I think it's somewhere in postprocess, but I can't find it so far.

I found packimages.pl but I'm not sure whether this does the copying, too.