On Fri, Jul 12, 2019 at 09:33:50AM -0700, Ivan Petkov wrote:
> A bit more detailed context:
> The rust project makes pre-release sources available for testing ahead of
> the formal release, and the process is meant to shake out any potential bugs.
> I tested with the prerelease build originally, and after the real release
> came out I updated the package URL to the formal release and immediately
> rebuilt successfully.
> 
> I'm not 100% sure if maybe guix reused the cached tarball I had from earlier,
> or whether the prerelease source was immediately upgraded to the formal release
> and fixed shortly after. (I did try rebuilding right before pushing the change
> out which succeeded with no changes, which I'm guessing is because guix did
> not redownload the tarball and why I didn't notice the hash mismatch).

Right, Guix looks up the sources locally by hash. So, if you change a
URL but not the hash, and you have the old file with the same hash in
/gnu/store, Guix will use the old file and you will not notice that the
URL / hash pair is incorrect.