On Tue, May 22, 2018 at 11:17:49AM +0200, Ricardo Wurmus wrote:
> Unfortunately, the archive does not remain the same.  These archives are
> created on demand and cached for months.  Once they expire they are
> recreated.  Since the archives contain timestamps the hash will change.

They may also change when the tools used to create the archives by
GitHub are changed. This happened in autumn 2017 and broke many
downloads for many downstream projects. For now, GitHub doesn't
guarantee these snapshot archives are bit-reproducible and recommend
that we don't rely on them to be stable over time. They know that, in
practice, it's an issue.