[anderskaseorg]

Nixpkgs’s fetchFromGitHub function hashes the contents of GitHub archives after unpacking, so it’s unaffected.

[pxc]

I should have remembered this! Nixpkgs committers are consistently mindful of things like this in code reviews.