[Lockal]

There is a minor note that technically there is a weak guarantee that checksums won't break after server update and recompression with different version / alternative implementation of gzip.

https://github.com/orgs/community/discussions/45830

[Aissen]

It's not a minor note, it's a major reason that the github auto-generated tarballs are useless as-is, since they are not stable.

[colejohnson66]

This was not GitHub’s fault, but Git itself combined with cache pruning. Specifically, GitHub updating to Git 2.38 which changed the algorithm. Non-cached tarballs were regenerated on demand, and all hell broke loose: https://github.blog/2023-02-21-update-on-the-future-stabilit...

[Aissen]

It was not the first instance of this happening; other times I'm not certain it was git's fault.

[rwmj]

github have (for the moment) backed down and currently the auto-generated tarballs are stable, but they have in the past and may in the future change this.

[Lockal]

Thank you for highlighting this. I've started a new discussion https://github.com/orgs/community/discussions/116557 to provide strong guarantees for checksum stability for autogenerated tarballs attached to releases.