First reported by @schiotz at #4871 (comment), several other projects have been hit by this as well:

• sha256 changes on v3.3.0, v3.3.1? protocolbuffers/protobuf#3619
• How to depend on Bazel release (not on the tarball from Github of 0.5.4 tag -> checksum changed) bazelbuild/bazel#3722
• bazel compiliation is broken! build failure due to github checksums changing tensorflow/tensorflow#12979

Some more details in libgit2/libgit2#4343 (comment)

Long story short: we should try to avoid downloading from github.com/.../.../archive (and try to use github.com/.../.../releases (or another located where 'packaged' tarballs are available) instead, if at all possible.

If not, the alternatives I see are:

• doing a git clone on the tagged version and creating the tarball ourselves (directly using tar), which should always give the same tarball?
• not including any checksums if we need to download from github.com/.../.../archive