Forge build artifacts do not replicate — each backend builds its own copy from the same commit. A plain `zip -r` stores checkout mtimes and readdir order, so those copies came out the same SIZE but a different HASH. Behind the load balancer that means /releases/<repo>/<version>/<file> serves different bytes depending on which backend answers, and a checksum a user records is only valid for whichever one they happened to hit. Pinning mtimes to the commit timestamp, sorting entries and passing -X makes independent builds of a commit byte-identical, which restores the URL as a stable identifier. Verified locally first: two simulated checkouts produced two hashes with the old recipe and one with this. This does not make divergence impossible in general — a recipe embedding timestamps or using non-deterministic tooling will still differ per backend, so a puller still must not treat a hash mismatch as corruption. It does mean a repo can opt into being verifiable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>