To investigate #71948 I made a following setup to try to catch the hash changes: A following script:

#!/bin/bash
  
. ~/.nix-profile/etc/profile.d/nix.sh

BASEDIR="$(dirname "$0")"
"$HOME"/.nix-profile/bin/nix-prefetch-url "$BASEDIR"/nixpkgs -A emacsPackages.lua-mode.src 1> "$BASEDIR"/`date +%j-%Y`.out 2> "$BASEDIR"/`date +%j-%Y`.err

Was run daily using cron, the "$BASEDIR"/nixpkgs was an immutable nixpkgs checkout. There were two observed changes:

# grep path *.err
010-2020.err:path is '/nix/store/lj9l6grfbh1d5pxs1kccbnsk6snmb4q4-source'
<snip>
037-2020.err:path is '/nix/store/lj9l6grfbh1d5pxs1kccbnsk6snmb4q4-source'
038-2020.err:path is '/nix/store/5cd6xbb5a31a1d9a0iyn3kbxxad8xd5v-source'
<snip>
092-2020.err:path is '/nix/store/5cd6xbb5a31a1d9a0iyn3kbxxad8xd5v-source'
093-2020.err:path is '/nix/store/iss0dg74shwiph6yaagfwl8b36p4yspn-source'
094-2020.err:path is '/nix/store/iss0dg74shwiph6yaagfwl8b36p4yspn-source'
095-2020.err:path is '/nix/store/iss0dg74shwiph6yaagfwl8b36p4yspn-source'

The first one looks like a version bump, but the second one looks more interesting:

diff -aru /nix/store/5cd6xbb5a31a1d9a0iyn3kbxxad8xd5v-source/lua-mode.el /nix/store/iss0dg74shwiph6yaagfwl8b36p4yspn-source/lua-mode.el
--- /nix/store/5cd6xbb5a31a1d9a0iyn3kbxxad8xd5v-source/lua-mode.el      1969-12-31 19:00:01.000000000 -0500
+++ /nix/store/iss0dg74shwiph6yaagfwl8b36p4yspn-source/lua-mode.el      1969-12-31 19:00:01.000000000 -0500
@@ -36,7 +36,7 @@
 
 ;; This field is expanded to commit SHA, date & associated heads/tags during
 ;; archive creation.
-;; Revision: 1f596a9 (Wed, 4 Dec 2019 15:34:26 +0100  (HEAD -> master))
+;; Revision: 1f596a9 (Wed, 4 Dec 2019 15:34:26 +0100 )
 ;;
 
 ;;; Commentary:

This lead me to an upstream commit immerrr/lua-mode@b124dd0 which uses the "export-subst" feature of git https://git-scm.com/docs/gitattributes#_creating_an_archive

I guess, the value of "%d" depends on what branches are pointing to a certain commit, so the contents of such a tarball would not be uniquely determined by the revision alone. To make things more interesting, upstream forbids export of .gitignore, so we can't even reliably detect the use of "export-subst".