Problem:

I created a github release, which makes use of versioneer to generate a version number. I downloaded the tar.gz archive and computed the hash (which is required by third-party package managers, like macports and homebrew-core). A few days later, however, I was notified that the hash of the released archive file changed.

Inspecting the original and subsequent tar.gz files, I found that the tar.gz archive did indeed change, and the cause of this change is git_refnames in the file _version.py generated by versioneer.

diff -r SHTOOLS-4.7.1 SHTOOLS2-4.7.1
diff -r SHTOOLS-4.7.1/pyshtools/_version.py SHTOOLS2-4.7.1/pyshtools/_version.py
26c26
<     git_refnames = " (HEAD -> master, tag: v4.7.1)"
---
>     git_refnames = " (HEAD -> master, tag: v4.7.1, develop)"

The only thing that makes sense is that Github recreated the project tar.gz file a few days later, and that for some reason, the git tag was modified somehow. Though I don't know why github would recreate this file, I also question whether git_refnames is required by versioneer. and _version.py.

Additional context:
The release of our project, along with the release tag "v4.7.1" was created using the Github release page. I then pulled the tags to my local repository using git pull --tags. We work on a parallel develop branch, and have since pushed new commits to the develop branch on Github.

Examples of other people having the same problem:

• attic/_version.py from github releases change over time jborg/attic#335
• Unstable MD5 Due to Git Archive + Versioneer spack/spack#7937
• https://trac.macports.org/ticket/41657#comment:2
• shtools: new port macports/macports-ports#8518

Solution
I don' know the solution, nor if there is one. I have opened an issue at GiHub support to find out why the tar.gz file was recreated after the release: This seems very dangerous to me, but perhaps there is a reason this was done.

If there is not a solution, then at a minimum, versioneer should provide a warning in the documentation as to how to avoid this problem. It is not 100% clear what I could have done differently to avoid this.