Per-artifact checksums of release archives as shipped — the
tarball itself, not its contents. Content-level indexes (Software
Heritage, distro file digests) unpack archives before hashing, so a
pristine hello-2.12.3.tar.gz matches nothing in them; the three
package indexes here publish exact hashes of the artifact:
debian — sid Sources.xz, all four components: md5 and
sha256 per source file (orig/debian tarballs, .dsc, .asc) —… See the full description on the dataset page:
https://huggingface.co/datasets/david-ar/release-tarballs.
