Came across a blog article from Github about archive checksums changing. It has been rolled back (for now) but will likely be reinstated in the future. How will that impact nixpkg derivations?
Not much because we unpack the archives and hash the content if fetchFromGitHub is used.
Similarly, patches (and diffs) fetched from such services also tend to change sometimes; most of those changes are avoided by