The tarball host serves archives as immutable for a year, but a rebuild of the same JASP version reused jasp-desktop-<ver>-x86_64.tar.zst with new bytes, so a cache could hand out the old tarball against the new PKGBUILD's sha256. The name now carries the first 12 hex digits of its sha256, and the PKGBUILD keeps that name locally too, so a stale download in the build directory no longer fails the checksum either. Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9