Change:
Ref. includes: // NOTE: The $Format strings are replaced during 'git archive' thanks to the // companion .gitattributes file containing 'export-subst' in this same // directory. See also https://git- gitVersion string = "v0.0.0-master+" This directive, activated by and the  containing the line , results in file contents served by GitHub Archives that can change in unexpected ways. For example, the length of the commit SHA can expand over time as there are collisions. This non-determinism can lead to surprises, such as , where a client-go dependency resulted in unexpectedly different tar hashes, which was detected when a new version of the ko binary was being to Homebrew. tl;dr: though the client-go dependency itself didn't change for ko, later runs of (via GitHub Archives) resulted in different contents for the string to avoid a new collision for the previous prefix length, which cascaded into different content SHAs and shady-looking binary SHAs. I'm not sure, but after reading docs I believe you could naively solve this by replacing with so the string includes the full commit hash instead of the abbreviated one. I have no idea if anything depends on being a shorter string, but presumably things are fine with it having been a variable-length string so . Given enough time/collisions, I suppose theoretically will slow grow to be equal to , but I don't think that will happen during any of our lifetimes cc
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
Thanks for the report. Moving to kubernetes/kubernetes where this source comes from. There's not a lot we can do for past releases, but I'd be in favor of switching to %H going forward. Reproducibility of source archives is important.
/sig release
/kind bug
Thanks for taking this on !!
since we don't actually use to full-fill the commit info as version, should we just delete that file? containerd a issue about checksum mismatch due to this.
and before that it was and before that , so everywhere
I have created to stop including the files in k8s libraries. For anyone vendoring these libraries in the future, you should no longer be affected by this issue.

Discussion:
// NOTE: The $Format strings are replaced during 'git archive' thanks to the // companion .gitattributes file containing 'export-subst' in this same // directory.  See also https://git-scm.com/docs/gitattributes <del> gitVersion   string = "v0.0.0-master+$Format:%h$" </del> <ins> gitVersion   string = "v0.0.0-master+$Format:%H$" </ins> gitCommit    string = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD) gitTreeState string = ""            // state of git tree, either "clean" or "dirty"

// NOTE: The $Format strings are replaced during 'git archive' thanks to the // companion .gitattributes file containing 'export-subst' in this same // directory.  See also https://git-scm.com/docs/gitattributes <del> gitVersion   = "v0.0.0-master+$Format:%h$" </del> <ins> gitVersion   = "v0.0.0-master+$Format:%H$" </ins> gitCommit    = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD) gitTreeState = ""            // state of git tree, either "clean" or "dirty"