The canonical sdist is built from the tag, but a second build of the same commit differs in tar and gzip timestamps, so its digest is recorded from the published asset, not from a rebuild. Correct the comments and docs that said "reproducible sdist". No behaviour change.