in reply to Daniel Barlow
self reply

@dan I fixed the timestamps but I had unexplained checksum mismatches in the windows and arm binaries, and the tarballs. I've rebuild those from pristine sources.

I don't believe it to be due to an intrusion; the diff in the tarball only had to do with a change to the makefile which didn't get checked in for 0.9.1. I'm not sure about the changes to the arm or windows versions but they are consistent on my laptop and the site, so I'm not worried about there being an attack.

in reply to tech? no! man, see...

Thanks. It's the tarball I was after anyway. According to Nix the sha256 went from 0m2al5j0nf8nydrs6yiif3zfwrfa68r97scj6kw4ysv2h4z6al5r to 0wq7wl1qg53rfb6ksg9asps98mb5wn2jbrdzyr0fa3gbxjwvpds4 but I don't know offhand if that's the shasum of the tarball itself or if nix does some kind of uncompression/unpacking before computing it