Guidance on version-identical source packages with different checksums

["MOESSBAUER, Felix" <felix.moessbauer@siemens.com>]

Dear snapshot team,

we just noticed the following oddity regarding what precisely
identifies a Debian source package:

The sratom 0.6.14-1 source is available in multiple archives (e.g.
debian, debian-debug and debian-ports), but the version in ports has a
different checksum [1]. Diffoscope shows, that the changelog is
different in the hurd archive:

├── debian/changelog
│ @@ -1,8 +1,8 @@
│ -sratom (0.6.14-1) unstable; urgency=medium
│ +sratom (0.6.14-1) unreleased; urgency=medium

Our assumption was, that a Debian source package is precisely
identified by its name and version, but this does not seem to be true.
Is this indeed not required by the policies, or are these findings
bugs?

[1] https://snapshot.debian.org/package/sratom/0.6.14-1/

Best regards,
Felix Moessbauer

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany