I think this may be a person who is concerned a out being tainted by a license. Life if the code was source-available only and they saw it and then were accused to copying some functionality into another open source project.
Now seriously, I'm not particularly interested on this, but if it helps here are additional points of reference to at least be able to verify some integrity in case you want to try it.
Doesn't prove the absence of any malicious intent, but at least it should help prove that nothing is changing between requests (i.e. that the file I got is the same as the file you got).
