The old URL did have a Git commit hash in it, but apparently the server was ignoring it and only used the `master` that was also mentioned in the URL. As a result, every new download would get the latest version from the `master` branch, invalidating the SHA256 checksum. I replaced `master` with the actual commit hash. This should make the situation stable. No functional changes.