Hacker News Reader

Nixpkgs’s fetchFromGitHub function hashes the contents of GitHub archives after unpacking, so it’s unaffected.

I should have remembered this! Nixpkgs committers are consistently mindful of things like this in code reviews.