Comment 1 for bug 663562

The issue is that pub 277962's linux_2.6.24.orig.tar.gz was somehow replaced with a different one. Archive.getFilesAndSha1s assumes that there is only one hash for a particular file in an archive, and is sensitive to DB ordering when there are multiple.

The best fix is probably to identify and expire all the conflicting files, since none of them should be published any more.