Release tarballs aren't stable

Summary

I had downloaded the bst 1.2.3 release tarball on release day.

Downloading it now, I get a different tarball.

Here is the difference:

diff -ur old/buildstream/_version.py new/buildstream/_version.py
--- old/buildstream/_version.py	2018-10-05 09:01:57.000000000 +0200
+++ new/buildstream/_version.py	2018-10-05 09:01:57.000000000 +0200
@@ -24,7 +24,7 @@
     # setup.py/versioneer.py will grep for the variable names, so they must
     # each be defined on a line of their own. _version.py will just call
     # get_keywords().
-    git_refnames = " (tag: 1.2.3, refs/keep-around/10abe77fe8d77385d86f225b503d9185f4ef7f3a, bst-1.2)"
+    git_refnames = " (tag: 1.2.3, refs/keep-around/10abe77fe8d77385d86f225b503d9185f4ef7f3a)"
     git_full = "10abe77fe8d77385d86f225b503d9185f4ef7f3a"
     git_date = "2018-10-05 16:01:57 +0900"
     keywords = {"refnames": git_refnames, "full": git_full, "date": git_date}

Steps to reproduce

It's not really possible to reproduce it any more, I think.

What is the current bug behavior?

Tarballs aren't reproducibly generated.

What is the expected correct behavior?

Tarballs should be reproducibly generated, no matter when they are downloaded.

Other relevant information

I think the issue is that back when I had downloaded it the first time, that tag was the tip of the bst-1.2 branch, and as a result the branch name got added to git_refnames?

---