Building 1.6.3 using the original hash is failing because of a hash mismatch. Presumably this was an (accidental?) Git history rewrite, moving of the existing v1.6.3 tag to a different commit. Would it be possible for someone to verify this, just to have a reference that nothing hijacky is going on?
Would it be possible to use new tags for those re-releases in future? Moving tags means extra work for downstream packagers relying on the hash of the inputs.