Comment by blueflow

I think you got unlucky with unzip because you noticed. Distributions heavily patching software is rather the norm than the exception.

As an example, look how Debian patches the Linux kernel: https://udd.debian.org/patches.cgi?src=linux&version=6.12.21... . And the kernel is a very active project.

Funnily, this makes recoding the version number for a SBOM pretty useless.