These are actually all zip files. The reason for the non-reproducibility is that something copies the contents from the source to a mktemp'ed directory without preserving timestamps. Then this directory is zipped up.
So the zip file now contains non-constant timestamps. I think it's somewhere in postprocess, but I can't find it so far. I found packimages.pl but I'm not sure whether this does the copying, too.
pgpZEesp19ohh.pgp
Description: OpenPGP digital signature
