VSIX files are different between file service and CDN downloads

[dtivel]

Describe the bug
Downloading the same version of Tyriar.luna-paint-0.16.0.vsix from both the VS Marketplace file service and CDN yields slightly different files.

To Reproduce
Steps to reproduce the behavior:

1. Go to https://marketplace.visualstudio.com/items?itemName=Tyriar.luna-paint
2. Click on '"Download Extension" (Note: this assumes the current version is 0.16.0.) This will download file Tyriar.luna-paint-0.16.0.vsix.
3. Open a PowerShell prompt and execute:

curl -sSL https://tyriar.gallerycdn.vsassets.io/extensions/tyriar/luna-paint/0.16.0/1661007177305/Microsoft.VisualStudio.Services.VSIXPackage -o Tyriar.luna-paint-0.16.0-CDN.vsix

Write-Host "File #1 SHA-256 hash:  $((Get-FileHash '.\Tyriar.luna-paint-0.16.0.vsix').Hash)" ; Write-Host "File #2 SHA-256 hash:  $((Get-FileHash '.\Tyriar.luna-paint-0.16.0-CDN.vsix').Hash)"

Expected behavior
File hashes will be identical.

Actual behavior
The files are different.

File #1 SHA-256 hash:  E7F2EF903F2DCD0A033DE2887F82DA348EA51EF54ED07DB2756887B64DA920F3
File #2 SHA-256 hash:  63F9CF1E24D92CBFE564331FB26EADA11D54ED9CB8C4A732FD2B673CEF211E2C

Note the file sizes are identical. ZIP metadata has probably changed.

    Directory: C:\Users\dtivel\Downloads

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a---           3/15/2023  6:37 AM         879095 Tyriar.luna-paint-0.16.0-CDN.vsix
-a---           3/15/2023  6:36 AM         879095 Tyriar.luna-paint-0.16.0.vsix

CC @nikhgup, @isidorn, @joaomoreno, @sandy081

[isidorn]

Sounds like a general marketplace bug unrelated to signing.
Also fyi @xavierdecoster

[drewgillies]

We now have consistent VSIX assets and signatures for package signing failures identified before August 2023. Any remaining will be corrected soon. The conditions which allowed this failure were corrected in October. Please test any previously failing scenarios (be aware that some CDN caching may need to expire) and let us know your experience.

[skofman1]

@drewgillies , should we close this one since the issue was resolved?

[drewgillies]

Yes, closing it. Thank you. If anyone feels it should be reopened, please comment here (or reopen it directly).