here's another case of this bug: https://salsa.debian.org/eighthave/androguard/-/jobs/47277
I'm often working on a mix of Ubuntu/LTS, Debian/stable, and Debian/testing. It was likely that the tarball was added with gbp-import-orig on Ubuntu/xenial, and that build log is from Debian/testing with some sid packages. Here's what's running on Ubuntu/xenial: ii tar 1.29b-1.1 amd64 ii pristine-tar 1.38 amd64 .hc