I thought the spec said that files with identical content should always produce the same hash, but in practice, that doesn't seem to be the case. It looks like the hash is being generated by including metadata such as upload time as well.