bug#33276: guix still building when substitute is available (or is guix pull not reproducible)

[Pjotr Prins]

I have a guix-publish server and I am building the packages with the
exact same checkout of 'guix pull'. Even though the client sees the
substitutes with --dry-run it still builds them.

On build host (check version first)

        penguin2:~$ ~/.config/guix/current/bin/guix --version
        guix (GNU Guix) ff349415b27cc764fd7168ef35ca76c3b8b05889

        Copyright (C) 2018 the Guix authors

        penguin2:~$ ~/.config/guix/current/bin/guix package -i perl mosh 
--substitute-urls="https://berlin.guixsd.org"; --fallback

        building 
/gnu/store/ih5liw094mkjg1n4qakipfdgmrhvpj68-protobuf-3.5.1.drv...
        building /gnu/store/bhrgmk0xax0yl50whb8faankknw4z254-mosh-1.3.2.drv...
        The following packages will be installed:
                 perl 5.26.1  
/gnu/store/7ifc22sh86zblnzamqimgmv06idyx69v-perl-5.26.1
                 mosh 1.3.2   
/gnu/store/5qanifm23gqxhg2bh587dzah0mf79fp0-mosh-1.3.2

On client (check version first)

        monza:~$ ~/.config/guix/current/bin/guix --version
        guix (GNU Guix) ff349415b27cc764fd7168ef35ca76c3b8b05889

        Copyright (C) 2018 the Guix authors

        monza:~$ ~/.config/guix/current/bin/guix package -i perl mosh 
--substitute-urls="http://guix.genenetwork.org https://berlin.guixsd.org"; 
--dry-run
        The following packages would be installed:
                 perl 5.26.1  
/gnu/store/6zz27h4l21b8f2mifrk9sidvib9cns2i-perl-5.26.1
                 mosh 1.3.2   
/gnu/store/dkpkd7ajh3kvpzfdfacqg50x49i78x5y-mosh-1.3.2

Strangely the hash values differ but it still wants to fetch them. But when I 
do an actual install it rebuilds:

        monza:~$ ~/.config/guix/current/bin/guix package -i perl mosh 
--substitute-urls="http://guix.genenetwork.org https://berlin.guixsd.org";
        building 
/gnu/store/ih5liw094mkjg1n4qakipfdgmrhvpj68-protobuf-3.5.1.drv...

What is causing the difference? Should the guix pull not be identical
when it is the same checkout? Or am I missing something.

Obviously this does not work for my deployment purposes. Or at least
it is limited in use if I can't use a 'guix publish' server. Showing
the faulty substitutes is also interesting behaviour...