This requires allowing ports to override fetch() since tar.gz sha256sums from googlesource.com are not deterministic.