When the circumstances are just right, pulp_deb will produce inconsistent verbatim publications

[quba42]

Version
Affects every version tested (at least the cutting edge all the way back to 3.14)

Describe the bug
Does not happen with download policy immediate, (reproduced with streamed, but on_demand is probably the same).

When re-syncing a repo with a unchanged Package index file, but a changed associated Package.gz file. (Can happen when syncing from another Pulp instance that uses a new APT publication with the same repo version.), then the existing PackageIndex is given a new artifact, rather than creating a new PackageIndex content. As a result existing repo versions have a release file referencing a Package.gz file with a different checksum than the one now included. When verbatim publishing such a repo versions clients will rightly complain about failed checksums.

Expected behavior
Metadata content should be completely immutable. If anything changes new metadata should be created, not existing content altered!

Additional context
The problem is the uniqueness constraints on the affected content types!