> Defendants then linked their site to those "mirror" sites, after first checking to ensure that the mirror sites in fact were posting DeCSS or something that looked like it, and proclaimed on their own site that DeCSS could be had by clicking on the hyperlinks on defendants' site. By doing so, they offered, provided or otherwise trafficked in DeCSS.
The appeal was mostly about whether the DMCA and/or the specific injunction in question violated the First Amendment, and the court found that it didn't.
(Universal City Studios vs. Reimerdes at the district court level, Universal City Studios v. Corley at the circuit)
(to clarify, I wasn't talking about any git-specific hashes, just regular sha2/blake2b hashes of python, json, and font files. However, the two sha1 commit hashes in the git history match as well.)
4526863 - Initial commit
The repo as I and many other people cloned it has the first commit ("first commit", not "initial commit") at Oct 12 23:20 Z, and the "done" commit at Oct 15 19:37 Z.
A likely explanation is that pixelmelt squashed both commits at or after they put up the blog post, but didn't force-push the rewritten history to github until it hit HN and blew up.