milestoned an 3.0.3 as 4de6dfb is on the PR into 2.2.x and the backport bot only needs to pull this back to 3.0.x.

and in duplicating comments, I think the caching as the sha is ok (as users should put the files in the tree where they should be rather than rely on putting things in the right place in the cache) and the issue with freetype has PRs / commits to fix it.

But for the case of FreeType that doesn't really work anymore (I think?)? Previously you could just have the tarball in the cache and we wouldn't try to download it, now you need to have the tarball renamed to the sha for that.

The FreeType issue just above remains valid (well, at least unless @tacaswell explicitly dismisses it, which is fine with me too).

Ah, I miss understood some of the bail logic, another PR coming.