The bug is caused by code in packaging.create that iterates over a dict (package_data) to extend a list (extra_files).  Instead of just calling sorted to make output deterministic, I’d prefer to fix that more serious behavior bug (see also #13463, #11805 and #5302 for more !fun package_data bugs).  Problem is that the setup.cfg syntax does not define how to give more than one value.  If it’s judged acceptable to disallow paths with embedded spaces, we could do something like this:

[files]
package_data =
    spam = first second third

Otherwise we’d need to use multiple lines (requested in #5302):

[files]
package_data =
    spam = first
    spam = second
    spam = third

We probably don’t want that.  An intermediate idea:

[files]
package_data =
    spam = first
           second
           third

Not sure this would be the nicest thing for people to write, and for us (me) to extend the setup.cfg parser for.

Anyway, attached patch fixes the code so that package_data in setup.py becomes package_data in setup.cfg and adapts the tests to check that, disabling multi-value package_data for now.  I tested it with distutils2 and pypy, so it should fix the hash change in your clone.