Swift build/test always updating dependencies

Using Swift
,
1

I've got a project that when I call swift build or swift test it always performs dependency resolution. The project is available if you want to look at the Package.swift.

I'm building on Ubuntu 18.04 with 5.1 (the same errors happen with 5.3, including a bunch more issues I don't feel like fixing right now). I've tried a clean checkout and still have the problem.

I'm at a loss as to how to fix this. Help is greatly appreciated.

$ swift build
Updating https://github.com/Thomvis/BrightFutures.git
Updating https://github.com/Kitura/Kitura
Updating https://github.com/Kitura/TypeDecoder.git
Updating https://github.com/Kitura/Kitura-TemplateEngine.git
Updating https://github.com/rc2server/appmodelSwift.git
Updating https://github.com/IBM-Swift/HeliumLogger.git
Updating https://github.com/IBM-Swift/FileKit.git
Updating https://github.com/mlilback/pgswift.git
Updating https://github.com/Kitura/BlueRSA.git
Updating https://github.com/Kitura/BlueSSLService.git
Updating https://github.com/Kitura/BlueECC.git
Updating https://github.com/Kitura/KituraContracts.git
Updating https://github.com/ianpartridge/swift-backtrace
Updating https://github.com/Kitura/Swift-JWT.git
Updating https://github.com/weichsel/ZIPFoundation.git
Updating https://github.com/apple/swift-log.git
Updating https://github.com/Kitura/BlueSignals.git
Updating https://github.com/Kitura/BlueSocket.git
Updating https://github.com/rc2server/CommandLine.git
Updating https://github.com/Kitura/Kitura-WebSocket.git
Updating https://github.com/Kitura/OpenSSL.git
Updating https://github.com/Kitura/LoggerAPI.git
Updating https://github.com/Kitura/Kitura-net.git
Updating https://github.com/IBM-Swift/BlueCryptor.git
Completed resolution in 7.69s
Everything is already up-to-date
2

I saw this once a long time ago when a package graph contained references to both Some/Package and Some/Package.git. SwiftPM resolved successfully, correctly treating them as the same node, but it would always mistakenly think its previous resolution was stale. The problem went away once every package reference (in the entire graph) was changed to exactly match the recommendation in the respective package’s read‐me.

I don’t know if modern toolchains still suffer from that problem, but it is the first thing I would try.