Composer registry does not report the shasum

[magnetik]

For instance, after installing a package with the nexus repository, we have:

            "dist": {
                "type": "zip",
                "url": "https://my.company.org/repository/composer-proxy/firebase/php-jwt/v7.0.5/firebase-php-jwt-v7.0.5.zip",
                "reference": "47ad26bab5e7c70ae8a6f08ed25ff83631121380",
                "shasum": ""
            },

We can see that shasum is empty while it was not when using packagist directly.

[mpiggott]

Which endpoint produces the JSON?