these lines are backwards

It looks like what we want is to match the artifacts of the current package with all packages referenced in the previous snapshot in turn.

I _think_ that the logic in this loop is inverted, but I have a hard time comprehending it. The comments are backwards too :(

The logic would be much clearer if we did the comparison using set logic:

• build the set of (filename, (sha256, sha1, size, ...)) tuples for the package we're currently trying to load
• build the set of (filename, (sha256, sha1, size, ...)) tuples for every revision found in the previous snapshot
• check if these two sets are equal

We could even make these sets ordered by filename, which lets us turn them into (hashable) tuples, which lets us build a dict mapping ((filename, (hash, hash, size)), ...) to revision_ids directly when fetching the previous snapshot, making this function a plain dict lookup.

This try block feels overly broad.

Could you just do

if 'files' not in artifact_metadata:
    logger.warning(...)
    return None  # or even artifact_metadata.get('revision_id')

at the beginning of the function instead?