For some FOSS releases, it's common to publish the tarball along with PGP signature. I do this with https://pagure.io/clufter, and noticed that despite I was able to select both files at once (upon which the web interface reported "2 files"), only the first one appeared in the release directory listing.
Fixed in https://pagure.io/pagure/pull-request/386
Commit d68be679 fixes this issue