The distfile at http://people.seas.harvard.edu/~apw/stress/ is GPL2, the distfile at http://fossies.org/linux/privat/ is GPL3. The distfiles are different because different versions of the COPYRIGHT file are included. No other changes are found by diff.
I reached out to the original author to clarify that stress is licensed under the GPLv2.
A commit references this bug: Author: skreuzer Date: Mon Apr 3 13:06:28 UTC 2017 New revision: 437657 URL: https://svnweb.freebsd.org/changeset/ports/437657 Log: Remove fossies.org from MASTER_SITES as the distfile they are distributing is fails to match the checksum in distinfo PR: 217890 Reported by: Kurt Jaeger <pi@FreeBSD.org> Changes: head/sysutils/stress/Makefile
I never heard back from the developer so I just dropped that site from MASTER_SITES. I also checked around and it seems like the tarball provided on various sites all seem to have the GPLv3 license.