It is 'easy' to generate hash collisions for md5: http://www.win.tue.nl/hashclash/

I don't think this means one can create documents with a given md5 hash, but if you're concerned about people making software that impersonates your release, you definitely should start worrying about someone producing a compromised 'copy' of your software with the same md5 hash.