Thanks for the information about this. I didn't know that md5 was quite that easy to fool. The hashes have been duly changed to using sha256sum. I'll file bug reports for any md5 hashes that I see in future.