It's not the nineties anymore, MD5 doesn't protect you from much, and especially not from the author of the original package creating an alternate version. Via

It's not the nineties anymore, MD5 doesn't protect you from much, and especially not from the author of the original package creating an alternate version. Viable verification is based on an unbroken hash (preferably SHA-(256|384|512), but SHA1 still not broken even it it's definitely too short nowadays. And the hashes need to be distributed properly, either PGP signed or hosted on a trusted TLS protected site... Yet many projects still distribute MD5 hashes, thinking it got any value.