esr@thyrsus.com ("Eric S. Raymond") writes:
Something like how I started this Bugzilla report is one way packages are submitted. Only the URL to SRPM, URL to md5sums.asc, and a short description about what the package does.
...
(2) Don't RPMs have their own internal checksum?
Yes, they have but we request the md5sums because of security reasons: hostile packager could replace the package with a malicious version after a successful review.
The buildsystem verifies actual and expected MD5sum to prevent this kind of attack.
Enrico