toad: > When is the MD5 field calculated (or checked) ? It's calculated by dpkg-scanpackages or apt-ftparchive at the master server archive, ftp-master.debian.org, and it's checked by dpkg and friends at install time. Don't know what freenet is, but I fail to see why would you need yet another hash.