The submitter replied via private email. It appears that he somehow got a Packages file without any cryptographic checksums (not sure how); I get the same behavior if I remove the cryptographic checksums from my Packages file. If this is intended behavior (and it makes sense to me), apt should probably detect the missing sums and generate a different error from the error it generates for a sum mismatch. Daniel