The widespread use of MD5 in AUR is because that is the default in makepkg, making it both AUR&#x27;s and makepkg&#x27;s &quot;problem&quot;.<p>&gt; It doesn&#x27;t matter what algorithm you use<p>Of course it matters, they have different guarantees. A secure hash would at least guarantee that the file you get is the same one the packager got, MD5 doesn&#x27;t. They are refusing to use strictly better alternatives out of pure stubbornness.