&gt;  I assure you Yaourt doesn&#x27;t have an .asc signature either.<p>That&#x27;s yaourt&#x27;s problem, not makepkg&#x27;s or the AUR&#x27;s.<p>&gt; They should be using SHA-256, or Blake 2 if they think the extra seconds spent verifying matter, but insisting on using MD5 is pretty much going out of your way to increase your attack surface.<p>It doesn&#x27;t matter what algorithm you use, <i>file hashes are not a security feature.</i> Use GPG!