MD5 is used as an authentication method. The RPM file is passed through a utility that calculates an MD5 digest (summary) which is a hash of the RPM. If you reapply MD5 to the downloaded RPM and the recalculated digest disagrees with the supplied MD5, it indicates that someone has tampered with the RPM (e.g. substituted a trojan copy).
The RPM utility has the ability to apply the MD5sum as part of the install/verify process, thus making it harder for "bad guys" to corrupt your system.
An especially useful feature is that the -V option of RPM can verify the current state of your system against the package's original MD5s in order to hilight files which have been altered (it also does a number of other tests to further determine if/how a change occurred).
You can do "rpm -Va" to check out EVERY package in the system (a == "all"). Be prepared to wait a while, and it's a good idea to log to disk, since a lot of /dev files will indicate changes just because of the way they get installed.
Tripwire is another product that uses MD5s to
test system integrity, except that here you can also monitor ongoing (post-install) changes to files and files that are not managed by RPM.
The secret of how to be miserable is to constantly expect things are going to happen the way that they are "supposed" to happen.
You can have faith, which carries the understanding that you may be disappointed. Then there's being a willfully-blind idiot, which virtually guarantees it.
