MD5 comparison fails in package-get