I didn't notice till recently but the Apache policy [1] has been updated, and the use of SHA1 checksums over MD5 is now being encouraged.
Is this a massive change to our build script ? [1] http://www.apache.org/dev/release-distribution -- Tom Apache Flex