A package declares the MD5 digests for the package file contents by including an md5sums file in its control archive (i.e. DEBIAN/md5sums during package creation). This file is used for integrity verification and deduplication purposes, and not for any kind of security purpose.
This file contains a list of MD5 digests (as 32 case-insensitive hexadecimal characters) followed by two spaces (U+0020 SPACE) and the absolute pathname of a plain file, one per line.
Trailing slashes (U+002F /) in the pathname will be trimmed. Neither trailing whitespace nor empty or whitespace-only lines are accepted.
If the control file does not exist in the binary package, dpkg(1) will generate the matching information at unpack time (since dpkg 1.16.3).
53c0d4afe4bc4eccb5cb234d2e06ef4d usr/bin/dpkg f8da2bc74cdcad8b81c48a4f0d7bb0a8 usr/bin/dpkg-deb 70b913132de56e95e75de504979309b4 usr/bin/dpkg-divert […]
md5sum(1), dpkg-deb(1), dpkg(1).