The MD5 hashing algorithm is known to be vulnerable to collisions for a number of years now, see its Wikipedia entry. Still, I see that in many places throughout the web, MD5 is used to verify download integrity, e.g., the Ubuntu images. CMake's
ExternalData()C feature description even says:
Note that the hashes are used only for unique data identification and download verification. This is not security software.
It seems that an attacker could append malicious data to a download, and then append a little more to provoke a hash collision.
Why do security concerns about MD5 not impact its popularity as download verification? Why have SHA1 (or similarly safe algorithms) not become the standard?