A possible step toward integrity measurement for Fedora

"Breaking the hash" is most often when an attacker can produce two inputs that collide, one that will be deemed acceptable by an authority and one which is malicious. In context, "producing a collision" would be coming up with an RPM with the same hash as an RPM the attacker didn't have any influence over, which is significantly harder, but is possible now for MD5 and will probably soon be possible for SHA1.