I was wondering why fedora has choosen yum over apt-get

[seth vidal]

> I think I don't understand you here -- how am I supposed to compute an
> MD5 sum lying on a webserver without downloading the file first?

go read the specification for the metadata.

the idea is this.
repomd.xml is a file that ONLY has:
the md5sums of the other metadata files.

it doesn't contain any information about the packages, it only contains
information about the metadata files.

so you download the repomd.xml file (which is tiny tiny <1K), you check
your md5sums versus the ones in the file, to determine what you might
need.

That also means you can gpg sign this repomd.xml file for security.

-sv