Fortunately, this problem has been solved elsewhere in Debian before - here's a legal replacement: http://sources.debian.net/src/dpkg/1.17.6/lib/compat (They no longer use it as MD5 is now too easy to break, but it still works if you're only checking for accidental corruption.)