diff --git a/CHANGELOG.md b/CHANGELOG.md
index 109e65c6..d01409a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Renamed `vieter repos` to `vieter targets`
 * Renamed `/api/v1/repos` namespace to `/api/v1/targets`
 
+### Removed
+
+* md5 hashes are no longer calculated for packages
+
 ## [0.3.0](https://git.rustybever.be/vieter/vieter/src/tag/0.3.0)
 
 Nothing besides bumping the versions.
diff --git a/src/package/package.v b/src/package/package.v
index 273322fa..86bf40ad 100644
--- a/src/package/package.v
+++ b/src/package/package.v
@@ -42,8 +42,8 @@ pub mut:
 	checkdepends []string
 }
 
-// checksum calculates the md5 & sha256 hash of the package
-pub fn (p &Pkg) checksum() ?(string, string) {
+// checksum calculates the sha256 hash of the package
+pub fn (p &Pkg) checksum() ?string {
 	return util.hash_file(p.path)
 }
 
@@ -201,8 +201,7 @@ pub fn (pkg &Pkg) filename() string {
 }
 
 // to_desc returns a desc file valid string representation
-// TODO calculate md5 & sha256 instead of believing the file
-pub fn (pkg &Pkg) to_desc() string {
+pub fn (pkg &Pkg) to_desc() ?string {
 	p := pkg.info
 
 	// filename
@@ -223,9 +222,8 @@ pub fn (pkg &Pkg) to_desc() string {
 	desc += format_entry('CSIZE', p.csize.str())
 	desc += format_entry('ISIZE', p.size.str())
 
-	md5sum, sha256sum := pkg.checksum() or { '', '' }
+	sha256sum := pkg.checksum()?
 
-	desc += format_entry('MD5SUM', md5sum)
 	desc += format_entry('SHA256SUM', sha256sum)
 
 	// TODO add pgpsig stuff
diff --git a/src/repo/repo.v b/src/repo/repo.v
index 817ec304..c4b85c0b 100644
--- a/src/repo/repo.v
+++ b/src/repo/repo.v
@@ -139,7 +139,7 @@ fn (r &RepoGroupManager) add_pkg_in_arch_repo(repo string, arch string, pkg &pac
 
 	os.mkdir_all(pkg_dir) or { return error('Failed to create package directory.') }
 
-	os.write_file(os.join_path_single(pkg_dir, 'desc'), pkg.to_desc()) or {
+	os.write_file(os.join_path_single(pkg_dir, 'desc'), pkg.to_desc()?) or {
 		os.rmdir_all(pkg_dir)?
 
 		return error('Failed to write desc file.')
diff --git a/src/util/util.v b/src/util/util.v
index 266bcb5b..4cd374e7 100644
--- a/src/util/util.v
+++ b/src/util/util.v
@@ -1,7 +1,6 @@
 module util
 
 import os
-import crypto.md5
 import crypto.sha256
 
 const (
@@ -23,12 +22,10 @@ pub fn exit_with_message(code int, msg string) {
 	exit(code)
 }
 
-// hash_file returns the md5 & sha256 hash of a given file
-// TODO actually implement sha256
-pub fn hash_file(path &string) ?(string, string) {
+// hash_file returns the sha256 hash of a given file
+pub fn hash_file(path &string) ?string {
 	file := os.open(path) or { return error('Failed to open file.') }
 
-	mut md5sum := md5.new()
 	mut sha256sum := sha256.new()
 
 	buf_size := int(1_000_000)
@@ -40,16 +37,12 @@ pub fn hash_file(path &string) ?(string, string) {
 		bytes_read := file.read(mut buf) or { return error('Failed to read from file.') }
 		bytes_left -= u64(bytes_read)
 
-		// For now we'll assume that this always works
-		md5sum.write(buf[..bytes_read]) or {
-			return error('Failed to update md5 checksum. This should never happen.')
-		}
-		sha256sum.write(buf[..bytes_read]) or {
-			return error('Failed to update sha256 checksum. This should never happen.')
-		}
+		// This function never actually fails, but returns an option to follow
+		// the Writer interface.
+		sha256sum.write(buf[..bytes_read])?
 	}
 
-	return md5sum.checksum().hex(), sha256sum.checksum().hex()
+	return sha256sum.checksum().hex()
 }
 
 // pretty_bytes converts a byte count to human-readable version