When you fetch an archive from CTAN (the comprehensive TeX archive
network) all the sites consistently make the requested tar.gz file
on-the-fly from the actual directory. The checksum seems to come out
different every time, or at least different for every site.

My question: Is it OK, therefore, to set NO_CHECKSUM in the package
Makefile, or what?