Only validate the MD5 if we downloaded - trust the file system

lib/obs.py

@@ -168,13 +168,14 @@ class OBS:
         if not self.in_cache(name, cachedir, file_md5):
             with (dirpath / name).open("wb") as f:
                 f.write(self._download(project, package, name, revision).read())
+
             shutil.copy(dirpath / name, cached_file)
-        else:
-            shutil.copy(cached_file, dirpath / name)
 
             # Validate the MD5 of the downloaded file
-        if md5(dirpath / name) != file_md5:
+            if md5(cached_file) != file_md5:
                 raise Exception(f"Download error in {name}")
+        else:
+            shutil.copy(cached_file, dirpath / name)
 
     def list(self, project, package, srcmd5, linkrev):
         params = {"rev": srcmd5, "expand": "1"}