Index: wp-admin/includes/file.php
===================================================================
--- wp-admin/includes/file.php	(revision 19953)
+++ wp-admin/includes/file.php	(working copy)
@@ -492,9 +492,12 @@
  *
  * @param string $url the URL of the file to download
  * @param int $timeout The timeout for the request to download the file default 300 seconds
- * @return mixed WP_Error on failure, string Filename on success.
+ * @param mixed $verify Whether to attempt download verification using the Content-MD5 header if it exists, bool to use Content-MD5 header, or string for a hex hash, or URL to MD5 file
+ * @param bool $force_verify Whether to force verification, despite the existence of the MD5
+ * @param bool $full_response Whether to return the full response instead of just the filename
+ * @return mixed WP_Error on failure, string Filename or HTTP API response array on success.
  */
-function download_url( $url, $timeout = 300 ) {
+function download_url( $url, $timeout = 300, $verify = true, $force_verify = false, $full_response = false ) {
 	//WARNING: The file is not automatically deleted, The script must unlink() the file.
 	if ( ! $url )
 		return new WP_Error('http_no_url', __('Invalid URL Provided.'));
@@ -515,7 +518,30 @@
 		return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) );
 	}
 
-	return $tmpfname;
+	if ( is_bool( $verify ) ) {
+		$content_md5 = wp_remote_retrieve_header( $response, 'content-md5' );
+		if ( ! $content_md5 && $force_verify )
+			return new WP_Error( 'download_verification_failed', __( 'A Content-MD5 header was not found.' ) );
+	} else if ( preg_match( '!^(http|https|ftp)://!i', $verify ) ) {
+		$md5response = wp_remote_get( $verify );
+		if ( ( is_wp_error ( $md5response ) || (int) wp_remote_retrieve_response_code ( $md5response ) !== 200 ) && $force_verify )
+			return new WP_Error( 'download_verification_failed', sprintf( __( 'Failed to retrieve the specified MD5 file from <span class="code">%s</span>.' ), $verify ) );
+		else
+			$content_md5 = current( explode( '  ' , wp_remote_retrieve_body( $md5response ) ) );
+	} else {
+		$content_md5 = $verify;
+	}
+
+	if ( ( ! empty( $content_md5 ) && $verify ) || $force_verify ) {
+		$md5_file = md5_file( $response['filename'] );
+		if ( $md5_file != $content_md5 )
+			return new WP_Error( 'download_verification_failed', sprintf( __( 'The checksum of the download (%1$s) does not match the provided checksum value (%2$s).' ), $md5_file, $content_md5 ) );
+	}
+
+	if ( $full_response )
+		return $response;
+	else
+		return $tmpfname;
 }
 
 /**
Index: wp-admin/includes/class-wp-upgrader.php
===================================================================
--- wp-admin/includes/class-wp-upgrader.php	(revision 19953)
+++ wp-admin/includes/class-wp-upgrader.php	(working copy)
@@ -115,7 +115,7 @@
 
 		$this->skin->feedback('downloading_package', $package);
 
-		$download_file = download_url($package);
+		$download_file = download_url($package, 300, true);
 
 		if ( is_wp_error($download_file) )
 			return new WP_Error('download_failed', $this->strings['download_failed'], $download_file->get_error_message());