Hi Richard,
 
This was detected internally when users modify source files and update
the hashes inside the recipes to match. Bitbake is allowing this operations
because it identifies a mismatch and renames it to procede with the download.
 
I tested this locally with:
 
 - Create a source file, for example, test_download.tar.gz
 - Create a simple http server (python3 -m http.server 1212 )
 - Create a small recipe, local_test.bb
------------------------------------------------------------------------
SUMMARY = "local test recipe"
DESCRIPTION = "Downloads and installs test files"
LICENSE = "CLOSED"
 
SRC_URI = "http://0.0.0.0:1212/test_download.tar.gz"

S = "${WORKDIR}"
 
SRC_URI[md5sum] = "12e597833772126eade44740570aab3c"
SRC_URI[sha256sum] = "f03e325aa451beda1b340a7ce0fcfd620b74c86e12b8156a3d4949f7de67fc87"
 
do_install() {
    install -d ${D}/etc/test
    install  ${S}/README.md -C ${D}/etc/test
}
 
FILES:${PN} = "/etc/test/README.md"
 
------------------------------------------------------------------------
 - Run it: bitbake -C fetch local-test
 - Modify source file
 - Update the hash
 - Run it: bitbake -C fetch local-test
   - A warning is raised: WARNING: local-test-1.0-r0 do_fetch: Renaming /home/test/yocto-downloads/test_download.tar.gz to /home/test/yocto-downloads/test_download.tar.gz_bad-checksum_f03e325aa451beda1b340a7ce0fcfd620b74c86e12b8156a3d4949f7de67fc87
  - Bitbake continues the next steps with this new tarball.
 
 
Cheers.