Apple's Leopard's firewall changes hash values on disk.

Greetings,

Via code signing, Apple's new firewall changes the hash values of binaries that the user enables to pass traffic through the firewall

http//www.heise-security.co.uk/news/98492

The underlying feature, code signing, is documented here

http//developer.apple.com/releasenotes/Security/RN-CodeSigning/

-David