There is a bug in the check_signatures script in the part where the variable $loc_signature is assigned. The output of md5sum is assigned to this variable and md5sum also outputs the source where the hash was computed instead of just the hash.

From MD5SUM(1): "The default mode is to print a line with checksum, a character indicating type (`*' for binary, ` ' for text), and name for each FILE."

In this case the input (or the FILE) is STDIN which is represented as a hyphen.

So the actual check in the Bash script looks like this:
+ '[' '<hash>  -' = <hash> ']'
And this produces sig004w false positives out of every file it
checks.

This can be easily fixed by using Awk. See the attached patch file.