Just a quick note for anyone rolling their own versions.xml, at the moment it appears as if you must use sha1 hashs for AppUpdater to identify if the file/app is installed. If you need a windows hash'er, I use sha1sum.
Update on this, I just checked in a fix so that you can use pure MD5 based repositories. This will be included in the upcoming 1.0 release. A hash tool will also be included!