The .md5 file contains a digital signature; you run the md5 utility on the .gz file-use --help to see options-and compare the hex id generated with what's in the .md5 file -they should be the same; if not, redownload.
Windows: Use WinZip (download eval free) and extract .iso file from the .gz file. Then use CD burning software to create a CD based on that file. There's a lot of CD ROM burning software out there; use a Search engine and pick out something reputable (I use Nero, which costs, but maybe others will suggest free stuff that's good).
Linux command line: use the gunzip command; then use cdrecord. Use the --help option to see what the arguments are...