Golang's package manager has a rather elegant shared checksum database (a merkle tree), making it easy to trust mirrors:
miniblog.
Related Posts
What's your favourite file checksum when you don't need cryptographic strength?
md5sum is convenient (it's installed on most systems), but it was originally intended to be secure. I just want a fast content check.
(Or is sha256sum sufficiently optimised that it doesn't matter?)