They provide gpg signed sha hashes, it&#x27;s apparently just not documented:<p><a href="https:&#x2F;&#x2F;micahflee.com&#x2F;2016&#x2F;02&#x2F;backdoored-linux-mint-and-the-perils-of-checksums&#x2F;" rel="nofollow">https:&#x2F;&#x2F;micahflee.com&#x2F;2016&#x2F;02&#x2F;backdoored-linux-mint-and-the-...</a>