Isn't there a checksum?
Yes, there is a link on the download page "Verify release signatures".
Verifying the checksum of Bitcoin software is important.
If someone were able to change the software on the site, don't you think they'd be able to adjust the checksum mentioned there as well?
That's why developers should always sign the checksums with their keys. However, the client_downloads to checksum_downloads ratio
is daunting.
Checksum is for validating bit errors likely to occur in a bit stream i.e. communication channel. It is NOT EVER EVER meant to be used cryptographically!! It is very feasible to modify the file and keep a valid checksum. In fact, CRC was used in the old 802.11/WEP standard as a message authentication code, and we know how well that worked out.
The entire file needs to be signed, or a secure hash (SHA256 hash in this case) that is signed. Signed by whom and validated by whom in which chain of trust is another can of worms best left unopened.
I know that what is actually provided is a SHA256 hash and not a checksum so I'm just being mean :-(
Edit: Technically it should be a MAC like HMAC_SHA256 as a pure SHA256 is vulnerable to a padding based attack, while SHA-3/Keccak in general is not.
I think you are right. I got caught up in lingo, as they name the file SHA256SUMS.asc on their site.