@xerz @star to be fair, a lot of the cases where a file hash is provided (foo.net listing the hash of a file you download... from foo.net) is simply not security relevant.

unless the file is actually being hosted on a mirror and the file hash isn't.

in that case, yeah, it makes sense (but also you still kinda need to trust the mirror because in 99% of cases people won't check the hash unless you do it automatically)