most distributions provide signatures/checksums to verify the download eg. https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview