Verify a download with shasum -a 256 <file> and compare the line below. The list comes from the release manifest.