You can use SHA for this purpose if you retrieve the hashes from a trusted and secured source. Buildroot does that for 3rd party packages for instance. It down

You can use SHA for this purpose if you retrieve the hashes from a trusted and secured source. Buildroot does that for 3rd party packages for instance. It downloads the source from the original website (possibly completely non-secured) but then validates the checksum against a locally trusted hash list. Buildroot supports a variety of hash algorithms but many packages still use SHA-1.