@jobus
The checksums for the partition images are served by api.ubports.com. This sha256 hash is checked both in the manual install instructions and in the installer. You can find the json for your device here: https://api.ubports.com/v1/devices/vegetahd
I will add checksums for the executables and installation packages of the installer to the releases page, doing that automatically in ci has been on my list for a while. Wasn't my highest priority so far, because github defaults to https, so the only remaining attack vector i can see would be to switch the files hosted there, which is not very likely to happen unless we have a mole, the account of someone with access to the org gets pwned or someone hacks Microsoft. In all cases, there'd be more efficient ways to do much more severe damage, but since this has been requested some times now, who am i to stand in the way of progress.