sum
Checksums of files and text, compared with the ones you were given, and a check of this site against its own manifest.
One digest, or a whole checksum file such as SHA256SUMS.
text
SHA-256 of 0 bytes
this site
manifest.txt lists the SHA-256 of every file on this site apart from the colophon and itself. The check fetches it and every file it names and hashes them here, which is what shasum -c does with a copy on disk. Then it looks for the manifest's own digest on the colophon.
The colophon comes from the same server as everything it vouches for, so a match shows only that the site agrees with itself. To know this is what was released, compare the manifest's digest with a copy kept somewhere this server doesn't control.