The source download page: https://trac.osgeo.org/gdal/wiki/DownloadSource .. gives MD5 checksums for the source releases. Starting with 2.3.1, can I suggest we start using SHA256 instead of the long-broken MD5? Ben