In Debian and Ubuntu at least, all published files containing binary executable files (ISOs, .deb packages, etc.) are hashed and the hash signed by a well-known system pre-installed PGP key.

Given trust in the protection of the private key used to sign the hash list file the integrity of the executable content can be proved (assuming useful SHA1 collision creation is prohibitively expensive).

Coincidentally I was writing a Bash script this weekend to auto-install (Ubuntu) releases into LVM volumes and it includes the following code to verify the download:

  set -e
  # ...
  ISO="${NEW_DIST}-desktop-${ARCH}.iso"
  for F in SHA1SUMS SHA1SUMS.gpg ${ISO}; do
    if [ ! -r $F ]; then
      wget http://cdimage.ubuntu.com/${FLAVOUR}/daily-live/current/$F
    fi
  done

  if ! gpg --verify --keyring /etc/apt/trusted.gpg SHA1SUMS.gpg SHA1SUMS; then
    echo "Error: failed to verify the hash file list signature; files may have been tampered with"
    exit 2
  fi
  if ! grep ${ISO} SHA1SUMS | sha1sum -c; then
    echo "${ISO} is corrupted; please try again"
    exit 1
  fi