Software vendors publish MD5 hash values for software. We need hash value for Postgres 10 database software and will verify this value by command shared in below email PFB inline response
If you are talking about binaries, you'd have to check that which each individual binary provider. For example, the RPM and DEB binaries are all GPG signed, which is an even stronger signing.