#19494 (Invalid SHA256 on version 6.0.1 et 6.0.2)
The sha256sums-unsigned-build.txt file contains the hashes of the bundles before they are signed.
For the Windows bundles, you can use
osslsigncode to remove the signature. It is available in this git repository: http://git.code.sf.net/p/osslsigncode/osslsigncode/
Then you can do:
$ sha256sum torbrowser-install-6.0.2_en-US.exe
$ ./osslsigncode remove-signature torbrowser-install-6.0.2_en-US.exe torbrowser-install-6.0.2_en-US.exe-unsigned
$ sha256sum torbrowser-install-6.0.2_en-US.exe-unsigned
We are still working on the instructions to remove the code signing on the .dmg files. This is ticket #18925.
If you want to verify the download, use the corresponding
.asc file. It both validates the cryptographic hash of the file and allows you to ensure that the hash is provided by the the correct key (I.E. the providence of the claimed cryptographic hash of the file).
You do want to ensure that the cryptographic hash is actually provided to you by the correct party and not just rely on a checksum published on a website, for an example as to why this is important see what happened to Linux Mint recently (hackers replaced their download links and the checksums for the isos listed on the website, signature verification would have prevented this.).