I use the Tor Browser Bundle for software downloads because I can not use the internet for this without Tor. Windows and Linux software download sites often do not use HTTPS, so I run the risk of having my downloads modified by the exit node without my knowledge. What is the correct way to verify my downloads are safe?
Whilst not as certain as verifying downloads by MD5 hash/checksum, an alternative would be to download the same files multiple times using "New Identity" in Torbutton (or "Use New Identity" in Vidalia). The chances of randomly picking a bad exit that would tamper with your particular download and which hasn't been flagged yet is already fairly low. The chances of this happening multiple times with different exit nodes decreases exponentially.
Once you have a couple of copies of the same file you can compare your own checksums. If they match, then it's pretty likely that you're safe.
The site you download from probably lists MD5 sums for the files they offer. So you can use that to verify the integrity of your downloads. Of course the exit node could have tampered with that too, so to double check, you can google the MD5 sum and see if it comes up with the right file.
At this point you should also decide who you (dis)trust more: the exit node or the site you download from.