Step 1: create SHA-256 hash value from the downloaded file:
General Guidance
shasum -a 256 /path/to/downloaded.pkg
Specific Guidance check Firefox Browser 102.1.0esr Example:
shasum -a 256 /Users/USERNAME_HERE/Downloads/Firefox\ 102.1.0esr.pkg
Link to 102.1.0esr records
https://ftp.mozilla.org/pub/firefox/releases/102.1.0esr/
Checking Firefox Browser SHA 256 SUMS 102.1.0esr Returns:
d0d6b0637a1533999cec9b7e6e0a5084d4e5c101e21f7ce526501ff509b766f9 /Users/USERNAME_HERE/Downloads/Firefox 102.1.0esr.pkg
Checking Firefox Browser SHA 512 SUMS 102.1.0esr Returns:
shasum -a 512 /Users/USERNAME_HERE/Downloads/Firefox\ 102.1.0esr.pkg
4344d30a8f1b864496a8c81468c2ca3a4c45be33facdfea3fad103a03d398d6aacbfa95d81a289614f271fd0faf5f6f925532c7293e666c72df8d7ab96213f44 /Users/USERNAME_HERE/Downloads/Firefox 102.1.0esr.pkg
Firefox version: about firefox screen – showing version Firefox Extended Support Release 102.1.0esr
Specific Firefox Browser 102.1.0esr Example: from this link
d0d6b0637a1533999cec9b7e6e0a5084d4e5c101e21f7ce526501ff509b766f9 mac/en-US/Firefox 102.1.0esr.pkg
Check the SHA sum(s) for this Apple macOS (Firefox) browser software
https://ftp.mozilla.org/pub/firefox/releases/102.1.0esr/SHA256SUMS
Simply put, the goal – security check – is to verify and compare the hash value derived from the download with what the vendor has published to verify the contents have not been tampered with or altered during the download process