Is there a way to verify stock ROMs?

When we download a .FTF or ROM file as a stock ROM, is there a way to verify that it is really the stock ROM and is not modified by someone?

Answer

Yes, you can check the SHA1 or MD5 checksum.

You didn't specify which ROM you are downloading. Let's have a look at the Nexus stock ROMs:

https://developers.google.com/android/nexus/images#mantaray

There is a download link and a version number and checksums listed like that:

To verify a checksum you can do it via command line:

$ md5sum mantaray-jdq39-factory-d79f489e.tgz
b7a1162fb4e617143306ef6c4ca6c040

Or:

$ openssl sha1 mantaray-jdq39-factory-d79f489e.tgz 
SHA1(mantaray-jdq39-factory-d79f489e.tgz)= d79f489e1001d183b31d8a407b47cd5b8e9505cd

If it matches with the one stated at the google page, you can assume the file is not corrupted or modified.

Note: Linux, MacOS, Windows

The terminal commands only work out of the box in MacOS or Linux. To verify checksums in Windows there is a tool by Microsoft called Checksum Integrity Verifier.