I used to flash freshly downloaded images and would verify their checksum against the published checksums.
What’s the best way to do this for an attended upgrade? For example for an upgrade from 25.12.2 to .3, would the checksum match the checksum of the generic sysupgrade image (from my understanding it wouldn’t as the images are tailored builds)?