Like under an average Linux distribution - are there any checkings that the downloaded packages are really the packages that are on the mirror server?
Packages fetched by
pkg_add from the official mirror sites are signed and the
pkg_add utility will automatically check the signatures against the keys available on your system.
If a package is digitally signed: • pkg_add checks that its signature is valid and that the signature was emitted by a valid signing key, as stored in /etc/signify/*-pkg.pub, • pkg_add verifies that the compressed package data matches the signature, before it decompresses and unpacks files.
The signatures are not checked using GnuPG but with the native
Old (outdated) answer from 2011:
No, there are not. But see these threads from the openbsd-misc list:
Now you can perform some checks, when you update the system!
signify command mentioned here:
You can get the SHA256.sig file from the official mirror, under your version and architecture.
When you update, you need to check the new version's kernel signatures before booting it (and selecting
(U)pgrade). After that, the updater does signature checking automatically for the rest of the system it installs.