Have a look inside the
.asc file, you will see it starts with:
-----BEGIN PGP SIGNATURE-----
So this is a PGP Signature. It means it signs some content with some specific PGP key.
1) The content
Based on the name, the content is the file
.txt, it is the list of files corresponding to the software to download and each file has its corresponding hash.
2) The signature
If you launch
gpg on both files, here is the result:
$ gpg --verify cmake-3.11.0-rc3-SHA-256.txt.asc cmake-3.11.0-rc3-SHA-256.txt
gpg: Signature made Fri Mar 9 10:29:10 2018 EST
gpg: using RSA key 2D2CEF1034921684
gpg: Can't check signature: No public key
So how does it all work? You are supposed to have the key
2D2CEF1034921684 in your local keychain. How do you get it, and more important you do make sure you get the proper one? (the id by itself is not enough). This is where the web of trust model of OpenPGP takes place. It would be too long to detail here but in short, ideally, you get access to the keys out of band and you have means to authentify it... or to authentify some other key of someone you know that itself has authentified the other key. And/Or you find it online in one or multiple places, secured by HTTPS (with a certificate and CA you trust), and ideally with DNSSEC.
If you have the public key, and you trust it to be good and not forged (and that typically it corresponds to the software developers of the tool you are trying to download), the above command show you that the
.txt files has not been tampered with. And in turn this gives you the hash of all archives files, so you can download it and re-run the hash algorithm (SHA256 as written in the filename) and compare it with the value stored in file.
If someone had compromised the server and changed some archives it could, as you say yourself, as well change the
.txt file with the new hashes so you could believe files do match.
However this third party would not be able to generate the proper
.asc file with the PGP signature (upon
gpg --verify you would get an error about invalid signature), because to do so he would need to have access to the private key which is supposedly properly secured and not stored on the webserver anyway.
And if it does generate it with another key you will see it because you will not trust this unknown key.
But of course the whole model collapses if the key itself is compromised.