Modern releases (20.04 and later) automatically scan. I for sure let that scan occur (on the first boot of the day; I tend to skip it if rebooted in the same box on the same day).
If you don't want to check beforehand, you can switch to a terminal (post-install) and always do a
dmesg |grep squashfs
and look for errors. A standard install should find only the copyright messages when
dmesg is scanned; if any other lines appear with squashfs I'd read them as the install is likely not trustworthy.
If using an older release (pre-20.04), I'll always also do a manual CD integrity check, primarily as the write to USB-media I've found the most troublesome (I have 10+ failures per year, even if that's a smallish percentage of writes; it's still significant).
Ubuntu 23.04 Desktop
The way you verify actually varies on release, with a Ubuntu 23.04 Desktop system I'll use the following
sudo journalctl |grep casper-md5check
And what I look for is
May 11 08:37:42 ubuntu casper-md5check: Checking ./casper/install-sources.yaml..../casper/install-sources.yaml: OK
May 11 08:37:42 ubuntu casper-md5check: Checking ./casper/vmlinuz..../casper/vmlinuz: OK
May 11 08:37:47 ubuntu casper-md5check: Checking ./casper/initrd......./casper/initrd: OK
May 11 08:37:47 ubuntu casper-md5check: Checking ./boot/memtest86+x64.bin..../boot/memtest86+x64.bin: OK
May 11 08:37:47 ubuntu casper-md5check: Checking ./boot/grub/grub.cfg..../boot/grub/grub.cfg: OK
May 11 08:37:47 ubuntu casper-md5check: Checking ./boot/grub/loopback.cfg...../boot/grub/loopback.cfg: OK
May 11 08:37:47 ubuntu casper-md5check: Check finished: no errors found.
May 11 08:37:47 ubuntu systemd: Finished casper-md5check.service - casper-md5check Verify Live ISO checksums.
Where the key message I look (& wait for; ie. I may need to run this command a few times as the process will continue to run as a background task) is
Check finished: no errors found.
ISO image Validation
As for ISO image validation pre-write, or How to verify your Ubuntu download, I download using
zsync and it checks the integrity of the ISO image at the conclusion of download; I tend to trust that, and just do the self-scan on boot.
If I download via a torrent, I tend to do a quick
sha256sum check against the checksum file I downloaded using
wget on a different device. I tend to perform this check on ISO image files downloaded previously anyway.
Why do it?
The checks take seconds to maybe a minute. If you have a single bit wrong, the debugging the installation or corrupted data could take hours if you're lucky, but more likely days-weeks-months.
There are generally at least one bug report filed per day (on launchpad; I monitor via #ubuntu-bugs-announce), reported by users who've been having problems with they consider a bug that would have been prevented by these checks. The bug reports are just marked INVALID and given a quick paste with a couple of lines from their
dmesg output). So I see on a very regular basis users wasting hours trying to repeat processes that will never work (often over days), because they skipped these checks and thus are starting with corrupted media where problems should be expected.
I see it as a very cheap insurance.