I came across this site today.
https://github.com/GOG-Games-com/MD5-for-GOG.com

It claims to have the MD5 hashes but it is in sfv format which, as far as I know, is supposed to be for CRC32 hashes.

Well, decided to check it against one of my games. And I opened the sfv file in notepad and the hash did match for MD5 so tried it with multiple hashing programs and all of them either said the file didn't exist because it had added the numbers to the file name or one actually read the file name right but said the hash was wrong since it wasn't the CRC hash.

So, tried to rename the extension to .md5 to see if that was it. I thought the formats of the files were different but was worth a shot and again no luck.

So, my question, what is the point of these things? How do you use them properly? They are the MD5 hashes in the CRC32 file format and while the hashes appear correct in what I tried, short of manually reading them per file, how do you use them?

This all sounds really complicated. Is Windows really strapped for tools to verify checksums? Because I can do that in Dolphin File manager in the third property tab.

Now, true GOG doesn't provide actual checksums for the files without a little budging, but just use the -i or -v (whichever it was) command line switch and huzzah!

They are plain MD5 checksum values. I had confirmed this by locally running:
md5sum Fallout_Bible_gog.zip

This produced the expected matching output of (GOG forum software trims the two separating spaces down to one):
cbbf7fbb000f14bdcae70d59e69f2c52 Fallout_Bible_gog.zip

Oddly enough, some exe and bin file checksum values (namely, for Fallout 4) did not match those of my off-line installer files (downloaded directly from the GOG web site). Initially, I had assumed that this could be due to the files (listed within the SFV files) referring to the versions downloaded via the GOG Galaxy client (known to have differing checksum values), but, from what I had read, those usally have slightly-altered file names. rhash is a utility that can interpret this rather easy to parse (if completely unnecessary) format.

SFV only differs from the typical md5sum-readable format in that the file name (or, full path) and checksum value are separated by one (or, more) spaces, as opposed to the strict md5sum requirement of two, and the MD5 checksum value and file name/path have exchanged positions.

I had created a file named test.sfv with the following contents:
Fallout_Bible_gog.zip cbbf7fbb000f14bdcae70d59e69f2c52

Then, I had run:
rhash -c test.sfv

Output: I am uncertain as to why the author(s) of that Github repository did not simply use the md5sum format. One argument might be that it is easier to properly order the array of items (though, judging by their fallout_classic.sfv, that seems to be of little concern). If needed, the output of md5sum may be piped to 'sort' (in this instance, the lines are sorted according to the second space-delimited field/column):
md5sum * | sort -f -k 2 > example.md5

Thanks for the input.

When I look at it, it would be like if you saw some source code claiming it was written in COBOL only to see the files all had the .cpp extension. So you open it and the majority of meat is actually written in COBOL but part of the initialization and formatting were C++. It doesn't compile in any COBOL compiler due to the C++ stuff and doesn't compile in C++ because the bulk of it isn't that. So, you have this weird amalgam where all the information you need is there just in this unusable format which just leaves you wondering, "Why would they do that?"

Like with this stuff, I can see what he was trying to do and the information for the file names and MD5 hashes are there, just not in any format that you can actually use normally. So you are either stuck creating an extra process to convert them to a proper format or going by hand verifying stuff if you used it.

I don't even need these, just the shear confusion on why they did it that way just really bugs me for some reason.

Sometimes, GOG updated their offline installers but didn't change the filename and revision number.
Some games used to have 3 different sets of those installers, and their filenames were exactly the same.

In such cases, it is tempting to wonder about the motivations behind such unconventional solutions. Perhaps the original developer had special constraints or requirements that led him down such a confusing path. Or maybe he clicked on this link and ended up on a pleasure site and now he can't get out of it) Or maybe it was just a random mix-up! Either way, it's a reminder that software development can sometimes be a bizarre and unpredictable journey.

In Windows, you can likely right-click on a file, and then select the Checksum tab in the Properties window that pops up.

I don't know if latest Windows provides this ability by default, and I may have installed a plugin for earlier versions of Windows myself ... I seem to recall I did that back in the day for Win XP and maybe Win 7.

If you don't have it by default, then finding and installing the plugin is likely your simplest solution, unless you are comfortable with using freely available md5sum and the command-line ... perhaps via a batch file so you can use drag & drop.

When you renamed it to .md5, you were on the right track since MD5 tools expect .md5 extensions. But yeah, the formats can still mess things up because the tools might be looking for a specific structure in the file. To make it work, you might need a custom script or tool that can parse the SFV file and verify the MD5 hashes.