diff --git a/src/lib/externaldata.py b/src/lib/externaldata.py
index b3891650..24a6a496 100644
--- a/src/lib/externaldata.py
+++ b/src/lib/externaldata.py
@@ -248,6 +248,19 @@ def from_source(
         if not source.get("url"):
             raise SourceUnsupported('Data is not external: no "url" property')
 
+        if (
+            source.get("type") == ExternalBase.Type.EXTRA_DATA
+            and "sha256" not in source.keys()
+        ):
+            raise SourceLoadError("Extra data is missing SHA256 checksum")
+
+        if source.get("type") in (
+            ExternalBase.Type.FILE,
+            ExternalBase.Type.ARCHIVE,
+        ):
+            if not any(k in source.keys() for k in ("md5", "sha1", "sha256", "sha512")):
+                raise SourceLoadError("Data is missing checksum")
+
         # FIXME: https://github.com/python/mypy/issues/9282
         return super().from_source(source_path, source, module)  # type: ignore