A checksum can be provided for the following reasons:
- to validate that the download is complete;
- to validate that you are looking at the correct download (later in time);
- to make sure that a third party download service (proxy, torrent etc) provides you with a valid download.
HTTPS helps you with two things: to make sure you connect to the right server in the first place and to provide transport security.
The checksum is not going to help you if an attacker impersonates a server, which is why HTTPS can provide additional security. Furthermore it protects you from an attacker changing the data in transit.
TCP already checksums. The chances that a packet is damaged during transport is negligible for stable connections. I would say that neither HTTPS or a secure hash is required to detect damanged packets.
With regards to 1: Usually a browser or HTTP client already uses a temporary file while it is downloading. If it just downloads directly or if the move to the real file name is stopped prematurely then a hash can show you that the data is not fully copied.
With regards to 2: Checksums were very useful for slow connections. Now for smaller programs I just download again sometimes. You should however recognize that downloads cost money for the one providing the service. If you can avoid a download by validating a checksum please do so.
It could also protect you against service providers that just offer
setup.exe as download although it is unlikely that organizations like that (hi Microsoft!) provide any kind of checksum.
With regards to 3: if the checksums are provided on the original site (they usually are) then you can use the checksums to check if the software you downloaded from a mirror site can be trusted. If the mirror is out of date, has made an error copying files or if it is hacked then the MD5 will tell you if the file you just downloaded is correct or not.
This even works if the hash is MD5 as attacks on MD5 require a precalculated hash.
This is probably why sites like GitHub don't provide checksums; if the download is not mirrored then there is less need to provide a checksum
- checking a hash may be too much work for consumers, hence the many installers that perform the download and checksumming themselves (probably using a mirror)
- a hash is not a signature: if the original site is hacked then you are out of luck