There is no way to verify authenticity of vagrant boxes hosted on Atlas
(hashicorps image hosting service). For example running this command
with a completely fabricated fingerprint installs a Debian box without
any error message or warning:

     vagrant box add \
     --checksum 1234567890123456789012345678901234567890123456789012345678901234 \
     --checksum-type sha256 debian/jessie64

While I understand that official vagrant docs state that this is
intended behavior[1]. (Probably because when a new box version becomes
available the checksum changes). This renders all atlas-hosted vagrant
boxes unverifiable. `vagrant box add` unpacks .box files so users don't
have a chance to verify the box file manually.

thanks and best regards,
Michael

[1] https://www.vagrantup.com/docs/cli/box.html#options-for-direct-box-files

Indeed checksum verifycation does not work when vagrant box add refers
to a cloud based box.

Looking at:

https://www.vagrantup.com/docs/cli/box.html#options-for-direct-box-files

it seems the checksum should be embedded in the box metadata.

We probably need to improve the build process here.

In the meantime, you can donwload the box the boxes via wget, and add
them locally as a workaround, ie:

$ wget
https://vagrantcloud.com/debian/boxes/stretch64/versions/9.2.0/providers/virtualbox.box

$ vagrant box add --name debian/stretch64  --provider virtualbox
--checksum 
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a1
--checksum-type sha256 virtualbox.box

==> box: Box file was not detected as metadata. Adding it directly...
==> box: Adding box 'debian/stretch64' (v0) for provider: virtualbox
     box: Unpacking necessary files from:
file:///home/manu/Projects/vagrenvs/stable/virtualbox.box
     box: Calculating and comparing box checksum...
The checksum of the downloaded box did not match the expected
value. Please verify that you have the proper URL setup and that
you're downloading the proper file.

Expected:
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a1
Received:
3625435cbc6ace0a033f64e9495de65286d92d6560dfefe9239a3f9ab02f98a0

here the box is compared against the expected checksum and fails in case
of mismatch.

I reported the issue upstream in the vagrant cloud google group
https://groups.google.com/forum/#!topic/vagrant-up/V0E4PAajM-g