SHA256 hash:
2c7f4f0d370801b2849c48c9ef3f59553b5f1d3791d070cffb04599f9fc67b41 gmp-6.2.1.tar.lz
To try to verify that the file you have downloaded has not been tampered with, you can check that the GnuPG signature matches the contents of the file. Use your GnuPG software or a key server directly to get the key that was used for creating the signature. Starting from the repackaging of gmp-5.1.0 as gmp-5.1.0a.tar.* the following key is used to sign GMP releases:
Key ID: 0x28C67298
Key type: 2560 bit RSA
Fingerprint: 343C 2FF0 FBEE 5EC2 EDBE F399 F359 9FF8 28C6 7298
The development of GMP happens on mercurial, to learn more go here: https://gmplib.org/devel/repo-usage