What is the md5/sha1 checksum for Xcode 3.2.6 and iOS 4.3 SDK final?
I believe that opening a .DMG file automatically verifies it. 

Basically, it contains a checksum in the file (or are you worried about malicious packages, rather then just corruption?). 

Anyways, when I open a .dmg file, I see the message box with a progress bar say "Verifying" for a while, before it actually mounts.



Asmus added in a comment above:
"you can use hdiutil verify /path/to/image.dmg on the command line to compare an image against its internal checksum."