NIST publishes the National Software Reference Library (NSRL) each quarter with hash values of 'known' programs.
https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl
The NSRL is unsorted and The Sleuth Kit has a format that it uses to more quickly look hashes up.
This repository stores those indexes. They are not checked into the repository. But they are available as "Releases".
This data used to be stored at SourceForge.