A new attempt to sum up the relationship between RA validation and native MAME validation after I spent time lately working with lots of MAME metadata for offline arcade playlist tools:
Three approaches to validating ROMs are coded directly into MAME, each with increasing precision. It seems like the RetroArch DB currently offers two different ‘engines’ (CRC and Serial), neither of which is anything like MAME’s approach.
MAME.exe Method 1: Always at execution, the MAME execututable/core ensures that the ZIP file has the exact filename of one of the titles it supports. Filename matching is therefore what most or all MAME frontends do to generate playlists or scrape metadata for ROMs. No real protection against mismatched MAME versions.
MAME.exe Methods 2 and 3: zip contents manifest and CRC dat
MAME can export what it knows about the correct ROMs a DAT file (functionally equivalent to the pregenerated DATs available at ProgettoSNAPs etc). This provides two other approaches which are used to validate ROMs by programs like clrmamepro. 2) The filename list/manifest for each file in a supported ROM zip can be used to match/validate ROMs 3) The CRC of each of the ROM files within the ZIP is used to to validate the ROM.
If ZIP files store a contents manifest with CRCs as part of their header as was mentioned earlier, it seems not impossible to have a third scanning method aligned with MAME’s own scheme for validation. That’s easy for me to say though, because “Method 1” has been working well for my purposes. I don’t know about the ZIP format.