|
|
- <h1 id="verify">Verify the integrity of the files<a class="headerlink" href="#verify" title="Permanent link">¶</a></h1>
- <p>It is essential that you verify the integrity of the downloaded file using
- the PGP signature (<code>.asc</code> file) or a hash (<code>.md5</code> or <code>.sha*</code> file). Please read <a href="/info/verification.html">Verifying Apache Software
- Foundation Releases</a> for more information on why
- you should verify our releases.</p>
- <p>The PGP signature can be verified using PGP or GPG. First download the
- <code>KEYS</code> as well as the <code>asc</code> signature file for the relevant distribution.
- Make sure you get these files from the main distribution site, rather than
- from a mirror. Then verify the signatures using</p>
- <div class="codehilite"><pre><span class="c">% gpg --import KEYS</span>
- <span class="c">% gpg --verify downloaded_file.asc downloaded_file</span>
- </pre></div>
-
-
- <p><em>or</em></p>
- <div class="codehilite"><pre><span class="c">% pgpk -a KEYS</span>
- <span class="c">% pgpv downloaded_file.asc</span>
- </pre></div>
-
-
- <p><em>or</em></p>
- <div class="codehilite"><pre><span class="c">% pgp -ka KEYS</span>
- <span class="c">% pgp downloaded_file.asc</span>
- </pre></div>
-
-
- <p>Alternatively, you can verify the MD5 hash on the file. A unix
- program called <code>md5</code> or <code>md5sum</code> is included in many unix distributions. It
- is also available as part of
- <a href="http://www.gnu.org/software/textutils/textutils.html">GNU Textutils</a>.
- Windows users can get binary md5 programs from
- <a href="http://www.fourmilab.ch/md5/">here</a>,
- <a href="http://www.pc-tools.net/win32/freeware/console/">here</a> , or
- <a href="http://www.slavasoft.com/fsum/">here</a>.</p>
|
