Apache Tarball完整性检查

PGP Signatures

All of the release distribution packages have been digitally signed (using PGP or GPG) by the Apache Group members that constructed them. There will be an accompanying distribution.asc file in the same directory as the distribution. The PGP keys can be found at the MIT key repository and within this project's KEYS file.

Always use the signature files to verify the authenticity of the distribution, e.g.,

% pgpk -a KEYS
% pgpv httpd-2.0.55.tar.gz.asc
or,
% pgp -ka KEYS
% pgp httpd-2.0.55.tar.gz.asc
or,
% gpg --import KEYS
% gpg --verify httpd-2.0.55.tar.gz.asc

We offer MD5 hashes as an alternative to validate the integrity of the downloaded files. A unix program called md5 or md5sum is included in many unix distributions. It is also available as part of GNU Textutils. Windows users can get binary md5 programs from here, here, or here.

%md5sum httpd-2.0.55.tar.gz >> httpd-2.0.55.tar.gz.md5
%more httpd-2.0.55.tar.gz.md5