{% include JB/setup %}
{{ site.data.project.name }} is released as a source artifact, and also through Maven.
Choose a source distribution in either tar or zip format, and verify using the corresponding pgp signature (using the committer file in [KEYS](http://www.apache.org/dist/{{ site.data.project.incubator_slash_name }}/KEYS)). If you cannot do that, the md5 hash file may be used to check that the download has completed OK.
For fast downloads, current source distributions are hosted on mirror servers; older source distributions are in the [archive](http://archive.apache.org/dist/{{ site.data.project.incubator_slash_name }}/). If a download from a mirror fails, retry, and the second download will likely succeed.
For security, hash and signature files are always hosted at Apache.