<h1 id="verify">Verify the integrity of the files<a class="headerlink" href="#verify" title="Permanent link">&para;</a></h1>
<p>It is essential that you verify the integrity of the downloaded file using
the PGP signature (<code>.asc</code> file) or a hash (<code>.md5</code> or <code>.sha*</code> file). Please read <a href="/info/verification.html">Verifying Apache Software
Foundation Releases</a> for more information on why
you should verify our releases.</p>
<p>The PGP signature can be verified using PGP or GPG. First download the
<code>KEYS</code> as well as the <code>asc</code> signature file for the relevant distribution.
Make sure you get these files from the main distribution site, rather than
from a mirror. Then verify the signatures using</p>
<div class="codehilite"><pre><span class="c">% gpg --import KEYS</span>
<span class="c">% gpg --verify downloaded_file.asc downloaded_file</span>
</pre></div>


<p><em>or</em></p>
<div class="codehilite"><pre><span class="c">% pgpk -a KEYS</span>
<span class="c">% pgpv downloaded_file.asc</span>
</pre></div>


<p><em>or</em></p>
<div class="codehilite"><pre><span class="c">% pgp -ka KEYS</span>
<span class="c">% pgp downloaded_file.asc</span>
</pre></div>


<p>Alternatively, you can verify the MD5 hash on the file. A unix
program called <code>md5</code> or <code>md5sum</code> is included in many unix distributions. It
is also available as part of
<a href="http://www.gnu.org/software/textutils/textutils.html">GNU Textutils</a>.
Windows users can get binary md5 programs from
<a href="http://www.fourmilab.ch/md5/">here</a>,
<a href="http://www.pc-tools.net/win32/freeware/console/">here</a> , or
<a href="http://www.slavasoft.com/fsum/">here</a>.</p>