mirror, by checksum or by signature . all official releases of code distributed by the apache software foundation are signed by the release manager for the release. pgp signatures and sha/md5 checksums are available along with the distribution. you are encouraged to download the releases from our mirrors...