Verify the Integrity of Downloads

You can verify the integrity of the downloaded files using their PGP (GPG) signatures or SHA256 checksums.

Verifying Hashes

To verify the downloads, first get the GPG signatures and SHA256 hashes using these links. Note that all links are for first-class Apache Software Foundation mirrors so there is already reduced opportunity for anyone maliciously tampering with these files.

You can verify the SHA256 hashes easily by placing the files in the same folder as the download artifact and then running shasum, which is included in most UNIX-like systems:

shasum -c apache-brooklyn-1.0.0.tar.gz.sha256

In order to validate the release signature, download both the release .asc file for the release, and the KEYS file which contains the public keys of key individuals in the Apache Brooklyn project.

Verify the signatures using one of the following commands:

pgpk -a KEYS
pgpv brooklyn-1.0.0-dist.tar.gz.asc

or

pgp -ka KEYS
pgp brooklyn-1.0.0-dist.zip.asc

or

gpg --import KEYS
gpg --verify brooklyn-1.0.0-dist.tar.gz.asc