how to search [close]

sum

Paste a checksum in the sum box ; then click button search.
You can search for :

• the SHA-1 of every file in /dist/
• the SHA-256 of every file that has a .sha256
• the SHA-512 of every file that has a .sha512
• the SHA-??? of every file that has a .sha
• the MD5 of every file that has a .md5

A checksum may only contain (upper- or lowercase) hex-characters [a-fA-F0-9] or white-space.

path dist/

Paste the path of an existing file or directory into the path box ; then click button search.

key-id, user

Paste a pgp key-id (in upper- or lowercase) in the key-id box ; then click button search.
You can search for all key-id's of the signing keys in /dist/.

If the key-id is short (lenght 8), it is converted to a long key-id (length 16).
Short key-id's should not be used anymore.

Any string that doesn't look like a key-id, is searched for in the uid's of the signing keys.

how to verify a package [close]

To verify a package :

• compute the SHA-1 checksum of the package - show me how

  How to compute the SHA1 checksum of myfile [hide]

  • on windows : certutil -hashfile myfile SHA1
  • on linux : sha1sum myfile
  • on mac : shasum -a 1 myfile

• paste that checksum into the sum box
• click the search button in the sum row

The result page shows all files with the SHA-1 you just computed.

• If the list is empty, your package is currently not in www.apache.org/dist/.
• If the list is not empty, your package should be in the list.
• Click on your package to get more info :
  • Under family you should see various checksum and signature files.
  • Icon flags verified checksum and signature files.
  • Icon flags bad checksum and signature files.
  • Icon is a link to the checksum or signature file.
  • The file should have at least one signatures-line.
  • click on the (.asc) signature-file
    Under signatures you should see :
    • signature : the signature should be a GOODSIG
    • ↪ key-id : the signing key, key references
    • ↪ signer : the primary uid of the signing key

Try for example :

(508) 637-8697

Or some bad package :

85f6962858d1f143c7cd97e37de06226587a6c7d