+ Note: When downloading from a mirror, please be sure to verify that checksums and signatures are correct. To do so, use the checksum and signature files from the main Apache site at + https://www.apache.org/dist/incubator/hawq/. Check here to get all the verification required files including OpenPGP keys that we used to sign releases: + KEYS +
++ The PGP signatures can be verified using PGP or GPG. First download the KEYS + as well as the asc signature file for the particular distribution. Then verify the signatures using: +
+
+ % pgpk -a KEYS
+
+ % pgpv ${filename}.tar.gz.asc
+
+ or
+
+ % pgp -ka KEYS
+
+ % pgp ${filename}.tar.gz.asc
+
+ or
+
+ % gpg --import KEYS
+
+ % gpg --verify ${filename}.tar.gz.asc
+
+
+ Alternatively, you can verify the SHA signature on the files.
+ For example, to check a SHA256 sum of a file:
+ On Linux:
+ % sha256sum filename.sha
+ On Mac:
+ % shasum -a 256 filename.sha
+