It is essential that you verify the integrity of the downloaded files using the PGP signature or the SHA1 or MD5 checksums. The checksums are not as strong indicators as the PGP signature.
The PGP signatures can be verified using PGP or GPG. First
download the KEYS
as well as the asc
signature file for the particular
distribution. Verify the signatures using
% pgpk -a KEYS
or
% pgpv <FILE_NAME>.asc
% pgp -ka KEYS
or
% pgp <FILE_NAME>.asc
% gpg --import KEYS
% gpg --verify <FILE_NAME>.asc
Alternatively, you can verify the checksums using *sum
tools:
% md5sum -c <FILE_NAME>.md5
% sha1sum -c <FILE_NAME>.sha
md5
/sha1
or
md5sum
/sha1sum
are included in many unix distributions.
*sum
is also available as part of GNU Textutils.
Windows users can get binary md5 programs from here or here. fsum and MD5Summersupport MD5 and SHA1.
I highly recommend to verify the PGP signature, though.