It is essential that you verify the integrity of the downloaded files using the PGP signature or the SHA1 or MD5 checksums. The checksums are not as strong indicators as the PGP signature.
The PGP signatures can be verified using PGP or GPG. First
download the KEYS
as well as the asc signature file for the particular
distribution. Verify the signatures using
% pgpk -a KEYS
or
% pgpv <FILE_NAME>.asc
% pgp -ka KEYS
or
% pgp <FILE_NAME>.asc
% gpg --import KEYS
% gpg --verify <FILE_NAME>.asc
Alternatively, you can verify the checksums using *sum tools:
% md5sum -c <FILE_NAME>.md5
% sha1sum -c <FILE_NAME>.sha
md5/sha1 or
md5sum/sha1sum are included in many unix distributions.
*sum is also available as part of GNU Textutils.
Windows users can get binary md5 programs from here or here. fsum and MD5Summersupport MD5 and SHA1.
I highly recommend to verify the PGP signature, though.
