It is essential that you verify the integrity of the downloaded files using the PGP signature or the SHA1 or MD5 checksums. The checksums are not as strong indicators as the PGP signature.
The PGP signatures can be verified using PGP or GPG. First
download the KEYS
as well as the
asc signature file for the particular
distribution. Verify the signatures using
% pgpk -a KEYS
% pgpv <FILE_NAME>.asc
% pgp -ka KEYS
% pgp <FILE_NAME>.asc
% gpg --import KEYS
% gpg --verify <FILE_NAME>.asc
Alternatively, you can verify the checksums using
Unix programs called
% md5sum -c <FILE_NAME>.md5
% sha1sum -c <FILE_NAME>.sha
sha1sumare included in many unix distributions.
*sumis also available as part of GNU Textutils. Windows users can get binary md5 programs from here or here. fsum and MD5Summersupport MD5 and SHA1.
I highly recommend to verify the PGP signature, though.