PGP verification ensures that the file came from a certain person.
We recommend you verify your downloads with PGP.
First download the Apache MyFaces
KEYS
as well as the asc signature file
for the particular distribution. It is important that you get these files from the ultimate
trusted source - the main ASF distribution site, rather than from a mirror.
You need an installation of e. g. OpenPGP or GPG to check the files. More information you'll find on the
Apache verification
site.
Then verify the signatures for all downloaded files. With gpg for the dist.tar.gz it looks like
$ TOBAGO_VERSION=6.6.0
$ gpg --import KEYS
$ gpg --verify myfaces-tobago-$TOBAGO_VERSION-dist.tar.gz.asc myfaces-tobago-$TOBAGO_VERSION-dist.tar.gz