Page History

...

Verify that the release bits were correctly generated. These steps don't check for release functionality.

1. Verify pgp signatures using the instructions at https://www.apache.org/info/verification.html#CheckingSignatures. You will need GPG installed. On MacOS machines, you can install GPG with HomeBrew using brew install gpg.
2. Verify checkums for the source and binary artifacts from the corresponding .mds files.
3. Verify that there are no MD5 signatures provided.
4. Verify that jars have been correctly staged to repository.apache.org.
   1. For 3.x releases and later, verify that the shaded fat jars look correct.
5. Sanity check the CHANGES.md and RELEASENOTES.md files.
6. Verify that source and binary tarballs include LICENSE.txt and NOTICE.txt files.

...