Please make sure to download VCL from an mirror server. The following link will automatically select one for you that should be close to you. After downloading it make sure you verify it with MD5 or SHA1 sums AND the GPG signature (sums and signature files should be downloaded directly from Apache, not from mirrors).
Download ASF VCL 2.1 (not available yet)
GPG Signature (not available yet)
MD5 Sum (not available yet)
SHA1 Sum (not available yet)
VCL KEYS file
Run the following command to verify the MD5 sum. You should get the same number that is in apache-VCL-2.1-incubating.tar.bz2.md5:
md5sum apache-VCL-2.1-incubating.tar.bz2
Similarly, Run the following command to verify the SHA1 sum. You should get the same number that is in apache-VCL-2.1-incubating.tar.bz2.sha1:
sha1sum apache-VCL-2.1-incubating.tar.bz2
To verify the GPG signature (you'll need to have GnuPG installed):