Many of the distribution kits have been digitally signed (using PGP). If so, there will be an accompanying distribution.asc file in the same directory as the distribution. The PGP keys can be found in the distribution directory at <http://www.apache.org/dist/avalon/release/KEYS>.
Always test available signatures, e.g.,
> pgpk -a KEYS
> pgpv Avalon-4.1.4-bin.tar.gz.asc
or,
> pgp -ka KEYS
> pgp Avalon-4.1.4-bin.tar.gz.asc
or,
> gpg --import KEYS
> gpg --verify Avalon-4.1.4-bin.tar.gz.asc
For more information about Avalon Excalibur, please go to http://avalon.apache.org/excalibur.