The links to the KEYS, sigs and hashes must uses https, not http
Also there should be instructions on the need to verify downloads and how to do so.
https links fixed in [98a240]
The download page http://www.apache.org/dyn/closer.cgi/allura/ has instructions about verifying those downloads.
Log in to post a comment.