e for the particular
distribution. It is important that you get these files from the ultimate
trusted source - the main ASF distribution site, rather than from a mirror.
Then verify the signatures using ...</p>


<pre>
% pgpk -a KEYS
% pgpv db-derby-X.Y.tar.gz.asc

<em>or</em>

% pgp -ka KEYS
% pgp db-derby-X.Y.tar.gz.asc

<em>or</em>

% gpg --import KEYS
% gpg --verify db-derby-X.Y.tar.gz.asc

</pre>


<p>To verify the MD5 signature on the files, you need to use a program
called <code>md5</code> or <code>m