Use the links below to download a distribution of Apache Santuario from one of our mirrors. It is good practice to verify the integrity of the distribution files. Apache Santuario releases are available under the Apache License, Version 2.0 - see the README.txt and LICENSE.txt and NOTICE.txt files contained in each release artifact.
You are currently using [preferred] . If you encounter a problem with this mirror, then please select another. If all mirrors are failing, there are backup mirrors at the end of the list. See status of mirrors.
The current Java release is XML Security 1.4.4: xml-security-bin-1_4_4.zip [PGP] [MD5]
The current C++ release is XML Security 1.6.0: xml-security-c-1.6.0.tar.gz [PGP] [MD5]
Older releases are available in the archive.
It is essential that you verify the integrity of the downloaded files using the MD5 and PGP signatures. MD5 verification ensures the file was not corrupted or tampered with. PGP verification ensures that the file came from a certain person.
The PGP signatures can be verified using
PGP or
GPG. First download the Apache Santuario
KEYS as well as the
*.asc
signature file for the particular distribution. It is
important that you get these files from the ultimate trusted source - the
main ASF distribution site, rather than from a mirror. Then verify the
signatures using ...
% pgpk -a KEYS % pgpv xml-security-bin-1_4_4.zip.asc or % pgp -ka KEYS % pgp xml-security-bin-1_4_4.zip.asc or % gpg --import KEYS % gpg --verify xml-security-bin-1_4_4.zip.asc
To verify the MD5 checksum on the files, you need to use a program called
md5
or md5sum
, which is included in many unix
distributions. It is also available as part of
GNU
Textutils. Windows users can get binary md5 programs from
here,
here, or
here or an openssl client
from
here.
% md5sum xml-security-X.Y.tar.gz ... output should match the string in xml-security-X.Y.tar.gz.md5
We strongly recommend you verify your downloads with both PGP and MD5.