You should verify the MD5 checksums of your downloaded archives. All Apache Clerezza releases are signed. To verify the signature of a release, you have to download the project's GPG keys.
