The download page currently links directly to the ASF main servers.
However downloads must use the mirror system; see:
Note the download page should also provide instructions for how to check hashes and signatures.
The links to the hashes, signatures and KEYS file must be to the ASF server and should use https.
However the links to the source and binary bundles must use the mirror system.