Note the download page should also provide instructions for how to check hashes and signatures.
The links to the hashes, signatures and KEYS file must be to the ASF server and should use https.
However the links to the source and binary bundles must use the mirror system.
BIGTOP-2891 only addressed mirror issue. Therefore this JIRA aims to add instructions.