Do not download from www.apache.org please use a mirror site to help save apache.org bandwidth.
Download Apache Flex from the nearest mirror site.
All of the release distribution packages have been digitally signed (using PGP or GPG) by the release manager.
The PGP keys can be found here or at the MIT key repository.
Always use the signature files to verify the authenticity of the distribution.
MD5 hashes as an alternative to validate the integrity of the files.