All ASF project must use the ASF infrastructure to distribute source, binary and documentation builds so that their releases appear in
dist.apache.org. This is how ASF keeps track of what releases it has made. Projects may distribute their code through other channels in addition to the ASF infrastructure.
As of March, 2020, all mirror sites are required to use the secure "https" protocol instead of "http". Sites using "https" encrypt data and move it through a secure socket layer (SSL) protocol between the website's server and the vistor's browser.
Projects must adhere to the following guidelines to ensure a consistent way to mirror our distributions, therefore lowering the impact of the enormous amount of bandwidth downloads consume.
downloads.apache.orgas fallback/backup mirror.
archive.apache.org/dist/and can be deleted from the main distribution directory.
Do not keep software distributions on the project's website. Move them to one of the two software distribution sites:
Current public releases appear on
downloads.apache.org/. Place current, official releases that the PMC has approved for end-users here, on the main public release site that is mirrored world-wide. Make all changes at
Older releases that you no longer recommend to the general public should appear on
archive.apache.org/dist/. This site automatically contains all the content of
downloads.apache.org/, but nothing is ever deleted. Therefore it should rarely be necessary to touch this site, except during a reorganization. Once your project no longer recommends public use of a particualr release, simply delete it from
downloads.apache.org/dist/ by removing it from
https://dist.apache.org/repos/dist/release/. It will remain on the archive site.
Complete instructions are on How to be an Apache Software Foundation download mirror.