...
(The mirror sites may vary, start from http://tomcat.apache.org)
To checksum the downloaded file look for the 'MD5' link on the Tomcat page then run md5sum on the file you downloaded. The number generated from the md5sum command should match the checksum provided by Tomcat. For example:
tar.gz (pgp, md5, sha1) <-- click on 'md5' to get the key that should match when you execute md5sum <filename>.
Tomcat 9.0
- 14Jun2016 - apache-tomcat-9.0.0.M8.tar.gz from http://tomcat.apache.org/download-90.cgi#9.0.0.M8
- apache-tomcat-9.0.0.M8-deployer.tar.gz from http://tomcat.apache.org/download-90.cgi#9.0.0.M8
- Made softlink apache-tomcat-9.0 points to apache-tomcat-9.0.0.M8
...