The log4j-1.2.16.jar that I downloaded from logging.apache.org has a SHA-1 hash of 0278c9d0ae02132ab6d00e709926c227022e85a4. I verified the .tar.gz that it came out of using gpg. The log4j-1.2.16.jar that I downloaded from search.maven.org has a SHA-1 hash of 7999a63bfccbc7c247a9aea10d83d4272bd492c6.