Fix Download page

Author: ppkarwasz

src/site/antora/modules/ROOT/pages/download.adoc

@@ -16,19 +16,97 @@
 ////
 
 = Download
+:dist-url: https://downloads.apache.org/logging/log4j/{log4j-core-version}
 
 You can manually download all published Log4j distributions, verify them, and see their licensing information by following the instructions in {logging-services-url}/download.html[the Download page] of {logging-services-url}[Logging Services].
 
-* Are you looking for **the Log4j installation instructions**? Proceed to xref:manual/installation.adoc[].
-* Are you looking for the list of changes associated with a particular release? Proceed to xref:release-notes.adoc[].
+[TIP]
+====
+* Are you looking for **the Log4j installation instructions**?
+Proceed to xref:manual/installation.adoc[].
+* Are you looking for the list of changes associated with a particular release?
+Proceed to xref:release-notes.adoc[].
+====
+
+[#source-distribution]
+== Source distribution
+
+You can download the source code of the latest Log4j release using the links below:
+
+.Source distribution files
+[cols="2h,5"]
+|===
+
+| Sources
+| {dist-url}/apache-log4j-{log4j-core-version}-src.zip[apache-log4j-{log4j-core-version}-src.zip]
+
+| Checksum
+| {dist-url}/apache-log4j-{log4j-core-version}-src.zip.sha512[apache-log4j-{log4j-core-version}-src.zip.sha512]
+
+| Signature
+| {dist-url}/apache-log4j-{log4j-core-version}-src.zip.asc[apache-log4j-{log4j-core-version}-src.zip.asc]
+
+| Signing keys
+| https://downloads.apache.org/logging/KEYS[KEYS]
+|===
+
+[#binary-distribution]
+== Binary distribution
+
+A set of binaries of Log4j is available through two main distribution channels:
+
+ASF Nexus Repository::
++
+All the binary artifacts are available on the Apache Software Foundation
+https://repository.apache.org/content/repositories/releases/[`repository.apache.org` Nexus repository].
+Its content is mirrored to the
+https://repo.maven.apache.org/maven2/[Maven Central repository].
++
+See xref:components.adoc[] for more information on the GAV coordinates of the artifacts.
+
+Binary distribution archive::
++
+All the artifacts in the ASF Nexus repository are also available in a single ZIP archive:
++
+.Binary distribution files
+[cols="2h,5"]
+|===
+
+| Binaries
+| {dist-url}/apache-log4j-{log4j-core-version}-bin.zip[apache-log4j-{log4j-core-version}-bin.zip]
+
+| Checksum
+| {dist-url}/apache-log4j-{log4j-core-version}-bin.zip.sha512[apache-log4j-{log4j-core-version}-bin.zip.sha512]
+
+| Signature
+| {dist-url}/apache-log4j-{log4j-core-version}-bin.zip.asc[apache-log4j-{log4j-core-version}-bin.zip.asc]
+
+| Signing keys
+| https://downloads.apache.org/logging/KEYS[KEYS]
+|===
+
+[NOTE]
+====
+The authenticity of the Log4j binary release is independently verified by the
+https://github.com/jvm-repo-rebuild/reproducible-central[Reproducible Builds for Maven Central Repository]
+project.
+You can check the reproducibility status of the artifacts on their
+https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/logging/log4j/log4j/README.md[`org.apache.logging.log4j:log4j` RB check] page.
+====
+
+[#sbom]
+== Software Bill of Materials (SBOM)
+
+Each Log4j artifact is accompanied by a Software Bill of Materials (SBOM).
+See {logging-services-url}/download.html#sbom[the Download page of Logging Services page] for details.
 
 [#older]
 == Older releases
 
 Are you looking for old versions of Log4j?
-While we recommend to always use the latest version, you can find the older versions here:
+While we recommend always using the latest version, you can find the older versions here:
 
-* {logging-services-url}/1.x/[Log4j 1.x (End of Life, Java 1.4)]
-* {logging-services-url}/2.3.x/[Log4j 2.3.x (Java 6)]
-* {logging-services-url}/2.12.x/[Log4j 2.12.x (Java 7)]
-* {logging-services-url}/2.x/[Log4j 2.x (Java 8)]
+* {logging-services-url}/1.x/index.html[Log4j 1.x (End of Life, Java 1.4)]
+* {logging-services-url}/2.3.x/index.html[Log4j 2.3.x (End of Life, Java 6)]
+* {logging-services-url}/2.12.x/index.html[Log4j 2.12.x (End of Life, Java 7)]
+* {logging-services-url}/2.x/index.html[Log4j 2.x (Java 8)]