My TPC knowledge is a bit dated, so take it with a grain of salt.

  First of all, make sure you are looking for the right benchmark for the
type of processing you are interested in.  For example, TPC-C is a benchmark
that is indicative primarily of rapid transaction processing.  There are
other benchmarks for workloads that are more DSS-intensive (TPC-H or TPC-D)
or web-intensive (TPC-W).

  Second, I don't know of any publicly available TPC-C kits.  It is my
understanding that the source code used for TPC-C benchmark applications are
closely-guarded secrets, since the application code itself might contain
code that accounts for significant performance improvements.

To validate what? why? for what purpose?

There is a huge difference between validation for security and
validation for transaction for a banking system.

You inquiry is roughly equivalent to "How an I test a vehicle with wheels?"

And my answer is roughly equivalent to "Is it a bicycle or a supersonic
jet?"

If you want to validate a database for use in your business environment, the
best thing to do is build a simple prototype of your business app and test
it on the databases you're considering.  Both DB2 and Oracle come in
"express" editions, and should be full-featured enough to put a prototype
through it's paces.  This way you can play with performance scaling, various
DDL options, backup/restore and other things that you're bound to do when in
production, and really get a feel for what works best in the intended
environment.

To echo someone else's comments -- using an off-the-shelf benchmark (such as
any of the TPC benchmarks) may not be anywhere near close to what your
business needs are, and thus you'd end up with something that isn't a good
fit.  It's much like deciding to buy a sports car because it was the fastest
and flashiest, and then finding out that your wife is pregnant with triplets
and you should have bought a mini-van :)

--
Matt Emmerton