Apache Trusted Releases
releases.apache.org
- Free plan
- Web
- API
- Self-hosted
What Apache Trusted Releases is
Apache Trusted Releases is a free, open-source platform for verifying and distributing Apache software releases. It supports a release workflow in which a project prepares a candidate, holds a Project Management Committee vote, then publishes and announces the release when approved. Before voting, automated checks examine signatures, hashes, archive layout, licensing, and software bill of materials content. Signatures are checked against committee public keys, while DSA signatures and RSA keys shorter than 2048 bits are blocked. ATR keeps a catalog of current and archived artifacts for people obtaining releases. Users can work through a web interface, JSON API, command-line interface, GitHub Actions, or Maven plugin. CycloneDX SBOM tools assess conformance, validation, license signals, and vulnerability data, and can generate, score, or augment SBOMs or run an OSV scan. The live service requires an ASF account. The project is in beta and provides no guarantees for stability, security, or backward compatibility.
Who it suits
It suits Apache project participants who publish software and end users who obtain Apache releases. Teams needing committee approval gates and release artifact checks can use its documented workflow.
Good to know, and what to watch
- Automated checks cover signatures, hashes, licensing, and SBOM content
- Web, API, CLI, GitHub Actions, and Maven interfaces
- Catalog includes current and archived release artifacts
- CycloneDX scoring and OSV vulnerability scanning
- Free and open source under Apache License 2.0
- Project is in beta development
- No guarantees for stability, security, or backward compatibility
- Live platform requires an ASF account
- ASF provides no formal or commercial support
The verdict
Apache Trusted Releases combines approval gates, artifact validation, and release cataloging for Apache projects. Its beta status and lack of formal support matter when planning production use.
What the maker publishes
- Access
- The live platform asks users to log in with an ASF account, and the Tooling site says users get access to their PMC's projects. source
- Access
- The live platform asks users to log in with an ASF account. source
- Additional SBOM tools
- ATR can generate a CycloneDX SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan. source
- Artifact checks
- Automated checks cover signatures, hashes, archive layout, licensing, and SBOM content before a vote. source
- Artifact checks
- ATR runs automated checks for signatures, hashes, archive layout, licensing, and SBOM content before a release vote. source
- Beta availability
- The ASF Tooling site says ASF PMCs and incubating podlings may participate in beta testing. source
- Deployment
- The repository recommends running ATR with Docker Compose and documents visiting a local HTTPS address using a self-signed certificate. source
- Development status
- The source repository describes the project as in beta development and says the code is provided without guarantees regarding stability, security, or backward compatibility. source
- Integrations
- Projects can use GitHub Actions for Trusted Publishing when they can demonstrate reproducible builds. source
- Intended users
- Its users include Apache project participants who publish software and end users who obtain it. source
- Intended users
- ATR serves Apache project committee participants who publish software and end users who obtain ASF software. source
- Interfaces
- The platform offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin. source
- Interfaces
- ATR offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin. source
- License
- The ATR site states that its material is licensed under Apache License, version 2.0. source
- Maker
- The ASF says it provides software for the public good and is a nonprofit organization. source
- Purpose
- Apache Trusted Releases is a platform intended to verify and distribute Apache releases securely. source
- Purpose
- ATR helps Apache project committees prepare, vote on, and publish official software releases. source
- Release catalog
- ATR maintains a catalog of current and archived release artifacts for end users. source
- Release catalog
- ATR maintains a catalog of current and archived release artifacts for end users. source
- Release workflow
- The documented workflow is to compose a candidate release, hold a PMC vote, and publish and announce the release if the vote passes. source
- Release workflow
- The release process has three steps: compose a candidate, hold the PMC vote, and publish and announce the release if the vote passes. source
- SBOM analysis
- For CycloneDX SBOM files, ATR evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data. source
- SBOM features
- ATR can score CycloneDX SBOMs and offers tasks to generate or augment SBOMs and run an OSV vulnerability scan. source
- Security scope
- ATR aims to reduce supply-chain attack risk by ensuring distributed software matches the legitimate submission from its project committee; it does not ensure the software’s quality. source
Checked against the maker's pages on 11 Oct 2026.