- Home
- Release Management Software
- Apache Trusted Releases
On the recordRead 11 Oct 202620 facts
Apache Trusted Releases
On the record
- Access
- The live platform asks users to log in with an ASF account.releases.apache.org · read 11 Oct 2026
- Additional SBOM tools
- ATR can generate a CycloneDX SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan.releases.apache.org · read 5 Oct 2026
- Artifact checks
- ATR runs automated checks for signatures, hashes, archive layout, licensing, and SBOM content before a release vote.releases.apache.org · read 11 Oct 2026
- Beta availability
- The ASF Tooling site says ASF PMCs and incubating podlings may participate in beta testing.tooling.apache.org · read 5 Oct 2026
- Deployment
- The repository recommends running ATR with Docker Compose and documents visiting a local HTTPS address using a self-signed certificate.github.com · read 5 Oct 2026
- Development status
- The source repository describes the project as in beta development and says the code is provided without guarantees regarding stability, security, or backward compatibility.github.com · read 5 Oct 2026
- Integrations
- Projects can use GitHub Actions for Trusted Publishing when they can demonstrate reproducible builds.releases.apache.org · read 11 Oct 2026
- Intended users
- ATR serves Apache project committee participants who publish software and end users who obtain ASF software.releases.apache.org · read 11 Oct 2026
- Interfaces
- ATR offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin.releases.apache.org · read 11 Oct 2026
- License
- The ATR site states that its material is licensed under Apache License, version 2.0.releases.apache.org · read 11 Oct 2026
- Maker
- The ASF says it provides software for the public good and is a nonprofit organization.apache.org · read 5 Oct 2026
- Purpose
- ATR helps Apache project committees prepare, vote on, and publish official software releases.releases.apache.org · read 11 Oct 2026
- Release catalog
- ATR maintains a catalog of current and archived release artifacts for end users.releases.apache.org · read 11 Oct 2026
- Release workflow
- The release process has three steps: compose a candidate, hold the PMC vote, and publish and announce the release if the vote passes.releases.apache.org · read 11 Oct 2026
- SBOM analysis
- For CycloneDX SBOM files, ATR evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data.releases.apache.org · read 5 Oct 2026
- SBOM features
- ATR can score CycloneDX SBOMs and offers tasks to generate or augment SBOMs and run an OSV vulnerability scan.releases.apache.org · read 11 Oct 2026
- Security scope
- ATR aims to reduce supply-chain attack risk by ensuring distributed software matches the legitimate submission from its project committee; it does not ensure the software’s quality.releases.apache.org · read 11 Oct 2026
- Signature policy
- ATR verifies artifact signatures against committee public keys and blocks signatures made with DSA keys or RSA keys shorter than 2048 bits.releases.apache.org · read 11 Oct 2026
