Apache Trusted Releases

Spec sheet

Purpose

ATR helps Apache project committees prepare, vote on, and publish official software releases.Read 11 Oct 2026 · releases.apache.org

Intended users

ATR serves Apache project committee participants who publish software and end users who obtain ASF software.Read 11 Oct 2026 · releases.apache.org

Deployment

The repository recommends running ATR with Docker Compose and documents visiting a local HTTPS address using a self-signed certificate.Read 5 Oct 2026 · github.com

Integrations

Projects can use GitHub Actions for Trusted Publishing when they can demonstrate reproducible builds.Read 11 Oct 2026 · releases.apache.org

Support

The ASF says it does not provide formal or commercial support for its software packages.Read 11 Oct 2026 · apache.org

License

The ATR site states that its material is licensed under Apache License, version 2.0.Read 11 Oct 2026 · releases.apache.org

Maker

The ASF says it provides software for the public good and is a nonprofit organization.Read 5 Oct 2026 · apache.org

Access

The live platform asks users to log in with an ASF account.Read 11 Oct 2026 · releases.apache.org

Additional SBOM tools

ATR can generate a CycloneDX SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan.Read 5 Oct 2026 · releases.apache.org

Artifact checks

ATR runs automated checks for signatures, hashes, archive layout, licensing, and SBOM content before a release vote.Read 11 Oct 2026 · releases.apache.org

Beta availability

The ASF Tooling site says ASF PMCs and incubating podlings may participate in beta testing.Read 5 Oct 2026 · tooling.apache.org

Development status

The source repository describes the project as in beta development and says the code is provided without guarantees regarding stability, security, or backward compatibility.Read 5 Oct 2026 · github.com

Interfaces

ATR offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin.Read 11 Oct 2026 · releases.apache.org

Release catalog

ATR maintains a catalog of current and archived release artifacts for end users.Read 11 Oct 2026 · releases.apache.org

Release workflow

The release process has three steps: compose a candidate, hold the PMC vote, and publish and announce the release if the vote passes.Read 11 Oct 2026 · releases.apache.org

SBOM analysis

For CycloneDX SBOM files, ATR evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data.Read 5 Oct 2026 · releases.apache.org

SBOM features

ATR can score CycloneDX SBOMs and offers tasks to generate or augment SBOMs and run an OSV vulnerability scan.Read 11 Oct 2026 · releases.apache.org

Security scope

ATR aims to reduce supply-chain attack risk by ensuring distributed software matches the legitimate submission from its project committee; it does not ensure the software’s quality.Read 11 Oct 2026 · releases.apache.org

Signature policy

ATR verifies artifact signatures against committee public keys and blocks signatures made with DSA keys or RSA keys shorter than 2048 bits.Read 11 Oct 2026 · releases.apache.org

Support and feedback

The site directs inquiries to [email protected] and bug reports and feedback to the source repository.Read 5 Oct 2026 · releases.apache.org

Where Specifiction places it

• Release Management Software#16 of 387.6