FREEDOM251

Freedom251 › Release Management Software

Apache Trusted Releases

Free plan APISelf-hostedWeb

Visit Apache Trusted Releases Alternatives

Apache Trusted Releases's own site

What Apache Trusted Releases is

Apache Trusted Releases is a platform for verifying and distributing Apache software releases. Its release process moves from assembling a candidate to a PMC vote, then publication and announcement if the vote succeeds. Before voting, automated checks review signatures, hashes, archive structure, licensing, and SBOM content. The catalog gives end users access to current and archived artifacts. Users can work through a web interface, JSON API, command-line interface, GitHub Actions, or Maven plugin. For CycloneDX SBOMs, the platform evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data; it can also generate or augment SBOMs and run an OSV scan. ATR aims to reduce supply-chain risk by checking that distributed files match the committee’s legitimate submission, not by evaluating software quality. The platform is free and open source under Apache License 2.0. The live service requires an ASF account, and the project describes its code as beta without guarantees of stability, security, or backward compatibility.

Who it suits

It is intended for Apache project participants publishing releases and end users obtaining them. It may also suit ASF PMCs and incubating podlings participating in beta testing.

What it does well

  • Automates checks before release votes
  • Supports web, API, command-line, GitHub Actions, and Maven
  • Maintains current and archived release artifacts
  • Includes CycloneDX SBOM analysis and OSV scanning

What to know first

  • Live access requires an ASF account
  • Beta code has no stability or security guarantees
  • Does not assess software quality
  • ASF provides no formal or commercial support

Limits

The project is in beta development, and its code is provided without guarantees regarding stability, security or backward compatibility. Live access is tied to ASF accounts and PMC projects.

Getting started

  1. Open https://releases.apache.org/.
  2. Log in to the live platform with an ASF account.
  3. Use the projects available through your PMC.
  4. For a local deployment, run ATR with Docker Compose and visit the documented local HTTPS address, accepting its self-signed certificate.
  5. For Trusted Publishing, connect GitHub Actions if the project can demonstrate reproducible builds.

Verdict

ATR brings release approval, artifact checks, and distribution into one workflow, with additional SBOM tools. Its beta status and stated limits make those conditions important to consider before relying on it.

Questions

How much does Apache Trusted Releases cost?

It is free and open source. The ATR site states that its material is licensed under Apache License, version 2.0.

What interfaces does ATR provide?

It offers a web interface, JSON API, command-line interface, GitHub Actions and a Maven plugin.

What does ATR check before a release vote?

Automated checks cover signatures, hashes, archive layout, licensing and SBOM content. Signature checks use committee public keys and block DSA signatures and RSA keys shorter than 2048 bits.

Does ATR assess the quality of software?

No. Its stated security scope is to reduce supply-chain risk by checking that distributed software matches the legitimate submission from the project committee.

Who can use the live platform?

The live platform asks users to log in with an ASF account, and the Tooling site says users get access to their PMC's projects. ASF PMCs and incubating podlings may participate in beta testing.

What support is available?

The ASF says it does not provide formal or commercial support for its software packages. The site directs inquiries to [email protected] and bug reports and feedback to the source repository.

Facts from Apache Trusted Releases's own pages

Access
The live platform asks users to log in with an ASF account. · releases.apache.org, 11 Oct 2026
Additional SBOM tools
ATR can generate a CycloneDX SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan. · releases.apache.org, 5 Oct 2026
Artifact checks
ATR runs automated checks for signatures, hashes, archive layout, licensing, and SBOM content before a release vote. · releases.apache.org, 11 Oct 2026
Beta availability
The ASF Tooling site says ASF PMCs and incubating podlings may participate in beta testing. · tooling.apache.org, 5 Oct 2026
Deployment
The repository recommends running ATR with Docker Compose and documents visiting a local HTTPS address using a self-signed certificate. · github.com, 5 Oct 2026
Development status
The source repository describes the project as in beta development and says the code is provided without guarantees regarding stability, security, or backward compatibility. · github.com, 5 Oct 2026
Integrations
Projects can use GitHub Actions for Trusted Publishing when they can demonstrate reproducible builds. · releases.apache.org, 11 Oct 2026
Intended users
ATR serves Apache project committee participants who publish software and end users who obtain ASF software. · releases.apache.org, 11 Oct 2026
Interfaces
ATR offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin. · releases.apache.org, 11 Oct 2026
License
The ATR site states that its material is licensed under Apache License, version 2.0. · releases.apache.org, 11 Oct 2026
Maker
The ASF says it provides software for the public good and is a nonprofit organization. · apache.org, 5 Oct 2026
Purpose
ATR helps Apache project committees prepare, vote on, and publish official software releases. · releases.apache.org, 11 Oct 2026
Release catalog
ATR maintains a catalog of current and archived release artifacts for end users. · releases.apache.org, 11 Oct 2026
Release workflow
The release process has three steps: compose a candidate, hold the PMC vote, and publish and announce the release if the vote passes. · releases.apache.org, 11 Oct 2026
SBOM analysis
For CycloneDX SBOM files, ATR evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data. · releases.apache.org, 5 Oct 2026
SBOM features
ATR can score CycloneDX SBOMs and offers tasks to generate or augment SBOMs and run an OSV vulnerability scan. · releases.apache.org, 11 Oct 2026
Security scope
ATR aims to reduce supply-chain attack risk by ensuring distributed software matches the legitimate submission from its project committee; it does not ensure the software’s quality. · releases.apache.org, 11 Oct 2026
Signature policy
ATR verifies artifact signatures against committee public keys and blocks signatures made with DSA keys or RSA keys shorter than 2048 bits. · releases.apache.org, 11 Oct 2026
Support
The ASF says it does not provide formal or commercial support for its software packages. · apache.org, 11 Oct 2026
Support and feedback
The site directs inquiries to [email protected] and bug reports and feedback to the source repository. · releases.apache.org, 5 Oct 2026

Where Apache Trusted Releases stands on Freedom251

Look at these too