diff --git a/src/pages/releases/index.md b/src/pages/releases/index.md index e8857f5784..b69e21d46e 100644 --- a/src/pages/releases/index.md +++ b/src/pages/releases/index.md @@ -5,13 +5,50 @@ description: This page provides download links for the latest release of Apache The Apache Cloudberry (Incubating) project is released in source form (`.tar.gz`) as its official releases. All the official releases are signed by the release manager for the release. PGP signatures and SHA512 checksums are available along with the distribution. -Convenience binaries (eg, `.deb`, `.rpm`) will be made in the future. +Convenience binaries (`.deb`, `.rpm`, and binary packages) for version 2.1.0 are coming soon. ## Releases -| Version | Date | Source archive | Signature & Checksum | Changelog | -|---------|------|----------------|-----------|---------------| -| 2.0.0-incubating (latest) | August 25, 2025 | [apache-cloudberry-2.0.0-incubating-src.tar.gz](https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz) | [.asc](https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz.asc), [.sha512](https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz.sha512) | [Changelog](../releases/2.0.0-incubating) | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
VersionDateSource archiveSignature & ChecksumConvenience BinariesChangelog
2.1.0-incubating (Latest)April 14, 2026apache-cloudberry-2.1.0-incubating-src.tar.gz.asc, .sha512RPM, DEB
(Coming soon)
Changelog
apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.asc, .sha512Binary Package
(Coming soon)
apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.asc, .sha512RPM, DEB
(Coming soon)
2.0.0-incubatingAugust 25, 2025apache-cloudberry-2.0.0-incubating-src.tar.gz.asc, .sha512-Changelog
## Verifying Releases @@ -19,69 +56,91 @@ Convenience binaries (eg, `.deb`, `.rpm`) will be made in the future. - Verify before use. Please check the SHA‑512 checksum (.sha512) and verify the OpenPGP signature (.asc); these should be fetched from the main Apache site. - The [`KEYS`](https://downloads.apache.org/incubator/cloudberry/KEYS) file contains the public keys used for signing release. We recommend that you use a web of trust, if possible, to confirm the identity of these keys. For more information, please see the [Apache Release FAQ](https://www.apache.org/dev/release.html). -### Checking the signature +### Step 1: Import release keys -``` -# Import Cloudberry release keys -curl https://downloads.apache.org/incubator/cloudberry/KEYS | gpg --import - -# Download artifact, matching .asc file -curl -O https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz -curl -O https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz.asc +Import the Cloudberry release keys (only need to do this once): -# Verify signature -gpg --verify apache-cloudberry-2.0.0-incubating-src.tar.gz.asc apache-cloudberry-2.0.0-incubating-src.tar.gz +```bash +curl https://downloads.apache.org/incubator/cloudberry/KEYS | gpg --import ``` -Expected output: +### Step 2: Download artifacts and verification files -``` -gpg: Signature made Thu 05 Jun 2025 05:43:53 PM PDT -gpg: using RSA key 21571B62BF59A2C896EEA49060C8D62C26775FC1 -gpg: issuer "espino@apache.org" -gpg: Good signature from "Ed Espino " [unknown] -gpg: WARNING: The key's User ID is not certified with a trusted signature! -gpg: There is no indication that the signature belongs to the owner. -Primary key fingerprint: 3B90 B563 4E45 06F0 5BA5 1F2F C960 4135 C07C D12A - Subkey fingerprint: 2157 1B62 BF59 A2C8 96EE A490 60C8 D62C 2677 5FC1 -``` +Download all components you need: -:::tip +```bash +# apache-cloudberry (main) +curl -L -o apache-cloudberry-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz?action=download" +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz.asc +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512 -To verify multiple `.tar.gz` artifacts in the current directory: +# apache-cloudberry-backup +curl -L -o apache-cloudberry-backup-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz?action=download" +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.asc +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512 +# apache-cloudberry-pxf +curl -L -o apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz?action=download" +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.asc +curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512 ``` -for i in *.tar.gz; do echo $i; gpg --verify $i.asc $i ; done -``` -::: -### Checking the SHA512 checksum +### Step 3: Verify GPG signatures -The SHA512 checksum is used to check that a file has been downloaded correctly, and your download hasn't been modifed or is otherwise incomplete or faulty. +Verify all downloaded artifacts: +```bash +# Verify all at once +for i in *.tar.gz; do echo "Verifying $i"; gpg --verify $i.asc $i; done ``` -curl -O https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz -curl -O https://downloads.apache.org/incubator/cloudberry/2.0.0-incubating/apache-cloudberry-2.0.0-incubating-src.tar.gz.sha512 -# For Linux users -sha512sum -c apache-cloudberry-2.0.0-incubating-src.tar.gz.sha512 +Or verify individually: -# For macOS users -shasum -a 512 -c apache-cloudberry-2.0.0-incubating-src.tar.gz.sha512 +```bash +gpg --verify apache-cloudberry-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-2.1.0-incubating-src.tar.gz +gpg --verify apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-backup-2.1.0-incubating-src.tar.gz +gpg --verify apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz ``` -Expected output should be: +Expected output: ``` -apache-cloudberry-2.0.0-incubating-src.tar.gz: OK +gpg: Signature made Wed 18 Mar 2026 11:27:33 PM PDT +gpg: using RSA key 9A36AA272348A207E193A49C500708B75754FB7C +gpg: Good signature from "Dianjin Wang (for apache cloudberry release) " [unknown] +gpg: WARNING: This key is not certified with a trusted signature! +gpg: There is no indication that the signature belongs to the owner. +Primary key fingerprint: 9A36 AA27 2348 A207 E193 A49C 5007 08B7 5754 FB7C ``` -:::tip +### Step 4: Verify SHA512 checksums + +Verify all checksums: -To check SHA512 checksums for multiple `.tar.gz` artifacts in the current directory: +```bash +# For Linux - verify all at once +for i in *.tar.gz; do echo "Checking $i"; sha512sum -c $i.sha512; done +# For macOS - verify all at once +for i in *.tar.gz; do echo "Checking $i"; shasum -a 512 -c $i.sha512; done ``` -for i in *.tar.gz; do echo $i; sha512sum --check $i.sha512; done + +Or verify individually: + +```bash +# For Linux +sha512sum -c apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512 +sha512sum -c apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512 +sha512sum -c apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512 + +# For macOS +shasum -a 512 -c apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512 +shasum -a 512 -c apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512 +shasum -a 512 -c apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512 ``` -::: \ No newline at end of file +Expected output: + +``` +apache-cloudberry-2.1.0-incubating-src.tar.gz: OK +``` \ No newline at end of file