Apache Trusted Releases
Apache Trusted Releases (ATR) is a platform for verifying and distributing Apache software releases.
What Apache Trusted Releases is
Apache Trusted Releases (ATR) is a platform for verifying and distributing Apache software releases. Its documented process moves from preparing a candidate release to a PMC vote, then publication and announcement if the vote passes. Before voting, automated checks examine signatures, hashes, archive layout, licensing, and software bill of materials (SBOM) content. ATR also maintains a catalog of current and archived release artifacts for end users.
Users can work with a web interface, JSON API, command-line interface, GitHub Actions, or Maven plugin. For CycloneDX SBOMs, ATR checks NTIA 2021 conformance, validation results, license signals, and vulnerability data. It can also generate an SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan. Signature checks use committee public keys and block signatures made with DSA keys or RSA keys shorter than 2048 bits. ATR aims to reduce supply-chain attack risk by checking that distributed software matches a committee's legitimate submission, not by assessing software quality. The platform is free and open source under Apache License 2.0. It is in beta development, and its code has no guarantees for stability, security, or backward compatibility.
Good
- Automates checks before a release vote
- Maintains current and archived release artifacts
- Provides a JSON API and command-line interface
- Can generate and analyze CycloneDX SBOMs
Watch out
- Platform is in beta development
- Code has no stability, security, or compatibility guarantees
- Live platform requires an ASF account
- ATR does not assess software quality
Who it suits
ATR is intended for Apache project participants who publish releases and end users who obtain them. Its beta status and lack of stability, security, and compatibility guarantees matter to teams considering deployment.
Verdict
ATR supports release preparation, approval, verification, and artifact distribution, with additional SBOM tools. Its beta status and stated limits mean users should account for the lack of guarantees when considering it.
The facts
Each one read from Apache Trusted Releases's own pages, with the date it was checked.
What it does
- Access
- The live platform asks users to log in with an ASF account.checked 11 Oct 2001
- Additional SBOM tools
- ATR can generate a CycloneDX SBOM from an archive, score or augment an SBOM, and run an OSV vulnerability scan.checked 5 Oct 2001
- Artifact checks
- ATR runs automated checks for signatures, hashes, archive layout, licensing, and SBOM content before a release vote.checked 11 Oct 2001
- Beta availability
- The ASF Tooling site says ASF PMCs and incubating podlings may participate in beta testing.checked 5 Oct 2001
- Deployment
- The repository recommends running ATR with Docker Compose and documents visiting a local HTTPS address using a self-signed certificate.checked 5 Oct 2001
- Development status
- The source repository describes the project as in beta development and says the code is provided without guarantees regarding stability, security, or backward compatibility.checked 5 Oct 2001
- Integrations
- Projects can use GitHub Actions for Trusted Publishing when they can demonstrate reproducible builds.checked 11 Oct 2001
- Intended users
- ATR serves Apache project committee participants who publish software and end users who obtain ASF software.checked 11 Oct 2001
- Interfaces
- ATR offers a web interface, JSON API, command-line interface, GitHub Actions, and a Maven plugin.checked 11 Oct 2001
- License
- The ATR site states that its material is licensed under Apache License, version 2.0.checked 11 Oct 2001
- Purpose
- ATR helps Apache project committees prepare, vote on, and publish official software releases.checked 11 Oct 2001
- Release catalog
- ATR maintains a catalog of current and archived release artifacts for end users.checked 11 Oct 2001
- Release workflow
- The release process has three steps: compose a candidate, hold the PMC vote, and publish and announce the release if the vote passes.checked 11 Oct 2001
- SBOM analysis
- For CycloneDX SBOM files, ATR evaluates NTIA 2021 conformance, validation results, license signals, and vulnerability data.checked 5 Oct 2001
- SBOM features
- ATR can score CycloneDX SBOMs and offers tasks to generate or augment SBOMs and run an OSV vulnerability scan.checked 11 Oct 2001
- Security scope
- ATR aims to reduce supply-chain attack risk by ensuring distributed software matches the legitimate submission from its project committee; it does not ensure the software’s quality.checked 11 Oct 2001
- Signature policy
- ATR verifies artifact signatures against committee public keys and blocks signatures made with DSA keys or RSA keys shorter than 2048 bits.checked 11 Oct 2001
- Support
- The ASF says it does not provide formal or commercial support for its software packages.checked 11 Oct 2001
- Support and feedback
- The site directs inquiries to [email protected] and bug reports and feedback to the source repository.checked 5 Oct 2001
The company
- Maker
- The ASF says it provides software for the public good and is a nonprofit organization.checked 5 Oct 2001
Alternatives to Apache Trusted Releases
- 1
Flagsmith
Free planOpen sourceAndroidiOSWebAPI8.5From $40 a month - 2
Unleash
Free planOpen sourceAndroidiOSWebAPI8.5From $6.25 a month - 3
Statsig
Free planAndroidiOSWebAPI8.1From $150 a month - 4
Zoho Sprints
Free planAndroidiOSWebAPI8.1From $0.08 a month - 5
LaunchDarkly Experimentation
Free planAndroidiOSWebAPI7.4From $108.33 a month - 6
ConfigCat
Free planAndroidiOSWebAPI7.3From $110 a month