The Apache Cloudberry (Incubating) project is released in source form (.tar.gz) as its official releases. All the official releases are signed by the release manager for the release. PGP signatures and SHA512 checksums are available along with the distribution.
Convenience binaries (.deb, .rpm, and binary packages) for version 2.1.0 are coming soon.
Releases
| Version | Date | Source archive | Signature & Checksum | Convenience Binaries | Changelog |
|---|---|---|---|---|---|
| 2.1.0-incubating (Latest) | April 14, 2026 | apache-cloudberry-2.1.0-incubating-src.tar.gz | .asc, .sha512 | RPM, DEB (Coming soon) | Changelog |
| apache-cloudberry-backup-2.1.0-incubating-src.tar.gz | .asc, .sha512 | Binary Package (Coming soon) | |||
| apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz | .asc, .sha512 | RPM, DEB (Coming soon) | |||
| 2.0.0-incubating | August 25, 2025 | apache-cloudberry-2.0.0-incubating-src.tar.gz | .asc, .sha512 | - | Changelog |
Verifying Releases
- Verify before use. Please check the SHA‑512 checksum (.sha512) and verify the OpenPGP signature (.asc); these should be fetched from the main Apache site.
- The
KEYSfile contains the public keys used for signing release. We recommend that you use a web of trust, if possible, to confirm the identity of these keys. For more information, please see the Apache Release FAQ.
Step 1: Import release keys
Import the Cloudberry release keys (only need to do this once):
curl https://downloads.apache.org/incubator/cloudberry/KEYS | gpg --import
Step 2: Download artifacts and verification files
Download all components you need:
# apache-cloudberry (main)
curl -L -o apache-cloudberry-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512
# apache-cloudberry-backup
curl -L -o apache-cloudberry-backup-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512
# apache-cloudberry-pxf
curl -L -o apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.1.0-incubating/apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512
Step 3: Verify GPG signatures
Verify all downloaded artifacts:
# Verify all at once
for i in *.tar.gz; do echo "Verifying $i"; gpg --verify $i.asc $i; done
Or verify individually:
gpg --verify apache-cloudberry-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-2.1.0-incubating-src.tar.gz
gpg --verify apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-backup-2.1.0-incubating-src.tar.gz
gpg --verify apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.asc apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz
Expected output:
gpg: Signature made Wed 18 Mar 2026 11:27:33 PM PDT
gpg: using RSA key 9A36AA272348A207E193A49C500708B75754FB7C
gpg: Good signature from "Dianjin Wang (for apache cloudberry release) <djwang@apache.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9A36 AA27 2348 A207 E193 A49C 5007 08B7 5754 FB7C
Step 4: Verify SHA512 checksums
Verify all checksums:
# For Linux - verify all at once
for i in *.tar.gz; do echo "Checking $i"; sha512sum -c $i.sha512; done
# For macOS - verify all at once
for i in *.tar.gz; do echo "Checking $i"; shasum -a 512 -c $i.sha512; done
Or verify individually:
# For Linux
sha512sum -c apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512
sha512sum -c apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512
sha512sum -c apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512
# For macOS
shasum -a 512 -c apache-cloudberry-2.1.0-incubating-src.tar.gz.sha512
shasum -a 512 -c apache-cloudberry-backup-2.1.0-incubating-src.tar.gz.sha512
shasum -a 512 -c apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz.sha512
Expected output:
apache-cloudberry-2.1.0-incubating-src.tar.gz: OK
