From 2b8d1b53c45387c347b2e52f5c85a6e2a764da61 Mon Sep 17 00:00:00 2001 From: Renjie Liu Date: Fri, 23 Feb 2024 18:14:03 +0800 Subject: [PATCH] doc: Add download page (#219) * doc: Add download page * Fix links --- website/src/download.md | 42 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/website/src/download.md b/website/src/download.md index e27485396..e2989fe63 100644 --- a/website/src/download.md +++ b/website/src/download.md @@ -17,3 +17,45 @@ ~ under the License. --> +# Apache Iceberg™ Rust Downloads + +The official Apache Iceberg-Rust releases are provided as source artifacts. + +## Releases + +The latest source release is [0.2.0](https://www.apache.org/dyn/closer.lua/iceberg/iceberg-rust-0.2.0/apache-iceberg-rust-0.2.0-src.tar.gz?action=download) ([asc](https://downloads.apache.org/iceberg/iceberg-rust-0.2.0/apache-iceberg-rust-0.2.0-src.tar.gz.asc), +[sha512](https://downloads.apache.org/iceberg/iceberg-rust-0.2.0/apache-iceberg-rust-0.2.0-src.tar.gz.sha512)). + +For older releases, please check the [archive](https://archive.apache.org/dist/iceberg/). + +## Notes + +* When downloading a release, please verify the OpenPGP compatible signature (or failing that, check the SHA-512); these should be fetched from the main Apache site. +* The KEYS file contains the public keys used for signing release. It is recommended that (when possible) a web of trust is used to confirm the identity of these keys. +* Please download the [KEYS](https://downloads.apache.org/iceberg/KEYS) as well as the .asc signature files. + +### To verify the signature of the release artifact + +You will need to download both the release artifact and the .asc signature file for that artifact. Then verify the signature by: + +* Download the KEYS file and the .asc signature files for the relevant release artifacts. +* Import the KEYS file to your GPG keyring: + + ```shell + gpg --import KEYS + ``` + +* Verify the signature of the release artifact using the following command: + + ```shell + gpg --verify .asc + ``` + +### To verify the checksum of the release artifact + +You will need to download both the release artifact and the .sha512 checksum file for that artifact. Then verify the checksum by: + +```shell +shasum -a 512 -c .sha512 +``` +