The Apache Trusted Releases (ATR) platform, a new tool from the ASF Tooling Initiative, is making it easier for open source maintainers across hundreds of independently governed ASF projects to ship secure, compliant releases without adding to their workload.
ATR automates the parts of the release process that used to depend on institutional knowledge (e.g., vote tabulation, SBOM validation, compliance checks), while still letting projects use the tools they already work in, from GitHub Actions to the command line. Rather than imposing one workflow across projects, it standardizes the underbelly and stays flexible on the surface.
For example, ATR reduced thousands of missing SBOM fields – such as required package components and metadata – to near complete coverage across releases. By automatically checking and flagging missing information as part of the release process, ATR addressed a problem that would have required maintainers to identify and fix those gaps manually, release after release. Hervé Boutemy of the Apache Maven PMC put it well: “It didn’t feel like we were being asked to change how we work: the system starts by helping us on the vote, then expands progressively at each project’s own pace.”
A new case study examines the impact of the ATR platform. It’s a good look at what “security infrastructure” can mean when it’s designed around maintainers instead of around compliance checklists – and why that distinction matters for a foundation as decentralized as the ASF.
If you’re an ASF contributor and want to try ATR yourself, it’s live at release-test.apache.org, with docs, an open API, and public source repos on GitHub.
