The Apache Cloudberry (Incubating) project is released in source form (.tar.gz) as its official releases. All the official releases are signed by the release manager for the release. PGP signatures and SHA512 checksums are available along with the distribution.

note

Convenience binaries for Cloudberry have been available since version 2.1.0. You can download them from the GitHub release page. After downloading, please verify the signatures and checksums of the files.

Releases

Version	Date	PostgreSQL Base	Source archive	Signature & Checksum	Convenience Binaries	Changelog
2.2.0-incubating (Latest)	November 6, 2026	PostgreSQL 14.10	apache-cloudberry-2.2.0-incubating-src.tar.gz	.asc, .sha512	RPM/DEB	Changelog
			apache-cloudberry-backup-2.2.0-incubating-src.tar.gz	.asc, .sha512	Binary Package
			apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz	.asc, .sha512	-
			apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz	.asc, .sha512	RPM/DEB
2.1.0-incubating	April 14, 2026	PostgreSQL 14.4	apache-cloudberry-2.1.0-incubating-src.tar.gz	.asc, .sha512	RPM/DEB	Changelog
			apache-cloudberry-backup-2.1.0-incubating-src.tar.gz	.asc, .sha512	Binary Package
			apache-cloudberry-pxf-2.1.0-incubating-src.tar.gz	.asc, .sha512	RPM/DEB
2.0.0-incubating	August 25, 2025	PostgreSQL 14.4	apache-cloudberry-2.0.0-incubating-src.tar.gz	.asc, .sha512	-	Changelog

Verifying Releases

• Verify before use. Please check the SHA‑512 checksum (.sha512) and verify the OpenPGP signature (.asc); these should be fetched from the main Apache site.
• The KEYS file contains the public keys used for signing release. We recommend that you use a web of trust, if possible, to confirm the identity of these keys. For more information, please see the Apache Release FAQ.

Step 1: Import release keys

Import the Cloudberry release keys (only need to do this once):

curl https://downloads.apache.org/incubator/cloudberry/KEYS | gpg --import

Step 2: Download artifacts and verification files

Download all components you need:

# apache-cloudberry (main)
curl -L -o apache-cloudberry-2.2.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-2.2.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-2.2.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-2.2.0-incubating-src.tar.gz.sha512

# apache-cloudberry-backup
curl -L -o apache-cloudberry-backup-2.2.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-backup-2.2.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-backup-2.2.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-backup-2.2.0-incubating-src.tar.gz.sha512

# apache-cloudberry-go-libs
curl -L -o apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz.sha512

# apache-cloudberry-pxf
curl -L -o apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz "https://www.apache.org/dyn/closer.lua/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz?action=download"
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz.asc
curl -O https://downloads.apache.org/incubator/cloudberry/2.2.0-incubating/apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz.sha512

Step 3: Verify GPG signatures

Verify all downloaded artifacts:

# Verify all at once
for i in *.tar.gz; do echo "Verifying $i"; gpg --verify $i.asc $i; done

Or verify individually:

gpg --verify apache-cloudberry-2.2.0-incubating-src.tar.gz.asc apache-cloudberry-2.2.0-incubating-src.tar.gz
gpg --verify apache-cloudberry-backup-2.2.0-incubating-src.tar.gz.asc apache-cloudberry-backup-2.2.0-incubating-src.tar.gz
gpg --verify apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz.asc apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz
gpg --verify apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz.asc apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz

Expected output:

gpg: Signature made Tue 20 Oct 2026 05:54:30 PM CST
gpg:                using RSA key 9397D9D3BAD2B7D474A16671AA15045C6ACA3F2B
gpg:                issuer "leborchuk@apache.org"
gpg: Good signature from "Leonid Borchuk <leborchuk@apache.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9397 D9D3 BAD2 B7D4 74A1  6671 AA15 045C 6ACA 3F2B

Step 4: Verify SHA512 checksums

Verify all checksums:

# For Linux - verify all at once
for i in *.tar.gz; do echo "Checking $i"; sha512sum -c $i.sha512; done

# For macOS - verify all at once
for i in *.tar.gz; do echo "Checking $i"; shasum -a 512 -c $i.sha512; done

Or verify individually:

# For Linux
sha512sum -c apache-cloudberry-2.2.0-incubating-src.tar.gz.sha512
sha512sum -c apache-cloudberry-backup-2.2.0-incubating-src.tar.gz.sha512
sha512sum -c apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz.sha512
sha512sum -c apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz.sha512

# For macOS
shasum -a 512 -c apache-cloudberry-2.2.0-incubating-src.tar.gz.sha512
shasum -a 512 -c apache-cloudberry-backup-2.2.0-incubating-src.tar.gz.sha512
shasum -a 512 -c apache-cloudberry-go-libs-2.2.0-incubating-src.tar.gz.sha512
shasum -a 512 -c apache-cloudberry-pxf-2.2.0-incubating-src.tar.gz.sha512

Expected output:

apache-cloudberry-2.2.0-incubating-src.tar.gz: OK