Your project's release download page is where people can download your product's latest release(s). This page describes how a release manager can put such a page together.
https://(SSL). For example:
Your Apache project's download page:
closer.luautility. For example:
https://www.apache.org/dyn/closer.lua/PROJECT/VERSION/SOURCE-RELEASE. (Note: the
closer.cgiscripts have been deprecated. Calls to them redirect to
http://www.apache.org/dyn/closer.lua/PROJECT) as the KEYS, signatures, and any verification instructions for your release would be missing from the top-level script.
Do not keep software distributions on your project's website. Move them to one of the two software distribution sites:
Current public releases appear on
downloads.apache.org/. Place current, official releases that the PMC has approved for end-users on the main public release site. Make all changes at
Older releases that you no longer recommend to the general public still appear on
archive.apache.org/dist/. This site automatically contains all the content that has ever appeared on
downloads.apache.org/. It is rarely necessary to touch this site, except during a reorganization. Once your project no longer recommends public use of a particular release, delete it from
downloads.apache.org/dist/ by removing it from https://dist.apache.org/repos/dist/release/, and removing the link to it from your download page. It remain on the archive site.
To remove an old release from the release area, use a command of the form:
svn del -m"Archiving release m.n" https://dist.apache.org/repos/dist/release/<project>/etc/m.n
You can use this for release directories or individual files (if multiple releases are present in a single directory).
Apache project download pages must use a closer.lua script. You'll find below a standard mechanism to let you easily create scripts that comply with the ASF distribution policy.
There are two options:
closer.luaintegrated with a page created in the normal way for the project and uses the project's standard document look and feel. This option takes more time to set up.
The starting point for using the generic
closer.lua script is a download page in your project's standard documentation which describes the releases. To use the generic script:
If the artifact is
foo-5.5.1.zip and it is located in
bar/foo relative to
downloads.apache.org, then the link
http://www.apache.org/dyn/closer.lua/bar/foo/foo-5.5.1.zip provides the link for downloading.
As an alternative, you can generate a direct download link using the following syntax:
Note: there is some information which every project should include on the download page (e.g. KEYS and signatures). Please read about best practices for download pages.
To use a project-specific download script, create a project page containing information for the user about the release to download, together with variables the script populates with the appropriate values.
Assuming you have called your download page
download.html, you can invoke our global download script by using the URI
This URI takes the path to the page as an input and passes it to
closer.lua. When you link to the project page (for example, from the rest of the project documentation), it is important to target these links at the script address (and not the html page address).
There is no requirement to name the script
download.cgi and the download release page
download.html, but the name of the script must correspond to the name of the download page. For example:
release.htmlwill not work
There are a number of elements that a good project download page should contain. See the content to generate that page here.
A variable URL links to downloadable artifacts. The download script substitutes the correct base URL for the
[preferred] variable. The rest of the URL should be the path to the artifact relative to the base of the Apache distribution directory.
For example, for artifact
foo-1.0.0.tar.gz contained in
Provide links to the checksum and signature for the artifact next to the download link. It is important that users check the sum and verify the signature, so these links should be close and clear.
For example, for artifact foo-1.0.0.tar.gz contained in bar/foo :
`<a href="[preferred]/bar/foo/foo-1.0.0.tar.gz">zip</a>` `<a href='https://downloads.apache.org/bar/foo/foo-1.0.0.tar.gz.asc'>PGP</a>`
More advice on creating a good project page is below.
All that remains is to wait for the main website to sync with the new page.
It is important that users understand that they should always verify the check sums and (if possible) the OpenPGP compatible signature of each file they download. The content of the release download page plays a critical role in this education process.
Provide clear and easy links to the KEYS, sums and signatures from the download release page or include the information directly in the page itself. The HTTPD page is a good example.
Include a reminder text with links to more information for users. For example:
Note: when downloading, please check the <a href="https://infra.apache.org/release-signing.html#sha-checksum" target="_blank">sha checksum</a> and verify the <a href="https://www.infra.apache.org/release-signing#openpgp" target="_blank">OpenPGP compatible signature</a> from the <a href="https://www.apache.org" target="_blank">main Apache site</a>. Links are provided above (next to the release download link). This <a href="https://downloads.apache.org/ws/axis2/KEYS" target="_blank">KEYS file</a> contains the public keys used for signing release. We recommend that you use a web of trust, if possible, to confirm the identity of these keys. For more information, please see the <a href="https://www.apache.org/dev/release.html" target="_blank">Apache Release FAQ</a>.
Users need to be able to verify the origin of the artifacts, signatures and sums they download. Check that the stylesheets your download site uses do not obscure the linked URLs. It is best to use a simple, plain style for download links. Note that some of the Maven-style sheets may obscure some external links in some browsers.
Your release will be available almost immediately after you upload it to
https://downloads.apache.org/, so you only have to wait about fifteen minutes before announcing it.
If you need assistance in implementing this policy, contact the
firstname.lastname@example.org mailing list.