While DataFusion is also distributed via the Rust crates.io package manager as a convenience, the official Apache DataFusion releases are provided as source artifacts.
The latest source release is 41.0.0 (asc, sha512).
For previous releases, please check the archive.
For releases earlier than 37.0.0, please check Arrow's archive.
You will need to download both the release artifact and the .asc signature file for that artifact. Then verify the signature by:
Download the KEYS file and the .asc signature files for the relevant release artifacts.
Import the KEYS file to your GPG keyring:
gpg --import KEYS
Verify the signature of the release artifact using the following command:
gpg --verify <artifact>.asc <artifact>
You will need to download both the release artifact and the .sha512 checksum file for that artifact. Then verify the checksum by:
shasum -a 512 -c <artifact>.sha512