title: “Download and verify”

Download and verify Apache Ranger

Apache Ranger is distributed as a source tarball, as binary tarballs for each service and plugin, as Docker images and as Maven artifacts. All releases are made under the Apache License, Version 2.0; the LICENSE and NOTICE files in each artifact list the terms of the bundled third-party components.

Whatever you download, verify it. Every file published by the project comes with a detached OpenPGP signature (.asc) and a checksum file (.sha512, and .sha256 for the source tarball). The signing keys are in the project's KEYS file. Verification takes a minute and protects you from a corrupted mirror or a tampered file.

Current release

The current stable release is Apache Ranger 2.9.0 (August 8, 2026); see the 2.9.0 release notes. Download it from the ASF download server, which serves the closest mirror:

ArtifactLink
Sourceapache-ranger-2.9.0.tar.gz (asc, sha512, sha256)
Servicesservices/ — admin, usersync, tagsync, kms, pdp
Pluginsplugins/ — atlas, elasticsearch, hbase, hdfs, hive, kafka, knox, kylin, ozone, presto, schema-registry, solr, sqoop, storm, trino, yarn
Toolstools/ — migration-util, ranger-tools, sample-client, solr_audit_conf
Everythingdownloads.apache.org/ranger/2.9.0/

Binary tarballs follow the naming pattern ranger-<version>-<component>.tar.gz, for example services/admin/ranger-2.9.0-admin.tar.gz and plugins/hive/ranger-2.9.0-hive-plugin.tar.gz. Each sits next to its .asc and .sha512 files. Binary tarballs have been published for 2.6.0 and later (the pdp service and the trino plugin from 2.9.0); for older releases build them from the source tarball.

Previous releases are listed on the Releases page. Every release ever made, including the incubating ones, stays available at archive.apache.org/dist/ranger/ and archive.apache.org/dist/incubator/ranger/.

Verify signatures and checksums

Signatures and checksums must always be fetched from the ASF servers (downloads.apache.org or archive.apache.org), not from a mirror, so that a compromised mirror cannot serve matching fake files.

1. Import the signing keys

The KEYS file contains the public keys of all Ranger release managers:

curl -O https://downloads.apache.org/ranger/KEYS
gpg --import KEYS

The same file is available from https://dist.apache.org/repos/dist/release/ranger/KEYS. Release announcement emails name the key used for that release; you can show a key's fingerprint with gpg --fingerprint <key-id>. Because you import keys from a file rather than through a web of trust, gpg will report the signature as good but the key as not certified; that warning is expected.

2. Verify the OpenPGP signature

export RANGER_VERSION=2.9.0
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.asc

gpg --verify apache-ranger-${RANGER_VERSION}.tar.gz.asc apache-ranger-${RANGER_VERSION}.tar.gz

A successful check prints Good signature from "<release manager>". Any other result means the file must not be used.

3. Verify the checksum

For releases from 2.5.0 onward the .sha512 file is produced with sha512sum, so it can be checked directly:

=== “Linux”

```bash
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.sha512
sha512sum -c apache-ranger-${RANGER_VERSION}.tar.gz.sha512
```

=== “macOS”

```bash
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.sha512
shasum -a 512 -c apache-ranger-${RANGER_VERSION}.tar.gz.sha512
```

The source tarball also ships a .sha256 file; sha256sum -c (or shasum -a 256 -c) checks it the same way. Repeat steps 2 and 3 for every binary tarball you download.

!!! note “Older releases”

The `.sha512` files of releases 2.0.0 through 2.4.0 are in `gpg --print-md SHA512` format (upper-case hex in
groups), which `sha512sum -c` cannot read. For those, run `gpg --print-md SHA512 apache-ranger-<version>.tar.gz`
and compare the output with the file. The 2.2.0 checksum files are named with an upper-case extension,
`apache-ranger-2.2.0.tar.gz.SHA512` and `.SHA256`. Releases 0.4.0 through 0.7.0 (except 0.6.3) have no
`.sha512` file; their digests are in a single `.mds` file (`gpg --print-mds` output), so compare the matching
line with `gpg --print-md SHA512 <file>` or `gpg --print-md SHA1 <file>`.

Docker images

Official images are published to Docker Hub under the apache organization for each release from 2.4.0 onward. The release manager builds them from the dev-support/ranger-docker Dockerfiles at the release tag; see Release process.

ImagePurposeTags
apache/rangerRanger Admin2.4.0 … 2.9.0
apache/ranger-dbPostgreSQL database initialized for Rangersame as apache/ranger
apache/ranger-solrSolr with the ranger_audits collectionsame as apache/ranger
apache/ranger-zkZooKeeper for Solr2.4.0 … 2.8.0 (no 2.9.0 tag has been published)
apache/ranger-baseBase image (OS + JDK) used to build and run the other images<date>-<n>-<jdk>, for example 20260806-2-17

The images are not signed; pull them by version tag rather than latest and check the image digest shown by Docker Hub. The quick-start below, from the cwiki page Run Ranger in Docker using DockerHub images, starts Ranger Admin with its PostgreSQL, Solr and ZooKeeper dependencies:

export RANGER_VERSION=2.9.0
export RANGER_ZK_VERSION=2.8.0
docker pull apache/ranger-zk:${RANGER_ZK_VERSION}
docker pull apache/ranger-solr:${RANGER_VERSION}
docker pull apache/ranger-db:${RANGER_VERSION}
docker pull apache/ranger:${RANGER_VERSION}

docker network create rangernw

docker run -d --name ranger-zk --hostname ranger-zk.example.com --network rangernw -p 2181:2181 \
  apache/ranger-zk:${RANGER_ZK_VERSION}

docker run -d --name ranger-solr --hostname ranger-solr.example.com --network rangernw -p 8983:8983 \
  apache/ranger-solr:${RANGER_VERSION} solr-precreate ranger_audits /opt/solr/server/solr/configsets/ranger_audits/

docker run -d --name ranger-db --hostname ranger-db.example.com --network rangernw \
  --health-cmd='su -c "pg_isready -q" postgres' --health-interval=10s --health-timeout=2s --health-retries=30 \
  apache/ranger-db:${RANGER_VERSION}

docker run -d --name ranger --hostname ranger.example.com --network rangernw \
  -e RANGER_VERSION=${RANGER_VERSION} -e RANGER_DB_TYPE=postgres -p 6080:6080 \
  apache/ranger:${RANGER_VERSION} /home/ranger/scripts/ranger.sh

Ranger Admin is then available at http://localhost:6080/ (user admin, password rangerR0cks!). To run the full stack with plugins, or to build images from a source checkout, use the compose files in dev-support/ranger-docker.

Maven Central

Ranger libraries are published to Maven Central under the group org.apache.ranger, with the release version as the artifact version. Releases 0.6.0 through 2.9.0 are available; artifacts for a new release are deployed during the release process, so check repo1.maven.org/maven2/org/apache/ranger/ if the version you need is not there yet.

Artifacts you are most likely to depend on:

ArtifactContents
ranger-plugins-commonPolicy engine, RangerBasePlugin, policy refresher, RangerAccessRequest/RangerAccessResult
ranger-plugins-audit (up to 2.6.0) / ranger-audit-dest-solr, ranger-audit-dest-hdfs, ranger-audit-dest-es, ranger-audit-dest-kafka, ranger-audit-dest-log4j, ranger-audit-dest-cloudwatch (2.7.0 and later)Audit framework and destinations; see the 2.7.0 breaking changes
ranger-intgJava client for the Ranger Admin REST API (RangerClient)
ranger-authz-api, authz-embeddedComponent-neutral authorization API and embedded authorizer (2.8.0 and later)
ranger-<component>-plugin, ranger-<component>-plugin-shimPer-component authorizers and their shim classes (hdfs, hive, hbase, kafka, knox, solr, ozone, trino, …)
ranger-plugin-classloaderClassloader used by the shims to isolate plugin dependencies
ranger-kms, ranger-tagsync, unixusersync, security-admin-webService modules
<dependency>
    <groupId>org.apache.ranger</groupId>
    <artifactId>ranger-plugins-common</artifactId>
    <version>2.9.0</version>
</dependency>

The Python client is published to PyPI as apache-ranger (pip install apache-ranger); its source is in intg/src/main/python of the repository.

Source code and release tags

Every release since 0.7.1 is tagged in the Git repository as release-ranger-<version> (https://github.com/apache/ranger/tags); the tag matches the contents of the source tarball. Release branches are named ranger-<major>.<minor>, for example ranger-2.9. To build a release from source:

git clone https://github.com/apache/ranger.git
cd ranger
git checkout release-ranger-2.9.0
mvn clean package -DskipTests

The build writes the same ranger-<version>-<component>.tar.gz files that are published in the services/, plugins/ and tools/ directories to target/.

Further reading