Download and verify Apache Ranger¶

Apache Ranger is distributed as a source tarball, as binary tarballs for each service and plugin, as Docker images and as Maven artifacts. All releases are made under the Apache License, Version 2.0; the LICENSE and NOTICE files in each artifact list the terms of the bundled third-party components.

Whatever you download, verify it. Every file published by the project comes with a detached OpenPGP signature (.asc) and a checksum file (.sha512, and .sha256 for the source tarball). The signing keys are in the project's KEYS file. Verification takes a minute and protects you from a corrupted mirror or a tampered file.

Current release¶

The current stable release is Apache Ranger 2.9.0 (August 8, 2026); see the 2.9.0 release notes. Download it from the ASF download server, which serves the closest mirror:

Artifact	Link
Source	apache-ranger-2.9.0.tar.gz (asc, sha512, sha256)
Services	services/ — `admin`, `usersync`, `tagsync`, `kms`, `pdp`
Plugins	plugins/ — `atlas`, `elasticsearch`, `hbase`, `hdfs`, `hive`, `kafka`, `knox`, `kylin`, `ozone`, `presto`, `schema-registry`, `solr`, `sqoop`, `storm`, `trino`, `yarn`
Tools	tools/ — `migration-util`, `ranger-tools`, `sample-client`, `solr_audit_conf`
Everything	downloads.apache.org/ranger/2.9.0/

Binary tarballs follow the naming pattern ranger-<version>-<component>.tar.gz, for example services/admin/ranger-2.9.0-admin.tar.gz and plugins/hive/ranger-2.9.0-hive-plugin.tar.gz. Each sits next to its .asc and .sha512 files. Binary tarballs have been published for 2.6.0 and later (the pdp service and the trino plugin from 2.9.0); for older releases build them from the source tarball.

Previous releases are listed on the Releases page. Every release ever made, including the incubating ones, stays available at archive.apache.org/dist/ranger/ and archive.apache.org/dist/incubator/ranger/.

Verify signatures and checksums¶

Signatures and checksums must always be fetched from the ASF servers (downloads.apache.org or archive.apache.org), not from a mirror, so that a compromised mirror cannot serve matching fake files.

1. Import the signing keys¶

The KEYS file contains the public keys of all Ranger release managers:

curl -O https://downloads.apache.org/ranger/KEYS
gpg --import KEYS

The same file is available from https://dist.apache.org/repos/dist/release/ranger/KEYS. Release announcement emails name the key used for that release; you can show a key's fingerprint with gpg --fingerprint <key-id>. Because you import keys from a file rather than through a web of trust, gpg will report the signature as good but the key as not certified; that warning is expected.

2. Verify the OpenPGP signature¶

export RANGER_VERSION=2.9.0
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz
curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.asc

gpg --verify apache-ranger-${RANGER_VERSION}.tar.gz.asc apache-ranger-${RANGER_VERSION}.tar.gz

A successful check prints Good signature from "<release manager>". Any other result means the file must not be used.

3. Verify the checksum¶

For releases from 2.5.0 onward the .sha512 file is produced with sha512sum, so it can be checked directly:

LinuxmacOS

curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.sha512
sha512sum -c apache-ranger-${RANGER_VERSION}.tar.gz.sha512

curl -O https://downloads.apache.org/ranger/${RANGER_VERSION}/apache-ranger-${RANGER_VERSION}.tar.gz.sha512
shasum -a 512 -c apache-ranger-${RANGER_VERSION}.tar.gz.sha512

The source tarball also ships a .sha256 file; sha256sum -c (or shasum -a 256 -c) checks it the same way. Repeat steps 2 and 3 for every binary tarball you download.

Older releases

The .sha512 files of releases 2.0.0 through 2.4.0 are in gpg --print-md SHA512 format (upper-case hex in groups), which sha512sum -c cannot read. For those, run gpg --print-md SHA512 apache-ranger-<version>.tar.gz and compare the output with the file. The 2.2.0 checksum files are named with an upper-case extension, apache-ranger-2.2.0.tar.gz.SHA512 and .SHA256. Releases 0.4.0 through 0.7.0 (except 0.6.3) have no .sha512 file; their digests are in a single .mds file (gpg --print-mds output), so compare the matching line with gpg --print-md SHA512 <file> or gpg --print-md SHA1 <file>.

Docker images¶

Official images are published to Docker Hub under the apache organization for each release from 2.4.0 onward. The release manager builds them from the dev-support/ranger-docker Dockerfiles at the release tag; see Release process.

Image	Purpose	Tags
apache/ranger	Ranger Admin	`2.4.0` … `2.9.0`
apache/ranger-db	PostgreSQL database initialized for Ranger	same as `apache/ranger`
apache/ranger-solr	Solr with the `ranger_audits` collection	same as `apache/ranger`
apache/ranger-zk	ZooKeeper for Solr	`2.4.0` … `2.8.0` (no `2.9.0` tag has been published)
apache/ranger-base	Base image (OS + JDK) used to build and run the other images	`<date>-<n>-<jdk>`, for example `20260806-2-17`

The images are not signed; pull them by version tag rather than latest and check the image digest shown by Docker Hub. The quick-start below, from the cwiki page Run Ranger in Docker using DockerHub images, starts Ranger Admin with its PostgreSQL, Solr and ZooKeeper dependencies:

export RANGER_VERSION=2.9.0
export RANGER_ZK_VERSION=2.8.0
docker pull apache/ranger-zk:${RANGER_ZK_VERSION}
docker pull apache/ranger-solr:${RANGER_VERSION}
docker pull apache/ranger-db:${RANGER_VERSION}
docker pull apache/ranger:${RANGER_VERSION}

docker network create rangernw

docker run -d --name ranger-zk --hostname ranger-zk.example.com --network rangernw -p 2181:2181 \
  apache/ranger-zk:${RANGER_ZK_VERSION}

docker run -d --name ranger-solr --hostname ranger-solr.example.com --network rangernw -p 8983:8983 \
  apache/ranger-solr:${RANGER_VERSION} solr-precreate ranger_audits /opt/solr/server/solr/configsets/ranger_audits/

docker run -d --name ranger-db --hostname ranger-db.example.com --network rangernw \
  --health-cmd='su -c "pg_isready -q" postgres' --health-interval=10s --health-timeout=2s --health-retries=30 \
  apache/ranger-db:${RANGER_VERSION}

docker run -d --name ranger --hostname ranger.example.com --network rangernw \
  -e RANGER_VERSION=${RANGER_VERSION} -e RANGER_DB_TYPE=postgres -p 6080:6080 \
  apache/ranger:${RANGER_VERSION} /home/ranger/scripts/ranger.sh

Ranger Admin is then available at http://localhost:6080/ (user admin, password rangerR0cks!). To run the full stack with plugins, or to build images from a source checkout, use the compose files in dev-support/ranger-docker.

Maven Central¶

Ranger libraries are published to Maven Central under the group org.apache.ranger, with the release version as the artifact version. Releases 0.6.0 through 2.9.0 are available; artifacts for a new release are deployed during the release process, so check repo1.maven.org/maven2/org/apache/ranger/ if the version you need is not there yet.

Artifacts you are most likely to depend on:

Artifact	Contents
`ranger-plugins-common`	Policy engine, `RangerBasePlugin`, policy refresher, `RangerAccessRequest`/`RangerAccessResult`
`ranger-plugins-audit` (up to 2.6.0) / `ranger-audit-dest-solr`, `ranger-audit-dest-hdfs`, `ranger-audit-dest-es`, `ranger-audit-dest-kafka`, `ranger-audit-dest-log4j`, `ranger-audit-dest-cloudwatch` (2.7.0 and later)	Audit framework and destinations; see the 2.7.0 breaking changes
`ranger-intg`	Java client for the Ranger Admin REST API (`RangerClient`)
`ranger-authz-api`, `authz-embedded`	Component-neutral authorization API and embedded authorizer (2.8.0 and later)
`ranger-<component>-plugin`, `ranger-<component>-plugin-shim`	Per-component authorizers and their shim classes (`hdfs`, `hive`, `hbase`, `kafka`, `knox`, `solr`, `ozone`, `trino`, …)
`ranger-plugin-classloader`	Classloader used by the shims to isolate plugin dependencies
`ranger-kms`, `ranger-tagsync`, `unixusersync`, `security-admin-web`	Service modules

pom.xml

<dependency>
    <groupId>org.apache.ranger</groupId>
    <artifactId>ranger-plugins-common</artifactId>
    <version>2.9.0</version>
</dependency>

The Python client is published to PyPI as apache-ranger (pip install apache-ranger); its source is in intg/src/main/python of the repository.

Source code and release tags¶

Every release since 0.7.1 is tagged in the Git repository as release-ranger-<version> (https://github.com/apache/ranger/tags); the tag matches the contents of the source tarball. Release branches are named ranger-<major>.<minor>, for example ranger-2.9. To build a release from source:

git clone https://github.com/apache/ranger.git
cd ranger
git checkout release-ranger-2.9.0
mvn clean package -DskipTests

The build writes the same ranger-<version>-<component>.tar.gz files that are published in the services/, plugins/ and tools/ directories to target/.