Downloads #

Paimon is released as a source artifact, and also through Maven.

Source Releases #

To download a source distribution for a particular release, click on the tar link.

For security, hash and signature files are always hosted at Apache.

All Paimon releases are available via https://archive.apache.org/dist/paimon/ including checksums and signatures.

Verify the Integrity of the Files #

You must verify the integrity of the downloaded file using the PGP signature (.asc file) or a hash (.sha256; .md5 for older releases). For more information why this must be done, please read Verifying Apache Software Foundation Releases.

Verify the hash digest #

We use SHA-512 to verify the hash digest of the file.

To check a hash, you can first compute the SHA-512 checksum for the file you just downloaded, and then download the digest file for comparison, they should be equal.

Compute the checksum of your file:

• Windows: certUtil -hashfile file SHA512
• Linux: sha512sum file
• Mac: shasum -a 512 file

Verify the PGP signature #

To verify the signature using GPG or PGP, please do the following:

1. Download the release artifact and the corresponding PGP signature from the table above.
2. Download the Apache Paimon KEYS file.
3. Import the KEYS file and verify the downloaded artifact using one of the following methods:

gpg --import KEYS
gpg --verify downloaded_file.asc downloaded_file

or

pgpk -a KEYS
pgpv downloaded_file.asc

or

pgp -ka KEYS
pgp downloaded_file.asc

Maven Artifacts #

Add the following to the dependencies section of your pom.xml file:

<dependencies>
    <dependency>
        <groupId>org.apache.paimon</groupId>
        <artifactId>paimon-flink-${flink.version}</artifactId>
        <version>0.8.0</version>
    </dependency>
</dependencies>

<dependencies>
    <dependency>
        <groupId>org.apache.paimon</groupId>
        <artifactId>paimon-spark-${spark.version}</artifactId>
        <version>0.8.0</version>
    </dependency>
</dependencies>