docs: add download page

Signed-off-by: tison <[email protected]>

docs/source/download.md

@@ -0,0 +1,60 @@
+<!---
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+
+# Download
+
+The official Apache DataFusion releases are provided as source artifacts.
+
+## Releases
+
+The latest source release is [0.45.0](https://www.apache.org/dyn/closer.lua/opendal/0.45.0/apache-opendal-0.45.0-src.tar.gz?action=download) ([asc](https://downloads.apache.org/opendal/0.45.0/apache-opendal-0.45.0-src.tar.gz.asc),
+[sha512](https://downloads.apache.org/opendal/0.45.0/apache-opendal-0.45.0-src.tar.gz.sha512)).
+
+For older releases, please check the [archive](https://archive.apache.org/dist/datafusion/).
+
+## Notes
+
+- When downloading a release, please verify the OpenPGP compatible signature (or failing that, check the SHA-512); these should be fetched from the main Apache site.
+- The KEYS file contains the public keys used for signing release. It is recommended that (when possible) a web of trust is used to confirm the identity of these keys.
+- Please download the [KEYS](https://downloads.apache.org/datafusion/KEYS) as well as the .asc signature files.
+
+### To verify the signature of the release artifact
+
+You will need to download both the release artifact and the .asc signature file for that artifact. Then verify the signature by:
+
+- Download the KEYS file and the .asc signature files for the relevant release artifacts.
+- Import the KEYS file to your GPG keyring:
+
+  ```shell
+  gpg --import KEYS
+  ```
+
+- Verify the signature of the release artifact using the following command:
+
+  ```shell
+  gpg --verify <artifact>.asc <artifact>
+  ```
+
+### To verify the checksum of the release artifact
+
+You will need to download both the release artifact and the .sha512 checksum file for that artifact. Then verify the checksum by:
+
+```shell
+shasum -a 512 -c <artifact>.sha512
+```

docs/source/index.rst

@@ -66,10 +66,11 @@ Please see the `developer’s guide`_ for contributing and `communication`_ for
    :maxdepth: 1
    :caption: Links
 
-   Github and Issue Tracker <https://github.com/apache/datafusion>
+   GitHub and Issue Tracker <https://github.com/apache/datafusion>
    crates.io <https://crates.io/crates/datafusion>
    API Docs <https://docs.rs/datafusion/latest/datafusion/>
    Code of conduct <https://github.com/apache/datafusion/blob/main/CODE_OF_CONDUCT.md>
+   Download <download>
 
 .. _toc.guide:
 .. toctree::

docs/source/user-guide/example-usage.md

@@ -36,7 +36,7 @@ tokio = "1.0"
 ## Add latest non published DataFusion dependency
 
 DataFusion changes are published to `crates.io` according to [release schedule](https://github.com/apache/datafusion/blob/main/dev/release/README.md#release-process)
-In case if it is required to test out DataFusion changes which are merged but yet to be published, Cargo supports adding dependency directly to Github branch
+In case if it is required to test out DataFusion changes which are merged but yet to be published, Cargo supports adding dependency directly to GitHub branch
 
 ```toml
 datafusion = { git = "https://github.com/apache/datafusion", branch = "main"}