The latest release is 3.7.1:

You can also find older releases on the releases page on GitHub.

The source archives are signed with Joel Rosdahl's OpenPGP key. To verify the integrity of a source archive, install the key, download the archive and the corresponding OpenPGP signature file and run gpg --verify file.asc.

Note that the releases above only are meant to be used when installing ccache. If you want to develop ccache, fix bugs, etc, you should check out the full source code from the repository instead.