Downloads require an access key. Sign in with your access key to enable them.
Adfinis
Log in

Products / OpenBao / v2.6.5

OpenBao

OpenBao v2.6.5

Stable release v2.6.5 — binaries, Arch packages, an RPM repository, a DEB repository, and container images. Verification data: checksums, GPG signatures, Sigstore provenance, and SBOMs.

Release notes

SECURITY

  • auth/cert: Add resolve path canonicalization to CRL paths. GHSA-736f-82w7-hj22. [GH-4325]
  • auth/ldap: Add resolve path canonicalization to user, group paths. GHSA-736f-82w7-hj22. [GH-4325]
  • auth/radius: Add resolve path canonicalization to user paths. GHSA-736f-82w7-hj22. [GH-4325]
  • secrets/approle: Add resolve path canonicalization in Role ID paths. GHSA-736f-82w7-hj22. [GH-4325]
  • secrets/identity: Ensure client_type=public is denied with client_credentials=true in the OIDC provider. GHSA-q824-44ff-f5j5. [GH-4325]
  • secrets/ssh: Deny wildcards (*) in SSH certificate identity templating by default. Configurable via the allow_wildcards_in_identity_templates parameter. GHSA-h76r-48x5-36hg. [GH-4325]
  • secrets/transit: Ensure imported key backup does not allow clobbering arbitrary keys through path traversal. GHSA-5pmx-2p74-x478. [GH-4325]

What's Changed

  • Backport dependencies, bump Go on v2.6.x by @satoqz in https://github.com/openbao/openbao/pull/4314
  • Bump container base images (#4312) by @satoqz in https://github.com/openbao/openbao/pull/4317
  • Address security issues for v2.7.2 - release/2.6.x branch (#4323 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/4325
  • Add release notes for v2.6.5 by @satoqz in https://github.com/openbao/openbao/pull/4327

Full Changelog: https://github.com/openbao/openbao/compare/v2.6.4...v2.6.5

Binaries

Precompiled archives from the official GitHub release.

Packages

Install from mirrored RPM/DEB repositories (package signatures and signed repo metadata verified at sync), or download Arch packages from the release.

RPM

Add the mirrored RPM repository. YUM/DNF substitutes $basearch for the host architecture.

Credentials are stored in /etc/yum.repos.d/openbao.repo (mode 0600). Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Delete /etc/yum.repos.d/openbao.repo to remove the repository configuration.

read -rs ACCESS_KEY
sudo install -m 0600 /dev/null /etc/yum.repos.d/openbao.repo
sudo tee /etc/yum.repos.d/openbao.repo > /dev/null <<EOF
[openbao]
name=openbao
baseurl=https://releases.robertdebock.nl/pulp/content/openbao/rpm/\$basearch/
username=<CLIENT_NAME>
password=${ACCESS_KEY}
enabled=1
# Package signatures: verified with the upstream key (gpgcheck).
# Repository metadata: signed by the Adfinis mirror (repo_gpgcheck).
# List both keys under gpgkey so DNF can import them for packages and metadata.
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://openbao.org/assets/openbao-gpg-pub-20240618.asc https://releases.adfinis.com/keys/adfinis-repo-metadata.asc
EOF
unset ACCESS_KEY
sudo dnf install openbao

Browse RPM repositoriesSign in to download

Containers

Authenticate before pulling. Paste your access key at the hidden prompt when running the commands below.

Docker stores credentials in ~/.docker/config.json after login. Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Run docker logout releases.robertdebock.nl to remove registry credentials from ~/.docker/config.json.

read -rs ACCESS_KEY
echo "$ACCESS_KEY" | docker login releases.robertdebock.nl -u <CLIENT_NAME> --password-stdin
unset ACCESS_KEY
docker pull releases.robertdebock.nl/openbao/openbao:2.6.5

Verification

SHA256 checksums
66 files verified, 169 not covered by upstream checksums.
Checksum manifest authenticity
Signature verified against the pinned upstream key.
GPG signatures
Detached signatures mirrored alongside the artifacts.
Sigstore provenance
Sigstore bundles mirrored alongside the artifacts.
SBOM
SPDX documents mirrored for this release.

Checksum coverage is required for: arch_pkg, binary. A release with an unverified file in one of those classes is not published.

Checksums
GPG signatures
Cosign / Sigstore
SBOM

Release source

Upstream source
https://github.com/openbao/openbao/releases/tag/v2.6.5
Published upstream
2026-10-26
Last successful sync
— when this mirror last downloaded and verified the bundle

Browse release tree

All files for v2.6.5Sign in to download All versions