Downloads require an access key. Sign in with your access key to enable them.
Adfinis
Log in

Products / OpenBao / v2.7.1

OpenBao

OpenBao v2.7.1

Stable release v2.7.1 — binaries, Arch packages, an RPM repository, a DEB repository, and container images. Verification data: checksums, GPG signatures, Sigstore provenance, and SBOMs.

Release notes

SECURITY

  • core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148]
  • core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148]
  • auth/approle: Ensure Secret ID cannot be used for authentication after expiration but before tidy is called. GHSA-7m59-mp95-w6ph. [GH-4148]
  • auth/approle: Fix incorrect JSON-decode path when parsing login requests with form data bodies. GHSA-5v22-543h-wg96. [GH-4148]
  • auth/cert: Fix omission of TLS connection propagation when calculating role-based quota. GHSA-5v22-543h-wg96. [GH-4148]
  • auth/kubernetes: Ensure Service Account JWT is validated on renewal, preventing post-revoke usage. GHSA-gf3j-hm38-jhh5. [GH-4148]

CHANGES

  • packaging: Update the default server config included in Linux packages to use the pebbledb backend instead of the removed file backend. [GH-4088]

BUG FIXES

  • core/barrier: Persist updates to key rotation config on changes to disabled field. [GH-4107]
  • core/grpc-invalidation: Ensure dispatcher lifecycle correctly handles active, standby state changes without locking conflicts. Resolves GRPC invalidation drops and pre-seal active node hangs. [GH-4117]
  • storage/raft: Fix auto_join breaking on providers that include ports with their discovered addresses. [GH-4113]
  • storage/postgresql: Switch to pg_last_wal_replay_lsn() for applied index value checks. [GH-4118]
  • api: Honor the error backoff interval after failed LifetimeWatcher renewal attempts. [GH-4036]

What's Changed

  • docs(guides): add migration guide for File to PebbleDB storage backends on Kubernetes (#4092 by @pree) backported by @pree in https://github.com/openbao/openbao/pull/4109
  • Update default config included in linux packages (#4088 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4121
  • KeyRotationConfig equals() method should compare disabled field (#4107 by @wslabosz-reply) backported by @satoqz in https://github.com/openbao/openbao/pull/4122
  • Use persistent JobManager in GRPC Invalidation (#4117 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/4123
  • Fix Auto Join with provider-specified port (#4113 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4124
  • Honor backoff after failed LifetimeWatcher renewals (#4036 by @haxonittech) backported by @satoqz in https://github.com/openbao/openbao/pull/4125
  • Swap to pg_last_wal_replay_lsn() (#4118 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/4126
  • Ensure release artifact signatures are verified on creation (#3838 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/4128
  • Bump ubi10-minimal from e3a5632 to 204e153 (#4129 by @dependabot) backported by @satoqz in https://github.com/openbao/openbao/pull/4138
  • Bump github.com/hashicorp/cap from 0.13.0 to 0.14.0 (#4133 by @dependabot) backported by @satoqz in https://github.com/openbao/openbao/pull/4143
  • v2.7.1 - Security Fixes against release/v2.7.x (#4146 by @06kellyjac, @cipherboy, @phil9909, @satoqz, @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/4147
  • Add release notes for v2.7.1 by @satoqz in https://github.com/openbao/openbao/pull/4149

Full Changelog: https://github.com/openbao/openbao/compare/v2.7.0...v2.7.1

Binaries

Precompiled archives from the official GitHub release.

Packages

Install from mirrored RPM/DEB repositories (package signatures and signed repo metadata verified at sync), or download Arch packages from the release.

RPM

Add the mirrored RPM repository. YUM/DNF substitutes $basearch for the host architecture.

Credentials are stored in /etc/yum.repos.d/openbao.repo (mode 0600). Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Delete /etc/yum.repos.d/openbao.repo to remove the repository configuration.

read -rs ACCESS_KEY
sudo install -m 0600 /dev/null /etc/yum.repos.d/openbao.repo
sudo tee /etc/yum.repos.d/openbao.repo > /dev/null <<EOF
[openbao]
name=openbao
baseurl=https://releases.robertdebock.nl/pulp/content/openbao/rpm/\$basearch/
username=<CLIENT_NAME>
password=${ACCESS_KEY}
enabled=1
# Package signatures: verified with the upstream key (gpgcheck).
# Repository metadata: signed by the Adfinis mirror (repo_gpgcheck).
# List both keys under gpgkey so DNF can import them for packages and metadata.
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://openbao.org/assets/openbao-gpg-pub-20240618.asc https://releases.adfinis.com/keys/adfinis-repo-metadata.asc
EOF
unset ACCESS_KEY
sudo dnf install openbao

Browse RPM repositoriesSign in to download

Containers

Authenticate before pulling. Paste your access key at the hidden prompt when running the commands below.

Docker stores credentials in ~/.docker/config.json after login. Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Run docker logout releases.robertdebock.nl to remove registry credentials from ~/.docker/config.json.

read -rs ACCESS_KEY
echo "$ACCESS_KEY" | docker login releases.robertdebock.nl -u <CLIENT_NAME> --password-stdin
unset ACCESS_KEY
docker pull releases.robertdebock.nl/openbao/openbao:2.7.1

Verification

SHA256 checksums
54 files verified, 137 not covered by upstream checksums.
Checksum manifest authenticity
Signature verified against the pinned upstream key.
GPG signatures
Detached signatures mirrored alongside the artifacts.
Sigstore provenance
Sigstore bundles mirrored alongside the artifacts.
SBOM
SPDX documents mirrored for this release.

Checksum coverage is required for: arch_pkg, binary. A release with an unverified file in one of those classes is not published.

Checksums
GPG signatures
Cosign / Sigstore
SBOM

Release source

Upstream source
https://github.com/openbao/openbao/releases/tag/v2.7.1
Published upstream
2026-10-01
Last successful sync
— when this mirror last downloaded and verified the bundle

Browse release tree

All files for v2.7.1Sign in to download All versions