# Install openbao with Homebrew, apk, dnf, MacPorts, Nix, pacman, zypper Provides a software solution to manage, store, and distribute sensitive data. Version 2.5.5 via Homebrew; verified 2026-06-22. ## Install ```sh sudo av install brew:openbao ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install openbao ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install openbao ``` Evidence: MacPorts ports tree: security/openbao/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add openbao ``` Evidence: Alpine Linux edge package indexes: openbao from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - dnf (92%): ```sh sudo dnf install openbao ``` Evidence: Fedora Rawhide package metadata: openbao from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#openbao ``` Evidence: nixpkgs package indexes: pkgs/by-name/op/openbao/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S openbao ``` Evidence: Arch Linux sync databases: openbao from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install openbao ``` Evidence: openSUSE Tumbleweed package metadata: openbao from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:openbao - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.5.5 - **Source summary:** Provides a software solution to manage, store, and distribute sensitive data - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MPL-2.0 - **Source archive:** - **Last updated:** 2026-06-22T14:05:41-07:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Build dependencies - go - node@22 - yarn ## Install behavior - Post-install hook: not defined - Service: declared - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 2.5.5 - Package-manager updated: 2026-06-22 - Local data: ok - Upstream repository: https://github.com/openbao/openbao - info: No cached GitHub release or tag data was available. ## Project history and usage OpenBao is an open source, community-governed fork of HashiCorp Vault for managing secrets, certificates, keys, identity-based access, leasing, dynamic credentials, and encryption services. ### Project history OpenBao began after HashiCorp's Vault ecosystem split over licensing. The project forked from the MPL-licensed Vault 1.14.x line and set its mission around preserving an OSI-approved open source secrets-management system under open governance. The project produced its initial general-availability release as OpenBao v2.0.0, with release notes listing July 16, 2024 as the 2.0.0 release date and the project blog announcing general availability on July 25, 2024. That first GA release emphasized stabilizing the fork, reducing binary size, and giving the community room to make governance and ecosystem decisions. OpenBao later moved from LF Edge into the Open Source Security Foundation. The OpenBao blog announced OpenSSF sandbox acceptance on June 17, 2025, describing the move as a better alignment with security professionals and open source maintainers. ### Adoption history The project's homepage lists supporters including EdgeX Foundry Development, Open Horizon Development, IOTech Systems, Viaccess-Orca, WALLIX, GitLab, SAP, NeoNephos, Adfinis, and Liquid Reply. That roster reflects why the fork mattered: organizations already using Vault-like workflows wanted a governed open source continuation point. OpenBao's migration guide explicitly targets in-place migration from Vault Community Edition clusters and states that OpenBao's API should be compatible with Vault enough that existing clients should not register a difference. That compatibility promise shaped adoption by making OpenBao a packaging and operations substitution rather than a ground-up secrets-manager migration. ### How it is used Operators run the `bao` server and CLI to store key/value secrets, issue dynamic credentials for systems such as Kubernetes and SQL databases, manage PKI/certificates, lease and revoke secrets, and expose encryption-as-a-service behind authentication and authorization policies. Developers integrate OpenBao through the HTTP API, the Go API module, existing Vault-compatible client patterns, and package-manager deployments. Its documentation describes use through UI, CLI, and API, but release notes for 2.0.x also warned that early OpenBao 2.0 releases did not include the built-in Web UI, making CLI and API operation central for the initial GA line. ### Why package nerds care OpenBao is significant because it turned a license-change event into a distro-visible package. Package maintainers got a new upstream with MPL-2.0 licensing, OpenSSF governance, native packages for common Linux distributions, and a binary named `bao` that deliberately avoids colliding with `vault` while keeping familiar operational behavior. It also shows the practical side of forks: compatibility, migration guides, release cadence, CVE process, plugin policy, and package distribution matter at least as much as the fork announcement. For security-sensitive packages, governance and release process are part of the artifact. ### Timeline - 2023-06-21: HashiCorp announced Vault 1.14.0, part of the MPL-licensed branch OpenBao later targeted. - 2024-03-29: OpenBao published its 2.0.0 alpha release. - 2024-07-16: OpenBao v2.0.0 GA release date in the project release notes. - 2024-07-25: The OpenBao blog announced v2.0.0 as the initial GA release. - 2025-06-17: OpenBao announced acceptance as an OpenSSF sandbox project. ### Related projects - OpenBao is historically tied to HashiCorp Vault and operationally tied to Vault-compatible clients, auth methods, secret engines, and migration workflows. Its governance home links it to OpenSSF and the Linux Foundation, while infrastructure users often compare it with OpenTofu because both emerged as open source continuity projects after HashiCorp license changes. ### Sources - - - - - - - ## Security Notes formula declares a Homebrew service. - **Geiger risk:** orange / medium - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.bao ## Credential files - Unix: ~/.vault-token ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** openbao - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Conflicts With:** bao - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - openbao: normalized package name match | nixpkgs package indexes: pkgs/by-name/op/openbao/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - openbao - 2.5.4-r0: normalized package name match | Alpine Linux edge package indexes: openbao from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | solution to manage, store, and distribute sensitive data including secrets, certificates, and keys | https://openbao.org/ - apk - openbao-openrc - 2.5.4-r0: normalized package name match | Alpine Linux edge package indexes: openbao-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | solution to manage, store, and distribute sensitive data including secrets, certificates, and keys (OpenRC init scripts) | https://openbao.org/ - dnf - openbao - 2.5.4-1.fc45: normalized package name match | Fedora Rawhide package metadata: openbao from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A tool for securely accessing secrets | https://openbao.org - dnf - openbao-vault-compat - 2.5.4-1.fc45: normalized package name match | Fedora Rawhide package metadata: openbao-vault-compat from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Vault-compatible command and service | https://openbao.org - pacman - openbao - 2.5.4-1: normalized package name match | Arch Linux sync databases: openbao from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | solution to manage, store, and distribute sensitive data | https://openbao.org - zypper - openbao - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Manage, store, and distribute sensitive data | https://github.com/openbao/openbao - zypper - openbao-agent - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-agent from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao agent | https://github.com/openbao/openbao - zypper - openbao-cassandra-database-plugin - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-cassandra-database-plugin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao database plugin for Cassandra | https://github.com/openbao/openbao - zypper - openbao-influxdb-database-plugin - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-influxdb-database-plugin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao database plugin for InfluxDB | https://github.com/openbao/openbao - zypper - openbao-mysql-database-plugin - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-mysql-database-plugin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao database plugin for MySQL | https://github.com/openbao/openbao - zypper - openbao-mysql-legacy-database-plugin - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-mysql-legacy-database-plugin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao database plugin for MySQL Legacy | https://github.com/openbao/openbao - zypper - openbao-postgresql-database-plugin - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-postgresql-database-plugin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao database plugin for PostgreSQL | https://github.com/openbao/openbao - zypper - openbao-server - 2.5.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: openbao-server from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | OpenBao server | https://github.com/openbao/openbao - MacPorts - openbao: normalized package name match | MacPorts ports tree: security/openbao/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Database and data packages](https://www.automicvault.com/pkg/database-data-tools/) - Matched database, SQL, migration, or data-store metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [yarn](https://www.automicvault.com/pkg/brew/yarn/) - Build dependency declared by Homebrew. - [infisical](https://www.automicvault.com/pkg/brew/infisical/) - Shares av.db curated category or tags: cli, secrets-management, security. - [secretspec](https://www.automicvault.com/pkg/brew/secretspec/) - Shares av.db curated category or tags: cli, secrets-management, security, vault. - [sops](https://www.automicvault.com/pkg/brew/sops/) - Shares av.db curated category or tags: cli, encryption, secrets-management, security. - [teller](https://www.automicvault.com/pkg/brew/teller/) - Shares av.db curated category or tags: cli, secrets-management, security, vault. - [chamber](https://www.automicvault.com/pkg/brew/chamber/) - Shares av.db curated category or tags: cli, secrets-management, security. - [credstash](https://www.automicvault.com/pkg/brew/credstash/) - Shares av.db curated category or tags: cli, secrets-management, security. - [fnox](https://www.automicvault.com/pkg/brew/fnox/) - Shares av.db curated category or tags: cli, encryption, secrets-management, security. - [git-secret](https://www.automicvault.com/pkg/brew/git-secret/) - Shares av.db curated category or tags: cli, encryption, secrets-management, security. ## Combined YAML source View the package source record on GitHub. [combined/openbao.yml](https://github.com/automic-vault/db/blob/main/combined/openbao.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph