{"id":13560695,"url":"https://github.com/openbao/openbao","last_synced_at":"2025-05-13T17:14:08.926Z","repository":{"id":208229821,"uuid":"716719284","full_name":"openbao/openbao","owner":"openbao","description":"OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.","archived":false,"fork":false,"pushed_at":"2025-05-12T21:47:43.000Z","size":278759,"stargazers_count":3751,"open_issues_count":143,"forks_count":201,"subscribers_count":31,"default_branch":"main","last_synced_at":"2025-05-12T22:34:03.044Z","etag":null,"topics":["go","secret-management","security"],"latest_commit_sha":null,"homepage":"https://openbao.org/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openbao.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":"audit/audit.go","citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":"GOVERNANCE.md","roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-11-09T18:17:33.000Z","updated_at":"2025-05-12T21:47:47.000Z","dependencies_parsed_at":"2024-11-05T19:33:10.775Z","dependency_job_id":"8a2056af-e19b-4557-8e59-857cd963ec05","html_url":"https://github.com/openbao/openbao","commit_stats":null,"previous_names":["lf-edge/openbao","openbao/openbao"],"tags_count":135,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openbao%2Fopenbao","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openbao%2Fopenbao/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openbao%2Fopenbao/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openbao%2Fopenbao/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openbao","download_url":"https://codeload.github.com/openbao/openbao/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253990499,"owners_count":21995776,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","secret-management","security"],"created_at":"2024-08-01T13:00:48.761Z","updated_at":"2025-05-13T17:14:03.846Z","avatar_url":"https://github.com/openbao.png","language":"Go","readme":"# OpenBao\n\n----\n\n**Please note**: We take OpenBao's security and our users' trust very seriously. If you believe you have found a security issue in OpenBao, _please responsibly disclose_ by contacting us at [openbao-security@lists.lfedge.org](mailto:openbao-security@lists.lfedge.org).\n\n----\n\n\u003c!-- -\tWebsite: https://www.openbao.org --\u003e\n- [Mailing List](https://lists.lfedge.org/g/openbao)\n- [GitHub Discussions](https://github.com/openbao/openbao/discussions)\n- [Chat Server](https://chat.lfx.linuxfoundation.org/)\n  - `#openbao-announcements` ([matrix client](https://matrix.to/#/#openbao-announcements:chat.lfx.linuxfoundation.org), [home server](https://chat.lfx.linuxfoundation.org/#/room/#openbao-announcements:chat.lfx.linuxfoundation.org))\n  - `#openbao-development` ([matrix client](https://matrix.to/#/#openbao-development:chat.lfx.linuxfoundation.org), [home server](https://chat.lfx.linuxfoundation.org/#/room/#openbao-development:chat.lfx.linuxfoundation.org))\n  - `#openbao-general` ([matrix client](https://matrix.to/#/#openbao-general:chat.lfx.linuxfoundation.org), [home server](https://chat.lfx.linuxfoundation.org/#/room/#openbao-general:chat.lfx.linuxfoundation.org))\n  - `#openbao-questions` ([matrix client](https://matrix.to/#/#openbao-questions:chat.lfx.linuxfoundation.org), [home server](https://chat.lfx.linuxfoundation.org/#/room/#openbao-questions:chat.lfx.linuxfoundation.org))\n  - `#openbao-random` ([matrix client](https://matrix.to/#/#openbao-random:chat.lfx.linuxfoundation.org), [home server](https://chat.lfx.linuxfoundation.org/#/room/#openbao-random:chat.lfx.linuxfoundation.org))\n\n\u003cp align=\"center\"\u003e\n  \u003cimg width=\"300\" alt=\"OpenBao Mascot\" src=\"https://raw.githubusercontent.com/openbao/artwork/main/color/openbao-color.svg\"\u003e\n\u003c/p\u003e\n\n**OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. The OpenBao community intends to provide this software under an OSI-approved open-source license, led by a community run under open governance principles.**\n\nA modern system requires access to a multitude of secrets: database credentials, API keys for external services, credentials for service-oriented architecture communication, etc. Understanding who is accessing what secrets is already very difficult and platform-specific. Adding on key rolling, secure storage, and detailed audit logs is almost impossible without a custom solution. This is where OpenBao steps in.\n\nThe key features of OpenBao are:\n\n* **Secure Secret Storage**: Arbitrary key/value secrets can be stored\n  in OpenBao. OpenBao encrypts these secrets prior to writing them to persistent\n  storage, so gaining access to the raw storage isn't enough to access\n  your secrets. OpenBao can write to disk, [Consul](https://www.consul.io),\n  and more.\n\n* **Dynamic Secrets**: OpenBao can generate secrets on-demand for some\n  systems, such as AWS or SQL databases. For example, when an application\n  needs to access an S3 bucket, it asks OpenBao for credentials, and OpenBao\n  will generate an AWS keypair with valid permissions on demand. After\n  creating these dynamic secrets, OpenBao will also automatically revoke them\n  after the lease is up.\n\n* **Data Encryption**: OpenBao can encrypt and decrypt data without storing\n  it. This allows security teams to define encryption parameters and\n  developers to store encrypted data in a location such as a SQL database without\n  having to design their own encryption methods.\n\n* **Leasing and Renewal**: All secrets in OpenBao have a _lease_ associated\n  with them. At the end of the lease, OpenBao will automatically revoke that\n  secret. Clients are able to renew leases via built-in renew APIs.\n\n* **Revocation**: OpenBao has built-in support for secret revocation. OpenBao\n  can revoke not only single secrets, but a tree of secrets, for example,\n  all secrets read by a specific user, or all secrets of a particular type.\n  Revocation assists in key rolling as well as locking down systems in the\n  case of an intrusion.\n\nDocumentation, Getting Started, and Certification Exams\n-------------------------------\n\n\u003c!-- Documentation is available on the [OpenBao website](https://www.openbao.org/docs/). --\u003e\n\nDeveloping OpenBao\n--------------------\n\nIf you wish to work on OpenBao itself or any of its built-in systems, you'll\nfirst need [Go](https://www.golang.org) installed on your machine.\n\nFor local dev first make sure Go is properly installed, including setting up a\n[GOPATH](https://golang.org/doc/code.html#GOPATH). Ensure that `$GOPATH/bin` is in\nyour path as some distributions bundle the old version of build tools. Next, clone this\nrepository. OpenBao uses [Go Modules](https://github.com/golang/go/wiki/Modules),\nso it is recommended that you clone the repository ***outside*** of the GOPATH.\nYou can then download any required build tools by bootstrapping your environment:\n\n```sh\n$ make bootstrap\n...\n```\n\nTo compile a development version of OpenBao, run `make` or `make dev`. This will\nput the OpenBao binary in the `bin` and `$GOPATH/bin` folders:\n\n```sh\n$ make dev\n...\n$ bin/bao\n...\n```\n\nTo compile a development version of OpenBao with the UI, run `make static-dist dev-ui`. This will\nput the OpenBao binary in the `bin` and `$GOPATH/bin` folders:\n\n```sh\n$ make static-dist dev-ui\n...\n$ bin/bao\n...\n```\n\nTo run tests, type `make test`. Note: this requires Docker to be installed. If\nthis exits with exit status 0, then everything is working!\n\n```sh\n$ make test\n...\n```\n\nIf you're developing a specific package, you can run tests for just that\npackage by specifying the `TEST` variable. For example below, only\n`vault` package tests will be run.\n\n```sh\n$ make test TEST=./vault\n...\n```\n\n### Importing OpenBao\n\nThis repository publishes two libraries that may be imported by other projects:\n`github.com/openbao/openbao/api/v2` and `github.com/openbao/openbao/sdk/v2`.\n\nNote that this repository also contains OpenBao (the product), and as with most Go\nprojects, OpenBao uses Go modules to manage its dependencies. The mechanism to do\nthat is the [go.mod](./go.mod) file. As it happens, the presence of that file\nalso makes it theoretically possible to import OpenBao as a dependency into other\nprojects. Some other projects have made a practice of doing so in order to take\nadvantage of testing tooling that was developed for testing OpenBao itself. This\nis not, and has never been, a supported way to use the OpenBao project. We aren't\nlikely to fix bugs relating to failure to import `github.com/openbao/openbao`\ninto your project.\n\nSee also the section \"Docker-based tests\" below.\n\n### Acceptance Tests\n\nOpenBao has comprehensive [acceptance tests](https://en.wikipedia.org/wiki/Acceptance_testing)\ncovering most of the features of the secret and auth methods.\n\nIf you're working on a feature of a secret or auth method and want to\nverify it is functioning (and also hasn't broken anything else), we recommend\nrunning the acceptance tests.\n\n**Warning:** The acceptance tests create/destroy/modify *real resources*, which\nmay incur real costs in some cases. In the presence of a bug, it is technically\npossible that broken backends could leave dangling data behind. Therefore,\nplease run the acceptance tests at your own risk. At the very least,\nwe recommend running them in their own private account for whatever backend\nyou're testing.\n\nTo run the acceptance tests, invoke `make testacc`:\n\n```sh\n$ make testacc TEST=./builtin/logical/consul\n...\n```\n\nThe `TEST` variable is required, and you should specify the folder where the\nbackend is. The `TESTARGS` variable is recommended to filter down to a specific\nresource to test, since testing all of them at once can sometimes take a very\nlong time.\n\nAcceptance tests typically require other environment variables to be set for\nthings such as access keys. The test itself should error early and tell\nyou what to set, so it is not documented here.\n\n### Docker-based Tests\n\nWe have created an experimental new testing mechanism inspired by NewTestCluster.\nAn example of how to use it:\n\n```go\nimport (\n  \"testing\"\n  \"github.com/openbao/openbao/sdk/v2/helper/testcluster/docker\"\n)\n\nfunc Test_Something_With_Docker(t *testing.T) {\n  opts := \u0026docker.DockerClusterOptions{\n    ImageRepo: \"openbao/openbao\",\n    ImageTag:    \"latest\",\n  }\n  cluster := docker.NewTestDockerCluster(t, opts)\n  defer cluster.Cleanup()\n\n  client := cluster.Nodes()[0].APIClient()\n  _, err := client.Logical().Read(\"sys/storage/raft/configuration\")\n  if err != nil {\n    t.Fatal(err)\n  }\n}\n```\n\nHere is a more realistic example of how we use it in practice.  `DefaultOptions` uses\n`hashicorp/vault:latest` as the repo and tag, but it also looks at the environment\nvariable `BAO_BINARY`. If populated, it will copy the local file referenced by\n`BAO_BINARY` into the container. This is useful when testing local changes.\n\nOptionally you can set `COMMIT_SHA`, which will be appended to the image name we\nbuild as a debugging convenience.\n\n```go\nfunc Test_Custom_Build_With_Docker(t *testing.T) {\n  opts := docker.DefaultOptions(t)\n  cluster := docker.NewTestDockerCluster(t, opts)\n  defer cluster.Cleanup()\n}\n```\n\nFinally, here's an example of running an existing OSS docker test with a custom binary:\n\n```bash\n$ GOOS=linux make dev\n$ VAULT_BINARY=$(pwd)/bin/bao go test -run 'TestRaft_Configuration_Docker' ./vault/external_tests/raft/raft_binary\nok      github.com/openbao/openbao/vault/external_tests/raft/raft_binary        20.960s\n```\n","funding_links":[],"categories":["Go","security","\u003ca name=\"Go\"\u003e\u003c/a\u003eGo"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenbao%2Fopenbao","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenbao%2Fopenbao","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenbao%2Fopenbao/lists"}