v2026.10.2

Installation

Homebrew (macOS)

brew install vouch-sh/tap/vouch

To start the agent automatically:

brew services start vouch

winget (Windows)

winget install SmokeTurner.Vouch

APT Repository (Debian/Ubuntu)

curl -fsSL https://packages.vouch.sh/gpg/vouch.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/vouch-archive-keyring.gpg > /dev/null

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/vouch-archive-keyring.gpg] https://packages.vouch.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/vouch.list > /dev/null

sudo apt-get update && sudo apt-get install -y vouch

YUM/DNF Repository (Fedora/RHEL)

sudo tee /etc/yum.repos.d/vouch.repo << 'EOF'
[vouch]
name=Vouch
baseurl=https://packages.vouch.sh/rpm/$basearch/
gpgcheck=1
gpgkey=https://packages.vouch.sh/gpg/vouch.asc
enabled=1
EOF

sudo dnf install -y vouch

DEB Package (Debian/Ubuntu)

# amd64
gh release download v2026.10.2 --repo vouch-sh/vouch --pattern "vouch_2026.10.2_amd64.deb"
sudo dpkg -i vouch_2026.10.2_amd64.deb

# arm64
gh release download v2026.10.2 --repo vouch-sh/vouch --pattern "vouch_2026.10.2_arm64.deb"
sudo dpkg -i vouch_2026.10.2_arm64.deb

RPM Package (Fedora/RHEL)

# x86_64
gh release download v2026.10.2 --repo vouch-sh/vouch --pattern "vouch-2026.10.2-1.x86_64.rpm"
sudo rpm -i vouch-2026.10.2-1.x86_64.rpm

# aarch64
gh release download v2026.10.2 --repo vouch-sh/vouch --pattern "vouch-2026.10.2-1.aarch64.rpm"
sudo rpm -i vouch-2026.10.2-1.aarch64.rpm

Binary Downloads

Download the appropriate binary for your platform from the release assets below.

Platform	Architecture	Archive
Linux	x86_64	vouch-v2026.10.2-x86_64-unknown-linux-musl.tar.gz
Linux	aarch64	vouch-v2026.10.2-aarch64-unknown-linux-musl.tar.gz
macOS	Apple Silicon	vouch-v2026.10.2-aarch64-apple-darwin.tar.gz
Windows	x86_64	vouch-v2026.10.2-x86_64-pc-windows-msvc.zip
Windows	ARM64	vouch-v2026.10.2-aarch64-pc-windows-msvc.zip

Verify integrity

sha256sum -c SHA256SUMS.txt

Verify provenance

gh attestation verify vouch-v2026.10.2-aarch64-apple-darwin.tar.gz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

Using Helm (OCI)

helm install vouch-server oci://ghcr.io/vouch-sh/charts/vouch-server \
  --version 2026.10.2 \
  --namespace vouch-server \
  --create-namespace

Using Helm (from release assets)

helm install vouch-server \
  https://github.com/vouch-sh/vouch/releases/download/v2026.10.2/vouch-server-2026.10.2.tgz \
  --namespace vouch-server \
  --create-namespace

Container Image

docker pull ghcr.io/vouch-sh/vouch:2026.10.2

Verify Attestations

# Container image
gh attestation verify oci://ghcr.io/vouch-sh/vouch:2026.10.2 \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

# Binary archives
gh attestation verify vouch-v2026.10.2-aarch64-apple-darwin.tar.gz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

# Helm chart
gh attestation verify vouch-server-2026.10.2.tgz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

What's Changed

• fix(cli): remove cookie.txt and document credential token as debug-only by @jplock in #1762
• chore(detail): sync dpop-token-first-single-challenge rule by @jplock in #1763
• docs: record stale Detail rules that cannot be removed by @jplock in #1765
• fix(server): ship the AMI journal as plain text from boot by @jplock in #1766
• build: upgrade Rust toolchain to 1.99.0 by @jplock in #1767
• fix(server): judge access-token expiry at the request's arrival by @jplock in #1777
• fix(server): answer an inactive DPoP account with a DPoP challenge by @jplock in #1778
• fix(oidc): accept a request_uri with an uppercase HTTPS scheme by @jplock in #1779
• docs: register the issuer resource_uri without a trailing slash by @jplock in #1780
• docs: record the 2026-10-03 Detail triage batch by @jplock in #1781
• fix(server): judge every JWT's exp and nbf through one window type by @jplock in #1782
• refactor(server): judge every time window through ValidityWindow by @jplock in #1783
• docs(server): state that the AI-agent session tags are client-asserted by @jplock in #1784

Full Changelog: v2026.10.1...v2026.10.2