v2026.6.3

Installation

Homebrew (macOS)

brew install vouch-sh/tap/vouch

To start the agent automatically:

brew services start vouch

winget (Windows)

winget install SmokeTurner.Vouch

APT Repository (Debian/Ubuntu)

curl -fsSL https://packages.vouch.sh/gpg/vouch.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/vouch-archive-keyring.gpg > /dev/null

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/vouch-archive-keyring.gpg] https://packages.vouch.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/vouch.list > /dev/null

sudo apt-get update && sudo apt-get install -y vouch

YUM/DNF Repository (Fedora/RHEL)

sudo tee /etc/yum.repos.d/vouch.repo << 'EOF'
[vouch]
name=Vouch
baseurl=https://packages.vouch.sh/rpm/$basearch/
gpgcheck=1
gpgkey=https://packages.vouch.sh/gpg/vouch.asc
enabled=1
EOF

sudo dnf install -y vouch

DEB Package (Debian/Ubuntu)

# amd64
gh release download v2026.6.3 --repo vouch-sh/vouch --pattern "vouch_2026.6.3_amd64.deb"
sudo dpkg -i vouch_2026.6.3_amd64.deb

# arm64
gh release download v2026.6.3 --repo vouch-sh/vouch --pattern "vouch_2026.6.3_arm64.deb"
sudo dpkg -i vouch_2026.6.3_arm64.deb

RPM Package (Fedora/RHEL)

# x86_64
gh release download v2026.6.3 --repo vouch-sh/vouch --pattern "vouch-2026.6.3-1.x86_64.rpm"
sudo rpm -i vouch-2026.6.3-1.x86_64.rpm

# aarch64
gh release download v2026.6.3 --repo vouch-sh/vouch --pattern "vouch-2026.6.3-1.aarch64.rpm"
sudo rpm -i vouch-2026.6.3-1.aarch64.rpm

Binary Downloads

Download the appropriate binary for your platform from the release assets below.

Platform	Architecture	Archive
Linux	x86_64	vouch-v2026.6.3-x86_64-unknown-linux-musl.tar.gz
Linux	aarch64	vouch-v2026.6.3-aarch64-unknown-linux-musl.tar.gz
macOS	Apple Silicon	vouch-v2026.6.3-aarch64-apple-darwin.tar.gz
Windows	x86_64	vouch-v2026.6.3-x86_64-pc-windows-msvc.zip
Windows	ARM64	vouch-v2026.6.3-aarch64-pc-windows-msvc.zip

Verify integrity

sha256sum -c SHA256SUMS.txt

Verify provenance

gh attestation verify vouch-v2026.6.3-aarch64-apple-darwin.tar.gz --owner vouch-sh

Using Helm (OCI)

helm install vouch-server oci://ghcr.io/vouch-sh/charts/vouch-server \
  --version 2026.6.3 \
  --namespace vouch-server \
  --create-namespace

Using Helm (from release assets)

helm install vouch-server \
  https://github.com/vouch-sh/vouch/releases/download/v2026.6.3/vouch-server-2026.6.3.tgz \
  --namespace vouch-server \
  --create-namespace

Container Image

docker pull ghcr.io/vouch-sh/vouch:v2026.6.3

Verify Attestations

# Container image
gh attestation verify oci://ghcr.io/vouch-sh/vouch:v2026.6.3 \
  --owner vouch-sh

# Binary archives
gh attestation verify vouch-v2026.6.3-aarch64-apple-darwin.tar.gz --owner vouch-sh

What's Changed

• Add STIG-aligned kernel hardening and AMI STIG mapping doc by @jplock in #482
• Make CLI and agent XDG Base Directory compliant by @jplock in #484
• bump versions by @jplock in #483
• docs: update agent socket path to XDG location in project-overview by @detail-app[bot] in #487
• i18n by @jplock in #485
• docs: add i18n directory to project structure in CONTRIBUTING.md by @detail-app[bot] in #490
• CLI and Agent i18n by @jplock in #489
• fix docker by @jplock in #492
• i18n: close coverage gaps and tidy server catalog by @jplock in #494
• Fix Detail Bug reports #495–#499 by @jplock in #500
• chore: remove is_agent_running dead utility function by @detail-app[bot] in #502
• chore: remove unused INVALID_REQUEST error code constant by @detail-app[bot] in #503
• chore: remove unused remaining_seconds methods from SshCredentials and CertificateMetadata by @detail-app[bot] in #504
• chore: remove unused SshAgentServer::new constructor by @detail-app[bot] in #505
• chore: remove unused cleanup_expired method from SshAgentState by @detail-app[bot] in #506
• chore: remove unused accessor methods Session::authenticated_at and CachedCredential::cached_at by @detail-app[bot] in #507
• chore: remove unused AgentTransport trait and blanket impl by @detail-app[bot] in #508
• chore: remove unused encode_u32 wire utility by @detail-app[bot] in #509
• chore: remove vacuous rds test_rds_token_strips_https_prefix and test_rds_endpoint_format tests by @detail-app[bot] in #510
• chore: remove unused ClientKey::load_or_generate method by @detail-app[bot] in #511
• chore: remove unused delete_from_keychain function from key_store by @detail-app[bot] in #512
• chore: remove unused HttpClientExt::get_json_authenticated method by @detail-app[bot] in #514
• chore: remove expiration_from_secs unused utility by @detail-app[bot] in #515
• chore: remove unused read_cookie function and from_netscape_line parser by @detail-app[bot] in #516
• chore: remove process_config dead code from dns module by @detail-app[bot] in #517
• chore: remove unused Fido2Fixture::registration_challenge method by @detail-app[bot] in #518
• chore: remove unused EcdsaP384Signer/EcdsaP384Verifier implementations by @detail-app[bot] in #520
• chore: remove unused Ed25519Signer::public_key_bytes and Ed25519Verifier::key_id by @detail-app[bot] in #521
• chore: remove unused SfvListMember type alias by @detail-app[bot] in #524
• chore: remove unused VouchError enum and BrowserRegisterStartRequest struct by @detail-app[bot] in #519
• Wire audit events + Content-Digest enforcement; drop unused PIN methods by @jplock in #527
• Require RFC 9421 signatures on all /v1/* requests by @jplock in #529
• Remove vouch-agent's non-functional SSH cert refresh/lazy-provision by @jplock in #532
• refactor(test): consolidate test-client creation behind one factory by @jplock in #533
• feat(httpsig): drive /v1 signature policy from a shared predicate + emit Accept-Signature by @jplock in #534
• fix: address 13 detail-app bug reports (#536–#548, #550) by @jplock in #553
• i18n: migrate ApplicationErrorTemplate error messages to Fluent by @jplock in #556
• chore(doc): fix dsql comment by @jplock in #555
• fix(server): enforce OAuth secret cap/floor under concurrency (#551) by @jplock in #557
• fix(server): close lost-update races and error-handling gaps (#551) by @jplock in #560
• ci: bump the actions group with 2 updates by @dependabot[bot] in #558
• feat(ui): localize timestamp display in applications and admin UI by @jplock in #562
• feat(server): OpenID Connect RP-Initiated Logout 1.0 by @jplock in #563
• chore: release prep by @jplock in #564

Full Changelog: v2026.6.2...v2026.6.3