v2026.7.2

Installation

Homebrew (macOS)

brew install vouch-sh/tap/vouch

To start the agent automatically:

brew services start vouch

winget (Windows)

winget install SmokeTurner.Vouch

APT Repository (Debian/Ubuntu)

curl -fsSL https://packages.vouch.sh/gpg/vouch.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/vouch-archive-keyring.gpg > /dev/null

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/vouch-archive-keyring.gpg] https://packages.vouch.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/vouch.list > /dev/null

sudo apt-get update && sudo apt-get install -y vouch

YUM/DNF Repository (Fedora/RHEL)

sudo tee /etc/yum.repos.d/vouch.repo << 'EOF'
[vouch]
name=Vouch
baseurl=https://packages.vouch.sh/rpm/$basearch/
gpgcheck=1
gpgkey=https://packages.vouch.sh/gpg/vouch.asc
enabled=1
EOF

sudo dnf install -y vouch

DEB Package (Debian/Ubuntu)

# amd64
gh release download v2026.7.2 --repo vouch-sh/vouch --pattern "vouch_2026.7.2_amd64.deb"
sudo dpkg -i vouch_2026.7.2_amd64.deb

# arm64
gh release download v2026.7.2 --repo vouch-sh/vouch --pattern "vouch_2026.7.2_arm64.deb"
sudo dpkg -i vouch_2026.7.2_arm64.deb

RPM Package (Fedora/RHEL)

# x86_64
gh release download v2026.7.2 --repo vouch-sh/vouch --pattern "vouch-2026.7.2-1.x86_64.rpm"
sudo rpm -i vouch-2026.7.2-1.x86_64.rpm

# aarch64
gh release download v2026.7.2 --repo vouch-sh/vouch --pattern "vouch-2026.7.2-1.aarch64.rpm"
sudo rpm -i vouch-2026.7.2-1.aarch64.rpm

Binary Downloads

Download the appropriate binary for your platform from the release assets below.

Platform	Architecture	Archive
Linux	x86_64	vouch-v2026.7.2-x86_64-unknown-linux-musl.tar.gz
Linux	aarch64	vouch-v2026.7.2-aarch64-unknown-linux-musl.tar.gz
macOS	Apple Silicon	vouch-v2026.7.2-aarch64-apple-darwin.tar.gz
Windows	x86_64	vouch-v2026.7.2-x86_64-pc-windows-msvc.zip
Windows	ARM64	vouch-v2026.7.2-aarch64-pc-windows-msvc.zip

Verify integrity

sha256sum -c SHA256SUMS.txt

Verify provenance

gh attestation verify vouch-v2026.7.2-aarch64-apple-darwin.tar.gz --owner vouch-sh

Using Helm (OCI)

helm install vouch-server oci://ghcr.io/vouch-sh/charts/vouch-server \
  --version 2026.7.2 \
  --namespace vouch-server \
  --create-namespace

Using Helm (from release assets)

helm install vouch-server \
  https://github.com/vouch-sh/vouch/releases/download/v2026.7.2/vouch-server-2026.7.2.tgz \
  --namespace vouch-server \
  --create-namespace

Container Image

docker pull ghcr.io/vouch-sh/vouch:v2026.7.2

Verify Attestations

# Container image
gh attestation verify oci://ghcr.io/vouch-sh/vouch:v2026.7.2 \
  --owner vouch-sh

# Binary archives
gh attestation verify vouch-v2026.7.2-aarch64-apple-darwin.tar.gz --owner vouch-sh

What's Changed

• feat(server): per-org subdomain OIDC issuers for AWS federation by @jplock in #624
• version bump to 2026.7.2 by @jplock in #627
• fix(server): retry domain admin transactions on OCC conflict by @jplock in #630
• docs: add /admin/* to UI routes in CLAUDE.md by @detail-app[bot] in #632
• ci: bump the actions group with 6 updates by @dependabot[bot] in #631
• feat(server): per-org issuer signing key rotation by @jplock in #633
• test(server): add architecture layer-boundary test by @jplock in #634
• refactor(server): move shared types to their lowest consuming layer by @jplock in #635
• refactor(db): extract pure validation from organizations module by @jplock in #638
• refactor(db): extract additional-domain lifecycle into organizations/domains by @jplock in #639
• refactor(db): extract issuer subdomains and signing keys from organizations by @jplock in #640
• refactor(oidc): split org_keys into a directory module by @jplock in #642
• fix(i18n): route remaining user-facing strings through Fluent by @jplock in #644
• docs: fix stale compliance and monitoring docs after per-org key rotation by @detail-app[bot] in #645
• docs: fix stale references after OIDC per-org keys update by @detail-app[bot] in #646
• refactor(server): consolidate AWS token issuance on RS256 by @jplock in #648
• feat(cli): plumb IdC identity context into AssumeRole by @jplock in #649
• docs: update RSA signing key description for AWS token consolidation by @detail-app[bot] in #650
• docs: include error messages in CLI localization scope by @detail-app[bot] in #651
• feat: prefer hybrid post-quantum TLS key exchange in CLI and agent by @jplock in #652
• feat(server): record HPKE cipher suite with each encrypted document by @jplock in #653
• fix(db): merge repo deltas in modify closure, add OCC test seam by @jplock in #655
• update dependencies by @jplock in #656
• docs: remove hardcoded P-384 references after cipher-suite agility by @detail-app[bot] in #658
• remove unused deps by @jplock in #660
• refactor(server): pass now explicitly to time-validation functions by @jplock in #664
• refactor(server): extract ServiceError::oauth_description helper (#663) by @jplock in #666
• ci: run tests with --all-features to match make test by @jplock in #667
• fix(cli): embed Windows version info and exit 0 on bare invocation by @jplock in #668
• fix: kubeconfig YAML coercion, subdomain release retry, setup aws flag conflict by @jplock in #686
• build: harden Claude Code session setup hooks by @jplock in #687
• chore: remove unused MockFidoDevice::with_seed method by @detail-app[bot] in #673
• chore: remove stale #[allow(dead_code)] attributes from FIDO2 unix PIN helpers by @detail-app[bot] in #674
• chore: remove unused pub(crate) mod install_path and utils from vouch-cli lib by @detail-app[bot] in #675
• chore: remove unused extract_public_key_from_attestation by @detail-app[bot] in #676
• chore: remove unused fido2_types convenience type aliases by @detail-app[bot] in #677
• chore: remove unused RsaPssSha512/RsaV15Sha256 implementations by @detail-app[bot] in #678
• chore(httpsig): remove unused build_request_base and build_response_base wrappers by @detail-app[bot] in #679
• chore: remove degenerate test_aaguid_mismatch no-op test by @detail-app[bot] in #680
• chore: remove unused make_es256_cose_key and make_rs256_cose_key test helpers by @detail-app[bot] in #682
• chore: remove dead Document::expires_at wrapper field by @detail-app[bot] in #683
• chore: remove dead doc_id and consumed_at fields from ChallengeStateDoc by @detail-app[bot] in #684
• chore: remove unused OAuthEventType::as_str method by @detail-app[bot] in #685
• chore: remove dead TokenValidationContext::expected_audience field by @detail-app[bot] in #681
• fix(server): enforce access-token audience at resource endpoints (#688) by @jplock in #689
• build: upgrade toolchain to Rust 1.97.0 (#657) by @jplock in #690
• feat(aws): pin OIDC tokens to the requested role via the STS roles claim by @jplock in #691
• ci: bump the actions group with 4 updates by @dependabot[bot] in #692
• test(server): cite the documented role ARN length cap and boundary-test it by @jplock in #694
• docs: remove change-history narration from code comments by @jplock in #695
• docs(server): rewrite change-history comments as current-behavior docs by @jplock in #696
• prep 2026.7.2 release by @jplock in #697

Full Changelog: v2026.7.1...v2026.7.2