v2026.8.1

Installation

Homebrew (macOS)

brew install vouch-sh/tap/vouch

To start the agent automatically:

brew services start vouch

winget (Windows)

winget install SmokeTurner.Vouch

APT Repository (Debian/Ubuntu)

curl -fsSL https://packages.vouch.sh/gpg/vouch.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/vouch-archive-keyring.gpg > /dev/null

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/vouch-archive-keyring.gpg] https://packages.vouch.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/vouch.list > /dev/null

sudo apt-get update && sudo apt-get install -y vouch

YUM/DNF Repository (Fedora/RHEL)

sudo tee /etc/yum.repos.d/vouch.repo << 'EOF'
[vouch]
name=Vouch
baseurl=https://packages.vouch.sh/rpm/$basearch/
gpgcheck=1
gpgkey=https://packages.vouch.sh/gpg/vouch.asc
enabled=1
EOF

sudo dnf install -y vouch

DEB Package (Debian/Ubuntu)

# amd64
gh release download v2026.8.1 --repo vouch-sh/vouch --pattern "vouch_2026.8.1_amd64.deb"
sudo dpkg -i vouch_2026.8.1_amd64.deb

# arm64
gh release download v2026.8.1 --repo vouch-sh/vouch --pattern "vouch_2026.8.1_arm64.deb"
sudo dpkg -i vouch_2026.8.1_arm64.deb

RPM Package (Fedora/RHEL)

# x86_64
gh release download v2026.8.1 --repo vouch-sh/vouch --pattern "vouch-2026.8.1-1.x86_64.rpm"
sudo rpm -i vouch-2026.8.1-1.x86_64.rpm

# aarch64
gh release download v2026.8.1 --repo vouch-sh/vouch --pattern "vouch-2026.8.1-1.aarch64.rpm"
sudo rpm -i vouch-2026.8.1-1.aarch64.rpm

Binary Downloads

Download the appropriate binary for your platform from the release assets below.

Platform	Architecture	Archive
Linux	x86_64	vouch-v2026.8.1-x86_64-unknown-linux-musl.tar.gz
Linux	aarch64	vouch-v2026.8.1-aarch64-unknown-linux-musl.tar.gz
macOS	Apple Silicon	vouch-v2026.8.1-aarch64-apple-darwin.tar.gz
Windows	x86_64	vouch-v2026.8.1-x86_64-pc-windows-msvc.zip
Windows	ARM64	vouch-v2026.8.1-aarch64-pc-windows-msvc.zip

Verify integrity

sha256sum -c SHA256SUMS.txt

Verify provenance

gh attestation verify vouch-v2026.8.1-aarch64-apple-darwin.tar.gz --owner vouch-sh

Using Helm (OCI)

helm install vouch-server oci://ghcr.io/vouch-sh/charts/vouch-server \
  --version 2026.8.1 \
  --namespace vouch-server \
  --create-namespace

Using Helm (from release assets)

helm install vouch-server \
  https://github.com/vouch-sh/vouch/releases/download/v2026.8.1/vouch-server-2026.8.1.tgz \
  --namespace vouch-server \
  --create-namespace

Container Image

docker pull ghcr.io/vouch-sh/vouch:v2026.8.1

Verify Attestations

# Container image
gh attestation verify oci://ghcr.io/vouch-sh/vouch:v2026.8.1 \
  --owner vouch-sh

# Binary archives
gh attestation verify vouch-v2026.8.1-aarch64-apple-darwin.tar.gz --owner vouch-sh

What's Changed

• fix(jwt-bearer): enforce JWK use/alg constraints in kid-match path by @detail-app[bot] in #794
• fix(audit): normalize email case for domain filtering and HMAC correlation by @detail-app[bot] in #795
• fix(server): warn on missing KMS partition/region in with_account_id by @detail-app[bot] in #798
• ci: run required checks on merge_group for merge queue by @jplock in #806
• fix(db): normalize email to lowercase to prevent cross-protocol duplicate users by @detail-app[bot] in #804
• fix(cli): fall through empty AGENT env var to vendor-specific detection by @detail-app[bot] in #799
• fix(server): treat empty AWS region/AZ/partition values as unset by @detail-app[bot] in #781
• fix(cli): wait for CTAP2 readiness on YubiKey early-return path by @detail-app[bot] in #797
• fix(server): resolve KMS clients and key ARNs in the S3 config region by @detail-app[bot] in #800
• fix(cli): validate region partition matches role ARN before STS call by @detail-app[bot] in #801
• fix(server): use os_build for Windows OsRecency instead of 4-component os_version by @detail-app[bot] in #802
• fix(enroll): set auth_time on browser_register_complete session by @detail-app[bot] in #803
• fix(cli): propagate child exit code on Windows in exec and git-remote-codecommit by @detail-app[bot] in #805
• fix(server/db): deterministic user ID closes concurrent SCIM create race by @detail-app[bot] in #796
• ci: fast merge-group gates and default-branch-only bake cache writes by @jplock in #807
• chore: version bump by @jplock in #809
• fix(cli): validate SSM setup region partition against role ARN by @detail-app[bot] in #814
• fix(server): treat empty aws_use_fips_endpoint as unset by @detail-app[bot] in #815
• fix(server/db): lowercase userName/email SCIM eq filter for case-insensitive lookup by @detail-app[bot] in #816
• fix(cli): validate CodeCommit region partition against the minting role by @jplock in #817
• chore: refresh detail rules from proposal run by @jplock in #818
• ci: bump the actions group with 3 updates by @dependabot[bot] in #819
• chore: remove dead S3AcmeConfig from s3_config by @detail-app[bot] in #821
• chore: remove unused x5c field from JwkEntry by @detail-app[bot] in #822
• chore: remove dead sub_path_for_claims variable by @detail-app[bot] in #823
• docs: document _acme as a reserved S3 config key by @jplock in #824
• feat(server): add org-scoped audit events API with OCSF export by @jplock in #825
• fix(scim): reject user provisioning outside org's verified domains by @jplock in #826
• perf(server): batch user lookups on the admin audit page by @jplock in #829
• bump to 2026.8.1 by @jplock in #830
• docs(scim): remove stale email field from audit logging table by @detail-app[bot] in #832
• fix(scim): validate domain ownership inside user creation transaction to close TOCTOU race by @detail-app[bot] in #835
• fix(server): match Bearer/DPoP auth schemes case-insensitively per RFC 9110 by @detail-app[bot] in #836
• fix(server): key JIT account linking on upstream (issuer, subject) by @jplock in #837
• fix(scim): set User meta.lastModified from updated_at, not created_at by @detail-app[bot] in #851
• fix(cli): strip explicit :443 from host before CodeCommit/GitHub credential helper matching by @detail-app[bot] in #853
• fix(scim): make externalId co/sw filters case-sensitive per RFC 7644 by @detail-app[bot] in #855
• fix(server): return 404 from toggle_custom_policy when update did not occur by @detail-app[bot] in #856
• fix(server): revoke user sessions on device code race-loser AlreadyConsumed by @detail-app[bot] in #859
• fix(cli): propagate default_kubeconfig_path error in setup eks by @detail-app[bot] in #852
• fix(server): check user.active in OAuth token introspection by @detail-app[bot] in #850
• fix(oidc): return invalid_token instead of invalid_client for RFC 7592 registration bearer-token failures by @detail-app[bot] in #857
• fix(server): emit source-specific activity_name for OCSF activity_id 99 events by @detail-app[bot] in #854
• fix(router): place metrics middleware outside TimeoutLayer so 408s are recorded by @detail-app[bot] in #858
• fix(server): record email on browser login audit events by @jplock in #860
• fix(server): return 404 from member actions when the target vanished by @jplock in #861
• fix(server): close deactivation bypass in SSO, device flow, and key registration by @jplock in #862
• fix(cli): preserve original host in CodeCommit helper for git credential cache by @detail-app[bot] in #865
• fix(oidc): omit error parameter from RFC 7592 missing-token challenge by @detail-app[bot] in #866
• update deps by @jplock in #867
• fix: close empty-region, host-casing, and deactivation gaps by @jplock in #869
• ci: cache bake deps on GHCR and build CI with thin LTO by @jplock in #870
• ci: delete untagged cache package versions weekly by @jplock in #871
• ci: stop passing SOURCE_DATE_EPOCH to the bake ci target by @jplock in #873
• refactor(server): unify session extractors behind one active-user check by @jplock in #872
• ci: compress the GHCR deps cache with zstd by @jplock in #875
• refactor(server): canonicalize emails through an Email newtype by @jplock in #874
• ci: build Linux with plain cargo and drop the layer-cache stack by @jplock in #876
• refactor(server): centralize auth wire helpers; SCIM OCC exhaustion is 503 by @jplock in #877
• test: hold test and comment mass to the production bar by @jplock in #878
• docs: correct release verification bake target from ci to server by @detail-app[bot] in #879
• refactor(test): split test monoliths into per-topic child modules by @jplock in #880
• log aws-lc-rs version by @jplock in #881

Full Changelog: v2026.7.4...v2026.8.1