v2026.8.4

Installation

Homebrew (macOS)

brew install vouch-sh/tap/vouch

To start the agent automatically:

brew services start vouch

winget (Windows)

winget install SmokeTurner.Vouch

APT Repository (Debian/Ubuntu)

curl -fsSL https://packages.vouch.sh/gpg/vouch.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/vouch-archive-keyring.gpg > /dev/null

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/vouch-archive-keyring.gpg] https://packages.vouch.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/vouch.list > /dev/null

sudo apt-get update && sudo apt-get install -y vouch

YUM/DNF Repository (Fedora/RHEL)

sudo tee /etc/yum.repos.d/vouch.repo << 'EOF'
[vouch]
name=Vouch
baseurl=https://packages.vouch.sh/rpm/$basearch/
gpgcheck=1
gpgkey=https://packages.vouch.sh/gpg/vouch.asc
enabled=1
EOF

sudo dnf install -y vouch

DEB Package (Debian/Ubuntu)

# amd64
gh release download v2026.8.4 --repo vouch-sh/vouch --pattern "vouch_2026.8.4_amd64.deb"
sudo dpkg -i vouch_2026.8.4_amd64.deb

# arm64
gh release download v2026.8.4 --repo vouch-sh/vouch --pattern "vouch_2026.8.4_arm64.deb"
sudo dpkg -i vouch_2026.8.4_arm64.deb

RPM Package (Fedora/RHEL)

# x86_64
gh release download v2026.8.4 --repo vouch-sh/vouch --pattern "vouch-2026.8.4-1.x86_64.rpm"
sudo rpm -i vouch-2026.8.4-1.x86_64.rpm

# aarch64
gh release download v2026.8.4 --repo vouch-sh/vouch --pattern "vouch-2026.8.4-1.aarch64.rpm"
sudo rpm -i vouch-2026.8.4-1.aarch64.rpm

Binary Downloads

Download the appropriate binary for your platform from the release assets below.

Platform	Architecture	Archive
Linux	x86_64	vouch-v2026.8.4-x86_64-unknown-linux-musl.tar.gz
Linux	aarch64	vouch-v2026.8.4-aarch64-unknown-linux-musl.tar.gz
macOS	Apple Silicon	vouch-v2026.8.4-aarch64-apple-darwin.tar.gz
Windows	x86_64	vouch-v2026.8.4-x86_64-pc-windows-msvc.zip
Windows	ARM64	vouch-v2026.8.4-aarch64-pc-windows-msvc.zip

Verify integrity

sha256sum -c SHA256SUMS.txt

Verify provenance

gh attestation verify vouch-v2026.8.4-aarch64-apple-darwin.tar.gz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

Using Helm (OCI)

helm install vouch-server oci://ghcr.io/vouch-sh/charts/vouch-server \
  --version 2026.8.4 \
  --namespace vouch-server \
  --create-namespace

Using Helm (from release assets)

helm install vouch-server \
  https://github.com/vouch-sh/vouch/releases/download/v2026.8.4/vouch-server-2026.8.4.tgz \
  --namespace vouch-server \
  --create-namespace

Container Image

docker pull ghcr.io/vouch-sh/vouch:2026.8.4

Verify Attestations

# Container image
gh attestation verify oci://ghcr.io/vouch-sh/vouch:2026.8.4 \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

# Binary archives
gh attestation verify vouch-v2026.8.4-aarch64-apple-darwin.tar.gz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

# Helm chart
gh attestation verify vouch-server-2026.8.4.tgz \
  --owner vouch-sh \
  --signer-workflow vouch-sh/vouch/.github/workflows/reusable-build.yml

What's Changed

• fix(server): pass mTLS client cert in OptionalAuthenticatedToken by @detail-app[bot] in #898
• fix(scim): reject NUL bytes in group member user_ids by @detail-app[bot] in #899
• feat(cli): discover account access manager entitlements in aws setup by @jplock in #902
• docs: correct renamed CLI i18n module path by @detail-app[bot] in #903
• fix(scim): return 500 for group creation infrastructure errors by @detail-app[bot] in #918
• fix(server): accept SAML assertions with any valid SubjectConfirmation by @detail-app[bot] in #922
• fix(server): reject deactivated users in CLI key registration complete by @detail-app[bot] in #923
• fix(server): attribute denials per rule in multi-rule custom policies by @detail-app[bot] in #925
• fix(oidc): redact bearer tokens in Debug for exchange result structs by @detail-app[bot] in #927
• fix(scim): prevent duplicate group memberships under concurrent adds by @detail-app[bot] in #917
• fix(server): return false from delete_user when user is missing by @detail-app[bot] in #928
• fix(server): return DPoP-Nonce header on use_dpop_nonce at resource endpoints by @detail-app[bot] in #919
• fix(scim): apply Add operation to all single-valued attributes in PATCH by @detail-app[bot] in #921
• fix(server): accept session at max_age boundary in post-login validation by @detail-app[bot] in #924
• fix(server): reject invalid access_scope and fapi_profile values by @detail-app[bot] in #929
• fix(server): enforce FAPI sender-constraints on device flow tokens by @detail-app[bot] in #920
• fix(server): redact plaintext credentials in Debug output by @jplock in #931
• fix(oidc): require a sender-constraint witness to issue any token by @jplock in #933
• fix(server): transfer org-scoped applications when their creator is deleted by @jplock in #930
• refactor(scim): apply PATCH operations through a shared attribute table by @jplock in #932
• fix(server): return server_error for device flow infrastructure failures by @jplock in #934
• fix(oidc): preserve use_dpop_nonce error at /oauth/register (#935) by @detail-app[bot] in #937
• fix(server): return token_type DPoP for DPoP-bound device flow tokens by @detail-app[bot] in #938
• chore: add detail rules for error-converter parity and DPoP token_type by @jplock in #939
• build(deps): bump dogwood, aws-sdk-dsql, aws-smithy-types, sea-query by @jplock in #940
• docs: correct wrapper helper pattern to not skip WWW-Authenticate on 401 by @detail-app[bot] in #942
• docs: remove stale device.rs bug reference from DPoP token-type rule by @detail-app[bot] in #941
• ci: run cargo-deny bans check in CI, release gate, and make audit by @jplock in #945
• feat(server): serve RFC 9116 security.txt by @jplock in #946
• fix(agent): verify peer UID on SSH agent socket and validate runtime dir first by @jplock in #947
• ci: achieve SLSA Build Level 3 via reusable build workflow by @jplock in #948

Full Changelog: v2026.8.3...v2026.8.4