# OpenBao v2.7.1 corresponding source

This source offer corresponds to candidate tag `v2.7.1-tpio.1`, manifest
`sha256:d7bc22f2f86c33ed96e29ba3d10975def3d492a83914caa00994e3e2b948d79a`.
Publishing this source offer does not publish the image tag.

Download the official release archive listed in `archives.json` and the files
in this directory, then verify `SHA256SUMS`. The release archive is OpenBao
v2.7.1, which includes the Kubernetes auth JWT renewal fix for
GHSA-gf3j-hm38-jhh5. It retains the upstream MPL-2.0 licence. The pinned
source commit is `a5db72cef75c24b920ade02065b18dd8eb666bac`.

`Containerfile` is the exact build recipe used for this candidate. It rebuilds
the Ember UI from that same tarball with Node 20.20.0 and pnpm 10.34.4, then
builds `bao` with Go 1.27.3 for linux/amd64, CGO disabled, `-tags openbao,ui`,
the standard `golang.org/x/net@v0.60.0` bump, and a nonroot scratch runtime
(UID/GID 65532). `GitDescribe` is not stamped; `fullVersion` is `2.7.1`.
Go 1.27.3 includes the crypto/x509 fix for CVE-2026-111943 / GO-2026-6809.
Build records were extracted from this exact image: original and effective
go.mod and go.sum, vendor/modules.txt, binary Go build information, UI
package.json and pnpm-lock.yaml, upstream commit, licence, and module overrides.

Rebuild using the digest-pinned SDKs and checksum-pinned release archive:

```sh
podman build --platform linux/amd64 --file Containerfile \
  --tag localhost/openbao:v2.7.1-tpio.1 .
```

This reproduces the source/build configuration; no byte-for-byte image
reproducibility claim is made. `build-record.json` binds this offer to the
actual candidate manifest and image labels. `validation.json` is a sanitized
export of the passing official-chart functional result for that same digest
(harden.yml run 797). The test used chart 0.30.4, verified UID 65532, init
and unseal, a KV write/read, persistence across a pod restart, metrics, and
the embedded UI. Image publication requires a fresh unsuppressed zero
critical/high scan and all nine real Kubernetes checks to pass.