diff --git a/TI-reports/2026/2026-Q3-OpenBao.md b/TI-reports/2026/2026-Q3-OpenBao.md new file mode 100644 index 00000000..09ff0f55 --- /dev/null +++ b/TI-reports/2026/2026-Q3-OpenBao.md @@ -0,0 +1,249 @@ +# 2025 Q4 through 2026 Q3 OpenBao TAC update + +OpenBao's last OpenSSF TAC update was about a year ago: +https://gist.github.com/cipherboy/4bb66fe9967fd103a44ea561baaaa4e9 + +(This update never seems to have landed [in the TAC repo](https://github.com/ossf/tac/pull/501#pullrequestreview-3019995464) + though was shared with the Ryan in DMs with [him and Michael Hofer](https://openssf.slack.com/archives/C0963HC7R70/p1753197590786179)). + +**TSC Chair**: Michael Hofer + +**Dev WG Chair**: Alexander Scheel + +## About + +[OpenBao](https://openbao.org/) securely manages static and dynamic secrets, +certificates, and keys at scale, allowing greater auditing for compliance with +best practices. This is important because many other solutions don't allow for +centralized risk accounting and inventory. + +## Overview + +OpenBao's community has continued to grow and iterate on the project's +governance and functionality. We've made three new major release series +(13 total releases), seen adoption exceed 2M combined downloads, and managed +the increased load AI security findings have placed on the community. In the +next couple of releases, we'll likely reach reasonably full parity with Vault +Enterprise and continue innovating in novel directions. + +Lack of a formal working group hasn't negatively affected us, as so far we've +mostly routed through OpenSSF staff when relevant discussions needed to occur. + +On the whole, things are going very well for the project. + +### Challenges + +- Marketing and project visibility help is always appreciated. +- AI-assisted CVE deluge has continued, though OpenSSF staff has continued to + try to enable the project to get access to either Alpha/Omega or newer + replacement projects to help get ahead of this. The broader community has + been able to keep up with volume just fine, though. + +## Leadership + +In the last year, the following project leadership changes have occurred: + + - Alex S. left GitLab in January 2026, causing him to step down his TSC Chair + position so it continued to be held by an active TSC member. Michael H. + volunteered and was accepted by the TSC as chair. + - Alex S. acquired an individual TSC seat and subsequently rolled that into a + seat for ControlPlane in May 2026, a new entity on the TSC. + - The last IBM representative (Nathan P.) has fully left the project as of + June 2026, though IBM stepped down as a TSC member in January 2026. + - In September 2025, SAP (Klaus K., as member and Jonas K. from Reply as + alternate) joined the TSC. + - Four new voting members of the Dev WG (representing Reply and Adfinis) were + accepted in June 2026 (Huy D., Wojciech S., Pascal R., and Philipp S.). + - Jonas K. was promoted to org-wide maintainer (representing Reply) in March + 2026. + - Three new subsystem committers were added, representing Adfinis and + Securosys (Philipp S., Tomasz M., and Valentin W.) + - Four new org-wide moderators were invited, representing Adfinis, SAP, and + Ericsson (Philipp S., Klaus K., Tero S., and Valentin W.). + - WALLIX (Dan G. and Julian C.) and IOTech Systems (James B. and Brad C.) + renewed their TSC seat for another 2-year term in July 2026. + +Current status of the TSC and Dev WG can be seen on our [`CONTRIBUTING.md` +file](https://github.com/openbao/openbao/blob/main/CONTRIBUTING.md#technical-steering-committee-tsc-members) +and state of our maintainers, committers, and moderators can be seen on our +[`MAINTAINERS.md` file](https://github.com/openbao/openbao/blob/main/MAINTAINERS.md). +The TSC continues to regularly meet and/or handle business asynchronously on +the mailing list or Zulip. + +The TSC split our existing roadmap into [Project +Direction](https://docs.google.com/document/d/1oNqm4GXCsIZbcNHsIqft4kgciRcuwS9rrIRGXlMz1yg/edit?tab=t.j9lcyrvl3939#heading=h.9n1zwjabxqai) +and [Development Direction](https://docs.google.com/document/d/1oNqm4GXCsIZbcNHsIqft4kgciRcuwS9rrIRGXlMz1yg/edit?tab=t.j9lcyrvl3939#heading=h.f8brm190ymhh) +documents in March 2026 to set tangible and measurable yearly goals for the +project. + +## Releases + +OpenBao has made three major release series +([v2.4.x](https://openbao.org/community/release-notes/2-4-0/), +[v2.5.x](https://openbao.org/community/release-notes/2-5-0/), and +[v2.6.x](https://openbao.org/community/release-notes/2-6-0/)) since the last +update. + +The direct repository has seen [over 600k +downloads](https://tooomm.github.io/github-release-stats/?username=openbao&repository=openbao), +[over 1M+ DockerHub container pulls](https://hub.docker.com/r/openbao/openbao) +on our main image, and another [500k on +GHCR](https://github.com/openbao/openbao/pkgs/container/openbao). Quay regularly +sees [40k+ daily downloads](https://quay.io/repository/openbao/openbao) but +does not provide total download statistics. + +### v2.4.x + +**Release date**: August 28, 2025 + +The v2.4.x series brought key improvements to operability: declarative +self-initialization and audit devices (enabling templated deployment of +new instances); inline authentication (with no storage requirements unlike +regular token authentication); and ACL filtering of LIST and SCAN responses. +These worked towards our [roadmap goals](https://github.com/openbao/openbao/issues/569) +of **Safer** and **Scalability**. + +### v2.5.x + +**Release date**: February 4, 2026 + +The v2.5.x series brought key improvements to scalability: horizontal read +scalability on the Raft storage backend and configuration-driven plugin +registration with distribution via OCI images. These worked towards our +[roadmap goals](https://github.com/openbao/openbao/issues/569) of +**Community** and **Scalability**. + +### v2.6.x + +**Release date**: July 22, 2026 + +The v2.6.x series brought key improvements to security: per-namespace seals +to allow strong, cryptographic separation of tenants; externally pluginizing +auto-unseal to decouple releases and allow consumption of third-party KMS +devices; and the new workflow engine for native governance and cross-plugin +communication. These worked towards our [roadmap +goals](https://github.com/openbao/openbao/issues/1974) of **Sustainability** +and **Operator Experience**. + +Alex S. is working with the OpenSSF to land this release on the blog post. + +### Future + +v2.7.0 is already underway with PostgreSQL horizontal read scalability and +external HSM/KMS backed key material planned. Namespaces might see auto-unseal +support and other general improvements around multi-node consistency are also +underway. + +v2.8.0 will likely see improvements around authorization (allowing tying into +OPA or CEL), post-quantum algorithm adoption now that Go will have support for +ML-DSA, better break-glass recovery, and other foundational stabilizations and +refactors. + +Much of the rest of the roadmap will likely shift from 2026 into 2027+. + +## Community + +The community has continued to see growth the [number of contributors +YoY](https://insights.linuxfoundation.org/project/openbao/contributors?timeRange=past365days&start=2025-07-23&end=2026-07-23) +per LFX Insights: + +- 456 contributors, up 85% YoY +- 135 organizations, up 62% YoY +- Three contributors for 57% of all contributions, down from two contributors + for 53% of all contributions YoY. +- Three organizations for 65% of all contributions, down from two organizations + for 57% of all contributions YoY. +- Overall contribution volume has also improved. + +The community continues to see consistent participation in its regular working +group calls, though the broader community call's attendance has dropped. The +community has published 10 blog posts in the past year, down from 18 the year +before. + +OpenBao now has an [ecosystem page](https://openbao.org/ecosystem/), where +we've begun soliciting supporters, integrators, adopters, and vendors to +include their logos and a description of their involvement and a [news +page](https://openbao.org/ecosystem/news/) highlighting OpenBao at +conferences, blogs, and other publications. + +OpenBao contributors continue to work with other projects such as +[ESO](https://github.com/external-secrets/external-secrets/issues/6446) +and [FluxCD](https://fluxcd.io/blog/2026/07/flux-openbao-secrets-signatures/). + +### Development WG + +The Development WG is a top-level working group reporting to the OpenBao TSC, +focused on leading all day-to-day development actions. It directly handles +roadmap planning (subject to approval by the TSC), handles security incidents, +and has spun off a number of project-scoped sub-working groups discussed below: + +- **Horizontal Scalability WG**, focused on improving scalability of OpenBao. + When forked, OpenBao had no horizontal scalability and only had high + availability based on Vault Community/Enterprise edition's open core + feature differentiation. +- **Namespaces WG**, focused on bringing strong multi-tenancy to OpenBao. +- **UI WG**, focused on improvements to OpenBao's UI. +- **PKCS#11/KMS WG**, focused on using and integrating with various third-party + hardware security modules or key management systems, such as in Transit, PKI, + or for auto-unseal. +- **Supply Chain Security WG**, focused on meeting OpenSSF project + requirements and improving OpenBao's security posture in our + dependency tree. + +#### Horizontal Scalability WG + +The Horizontal Scalability WG saw the release of its flagship feature, Raft +horizontal scalability, and is working towards PostgreSQL horizontal +scalability. Designs for future write scalability are under discussion and +the community sees continued involvement and will continue for the foreseeable +future. + +#### Namespaces WG + +The Namespaces WG had previously underseen the release of the namespaces +feature and just shipped per-namespace sealing via Shamir's (manual +unseal). Up next will be auto-unseal support for namespace sealing followed +likely by assisting the Horizontal Scalability WG with write scaling based on +namespace sharding. + +Designs from GitLab had initially been proposed for a broader extended roadmap +for this working group but unless there's broader community buy-in, the +namespaces WG may fold into the horizontal scalability WG or may find other +avenues to continue. This is expected as namespaces were a broad but +self-contained agenda. + +#### UI WG + +The UI WG initially was working on a rewrite of the UI in React. This effort +has largely stalled and will not be continued. The UI WG is effectively +discontinued and may be formally disbanded later. + +#### PKCS#11/KMS WG + +The PKCS#11/KMS WG continues to see broad participation from multiple +entities. Many new KMS libraries have been built especially as support for +external KMS plugins landed in v2.6.x. Support for external keys in v2.7.0 is +this WG's immediate focus but work on KMIP server support is also happening. +This working group will likely continue indefinitely and sponsor most of the +post-quantum adoption work in the future as well. + +#### Supply Chain Security WG + +The WG has seen varying levels of participation and interest but overall +achieved various improvements such as adopting `security-insights.yml`, the +creation of [dependency-vulnerabilities](https://github.com/openbao/dependency-vulnerabilities) +to scan for and triage vulnerabilities, and renewed activities to push the +adoption of OSPS over the finish line. + +### Marketing WG + +While the Marketing WG is in motion to become our second dedicated top-level WG, +the community was able to achieve several improvements. It established the +already mentioned [ecosystem page](https://openbao.org/ecosystem/) which grew +already to 20+ members through proactive outreach. In addition, the +[ecosystem news](https://openbao.org/ecosystem/news/) is its newest addition +to spotlight publications from the wider community. For social media, the +community has revived its LinkedIn account with overall good success. The +amount of follower grew to 939 (up 798) with over 40 posts in the past year. +In terms of events and talks, the community was activate at several events +with sponsored booths and various talks to promote the project.