add openbao package

[wojciechka]

For new package PRs only

• REQUIRED - The package is available under an OSI-approved or FSF-approved license
• REQUIRED - The version of the package is still receiving security updates
• This PR links to the upstream project's support policy (e.g. endoflife.date)

[wojciechka]

For CVE, will ad an advisory at a later date

[kranurag7]

Great work!! looks like we need will also a compat package for this linking binary at /bin/bao and a further linking of the same at /bin/vault.

[wojciechka]

Great work!! looks like we need will also a compat package for this linking binary at /bin/bao and a further linking of the same at /bin/vault.

@kranurag7 added - please review the compat package definition

[kranurag7]

@wojciechka thanks for the work here.

We'll need the following change:
/bin/bao should link to /usr/bin/bao and /bin/vault should link to /bin/bao

[powersj]

@cipherboy FYI :)

[cipherboy]

@wojciechka @powersj Thank you both for getting this started!

• This PR links to the upstream project's support policy (e.g. endoflife.date)

As a FYI, this will be discussed on this Thursday's OpenBao TSC call. I suspect since the community is smaller without many commercial backers, we'll likely stick to an only-latest support policy.

But once that decision is made we'll publish something officially. I think openbao/openbao#426 tracks this on our side.

[wojciechka]

We'll need the following change:
/bin/bao should link to /usr/bin/bao and /bin/vault should link to /bin/bao

@kranurag7 done, PTAL

[kranurag7]

thanks for the work again, the symlink looks good now.

[kranurag7]

we can consider using go/bump pipeline to fix the CVEs in here?

  - uses: go/bump
    with:
      deps: github.com/anchore/archiver/[email protected]
      replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/[email protected]

[wojciechka]

we can consider using go/bump pipeline to fix the CVEs in here?

  - uses: go/bump
    with:
      deps: github.com/anchore/archiver/[email protected]
      replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/[email protected]

No, I would not do that. That is a fork, the project is aware of the issue (I emailed openbao-security list yesterday). It is also confirmed that it is a false positive in our case - it is used by debug subcommand and the package is only writing archives, the CVE talks about user-injected archives.

I believe It's better to add an advisory for this and mark it as false positive.