openbao-cli

Install the OpenBao bao CLI with pip or uv. No package manager, no manual download, no PATH surgery.

Install

pip install openbao-cli

Or as a standalone tool:

uv tool install openbao-cli

Or run it once without installing:

uvx --from openbao-cli bao version

Usage

bao is the real OpenBao CLI, so every upstream command works unchanged:

bao version
bao server -dev
export BAO_ADDR=http://127.0.0.1:8200
bao status
bao kv put secret/example password=hunter2
bao kv get -field=password secret/example

The openbao command is an alias for bao, for anyone who prefers the longer name.

Supported platforms

macOS 11 and earlier are not supported: the upstream binary is built with a minimum deployment target of macOS 12 and will not launch on older releases.

On any other platform, pip falls back to the source distribution, which contains no binary and fails the install with an explicit message rather than installing something that cannot run.

How it works

Each wheel bundles the official bao binary for one platform. The bao entry point replaces itself with that binary using execv, so signal delivery, interactive prompts, streamed logs and exit codes are exactly the real CLI's. On Windows, where execv has no equivalent, the binary is launched as a child process with inherited stdio.

Nothing is downloaded at install time or at first run. An install from a wheel works offline.

Verification

Every wheel is built from an official upstream release archive. Before a wheel is produced, the build:

1. verifies checksums.txt against OpenBao's GPG release key, pinned to fingerprint 66D15FDD87287219C8E15478D200CD702853E6D0, using a copy of the key committed to this repository rather than one fetched from the release being checked;
2. verifies the archive's SHA-256 against that now-trusted checksums.txt;
3. for Linux targets, confirms the binary needs no glibc symbol newer than 2.17, which is what the manylinux_2_17 tag promises.

Any of these failing aborts the build. No wheel is published from an artifact that could not be verified.

Versioning

The package version tracks the upstream OpenBao version exactly. Version 2.6.1 of this package contains OpenBao 2.6.1.

A .postN suffix (for example 2.6.1.post1) means a fix to the Python wrapper with the same upstream binary.

License and attribution

The wrapper code in this repository is MIT licensed.

The bundled bao binary is OpenBao, redistributed unmodified under the Mozilla Public License 2.0. Its source is at https://github.com/openbao/openbao, and the corresponding source for the exact bundled version is linked from the NOTICE file installed alongside the binary.

This is an unofficial repackaging. It is not affiliated with, endorsed by, or supported by the OpenBao project or the Linux Foundation. Report bugs in bao itself upstream; report packaging bugs here.