openbao / openbao

OpenBao / OpenBao

OpenBao OpenBao

Please note: We take OpenBao’s security and our users’ trust very seriously. If you believe you have found a security issue in OpenBao, please responsibly disclose by contacting us at openbao-security@lists.openssf.org. 请注意：我们非常重视 OpenBao 的安全性以及用户的信任。如果您认为自己发现了 OpenBao 中的安全问题，请通过 openbao-security@lists.openssf.org 与我们联系，以负责任的方式披露。

#openssf-openbao-discussion #openssf-openbao-support #openssf-openbao-tsc #openssf-openbao-discussion #openssf-openbao-support #openssf-openbao-tsc

Working Groups: #openssf-openbao-wg #openssf-openbao-wg-namespaces #openssf-openbao-wg-pkcs11 #openssf-openbao-wg-scalability #openssf-openbao-wg-supply #openssf-openbao-wg-ui 工作组：#openssf-openbao-wg #openssf-openbao-wg-namespaces #openssf-openbao-wg-pkcs11 #openssf-openbao-wg-scalability #openssf-openbao-wg-supply #openssf-openbao-wg-ui

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. The OpenBao community intends to provide this software under an OSI-approved open-source license, led by a community run under open-governance principles. OpenBao 是一款用于管理、存储和分发敏感数据（包括密钥、证书和密码）的软件解决方案。OpenBao 社区旨在通过 OSI 批准的开源许可证提供该软件，并由遵循开放治理原则的社区进行领导。

A modern system requires access to a multitude of secrets: database credentials, API keys for external services, credentials for service-oriented architecture communication, etc. Understanding who is accessing what secrets is already very difficult and platform-specific. Adding on key rolling, secure storage, and detailed audit logs is almost impossible without a custom solution. This is where OpenBao steps in. 现代系统需要访问大量的机密信息：数据库凭据、外部服务的 API 密钥、面向服务架构通信的凭据等。了解谁在访问哪些机密信息本身就非常困难且具有平台依赖性。若没有定制的解决方案，想要实现密钥轮换、安全存储和详细的审计日志几乎是不可能的。这正是 OpenBao 的用武之地。

The key features of OpenBao are: OpenBao 的主要功能包括：

Secure Secret Storage: Arbitrary key/value secrets can be stored in OpenBao. OpenBao encrypts these secrets prior to writing them to persistent storage, so gaining access to the raw storage isn’t enough to access your secrets. OpenBao can write to disk, PostgreSQL, and more. 安全机密存储：OpenBao 可以存储任意键/值对形式的机密信息。OpenBao 在将这些机密写入持久化存储之前会对其进行加密，因此仅获取原始存储数据的访问权限不足以窃取您的机密。OpenBao 支持写入磁盘、PostgreSQL 等多种存储后端。

Dynamic Secrets: OpenBao can generate secrets on-demand for some systems, such as AWS or SQL databases. For example, when an application needs to access an S3 bucket, it asks OpenBao for credentials, and OpenBao will generate an AWS keypair with valid permissions on demand. After creating these dynamic secrets, OpenBao will also automatically revoke them after the lease is up. 动态机密：OpenBao 可以为某些系统（如 AWS 或 SQL 数据库）按需生成机密。例如，当应用程序需要访问 S3 存储桶时，它会向 OpenBao 请求凭据，OpenBao 会按需生成具有有效权限的 AWS 密钥对。在创建这些动态机密后，OpenBao 也会在租约到期后自动撤销它们。

Data Encryption: OpenBao can encrypt and decrypt data without storing it. This allows security teams to define encryption parameters and developers to store encrypted data in a location such as a SQL database without having to design their own encryption methods. 数据加密：OpenBao 可以在不存储数据的情况下对其进行加密和解密。这使得安全团队能够定义加密参数，而开发人员可以将加密数据存储在 SQL 数据库等位置，而无需自行设计加密方法。

Leasing and Renewal: All secrets in OpenBao have a lease associated with them. At the end of the lease, OpenBao will automatically revoke that secret. Clients are able to renew leases via built-in renew APIs. 租约与续期：OpenBao 中的所有机密都关联有一个租约。租约到期时，OpenBao 会自动撤销该机密。客户端可以通过内置的续期 API 延长租约。

Revocation: OpenBao has built-in support for secret revocation. OpenBao can revoke not only single secrets, but a tree of secrets, for example, all secrets read by a specific user, or all secrets of a particular type. Revocation assists in key rolling as well as locking down systems in the case of an intrusion. 撤销：OpenBao 内置了对机密撤销的支持。OpenBao 不仅可以撤销单个机密，还可以撤销整个机密树，例如撤销特定用户读取的所有机密，或特定类型的所有机密。撤销功能有助于密钥轮换，并在发生入侵时锁定系统。

Documentation and Getting Started: Documentation is available on the OpenBao website. 文档与入门：文档可在 OpenBao 网站上查阅。

Developing OpenBao: Warning: Before submitting pull requests to OpenBao, ensure that you have read and understood our contribution guidelines described in CONTRIBUTING.md. A failure to do so will likely result in your pull request being rejected. 开发 OpenBao：警告：在向 OpenBao 提交拉取请求（Pull Request）之前，请确保您已阅读并理解 CONTRIBUTING.md 中描述的贡献指南。未能遵守这些指南很可能会导致您的拉取请求被拒绝。

If you wish to work on OpenBao itself or any of its built-in systems, you’ll first need Go installed on your machine. The Go toolchain version used in CI and releases is pinned at .go-version, but using the latest toolchain available for local development is typically fine. OpenBao uses Go Modules, so it is recommended that you clone the repository outside of the GOPATH. 如果您希望参与 OpenBao 本身或其任何内置系统的开发，首先需要在您的机器上安装 Go。CI 和发布版本中使用的 Go 工具链版本固定在 .go-version 文件中，但通常使用本地可用的最新工具链进行开发即可。OpenBao 使用 Go Modules，因此建议您在 GOPATH 之外克隆代码仓库。

To build a bao binary: 构建 bao 二进制文件：

$ mkdir -p bin
$ go build -o bin/bao .

To run the OpenBao server in development mode: 以开发模式运行 OpenBao 服务器：

$ go run . server -dev # Or `./bin/bao server -dev` if you've built the binary already.

Since OpenBao is a large codebase that takes a short while to compile from a cold cache, it is useful to attach the -v flag to build commands to get a better sense of compilation progress. 由于 OpenBao 是一个大型代码库，从冷缓存编译需要一点时间，在构建命令中添加 -v 标志可以更好地了解编译进度。

To test a package: 测试某个包：

$ go test ./some/package

Some additional notes on development: There is also a Makefile available for advanced build configurations and maintenance tasks. It is not required to build, run & debug OpenBao in most cases, but is worth a look. This repository also houses OpenBao’s website and documentation page just as OpenBao’s web UI application under the website and ui subtrees respectively. Development instructions are available at website/README.md and ui/README.md. 关于开发的额外说明：Makefile 可用于高级构建配置和维护任务。在大多数情况下，构建、运行和调试 OpenBao 并不强制要求使用它，但值得一看。该仓库还分别在 website 和 ui 子目录下存放了 OpenBao 的网站、文档页面以及 Web UI 应用程序。开发说明可在 website/README.md 和 ui/README.md 中找到。

Importing OpenBao: This repository publishes two libraries that may be imported by other projects: github.com/openbao/openbao/api/v2 and github.com/openbao/openbao/sdk/v2. Note that this repository also contains OpenBao (the application), and as with most Go projects, OpenBao uses Go modules to manage its dependencies. The mechanism to do that is the go.mod file. As it happens, the presence of that file also makes it theoretically possible to import OpenBao as a dependency into other projects. Some other projects have made a practice of doing so in order to take advantage of testing tooling that was developed for testing OpenBao itself. This is NOT, and has NEVER been, a supported way to use the OpenBao project. We will not fix bugs relating to failure to import github.com/openbao/openbao into your project or refactor internal code to make this easier to do. 导入 OpenBao：本仓库发布了两个可供其他项目导入的库：github.com/openbao/openbao/api/v2 和 github.com/openbao/openbao/sdk/v2。请注意，本仓库同时也包含 OpenBao（应用程序本身），与大多数 Go 项目一样，OpenBao 使用 Go modules 来管理依赖，其机制是通过 go.mod 文件实现的。由于该文件的存在，理论上可以将 OpenBao 作为依赖项导入到其他项目中。一些项目曾这样做，以便利用为测试 OpenBao 本身而开发的测试工具。这从来都不是、也永远不会是 OpenBao 项目支持的使用方式。我们不会修复因将 github.com/openbao/openbao 导入您的项目而导致的错误，也不会为了方便此类操作而重构内部代码。