build(openbao): refresh runtime dependencies

[sbaum1994]

TL;DR

• Updates the OpenBao runtime to 2.6.2 and applies available Alpine package upgrades.
• Rebuilds the JWT plugin with Go 1.27.0 and reviewed security floors for x/crypto, x/net, x/text, gRPC, and go-jose.

Additional Details

• Extends the binary verifier to assert every security-floor dependency in both plugin architectures.
• Updates the build helper, module files, README, and provenance documentation together.
• Upstream-owned dependencies embedded in the bao binary remain tracked separately.

For the Reviewer

• Review the runtime update, plugin dependency floors, and verifier assertions as one change.

For QA

• Ran the plugin go test ./... suite successfully.
• Inspected the exact OpenBao 2.6.2 upstream image and embedded Go dependency versions.
• Ran shell syntax checks and git diff --check.
• Full multi-architecture plugin/image verification remains for CI or an environment with the Go 1.27 toolchain available.

Issues

Closes #1476

Relates to #1475

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for DCO compliance.
• Existing build checks cover the update.
• Documentation is current.

Summary by CodeRabbit

• Updates
  • Updated OpenBao to version 2.6.2 and Go to version 1.27.0.
  • Alpine packages are upgraded before required runtime utilities are installed.
  • JWT plugin builds and verification now enforce newer minimum dependency versions.
  • Plugin verification reports dependency versions alongside existing metadata.
  • Updated build documentation and provenance details to reflect the new versions and verification requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4a140de9-a234-438f-ac9a-2f67e4d53b82

📥 Commits

Reviewing files that changed from the base of the PR and between 7e1968a and a0a8e69.

⛔ Files ignored due to path filters (1)

• infra/openbao/plugins/vault-plugin-secrets-jwt/go.sum is excluded by !**/*.sum

📒 Files selected for processing (6)

• infra/openbao/Dockerfile
• infra/openbao/README.md
• infra/openbao/files/plugins/PROVENANCE.md
• infra/openbao/plugins/vault-plugin-secrets-jwt/go.mod
• infra/openbao/scripts/build-jwt-plugin.sh
• infra/openbao/scripts/verify-jwt-plugin.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Updates the OpenBao runtime to 2.6.2 with Go 1.27.0, applies Alpine package upgrades, refreshes JWT plugin dependencies, and validates dependency floors embedded in plugin binaries.

Changes

OpenBao and JWT plugin refresh

Layer / File(s)	Summary
Runtime image version and package updates infra/openbao/Dockerfile, infra/openbao/README.md	The runtime uses OpenBao 2.6.2 and Go 1.27.0. The image upgrades Alpine packages before installing runtime tools. Build commands use the updated OpenBao version.
JWT plugin dependency inputs infra/openbao/plugins/vault-plugin-secrets-jwt/go.mod, infra/openbao/scripts/build-jwt-plugin.sh	The plugin module and build script use Go 1.27.0 and updated dependency versions for cryptography, networking, text, gRPC, and go-jose.
Embedded dependency floor verification infra/openbao/files/plugins/PROVENANCE.md, infra/openbao/scripts/verify-jwt-plugin.sh	Provenance records checksum verification and dependency floors. The verification script extracts, validates, and reports the embedded dependency versions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to a0a8e

The dependency refresh improves runtime security checks, but the verification floor does not cover the go-jose major version directly used by the JWT plugin, leaving a bounded security-assurance gap. No exploitable issue is currently verified, so the PR is mergeable with explicit owner awareness and follow-up to align or validate the dependency coverage.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (4 skipped: 4 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits with the valid build(openbao) format and accurately describes the dependency refresh and build changes.
Linked Issues check	✅ Passed	The changes satisfy the linked issue objectives [#1476]: OpenBao is updated to 2.6.2 with Alpine package upgrades, Go is updated to 1.27.0, the reviewed dependency floors are raised, and verification …
Out of Scope Changes check	✅ Passed	All reviewed changes support the linked issue [#1476]. The README and provenance updates document the runtime and dependency refresh, and no unrelated code changes are evident.

Full details: Linked Issues check

Explanation

The changes satisfy the linked issue objectives [#1476]: OpenBao is updated to 2.6.2 with Alpine package upgrades, Go is updated to 1.27.0, the reviewed dependency floors are raised, and verification covers both plugin architectures. The Dockerfile and supporting documentation also cover image build and inspection requirements.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (4 skipped: 4 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/openbao-server-wave2

---

_{Comment @coderabbitai help to get the list of available commands.}