Upload web vault as action artifact (or add them to releases)

[FibreTTP]

Given that Vaultwarden now extracts and uploads the built binaries as artifacts in the Release action to provide attestation, it would be nice if the web vault was tar'd and uploaded as well.

The Wiki currently suggests using Docker to create a container, then copy the binary and web vault out to the host, or (perhaps more dangerously), download the binaries and web vault from a third-party.

The extraction of the binary and web vault becomes more difficult when Docker is not installed on the host that will run Vaultwarden in the end (such as a lightweight, unprivileged LXC in Proxmox), so being able to download them directly would be nice.

To go further, it would be even better if the binary and web vault were also provided in releases, since you cannot download action artifacts without being logged in (unless you use a third-party service like nightly.link), unlike such releases.

edit: the Alpine binary, that is.

[BlackDex]

@FibreTTP you can find the web-vault files here https://github.com/dani-garcia/bw_web_builds/releases
They are currently not attested, but they are GPG Signed. That repo is where the builds are done and which uploads the containers used to extract the web-vault from.

[FibreTTP]

Oh cool! I assume Vaultwarden users will want to make sure to use the web vault version listed in the Vaultwarden release (i.e., don't use a future web vault version)? Should the Wiki be updated to use these sources instead?

Does this also mean Vaultwarden has no interest in providing those assets on the release page? Go ahead and close this discussion if so :)

[BlackDex]

If you use our build containers it's embedded already.
If you use any other source you have to maintain those dependencies your self