# Basic Info - **Time**: Wednesday 17 May 2023 at 13:00 CET (12:00 UTC) - **Place**: #openvpn-meeting channel on [LiberaChat](https://libera.chat/) IRC network # Topics ## Current Topics - **2.6.5 Release Plans** - "in about 4 to 8 weeks from now so anywhere between half June and half July" - **Hackathon Arrangements** - When: [Schedule](https://nuudel.digitalcourage.de/t1hjepaHGhdpiV2P) - Location: Torrevieja. - Topics: Yes. - **2.7 Plans, if Any?** - [Status of OpenVPN 2.7](https://community.openvpn.net/openvpn/wiki/StatusOfOpenvpn27) - **PGP Signing Key for OpenVPN Releases** - djpig noticed an issue with the GPG signing key. - Accidentally used a recently revoked key instead of the new key from a recent key rotation. - Also, the latest Debian release's GPG does not like SHA-1 anymore. - **Status of PoC Using Gerrit for Code Review** - cron2 took a look, hopefully it will be working now. - **Security Assessment of OpenVPN2 Codebase** - What was the result of last week's meeting? - **security@openvpn.net Mailing List** - The company is trying to get to SOC2 compliance. - Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net. - Company guy took the standard NDA we use for contractors, suggests using that. - novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all. - **License Amendment for OpenVPN2 to Solve OpenSSL/mbedTLS Licensing Issues** - Current status: [GitHub License Change](https://github.com/OpenVPN/openvpn-license-change) - The next step for us is to put in extra effort to try and reach those people that didn't respond or we couldn't reach yet. - **Website Release Process Woes** - The website team claims their solution is 95% done. We'll see. ## Topics on Standby - **Another Key Signing Topic** - The company switched EV code signing to CloudHSM, which is the same cert type used for driver signing and is also suitable for binary signing. - In the future, we could possibly switch the community to that same key to save having to maintain two different keys. - Depends on how hard/easy it is to access the company key signing thing from community infrastructure. - Also, no high priority at the moment, we have a working solution now. - **Can We Have Someone at OpenVPN Create Nicer Windows Traybar Logos?** - Matt is currently working on it in [GitHub Issue 595](https://github.com/OpenVPN/openvpn-gui/issues/595). - **SBOM Topic** - cron2 was asked if OpenVPN has a software bill of materials. The answer was no. - Coincidentally, at OpenVPN Inc., a security requirement is to have an SBOM so this is on our list of things to do. - When we pick up this task, we can coordinate on it. - **Forums Machine on Community Infrastructure is Only Non-Linux System** - mattock made a new forums system that runs on Rocky Linux 8 as agreed with ecrist. - ecrist has looked at it but the current state of the migration is unknown. - **OpenVPN 2.6 Performance Results** - We should work on an article to publish some performance results when 2.6 is out as stable, but first press release. - **Management Interface Documentation on Main Website Will Be Updated** - Information from doc/management-notes.txt will be updated. - novaflash will pick this up at some point. - **OpenVPN Quickstart on Community Resources Will Be Updated** - From `/doc/man-sections/example-fingerprint.rst` information. - Static-key will be deprecated and contents updated with peer-fingerprint stuff. - novaflash will pick this up again as time permits and other more important topics are done.