Basic info

• Time: Wednesday 18 October 2023 at 13:00 CEST (11:00 UTC)
• Place: #openvpn-meeting channel on LiberaChat IRC network

Topics

Current topics

• Closed: Community Hackathon 2023 meeting

  • This was held in Orihuela Costa 6-8 October.
  • For a summary see Hackathon 2023

• Closed: Weekly meeting summaries by email

  • It was decided novaflash will do meeting summaries on wiki and send a copy to the devel mailing list.
  • novaflash has joined the openvpn-devel mailing list and will send out these meeting summaries.

• Updated: Website release process woes

  • There is actual movement on this now, they're moving the Community Downloads content now to another CMS.
  • They will also move Security Advisories to this other CMS as well so both can be updated independently from website updates.

• Updated: OpenVPN 2.6.7 release

  • CMake backport is in.
  • Originally planned for 18 October, but it will be postponed a little but still expected to go out in October.
  • Reason: there are a number of outstanding issues ready to be merged that we want to get in, this takes a bit more time.
  • Also, there is a div-by-zero bug we want to get out soon so we'd rather delay 2.6.7 slightly to get it in.

• Updated: License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues

  • A new version of James Bottomley's patch is needed as it broke openssl 1.0.2 and libressl. Plaisthos will look into this.
  • Then dazo can review things so we can decide if we can finalize this.
  • One of the tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.

• Updated: OpenVPN community meetup 2024

  • Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
  • Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
  • When: At the moment tentatively set to 20-22 September 2024.
  • Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
  • Shirts: There is plenty of time still to prepare a shirt design.

• Security assessment of OpenVPN2 codebase.

  • Update 27 September: publishing this is currently being handled, it requires some preparation and internal reviews that are ongoing.

• Tunnelcrack published now https://tunnelcrack.mathyvanhoef.com

  • A post was published at TunnelCrack community wiki article
  • More details are in the Hackathon2023 meeting summary.

• Static-key mini how-to is outdated.

  • This page is outdated badly: https://openvpn.net/community-resources/static-key-mini-howto/
  • The company will send this to a tech writer to redo based on GitHub doc info and also retain a link to that GitHub doc.
  • Having a simple guide online will help adoption.

• openvpn release process topics

  • There was a request on GitHub issue to have releases on GitHub as well.
  • djpig seems to think it would be fairly doable to copy/paste that info to GitHub as well.
  • We could do this during a next release.

• OpenVPN 2.6 performance results.

  • Tests should cover: gre, ipsec, userland, dco
  • Linux, FreeBSD, Windows
  • Requires time to be dedicated to doing this
  • When time available will do it

• What's going on with new taskbar icons?

  • matt provided icons in GitHub issue
  • Update: will be picked up by selva when he has time

• security@openvpn.net mailing list

  • The company is trying to get to SOC2 compliance.
  • Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net
  • Company guy took the standard NDA we use for contractors, suggests to use that.
  • novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

• Another key signing topic

  • Company switched EV code signing to cloudhsm, this is the same cert type we use for driver signing, is also suitable for binary signing.
  • In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.
  • Depends on how hard/easy it is to access company key signing thing from community infrastructure.
  • Also no high priority at the moment, we have a working solution now.

• SBOM topic

  • cron2 was asked if openvpn has a software bill of materials. The answer was no.
  • Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do
  • When we pick up this task we can coordinate on it.

• Forums machine on community infrastructure is only non-Linux system.

  • mattock made a new forums system that runs on rocky linux 8 as agreed with ecrist.
  • ecrist has looked at it but the current state of the migration is unknown.

• Management interface documentation on main website will be updated with info from doc/management-notes.txt

  • novaflash will pick this up at some point

• https://openvpn.net/community-resources/openvpn-quickstart/ will be updated from /doc/man-sections/example-fingerprint.rst information.

  • Static-key will be deprecated and contents updated with peer-fingerprint stuff.
  • novaflash will pick this up again as time permits and other more important topics are done.