Basic Info

Topics

CMake backport is in.
We are working on some outstanding patches that we are working to get in.
Also, there is a div-by-zero bug and a critical bug we want to get out soon so we're waiting until that is in.
The patch for it is on the security mailing list and being reviewed by dazo and df12k.

Approvals and preparations are done for this.
Marketing sent a draft over internally, which was reviewed by novaflash and dazo and looks almost reasonable.
Expected to be published within the next 2 weeks.

The OpenSSL James Bottomley stuff is resolved now.
The --tls-export-cert feature needs to be removed by dazo and reimplemented by plaisthos.
Then it is up to dazo to review things so we can work on finalizing this.
One of the tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.
For new contributions, the new license already applies so maxf is unblocked to implement mbedTLS3 support on master.
maxf mentioned he will look into how much work it is to backport mbedTLS3 to 2.6.

Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
When: At the moment tentatively set to 20-22 September 2024.
Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
Shirts: There is plenty of time still to prepare a shirt design.

There is actual movement on this now, they're moving the Community Downloads content now to another CMS.
They will also move Security Advisories to this other CMS as well so both can be updated independently from website updates.

This page is outdated badly: Static Key Mini HowTo
The company will send this to a tech writer to redo based on GitHub Doc information and also retain a link to that GitHub doc.
Having a simple guide online will help adoption.

There was a request on GitHub Issue #397 to have releases on GitHub as well.
djpig seems to think it would be fairly doable to copy/paste that info to GitHub as well.
We could do this during a next release.

The company is trying to get to SOC2 compliance.
Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net
Company guy took the standard NDA we use for contractors, suggests using that.
novaflash thinks we should review that first to see if it's really suitable or not, as community members are not contractors after all.

Company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, also suitable for binary signing.
In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.
Depends on how hard/easy it is to access the company key signing thing from community infrastructure.
Also, no high priority at the moment, we have a working solution now.

cron2 was asked if OpenVPN has a software bill of materials. The answer was no.
Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM, so this is on our list of things to do.
When we pick up this task we can coordinate on it.

mattock made a new forums system that runs on Rocky Linux 8 as agreed with ecrist.
ecrist has looked at it, but the current state of the migration is unknown.