- Time: Wednesday 8 November 2023 at 13:00 CEST (11:00 UTC)

- Place: #openvpn-meeting channel on LiberaChat IRC network

- There is a div-by-zero bug and a critical bug we were waiting to get fixed before proceeding.

- The patch for fixing both is on the security mailing list and has acks so will go in now.

- The release is expected to happen today.

- Expected to be published either this or next week.

- A post was published at [TunnelCrack community wiki article](https://tunnelcrack.mathyvanhoef.com)

- More details are in the [Hackathon2023 meeting summary](https://wiki:TunnelCrack).

- A security advisory went up on the main website [OpenVPN Security Advisories](https://openvpn.net/security-advisories/)

- Current status: when mitigations start appearing we will mention them in meeting notes.

- The OpenSSL James Bottomley stuff is resolved now.

- The `--tls-export-cert` feature needs to be removed by dazo and reimplemented by plaisthos.

- Then it is up to dazo to review things so we can work on finalizing this.

- One of the tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.

- For new contributions, the new license already applies so maxf is unblocked to implement mbedtls3 support on master.

- maxf mentioned he will look into how much work it is to backport mbedtls3 to 2.6.

- Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.

- Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.

- When: At the moment tentatively set to 20-22 September 2024.

- Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.

- Shirts: There is plenty of time still to prepare a shirt design.

- There is actual movement on this now, they're moving the Community Downloads content now to another CMS.

- They will also move Security Advisories to this other CMS as well so both can be updated independently from website updates.

- This page is badly outdated: [Static Key Mini How-to](https://openvpn.net/community-resources/static-key-mini-howto/)

- The company will send this to a tech writer to redo based on info from the [GitHub Doc](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc.

- Having a simple guide online will help adoption.

- There was a request on [GitHub Issue #397](https://github.com/OpenVPN/openvpn/issues/397) to have releases on GitHub as well.

- djpig seems to think it would be fairly doable to copy/paste that info to GitHub as well.

- We could do this during a next release.

- Tests should cover: GRE, IPSec, userland, DCO

- Platforms: Linux, FreeBSD, Windows

- Requires time to be dedicated to doing this

- When time available will do it.

- matt provided icons in [GitHub Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)

- **Update:** will be picked up by selva when he has time.

- The company is trying to get to SOC2 compliance.

- Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net

- The company guy took the standard NDA we use for contractors, suggests to use that.

- novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

- The company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing.

- In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.

- Depends on how hard/easy it is to access the company key signing thing from community infrastructure.

- Also no high priority at the moment, we have a working solution now.

- cron2 was asked if OpenVPN has a software bill of materials. Answer was no.

- Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do

- When we pick up this task we can coordinate on it.

- mattock made a new forums system that runs on Rocky Linux 8 as agreed with ecrist.

- ecrist has looked at it but the current state of the migration is unknown.

- novaflash will pick this up at some point.