- **Time:** Wednesday 17 January 2024 at 13:00 CEST (11:00 UTC)

- **Place:** #openvpn-meeting channel on LiberaChat IRC network

- lev is looking into this.

- dazo will work with lev to arrange a CVE report.

- [TracWikiReplacements](TracWikiReplacements)

- There are a couple of potential Wiki alternatives in that list

- More research or deploy something to get some experience on the options?

- [ServerSideTestingImprovementPlan](ServerSideTestingImprovementPlan)

- Do we want to start doing some improvements on this front? If so, which would be a priority?

- Buildbot

- Mattock set up Buildbot master successfully on Ubuntu 20.04 (current production instance?) as well as Ubuntu 22.04 and Ubuntu 23.10

- Any buildbot-related improvement we could do?

- Maybe building snapshot packages (deb/rpm) in buildbot and publishing them automatically?

- The pragmatic way would be to use FPM instead of "official" packaging tools

- Cloudfront + S3 + aptly might be a good solution for public repos with minimal/non-existent management overhead

- Normal meetings to resume on January 10 2024.

- Given that we're so close to the end of the year, we'll push this to next year.

- The --tls-export-cert PR needs a little love first.

- Tentative new release date is January 10.

- There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam.

- We agreed in the last meeting to commit to a path to get a new VM and switch to vBulletin and disconnect from community LDAP logins.

- The new VM is delivered, the license should be delivered this week too, so then ecrist can get to work.

- Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM.

- ordex wanted to discuss the state of Trac/Wiki. Do we move to something else? Do we update existing?

- mattock has been volunteered to look into alternatives.

- It must be open source. Self-hosted or hosted open-source both fine.

- There is no hard requirement for LDAP capability.

- Should have access controls so only approved members can edit.

- We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it.

- The reality is that 99.99% of forums users do not interact with the other tools.

- And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution.

- So we're inclined to disconnect from LDAP. For the forums, we already intend to do that now.

- No final decision reached at this time. Considering our options.

- plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements.

- Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement.

- mattock posted [ServerSideTestingImprovementPlan](https://community.openvpn.net/openvpn/wiki/ServerSideTestingImprovementPlan#no1)

- It's a plan to improve server-side testing. mattock would like to get eyes on this and feedback.

- Patches for this have been created and are in review, have not made it in yet.

- ordex has an initiative he wants to bring up regarding dev resources to be added to the community.

- This may tie into the donations topic.

- In short, ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.

- This would for example allow paying for allocated hours for mattock and cron2 to work on OpenVPN community tasks.

- This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.

- There is currently no place to donate money to the community, and we do want to allow that.

- We need to figure out how to deal with that legally, and what payment methods to accept and how.

- Probably plastic-money is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions.

- We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way.

- Random things yelled out (to investigate): legal entity? stripe? paypal? plastic-money? open collective? GitHub sponsors? Linux foundation? sf conservancy?

- ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community.

- Website team continues to report that they are on the verge of launching the new stuff.

- But there is a release freeze planned for the last weeks of December so we may not actually get it this year.

- For new contributions, the new license already applies.

- The --tls-export-cert code was removed, and plaisthos will reimplement it.

- Then it is up to dazo to review things so we can work on finalizing this.

- One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.

- [TunnelCrack community wiki article](wiki:TunnelCrack)

- Current status: when mitigations start appearing, we will mention them in meeting notes.

- Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.

- Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.

- When: At the moment tentatively set to 20-22 September 2024.

- Who: We'll do an open invitation to the openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.

- Shirts: There is plenty of time still to prepare a shirt design.

- This page is outdated badly: [Static-key mini how-to](https://openvpn.net/community-resources/static-key-mini-howto/)

- The company will send this to a tech writer to redo based on [GitHub documentation](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) info and also retain a link to that GitHub doc.

- Having a simple guide online will help adoption.

- Tests should cover: gre, ipsec, userland, dco

- Platforms: linux, freebsd, windows

- Requires time to be dedicated to doing this

- When time available will do it

- matt provided icons in [GitHub Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)

- Last update: will be picked up by selva when he has time

- The company is trying to get to SOC2 compliance.

- Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net

- The company guy took the standard NDA we use for contractors, suggests using that.

- novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

- The company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing.

- In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.

- Depends on how hard/easy it is to access the company key signing thingee from community infrastructure.

- Also no high priority at the moment, we have a working solution now.

- cron2 was asked if OpenVPN has a software bill of materials. The answer was no.

- Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do

- When we pick up this task, we can coordinate on it.

- novaflash will pick this up at some point.