Home A - Z
Page Index

An Otter Wiki

Blame

6f02e7 Samuli Seppänen 2025-01-29 06:40:08 1 
# Basic info
2
3
- **Time:** Wednesday 31 January 2024 at 13:00 CEST (11:00 UTC)
4
- **Place:** #openvpn-meeting channel on LiberaChat IRC network
5
6
# Topics
7
8
## Current topics
9
10
### Closed: License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues
11
_All work on this is now completed._
12
13
### New: security mailing list procedure can stand improvement
14
_To be discussed in more detail later._
15
16
### Updated: tasks related to build processes (Mattock)
17
- Buildbot can now skip builds that don't touch irrelevant files ([PR #31](https://github.com/OpenVPN/openvpn-buildbot/pull/31))
18
- Which file and/or directory changes should trigger the buildbot builds?
19
- Do we want the skipped builds to show up on the build state page? Or to be (almost) completely invisible to buildbot?
20
- We do not have answers right now to these questions but the fact that we can now skip irrelevant things is great.
21
- Extending the above: Have different Builders and build steps for different types of files
22
- We can have more than one Scheduler per project (e.g. openvpn)
23
- Each Scheduler can have a different Change Filters for builds that are relevant for that type of build
24
- Each Scheduler links to a set of Builders
25
- Each Builder runs different commands on the Worker (e.g. "autoreconf -vi && ./configure ..." or "do-something-else")
26
- Example Schedulers:
27
- **openvpn-default** Scheduler (=what we have now) would:
28
- Trigger normal builds on all builders
29
- No build would be triggered on documentation changes
30
- **openvpn-rst** Scheduler would:
31
- Trigger RST sanity check on one builder when `.rst` file changes
32
33
### Updated: OpenVPN 2.6.9 release
34
_There is a small security issue reported in OpenVPN for Windows installer._
35
_Once this is resolved we can make the 2.6.9 release._
36
_lev, selva, and d12fk, are looking into this at the moment._
37
_dazo will work with lev to arrange a CVE report._
38
39
### Updated: forums topics
40
_There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam._
41
_ecrist looked into setting up a new forum. Discovered that migrating data is not possible._
42
_Suggested approach is to run both old and new side-by-side and let people finish discussions on old forums while new is up. Then after some time make the old forum read-only._
43
_Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM._
44
45
### packet header order
46
_plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements._
47
_Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement._
48
_Currently this is still in progress/discussion._
49
50
### status of trac/wiki
51
_ordex wanted to discuss state of trac/wiki. Do we move to something else? Do we update existing?_
52
_mattock has been volunteered to look into alternatives._
53
_It must be open source. Self-hosted or hosted open-source both fine._
54
_There is no hard requirement for LDAP capability._
55
_Should have access controls so only approved members can edit._
56
57
### status of community LDAP sign-in solution
58
_We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it._
59
_The reality is that 99.99% of forums users do not interact with the other tools._
60
_And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution._
61
_So we're inclined to disconnect from LDAP. For the forums we already intend to do that now._
62
_No final decision reached at this time. Considering our options._
63
64
### plan to improve server side testing
65
_mattock posted [Server Side Testing Improvement Plan](https://community.openvpn.net/openvpn/wiki/ServerSideTestingImprovementPlan#no1)_
66
_It's a plan to improve server side testing. mattock would like to get eyes on this and feedback._
67
68
### TLS 1.0 PRF problem
69
_Patches for this have been created and are in review, have not made it in yet._
70
71
### community funding
72
_ordex has an initiative he wants to bring up regarding dev resources to be added to community._
73
_This may tie into the donations topic._
74
_In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN._
75
_This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks._
76
_This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF._
77
78
### Donations for OpenVPN community
79
_There is currently no place to donate money to the community, and we do want to allow that._
80
_We need to figure out how to deal with that legally, and what payment methods to accept and how._
81
_Probably plastic-money is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions._
82
_We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way._
83
_Random things yelled out (to investigate): legal entity? stripe? paypal? plastic-money? open collective? github sponsors? linux foundation? sf conservancy?_
84
_ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community._
85
86
### Website release process woes
87
_Website team continues to report that they are on the verge of launching the new stuff._
88
_But there is a release freeze planned for last weeks of December so we may not actually get it this year._
89
90
### Tunnelcrack progress
91
_Current status: when mitigations start appearing we will mention them in meeting notes._
92
93
### OpenVPN community meetup 2024
94
_Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome._
95
_Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged._
96
_When: At the moment tentatively set to 20-22 September 2024._
97
_Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest._
98
_Shirts: There is plenty of time still to prepare a shirt design._
99
100
### Static-key mini how-to is outdated.
101
_This page is outdated badly: [Static Key Mini How-to](https://openvpn.net/community-resources/static-key-mini-howto/)_
102
_company will send this to tech writer to redo based on [GitHub Info](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc._
103
_having a simple guide online will help adoption_
104
105
### OpenVPN 2.6 performance results.
106
_tests should cover: gre, ipsec, userland, dco_
107
_linux, freebsd, windows_
108
_requires time to be dedicated to doing this_
109
_when time available will do it_
110
111
### What's going on with new taskbar icons?
112
_matt provided icons in [GitHub Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)_
113
_last update: will be picked up by selva when he has time_
114
115
### security@openvpn.net mailing list
116
_company is trying to get to soc2 compliance._
117
_probably will need a simple nda to be signed by recipients of emails to security@openvpn.net_
118
_company guy took standard nda we use for contractors, suggests to use that._
119
_novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all._
120
121
### Another key signing topic
122
_company switched EV code signing to cloudhsm, this is same cert type we use for driver signing, is also suitable for binary signing._
123
_in future we could possibly switch community to that same key. saves having to maintain 2 different keys._
124
_depends on how hard/easy it is to access company key signing thingee from community infrastructure._
125
_also no high priority at the moment, we have a working solution now._
126
127
### SBOM topic
128
_cron2 was asked if openvpn has a software bill of materials. answer was no._
129
_coincidentally, in openvpn inc a security requirement is to have an SBOM so this is on our list of things to do_
130
_when we pick up this task we can coordinate on it._
131
132
### Management interface documentation on main website will be updated with info from doc/management-notes.txt
133
_novaflash will pick this up at some point_