# Basic info - **Time:** Wednesday 31 January 2024 at 13:00 CEST (11:00 UTC) - **Place:** #openvpn-meeting channel on LiberaChat IRC network # Topics ## Current topics ### Closed: License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues _All work on this is now completed._ ### New: security mailing list procedure can stand improvement _To be discussed in more detail later._ ### Updated: tasks related to build processes (Mattock) - Buildbot can now skip builds that don't touch irrelevant files ([PR #31](https://github.com/OpenVPN/openvpn-buildbot/pull/31)) - Which file and/or directory changes should trigger the buildbot builds? - Do we want the skipped builds to show up on the build state page? Or to be (almost) completely invisible to buildbot? - We do not have answers right now to these questions but the fact that we can now skip irrelevant things is great. - Extending the above: Have different Builders and build steps for different types of files - We can have more than one Scheduler per project (e.g. openvpn) - Each Scheduler can have a different Change Filters for builds that are relevant for that type of build - Each Scheduler links to a set of Builders - Each Builder runs different commands on the Worker (e.g. "autoreconf -vi && ./configure ..." or "do-something-else") - Example Schedulers: - **openvpn-default** Scheduler (=what we have now) would: - Trigger normal builds on all builders - No build would be triggered on documentation changes - **openvpn-rst** Scheduler would: - Trigger RST sanity check on one builder when `.rst` file changes ### Updated: OpenVPN 2.6.9 release _There is a small security issue reported in OpenVPN for Windows installer._ _Once this is resolved we can make the 2.6.9 release._ _lev, selva, and d12fk, are looking into this at the moment._ _dazo will work with lev to arrange a CVE report._ ### Updated: forums topics _There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam._ _ecrist looked into setting up a new forum. Discovered that migrating data is not possible._ _Suggested approach is to run both old and new side-by-side and let people finish discussions on old forums while new is up. Then after some time make the old forum read-only._ _Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM._ ### packet header order _plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements._ _Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement._ _Currently this is still in progress/discussion._ ### status of trac/wiki _ordex wanted to discuss state of trac/wiki. Do we move to something else? Do we update existing?_ _mattock has been volunteered to look into alternatives._ _It must be open source. Self-hosted or hosted open-source both fine._ _There is no hard requirement for LDAP capability._ _Should have access controls so only approved members can edit._ ### status of community LDAP sign-in solution _We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it._ _The reality is that 99.99% of forums users do not interact with the other tools._ _And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution._ _So we're inclined to disconnect from LDAP. For the forums we already intend to do that now._ _No final decision reached at this time. Considering our options._ ### plan to improve server side testing _mattock posted [Server Side Testing Improvement Plan](https://community.openvpn.net/openvpn/wiki/ServerSideTestingImprovementPlan#no1)_ _It's a plan to improve server side testing. mattock would like to get eyes on this and feedback._ ### TLS 1.0 PRF problem _Patches for this have been created and are in review, have not made it in yet._ ### community funding _ordex has an initiative he wants to bring up regarding dev resources to be added to community._ _This may tie into the donations topic._ _In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN._ _This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks._ _This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF._ ### Donations for OpenVPN community _There is currently no place to donate money to the community, and we do want to allow that._ _We need to figure out how to deal with that legally, and what payment methods to accept and how._ _Probably plastic-money is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions._ _We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way._ _Random things yelled out (to investigate): legal entity? stripe? paypal? plastic-money? open collective? github sponsors? linux foundation? sf conservancy?_ _ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community._ ### Website release process woes _Website team continues to report that they are on the verge of launching the new stuff._ _But there is a release freeze planned for last weeks of December so we may not actually get it this year._ ### Tunnelcrack progress _Current status: when mitigations start appearing we will mention them in meeting notes._ ### OpenVPN community meetup 2024 _Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome._ _Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged._ _When: At the moment tentatively set to 20-22 September 2024._ _Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest._ _Shirts: There is plenty of time still to prepare a shirt design._ ### Static-key mini how-to is outdated. _This page is outdated badly: [Static Key Mini How-to](https://openvpn.net/community-resources/static-key-mini-howto/)_ _company will send this to tech writer to redo based on [GitHub Info](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc._ _having a simple guide online will help adoption_ ### OpenVPN 2.6 performance results. _tests should cover: gre, ipsec, userland, dco_ _linux, freebsd, windows_ _requires time to be dedicated to doing this_ _when time available will do it_ ### What's going on with new taskbar icons? _matt provided icons in [GitHub Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)_ _last update: will be picked up by selva when he has time_ ### security@openvpn.net mailing list _company is trying to get to soc2 compliance._ _probably will need a simple nda to be signed by recipients of emails to security@openvpn.net_ _company guy took standard nda we use for contractors, suggests to use that._ _novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all._ ### Another key signing topic _company switched EV code signing to cloudhsm, this is same cert type we use for driver signing, is also suitable for binary signing._ _in future we could possibly switch community to that same key. saves having to maintain 2 different keys._ _depends on how hard/easy it is to access company key signing thingee from community infrastructure._ _also no high priority at the moment, we have a working solution now._ ### SBOM topic _cron2 was asked if openvpn has a software bill of materials. answer was no._ _coincidentally, in openvpn inc a security requirement is to have an SBOM so this is on our list of things to do_ _when we pick up this task we can coordinate on it._ ### Management interface documentation on main website will be updated with info from doc/management-notes.txt _novaflash will pick this up at some point_