Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openvpn for openSUSE:Factory checked in at 2026-08-11 17:09:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openvpn (Old) and /work/SRC/openSUSE:Factory/.openvpn.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openvpn" Tue Aug 11 17:09:49 2026 rev:122 rq:1370499 version:2.7.5 Changes: -------- --- /work/SRC/openSUSE:Factory/openvpn/openvpn.changes 2025-08-12 17:03:13.899903047 +0200 +++ /work/SRC/openSUSE:Factory/.openvpn.new.17972/openvpn.changes 2026-08-11 17:10:07.076206926 +0200 @@ -1,0 +2,23 @@ +Tue Jul 21 16:12:49 UTC 2026 - Rahul Jain <[email protected]> + +- Update to version 2.7.5 + * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117, + CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698) + * Improved DCO (Data Channel Offload) support built-in + * Better multi-socket event handling + * Enhanced DNS configuration handling + * Windows openvpnserv improvements and fixes +- Add debian packaging files (debian.control, debian.rules, + debian.tar.xz, *.dsc) as Source entries +- Remove all DCO patches (integrated or superseded in 2.7.5): + * 0001-dco-better-naming-for-function-parameters.patch + * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch + * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch + * 0001-dco_linux-Introduce-new-uAPIs.patch + * 0001-Implement-ovpn-version-detection.patch + * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch + * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch + * 0001-dco-linux-avoid-redefining-ovpn-enums.patch +- Change Recommends to ovpn-kmp (simplified) + +------------------------------------------------------------------- Old: ---- 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch 0001-Implement-ovpn-version-detection.patch 0001-dco-better-naming-for-function-parameters.patch 0001-dco-linux-avoid-redefining-ovpn-enums.patch 0001-dco_linux-Introduce-new-uAPIs.patch 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch openvpn-2.6.14.tar.gz openvpn-2.6.14.tar.gz.asc New: ---- debian.control debian.rules debian.tar.xz openvpn-2.7.5.tar.gz openvpn-2.7.5.tar.gz.asc openvpn-Debian_11.dsc openvpn-Debian_12.dsc openvpn-xUbuntu_22.04.dsc openvpn.dsc ----------(Old B)---------- Old: * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch * 0001-dco_linux-Introduce-new-uAPIs.patch Old: * 0001-dco_linux-Introduce-new-uAPIs.patch * 0001-Implement-ovpn-version-detection.patch * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch Old:- Remove all DCO patches (integrated or superseded in 2.7.5): * 0001-dco-better-naming-for-function-parameters.patch * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch Old: * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch * 0001-dco-linux-avoid-redefining-ovpn-enums.patch - Change Recommends to ovpn-kmp (simplified) Old: * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch * 0001-dco_linux-Introduce-new-uAPIs.patch * 0001-Implement-ovpn-version-detection.patch Old: * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch * 0001-dco-linux-avoid-redefining-ovpn-enums.patch Old: * 0001-dco-better-naming-for-function-parameters.patch * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch Old: * 0001-Implement-ovpn-version-detection.patch * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openvpn.spec ++++++ --- /var/tmp/diff_new_pack.mQpXZV/_old 2026-08-11 17:10:08.772278813 +0200 +++ /var/tmp/diff_new_pack.mQpXZV/_new 2026-08-11 17:10:08.772278813 +0200 @@ -1,8 +1,7 @@ # # spec file for package openvpn # -# Copyright (c) 2025 SUSE LLC and contributors -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -22,7 +21,7 @@ %define _rundir %{_localstatedir}/run %endif Name: openvpn -Version: 2.6.14 +Version: 2.7.5 Release: 0 Summary: Full-featured SSL VPN solution using a TUN/TAP Interface License: GPL-2.0-only WITH openvpn-openssl-exception @@ -38,15 +37,14 @@ Source9: %{name}.target Source10: %{name}-tmpfile.conf Source11: rc%{name} +Source12: debian.control +Source13: debian.rules +Source14: debian.tar.xz +Source15: %{name}.dsc +Source16: %{name}-Debian_11.dsc +Source17: %{name}-Debian_12.dsc +Source18: %{name}-xUbuntu_22.04.dsc Patch1: %{name}-2.3-plugin-man.dif -Patch2: 0001-dco-better-naming-for-function-parameters.patch -Patch3: 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch -Patch4: 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch -Patch5: 0001-dco_linux-Introduce-new-uAPIs.patch -Patch6: 0001-Implement-ovpn-version-detection.patch -Patch7: 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch -Patch8: 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch -Patch9: 0001-dco-linux-avoid-redefining-ovpn-enums.patch BuildRequires: iproute2 BuildRequires: libcap-ng-devel BuildRequires: liblz4-devel @@ -58,14 +56,15 @@ BuildRequires: pam-devel BuildRequires: pkcs11-helper-devel >= 1.11 BuildRequires: pkgconfig +BuildRequires: python3-docutils BuildRequires: xz +BuildRequires: pkgconfig(cmocka) BuildRequires: pkgconfig(libnl-genl-3.0) BuildRequires: pkgconfig(libsystemd) BuildRequires: pkgconfig(systemd) Requires: iproute2 Requires: pkcs11-helper >= 1.11 -# the former is KMP (for older distros), the latter is kernel-default -Recommends: (kmod(ovpn_dco_v2.ko) or kmod(ovpn.ko)) +Recommends: ovpn-kmp %systemd_ordering %description @@ -129,20 +128,17 @@ This package provides the header file to build external plugins. %prep -%autosetup -p1 +%autosetup -p0 sed -e "s|\" __DATE__|$(date '+%%b %%e %%Y' -r version.m4)\"|g" \ -i src/openvpn/options.c -sed -e "s|@PLUGIN_LIBDIR@|%{_libdir}/openvpn/plugins|g" \ - -e "s|@PLUGIN_DOCDIR@|%{_defaultdocdir}/%{name}|g" \ - -i doc/openvpn.8 sed -e "s|%{_localstatedir}/run|%{_rundir}|g" < %{SOURCE8} > %{name}.service # %%doc items shouldn't be executable. find contrib sample -type f -exec chmod a-x \{\} + %build -export CFLAGS="%{optflags} $(getconf LFS_CFLAGS) -W -Wall -fno-strict-aliasing" +export CFLAGS="%{optflags} $(getconf LFS_CFLAGS) -W -Wall -Wno-unused -fno-strict-aliasing" export LDFLAGS %if 0%{?suse_version} >= 1550 # usrmerge @@ -154,6 +150,7 @@ else confopt=--enable-dco fi +# Note: -fno-lto used so that the Unit-tests work %configure \ $confopt \ --enable-x509-alt-username \ @@ -162,9 +159,12 @@ --enable-plugins \ --enable-plugin-down-root \ --enable-plugin-auth-pam \ - CFLAGS="$CFLAGS $(getconf LFS_CFLAGS) -fPIE $PLUGIN_DEFS" \ - LDFLAGS="$LDFLAGS -pie -lpam -rdynamic -Wl,-rpath,%{_libdir}/%{name}/plugins" + CFLAGS="$CFLAGS $(getconf LFS_CFLAGS) -fno-lto -fPIE $PLUGIN_DEFS" \ + LDFLAGS="$LDFLAGS -fno-lto -pie -lpam -rdynamic -Wl,-rpath,%{_libdir}/%{name}/plugins" %make_build +sed -e "s|@PLUGIN_LIBDIR@|%{_libdir}/openvpn/plugins|g" \ + -e "s|@PLUGIN_DOCDIR@|%{_defaultdocdir}/%{name}|g" \ + -i doc/openvpn.8 %install %make_install @@ -192,6 +192,9 @@ rm -rf %{buildroot}%{_datadir}/doc/{OpenVPN,%{name}} find sample -name .gitignore -delete +%check +make check + %pre %service_add_pre %{name}.target @@ -227,6 +230,8 @@ %{_sbindir}/rcopenvpn %endif %{_sbindir}/openvpn +%dir %{_libexecdir}/%{name} +%{_libexecdir}/%{name}/dns-updown %files down-root-plugin %dir %{_libdir}/%{name} ++++++ debian.control ++++++ Source: openvpn Section: net Priority: optional Maintainer: Ubuntu Developers <[email protected]> XSBC-Original-Maintainer: Bernhard Schmidt <[email protected]> Uploaders: Jörg Frings-Fürst <[email protected]> Build-Depends: debhelper-compat (= 13), dpkg-dev (>= 1.16.1), libcap-ng-dev [linux-any], liblz4-dev, liblzo2-dev, libnl-genl-3-dev [linux-any], libp11-kit-dev, libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libsystemd-dev [linux-any], net-tools [!linux-any], pkg-config, python3-docutils Standards-Version: 4.6.0.1 Rules-Requires-Root: no Homepage: https://openvpn.net/ Vcs-Git: https://salsa.debian.org/debian/openvpn.git Vcs-Browser: https://salsa.debian.org/debian/openvpn Package: openvpn Architecture: any Depends: debconf | debconf-2.0, ${shlibs:Depends}, ${misc:Depends}, net-tools [!linux-any], Suggests: openssl, resolvconf, ovpn-dkms, openvpn-systemd-resolved, easy-rsa Description: virtual private network daemon OpenVPN is an application to securely tunnel IP networks over a single UDP or TCP port. It can be used to access remote sites, make secure point-to-point connections, enhance wireless security, etc. . OpenVPN uses all of the encryption, authentication, and certification features provided by the OpenSSL library (any cipher, key size, or HMAC digest). . OpenVPN may use static, pre-shared keys or TLS-based dynamic key exchange. It also supports VPNs with dynamic endpoints (DHCP or dial-up clients), tunnels over NAT or connection-oriented stateful firewalls (such as Linux's iptables). ++++++ debian.rules ++++++ #!/usr/bin/make -f ifeq ($(DEB_HOST_ARCH_OS), kfreebsd) # Avoid the /sbin/route wrapper which doesn't provide FreeBSD CLI as expected ENV_VARS := IFCONFIG=/sbin/ifconfig ROUTE=/lib/freebsd/route EXTRA_ARGS := else ENV_VARS := SYSTEMD_ASK_PASSWORD=/usr/bin/systemd-ask-password SYSTEMD_UNIT_DIR=/usr/lib/systemd/system TMPFILES_DIR=/usr/lib/tmpfiles.d EXTRA_ARGS := --enable-systemd --enable-dco endif #export DH_VERBOSE=1 export DEB_BUILD_MAINT_OPTIONS = hardening=+all %: dh $@ override_dh_auto_configure: -test -f tests/t_client.sh.not || mv tests/t_client.sh tests/t_client.sh.not $(ENV_VARS) dh_auto_configure -- $(shell dpkg-buildflags --export=configure) --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --mandir=\$${prefix}/share/man --includedir=\$${prefix}/include/openvpn \ --disable-unit-tests \ --enable-pkcs11 \ --enable-x509-alt-username \ $(EXTRA_ARGS) override_dh_auto_build: dh_auto_build # The one shipped in the tarball gets rebuild (chaging /bin/sh in some cases) #sed -i -e '1s%.*%#!/bin/sh%' tests/t_client.sh # make plugins # $(MAKE) -C plugin/auth-pam/ $(shell dpkg-buildflags --export=configure) # $(MAKE) -C plugin/down-root/ $(shell dpkg-buildflags --export=configure) # we may not want to run dh_auto_test #override_dh_auto_test: override_dh_auto_clean: # These two get deleted on "make clean", but come in the tarball # hack to keep them around after "make clean" -test -f distro/rpm/openvpn.spec.not || mv distro/rpm/openvpn.spec distro/rpm/openvpn.spec.not -test -f tests/t_client.sh.not || mv tests/t_client.sh tests/t_client.sh.not dh_auto_clean -test -f distro/rpm/openvpn.spec.not && mv distro/rpm/openvpn.spec.not distro/rpm/openvpn.spec -test -f tests/t_client.sh.not && mv tests/t_client.sh.not tests/t_client.sh # clean plugins # $(MAKE) -C plugin/auth-pam/ clean # $(MAKE) -C plugin/down-root/ clean override_dh_clean: dh_clean -X win/openvpn.nsi.orig override_dh_auto_install: dh_auto_install install -m 755 sample/sample-scripts/verify-cn $(CURDIR)/debian/openvpn/usr/share/openvpn install -m 755 debian/openvpn.if-up.d $(CURDIR)/debian/openvpn/etc/network/if-up.d/openvpn install -m 755 debian/openvpn.if-down.d $(CURDIR)/debian/openvpn/etc/network/if-down.d/openvpn # remove unwanted plugin files $(RM) $(CURDIR)/debian/openvpn/usr/lib/$(DEB_HOST_GNU_TYPE)/openvpn/plugins/*.la # resolvconf script install -m 755 debian/update-resolv-conf $(CURDIR)/debian/openvpn/etc/openvpn/update-resolv-conf # bash completion install -m 644 debian/openvpn.bash_completion $(CURDIR)/debian/openvpn/usr/share/bash-completion/completions/openvpn # append Debian's tmpfiles conf to upstream's on Linux (systemd) ifeq ($(DEB_HOST_ARCH_OS), linux) cat debian/openvpn.conf >> $(CURDIR)/debian/openvpn/usr/lib/tmpfiles.d/openvpn.conf endif $(RM) $(CURDIR)/debian/openvpn/usr/share/doc/openvpn/COPYING override_dh_link: dh_link usr/lib/$(DEB_HOST_MULTIARCH)/openvpn/plugins/openvpn-plugin-auth-pam.so usr/lib/openvpn/openvpn-plugin-auth-pam.so dh_link usr/lib/$(DEB_HOST_MULTIARCH)/openvpn/plugins/openvpn-plugin-down-root.so usr/lib/openvpn/openvpn-plugin-down-root.so dh_link override_dh_installexamples: dh_installexamples ## remove windoze stuff $(RM) -r $(CURDIR)/debian/openvpn/usr/share/doc/openvpn/examples/easy-rsa/Windows $(RM) -r $(CURDIR)/debian/openvpn/usr/share/doc/openvpn/sample # remove gitignore file from samples $(RM) $(CURDIR)/debian/openvpn/usr/share/doc/openvpn/examples/sample-keys/.gitignore override_dh_installinit: dh_installinit --no-start -- defaults 16 80 override_dh_compress: dh_compress --exclude=.cnf --exclude=pkitool override_dh_installsystemd: dh_installsystemd --no-restart-after-upgrade -r ++++++ openvpn-2.3-plugin-man.dif ++++++ --- /var/tmp/diff_new_pack.mQpXZV/_old 2026-08-11 17:10:08.908284577 +0200 +++ /var/tmp/diff_new_pack.mQpXZV/_new 2026-08-11 17:10:08.916284916 +0200 @@ -1,18 +1,16 @@ -Index: doc/openvpn.8 -=================================================================== ---- a/doc/openvpn.8.orig -+++ b/doc/openvpn.8 -@@ -6690,9 +6690,9 @@ For more information and examples on how - modules, see the README file in the \fBplugin\fP folder of the OpenVPN - source distribution. - .sp --If you are using an RPM install of OpenVPN, see --\fB/usr/share/openvpn/plugin\fP\&. The documentation is in \fBdoc\fP and --the actual plugin modules are in \fBlib\fP\&. -+If you are using an RPM install of OpenVPN, the actual plugin modules -+are in \fB@PLUGIN_LIBDIR@\fP\& and the documentation is in -+\fB@PLUGIN_DOCDIR@/README.<plugin-name>\fP\&. - .sp - Multiple plugin modules can be cascaded, and modules can be used in - tandem with scripts. The modules will be called by OpenVPN in the order +--- doc/man-sections/plugin-options.rst 2025-05-05 13:01:29.000000000 +0200 ++++ doc/man-sections/plugin-options.rst 2025-05-13 15:27:17.582112731 +0200 +@@ -43,9 +43,9 @@ + modules, see the README file in the ``plugin`` folder of the OpenVPN + source distribution. + +- If you are using an RPM install of OpenVPN, see +- :code:`/usr/share/openvpn/plugin`. The documentation is in ``doc`` and +- the actual plugin modules are in ``lib``. ++ If you are using an RPM install of OpenVPN, the actual plugin modules ++ are in :code:`@PLUGIN_LIBDIR@` and the documentation is in ++ :code:`@PLUGIN_DOCDIR@/README.<plugin-name>`. + + Multiple plugin modules can be cascaded, and modules can be used in + tandem with scripts. The modules will be called by OpenVPN in the order ++++++ openvpn-2.6.14.tar.gz -> openvpn-2.7.5.tar.gz ++++++ ++++ 169524 lines of diff (skipped) ++++++ openvpn-Debian_11.dsc ++++++ Format: 3.0 (quilt) Source: openvpn Binary: openvpn Architecture: any Version: 2.7.5 Maintainer: Frank Lichtenheld <[email protected]> Homepage: https://openvpn.net/ Standards-Version: 4.6.0.1 Build-Depends: debhelper-compat (= 13), dpkg-dev (>= 1.16.1), libcap-ng-dev [linux-any], liblz4-dev, liblzo2-dev, libnl-genl-3-dev [linux-any], libp11-kit-dev, libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libsystemd-dev [linux-any], net-tools [!linux-any], pkg-config, python3-docutils, systemd [linux-any] ++++++ openvpn-Debian_12.dsc ++++++ Format: 3.0 (quilt) Source: openvpn Binary: openvpn Architecture: any Version: 2.7.5 Maintainer: Frank Lichtenheld <[email protected]> Homepage: https://openvpn.net/ Standards-Version: 4.6.0.1 Build-Depends: debhelper-compat (= 13), dpkg-dev (>= 1.16.1), libcap-ng-dev [linux-any], liblz4-dev, liblzo2-dev, libnl-genl-3-dev [linux-any], libp11-kit-dev, libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libsystemd-dev [linux-any], net-tools [!linux-any], pkg-config, python3-docutils, systemd [linux-any] ++++++ openvpn-xUbuntu_22.04.dsc ++++++ Format: 3.0 (quilt) Source: openvpn Binary: openvpn Architecture: any Version: 2.7.5 Maintainer: Frank Lichtenheld <[email protected]> Homepage: https://openvpn.net/ Standards-Version: 4.6.0.1 Build-Depends: debhelper-compat (= 13), dpkg-dev (>= 1.16.1), libcap-ng-dev [linux-any], liblz4-dev, liblzo2-dev, libnl-genl-3-dev [linux-any], libp11-kit-dev, libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libsystemd-dev [linux-any], net-tools [!linux-any], pkg-config, python3-docutils, systemd [linux-any] ++++++ openvpn.dsc ++++++ Format: 3.0 (quilt) Source: openvpn Binary: openvpn Architecture: any Version: 2.7.5 Maintainer: Frank Lichtenheld <[email protected]> Homepage: https://openvpn.net/ Standards-Version: 4.6.0.1 Build-Depends: debhelper-compat (= 13), dpkg-dev (>= 1.16.1), libcap-ng-dev [linux-any], liblz4-dev, liblzo2-dev, libnl-genl-3-dev [linux-any], libp11-kit-dev, libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libsystemd-dev [linux-any], net-tools [!linux-any], pkg-config, python3-docutils, systemd-dev [linux-any] ++++++ openvpn.keyring ++++++ ++++ 1577 lines (skipped) ++++ between openvpn.keyring ++++ and /work/SRC/openSUSE:Factory/.openvpn.new.17972/openvpn.keyring
