Merge branch 'release/2.7' into master

Author: Yuriy Darnobyt

debian-sbuild/openvpn/changelog-2.7~rc4

@@ -0,0 +1,39 @@
+openvpn (2.7~rc4-debian0) stable; urgency=medium
+
+  * OpenVPN Release 2.7_rc4 (Gert Doering, 7e052cf2)
+  * Change ssl_ctx in struct tls_options to be a pointer (Arne Schwabe, 44dd39b3)
+  * multi: Warn about failing read in multi_process_file_closed() (Frank Lichtenheld, 18d1b1fe)
+  * buffer: Change buf_prepend and buf_advance to accept ssize_t for length (Frank Lichtenheld, cb4d5426)
+  * manage: Avoid several conversion warnings by using the correct types (Frank Lichtenheld, a4b51e68)
+  * multi: Fix various conversion warnings (Frank Lichtenheld, 5e5ead5b)
+  * multi: Fix type handling for hashes, mostly inotify_watchers (Frank Lichtenheld, e2c97f38)
+  * multi: Fix wrong sigma value in multi_push_restart_schedule_exit (Frank Lichtenheld, 310c6b9e)
+  * schedule: Rework documentation for schedule_add_entry (Frank Lichtenheld, 223192a0)
+  * options: Avoid some conversion warnings (Frank Lichtenheld, 2a9c8a8c)
+  * mbuf: Add unit tests (Frank Lichtenheld, 75cc34ec)
+  * buffer: Change limits for array_mult_safe (Frank Lichtenheld, 2b8149a4)
+  * Deprecate --fast-io option (Gianmarco De Gregori, e5ff8247)
+  * PUSH_UPDATE: fix option reset logic in continuation messages (Moritz Fain, 309c2332)
+  * mudp: fix unaligned 32-bit read when parsing peer ID (Gianmarco De Gregori, 8bf8bead)
+  * iservice: set adapter DNS only with search domains (Heiko Hund, f7afbc51)
+  * Correct documentation for --ns-cert-type (Frank Lichtenheld, a0813a9d)
+  * tun.c: set IPv4 address temporary on Windows (Lev Stipakov, 93c9b47c)
+  * options: Remove some verbose error messages for options deprecated in 2.4 (Frank Lichtenheld, d4df0a3f)
+  * Remove some obsolete references to --windows-driver (Frank Lichtenheld, 2ab3e873)
+  * tun: Change return type of write_tun/read_tun to ssize_t (Frank Lichtenheld, c97aa55a)
+  * tun: Refactor BSD write_tun/read_tun (Frank Lichtenheld, 6c7489e2)
+  * pull-filter: improve documentation (Selva Nair, d3e03b9a)
+  * GHA: Add minGW Release build (Frank Lichtenheld, 55a5e205)
+  * socket: Initialize struct in_addr_t in getaddr() (Frank Lichtenheld, e8dc7f35)
+  * CMake: For VS build, switch from /W2 to /W3 (Frank Lichtenheld, 9a2420fd)
+  * Documentation: Various syntax fixes and text improvements (Frank Lichtenheld, bd8d03e9)
+  * Prevent crash on invalid server-ipv6 argument (Klemens Nanni, 0ff66c05)
+  * mbedtls: gracefully exit if certificate file is NULL (Steffan Karger, d7c7caa3)
+  * Fix dco with null cipher being enabled without auth none (Arne Schwabe, 4ff746ad)
+  * Add CAP_SYS_NICE to the positive list in systemd service files (Simon Matter, 864aab8a)
+  * Add a section about wolfSSL GPLv3 and point out missing TLS PRF support (Arne Schwabe, 603fe533)
+  * Clarify some code in epoch with better comments (Arne Schwabe, c282b62f)
+  * Drop Mbed TLS 2.X compatibility (Max Fillinger, da51cc45)
+  * Set UTF-8 as the codepage using manifest declaration (Selva Nair, bcc7fb2d)
+
+ -- Yuriy Darnobyt <[email protected]>  Wed, 17 Dec 2025 09:30:46 +0100

release/source-build.sh

@@ -36,6 +36,14 @@ fi
 git -C $TOP_DIR/src/openvpn-gui remote update
 #TODO: make idempotent
 if ! [[ "$MSI_BUILD_ONLY" == "YES" ]]; then
+    # Re-initialize source directory to make sure we do not have
+    # any leftovers from previous builds
+    read -p "Would you like to re-initialize source directory? (Y/n): " resp
+    if [[ "$resp" != "N" && "$resp" != "n" ]]; then
+        rm -rf "$TOP_DIR"/src/*
+        git submodule update --init --recursive
+    fi
+
     $SCRIPT_DIR/create-release-files.sh
     read -p "Upload tarballs to $SECONDARY_WEBSERVER?"
     # uploads tarballs, required by some build steps

release/vars.example

@@ -23,13 +23,13 @@ GIT_AUTHOR="Yuriy Darnobyt <[email protected]>"
 MSI_BUILD_ONLY="NO"
 
 # Version numbers
-OPENVPN_PREVIOUS_VERSION="${OPENVPN_PREVIOUS_VERSION:-2.7_rc2}"
-OPENVPN_CURRENT_VERSION="${OPENVPN_CURRENT_VERSION:-2.7_rc3}"
+OPENVPN_PREVIOUS_VERSION="${OPENVPN_PREVIOUS_VERSION:-2.7_rc3}"
+OPENVPN_CURRENT_VERSION="${OPENVPN_CURRENT_VERSION:-2.7_rc4}"
 OPENVPN_CURRENT_TAG="${OPENVPN_CURRENT_TAG:-HEAD}"
 OPENVPN_PREVIOUS_TAG="refs/tags/v$OPENVPN_PREVIOUS_VERSION"
 
 OPENVPN_GUI_CURRENT_MAJ_VERSION=11
-OPENVPN_GUI_CURRENT_MIN_VERSION=59
+OPENVPN_GUI_CURRENT_MIN_VERSION=60
 OPENVPN_GUI_CURRENT_FULL_VERSION="$OPENVPN_GUI_CURRENT_MAJ_VERSION.$OPENVPN_GUI_CURRENT_MIN_VERSION.0.0"
 OPENVPN_GUI_BRANCH="master"
 

src/openvpn

@@ -129,7 +129,7 @@
         <!--
             Launch conditions
         -->
-        <Condition Message="[SimpleProductName] requires Windows 7 or later version of Windows."><![CDATA[Installed OR (VersionNT>=601)]]></Condition>
+        <Condition Message="[SimpleProductName] requires Windows 10 or later version of Windows."><![CDATA[Installed OR (VersionNT>=603)]]></Condition>
         <?if $(sys.BUILDARCH)~="x86" Or $(sys.BUILDARCH)~="ARM" ?>
         <Condition Message="You are attempting to install a 32-bit variant of [SimpleProductName] on a 64-bit operating system. The 32-bit variant will not work with your operating system. An installation of a 64-bit variant is recommended."><![CDATA[Installed OR NOT VersionNT64]]></Condition>
         <?endif?>

src/openvpn-gui

@@ -25,7 +25,7 @@ dnl The only binaries which Openvpn-build uses from Easy-RSA, are the *nix style
 dnl (32bit only) binaries for Windows, from easy-rsa/distro/windows/bin.
 dnl Further details: easy-rsa/distro/windows/Licensing/mksh-Win32.txt
 dnl renovate: datasource=github-releases depName=OpenVPN/easy-rsa
-define([EASYRSA_VERSION], [3.2.4])
+define([EASYRSA_VERSION], [3.2.5])
 
 dnl ============================================================
 dnl MSI Provisioning