Merge branch 'release/2.7' of github.com:OpenVPN/openvpn-build into merge-master

* 'release/2.7' of github.com:OpenVPN/openvpn-build:
  Prepare release of 2.7.1-I001
  chore(deps): update src/vcpkg digest to bba8b52
  chore(deps): update dependency openvpn/easy-rsa to v3.2.6
  chore(deps): update src/openvpn digest to 96781b4
  chore(deps): update src/ovpn-backports digest to 15c9482
  chore(deps): update github actions
  chore(deps): update src/vcpkg digest to ed8445d

Author: flichtenheld

debian-sbuild/openvpn/changelog-2.7.1

@@ -0,0 +1,42 @@
+openvpn (2.7.1-debian0) stable; urgency=medium
+
+  * OpenVPN Release 2.7.1 (Gert Doering, 5c4e4c08)
+  * Add an optional username-only flag for auth-user-pass (Selva Nair, 96781b42)
+  * socket: restore per-connection lport override over global default (Gianmarco De Gregori, b5039975)
+  * tests: skip test execution when cross-compiling (Haixiao Yan, 66989b38)
+  * Increase default size of internal hash maps to 4 * --max-clients (Arne Schwabe, 216c7632)
+  * Use const specifices in extract_x509_field_ssl (Arne Schwabe, 82f67657)
+  * Do not support tls_ctx_set_cert_profile on AWS-LC (Arne Schwabe, 4577a0dc)
+  * ssl_verify_openssl: use official ASN1_STRING_ API (Rudi Heitbaum, 38880078)
+  * ssl_verify_openssl: Clean up extract_x509_extension (Frank Lichtenheld, 5f0a1683)
+  * Use openssl_err_t typedef to deal with difference between TLS libraries (Arne Schwabe, ca6c9a88)
+  * GHA: Cache built crypto libraries (Arne Schwabe, 6dc947e2)
+  * Remove unnecessary OpenSSL init and cleanup commands in unit tests (Arne Schwabe, 0bb9a250)
+  * doc: fix typo with --ingore-unknown-option (Heiko Hund, 40050f37)
+  * doc: improve Windows-specific options section (Heiko Hund, 78314ce7)
+  * systemd: Change LimitNPROC to TasksMax and increase limit (Frank Lichtenheld, 8a156abb)
+  * Show version and double check we use the right TLS library in Github Actions (Arne Schwabe, 1b2518e6)
+  * GHA: Install aws-lc under /opt/aws-lc (Arne Schwabe, 7158e76f)
+  * AWS-LC: Add missing return and cast in ssl_tls1_PRF (Arne Schwabe, 06859871)
+  * doc: fix client-nat syntax and examples (Ralf Lici, 16646eb0)
+  * Use USER_PASS_LEN for private key password buffer size (Selva Nair, 6a1ae7f2)
+  * vcpkg-ports: Review pkcs11-helper port (Frank Lichtenheld, 30f7847c)
+  * buffer: Add checked_snprintf function and use it in the code (Frank Lichtenheld, c0e79211)
+  * Merge stream_buf_get_next and stream_buf_set_next (Arne Schwabe, 4d6cf3dc)
+  * Document management client versions (Selva Nair, cb154f03)
+  * Avoid unbounded allocations in pkcs11_mbedtls.c (Max Fillinger, bf7f8548)
+  * GHA: Maintenance update February 2026 (Frank Lichtenheld, a6cbca89)
+  * options: drop useless init_gc param for init_options() (Antonio Quartulli, acbe874c)
+  * dco_freebsd: use AF_LOCAL sockets for ioctl() communication with DCO driver (Gert Doering, b215499c)
+  * Fixup version command on management interface (Selva Nair, d88e9023)
+  * configure.ac: adjust to native inotify support for FreeBSD 15+ (Gert Doering, d9279c77)
+  * DCO Linux: Fix setting DCO ifmode failing on big endian archs (Arne Schwabe, 1c9f9bfa)
+  * ntlm: fix discards 'const' qualifier from pointer target type (Rudi Heitbaum, 18b38ffc)
+  * auth-pam: fix discards 'const' qualifier from pointer target type (Frank Lichtenheld, 2fd42e6d)
+  * dns: fix discards 'const' qualifier from pointer target type (Rudi Heitbaum, 188d3d68)
+  * Change stream_buf_read_setup_dowork parameter to struct steam_buf (Arne Schwabe, 9c8d28c7)
+  * rework all occurrences of 'M_ERR | M_ERRNO' (Gert Doering, 158f1fa1)
+  * clang-format: Add missing InsertBraces: true (Frank Lichtenheld, 6edd5fee)
+  * port-share: log incoming connections at verb 3 only (Gert Doering, 27505a5f)
+
+ -- Frank Lichtenheld <[email protected]>  Mon, 30 Mar 2026 18:49:56 +0200

debian-sbuild/ovpn-backports/changelog-7.0.0.2026032400

@@ -0,0 +1,5 @@
+ovpn-backports (7.0.0.2026032400-debian0) stable; urgency=medium
+
+  * Generated sources for ovpn-net-next/main-7.0.0-rc4-2026032400 (GitHub Actions, 15c9482)
+
+ -- Frank Lichtenheld <[email protected]>  Tue, 24 Mar 2026 16:20:20 +0000

release/vars.example

@@ -14,7 +14,7 @@ GPG_KEY_ID="F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7"
 # This also helps catch various problems with expired subkeys and public
 # keys.
 GPG_OPTS="--no-default-keyring --keyring ~/[email protected]/pubring.kbx"
-GIT_AUTHOR="Yuriy Darnobyt <yuriy.darnobyt@openvpn.net>"
+GIT_AUTHOR="Frank Lichtenheld <frank.lichtenheld@openvpn.com>"
 
 # Sometimes we release MSI build only with new INSTALLER_BUILD version
 # It does not require to tag and push OpenVPN sources again
@@ -23,20 +23,20 @@ GIT_AUTHOR="Yuriy Darnobyt <[email protected]>"
 MSI_BUILD_ONLY="NO"
 
 # Version numbers
-OPENVPN_PREVIOUS_VERSION="${OPENVPN_PREVIOUS_VERSION:-2.7.0}"
+OPENVPN_PREVIOUS_VERSION="${OPENVPN_PREVIOUS_VERSION:-2.7.1}"
 OPENVPN_CURRENT_VERSION="${OPENVPN_CURRENT_VERSION:-2.8_git}"
 OPENVPN_CURRENT_TAG="${OPENVPN_CURRENT_TAG:-HEAD}"
 OPENVPN_PREVIOUS_TAG="refs/tags/v$OPENVPN_PREVIOUS_VERSION"
 
 OPENVPN_GUI_CURRENT_MAJ_VERSION=11
-OPENVPN_GUI_CURRENT_MIN_VERSION=61
+OPENVPN_GUI_CURRENT_MIN_VERSION=62
 OPENVPN_GUI_CURRENT_FULL_VERSION="$OPENVPN_GUI_CURRENT_MAJ_VERSION.$OPENVPN_GUI_CURRENT_MIN_VERSION.0.0"
 OPENVPN_GUI_BRANCH="master"
 
-OPENVPN_DCO_PREVIOUS_VERSION="${OPENVPN_DCO_PREVIOUS_VERSION:-6.17.0.2025112700}"
-OPENVPN_DCO_CURRENT_VERSION="${OPENVPN_DCO_CURRENT_VERSION:-7.0.0.2026030300}"
-OPENVPN_DCO_CURRENT_TAG="${OPENVPN_DCO_CURRENT_TAG:-refs/tags/ovpn-net-next/main-7.0.0-rc1-2026030300}"
-OPENVPN_DCO_PREVIOUS_TAG="${OPENVPN_DCO_PREVIOUS_TAG:-refs/tags/ovpn-net-next/main-6.17.0-2025112700}"
+OPENVPN_DCO_PREVIOUS_VERSION="${OPENVPN_DCO_PREVIOUS_VERSION:-7.0.0.2026030300}"
+OPENVPN_DCO_CURRENT_VERSION="${OPENVPN_DCO_CURRENT_VERSION:-7.0.0.2026032400}"
+OPENVPN_DCO_CURRENT_TAG="${OPENVPN_DCO_CURRENT_TAG:-refs/tags/ovpn-net-next/main-7.0.0-rc4-2026032400}"
+OPENVPN_DCO_PREVIOUS_TAG="${OPENVPN_DCO_PREVIOUS_TAG:-refs/tags/ovpn-net-next/main-7.0.0-rc1-2026030300}"
 
 INSTALLER_BUILD=1
 INSTALLER_VERSION="I"$(printf "%03d\n" $INSTALLER_BUILD)

src/openvpn-gui

@@ -25,7 +25,7 @@ dnl The only binaries which Openvpn-build uses from Easy-RSA, are the *nix style
 dnl (32bit only) binaries for Windows, from easy-rsa/distro/windows/bin.
 dnl Further details: easy-rsa/distro/windows/Licensing/mksh-Win32.txt
 dnl renovate: datasource=github-releases depName=OpenVPN/easy-rsa
-define([EASYRSA_VERSION], [3.2.5])
+define([EASYRSA_VERSION], [3.2.6])
 
 dnl ============================================================
 dnl MSI Provisioning