Skip to content

SupiVPN v0.8.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 15:46
Immutable release. Only release title and notes can be modified.
v0.8.3
4051363
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

SupiVPN v0.8.3

Changes

  • Remove explicit remote-cert-ku 80 and remote-cert-eku "TLS Web Server Authentication" from the shipped client template following a Windows client compatibility report. The template is delivered in the Linux bundle, public Lambda ZIP and Debian packages.
  • Preserve CA trust, certificate validity, TLS 1.2 minimum and the exact server common-name check in account-bound downloads. Add handshake rejection tests for a mismatched server name, an untrusted CA and an expired certificate.
  • Document how to update an existing template or imported profile without rotating its credential or changing its registered owner.

Compatibility

No database migration or profile reissuance is required; schema version 12 and the two-port 0.8.x/0.9.x migration window remain unchanged. Working older profiles continue to work.

Update the profile-serving controller/template, or the public Lambda ZIP. A package upgrade does not replace a configured template already copied to /etc, and no server upgrade rewrites an imported .ovpn. Remove only the two explicit KU/EKU directives from custom templates and affected profile files; re-import the edited file if the client requires it. Preserve the CA, verify-x509-name, inline profile credential and tls-crypt-v2 blocks. Downloading a new profile instead creates a separate credential.

Explicit KU/EKU-extension requirements are no longer imposed by these directives; TLS-library validation depends on the client. VPN server certificates must still be provisioned for TLS server authentication. Account-bound downloads retain exact CN checking, which is not wildcard/DNS-SAN verification. Legacy profiles still do not verify a specific server name and may accept another certificate under the trusted CA. This release does not add the bound-profile guarantee to the legacy path.

Windows UI/tunnel acceptance and a live AWS deployment have not been independently reproduced for this patch.

Packages

Commit: 405136386d8f88fd05dcd7823a712d03b525a444. License: AGPL-3.0-only.

Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.

Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.

GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.

Database schema: 12; compatible VM schemas: 7, 8, 9, 10, 11, 12.
Isolated Lambda required schema: 12.

Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.

Assets 18
Loading