Hi,

Debian CI is switching away from lxc containers in favor of incus Containers.
This is motivated by security concerns from us; incus is based on lxc, but
orchestrates containers substantially different: containers are not privileged
(so root in the container is not uid 0 outside of it, and incus imposes a
stricter isolation from the host system.

openvpn passes its tests under lxc, but fails under incus.
The relevant part of the failure is (hopefully):
https://ci.debian.net/experiments/8/regressions/
(please beware of pagination)

Common types of failure and suggested fixes are being documented at:
https://wiki.debian.org/ContinuousIntegration/LxcToIncus

Note that for the time being, openvpn is still being tested under lxc to
avoid disturbing its testing migration test results.

If you decide to add the `isolation-machine` restriction to get this package
tested under qemu, please mention that explicitly when closing this bug (it's
fine to do that only in the package changelog entry that closes the bug) so
that we can configure your package for qemu on ci.debian.net.

We believe that the bug you reported is fixed in the latest version of
openvpn, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144822@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bernhard Schmidt <berni@debian.org> (supplier of updated openvpn package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 07 Oct 2026 20:53:54 +0200
Source: openvpn
Architecture: source
Version: 2.7.8-1
Distribution: unstable
Urgency: high
Maintainer: OpenVPN Maintainers <openvpn@packages.debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Closes: 1144822
Changes:
 openvpn (2.7.8-1) unstable; urgency=high
 .
   * New upstream version 2.7.8
     - CVE-2026-84790: Check for NULL-Bytes in certificate subjects - refuse all
       such certificates now as "invalid"
     - CVE-2026-88964: options: fix unsigned underflow when clearing
       domain_search_list
     - fixes various DCO-related race conditions
   * tests: Use isolation-machine, add iproute2 dependency (Closes: #1144822)
Checksums-Sha1:
 b80911991029425d22581a2d39c1559cbb3a4d80 2367 openvpn_2.7.8-1.dsc
 86cd545b88f1eca07594a5fad879aa5f63b74e62 2123466 openvpn_2.7.8.orig.tar.gz
 7080d6c56189e8ea699acf508b6c7e1873e80597 61944 openvpn_2.7.8-1.debian.tar.xz
 c028c39892ef57de810f87668c74b11843193768 7070 openvpn_2.7.8-1_amd64.buildinfo
Checksums-Sha256:
 9e134421b9446d6e11d9e4b427767fb71bc545928bdb41cf5efe09cec44b6c10 2367 openvpn_2.7.8-1.dsc
 c070d1d2440b5a6fca6c2c68645c98cd492116ac36ef4f0946177115532c8e36 2123466 openvpn_2.7.8.orig.tar.gz
 5b137d701dba80c357f05a9e0b9581ea8dd672e73e5e78adf1e69e7a3feb2196 61944 openvpn_2.7.8-1.debian.tar.xz
 ab056b3e5bab3ff562a8f924bdf1cf9dd7ece69881bdfbb3eeaa8f26091990c5 7070 openvpn_2.7.8-1_amd64.buildinfo
Files:
 e02d352782d0c2208ce0438f089c2ee6 2367 net optional openvpn_2.7.8-1.dsc
 24a6ccd5aa034df9e91618f3fee58818 2123466 net optional openvpn_2.7.8.orig.tar.gz
 8d9246a0dc398be48096fdea4855467f 61944 net optional openvpn_2.7.8-1.debian.tar.xz
 de1c1709ff06a92f8424c5763ec31bb2 7070 net optional openvpn_2.7.8-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmrGof8RHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJMMFg//YX8o3SLfP0nwBu7PBrNThA0m+lIo+33O
YWSK1onDvHMuAASDuUvxQZijixD2YbzipY1W8qT3kGQ0FbmDEWo0l1Cv80EPjOxR
oSP3Zndn+EunLYqzhmH78j5TS6e6M+AFxHXIhRrw8N0eTgZ5aLw3jxNZ1cOvnHOb
4OhSN2wMefsG2LHlXq/6XDcD+0HWKIM9TPp/vKGlZ3cNGBTBQOUZV5Nze9H7vZ6l
OMIVbNB8+XlM6RB3bUTiteNg2OzPsnsMQC9aG/vAstzoXvIM0SdCULw2FduIQeii
JWVQLUdCPyJbrINk+LIzJAvJgSlB5F9KNflJLwnffhi6NOl+V4fCOfjeZwEHoJqq
lnDCcuEZlyXBLohyB/SM91vDdLj4VGLFFu6PCAoK7aRDhFr9g5GRlYTkXds+ekMZ
U6NIaIv8210iAonBhqRb824l8E8y+nT4zQrAicXoAahB5Z/5hZy/ZuSWDb1rOdvv
Y0wfHbrTs4R+3Mt11mDYZuGbYVi8bj36if+FtmCK7UV5EL66daPy+107ZVlhMuKL
/hXbs6zG1QvJ7yQ7X9GofIqNWDZkbuJnftzb9KFGu6FfjKzPDoiIYG2xk2DqcVM4
miIgsEGIeylNUQztMQDMU742iypAu/z2KnfFWiKe70LBTA0FNJNA8l+XqGLo79SM
DRJyRvkSK+Q=
=Tahd
-----END PGP SIGNATURE-----