- up to 2.3.0; easy-rsa is gone (separate spec is needed); contrib scripts not installed by default; this version supports IPv6 already so drop external patch/bcond