News: Download areas
Download areas
Item posted by James E. Blair <corvus> on Thu Jan 15 22:15:29 2004.
Files that were in the download areas on Savannah before the
compromise can be downloaded from ftp://ftp.gnu.org/savannah/files.
We kindly ask project administrators to verify the integrity of those
files and use the following procedure to upload them to the new file
areas on Savannah.
Savannah has a new system to handle uploads of files to the download
area in a secure way. Project administrators are the only ones
allowed to upload files at this time.
To begin, please add your GPG key by logging in to Savannah and
visiting one of the following URLs:
https://savannah.gnu.org/account/change.php?item=gpgkey
https://savannah.nongnu.org/account/change.php?item=gpgkey
Within 2 hours the system should have updated the files necessary for
uploads.
After that time, use the following procedure to upload files:
For each upload destined for Savannah, two files need to be
uploaded via ftp to the site.
(1) File to distributed (eg. foo.tar.gz)
(2) Detached GPG binary signature for (1) (using gpg -b)
(eg. foo.tar.gz.sig)
The files should be uploaded via anonymous ftp to savannah.gnu.org.
and placed in the /incoming/savannah/<projectname> directory. For
example, to place foo.tar.gz in project bar's download area, upload
foo.tar.gz and foo.tar.gz.sig to:
ftp://savannah.gnu.org/incoming/savannah/bar
Uploads are processed every five minutes. Uploads that are in
progress when the upload processing script is running are handled
properly, so do not worry about the timing of your upload.
Currently there is no easy way to manipulate (move, rename, delete, or
work in subdirectories) with the new system. If you are an
experienced PHP programmer and would like to help add this
functionality, please contact us.
If you have questions about this process, please contact us at
<savannah-hackers@gnu.org>.
Thank you for your patience.
Comments:
| Does not work for me... (posted by Wolfgang Müller, Wed Jun 9 12:15:10 2004) |
Hi, I tried Savannah-Helper on this, and it gives comparable results to those given below:
ftp> pwd
Any suggestions? |
| Works for me now! (posted by Wolfgang Müller, Wed Jun 9 15:13:39 2004) |
Apparently my key was wrong?? In any case, it works now for me. |
| major nuissance (posted by Sam Steingold, Sat Mar 13 17:00:39 2004) |
this system is a major nuissance.
While I do appreciate your security concerns
1. It is absurdly complicated.
2. It does not let me create symbolic links.
3. It does not let me remove files.
4. It requires me to sign even plain text files like NEWS.
Consider this scenario: I want to put a nightly snapshot
The previous system (ssh to gnudist) was much more convenient,
Remember, when people are unduly inconvenienced by security,
|
| RE: major nuissance (posted by Sylvain Beucler, Sun Mar 14 19:57:34 2004) |
I would say this system, at least for Savannah, is temporary. We plan to provide an interface to manage files once they are uploaded. Symbolic links should be taken into account indeed.
What I suggest is to keep these comments for when the system will be ready again, ie when people will be willing to changes things, with alpha|ftp.gnu.org in cc, since decisions at Savannah are independant.
While I do not know whether it is ok to upload non-archive/release files at *.gnu.org (the Savannah cvsweb space may be more appropriate), you may want to do use an automated way to sign your files meanwhile, using:
The fact you cannot remove files at *.gnu.org is, if I am right, a GNU policy: each release should be kept/archived. This may be discussed at the GNU mailing lists.
|
| RE: major nuissance (posted by Sam Steingold, Tue Mar 16 14:36:42 2004) |
1. there is nothing more permanent than something temporary.
2. I do not understand the paragraph mentioning SCO. Could you please clarify it?
3. saving passphrase into a text file is exactly what I meant when I said "when people are unduly inconvenienced by security, they circumvent it to get the job done": this is extremely insecure and defeats the whole purpose of this process.
4. if I accidentally uploaded a wrong file, I should be able to remove it.
5. a tarball should be accompanied by a README file, right? (at least one README per subdirectory, symlinks to .message).
thanks. |
| RE: major nuissance (posted by Sylvain Beucler, Thu Mar 18 09:36:22 2004) |
I do not like that solution either, because of the "security risk" I mentioned (anybody can upload a signed file, eg emails). However, since authentication is taken very seriously and given our copyright laws, I think that ssh is not enough because it allows to upload non signed files. I also saw in a news item that signed CVS commits are planned, so uploading browsable documentation will be ok too. We sure miss gpg-agent for this to work, and my password text file is gross indeed, hehe. I wonder, though, whether download areas are meant for uploading 150+ files. By the way, if we upload a wrong file at *.gnu.org, we still can contact the admins for now.
SCO's example just came to my mind because a cracker could add some foreign code into one of our packages to start tedious lawsuits. Sorry if I was confusing.
|
| RE: major nuissance (posted by Delete me, Thu Mar 18 23:39:09 2004) |
A GnuPG signature is not legally binding so it doesn't matter if each upload/commit is signed by GnuPG or by any other non-government/non-legally approved digital signature. |
| RE: major nuissance (posted by Sylvain Beucler, Fri Mar 19 07:51:56 2004) |
[replies by chronological order]
GnuPG is a RFC2440 (OpenPGP) compliant application, so you are not forced to use that piece of software. However, we do not encourage the use of proprietary software either.
Bradley Kuhn said (https://savannah.gnu.org/forum/forum.php?forum_id=2752):
GPG keys are very similar to SSH keys: they are easy to use, but blank passphrases are a security risk: anybody who can get your private key can make people believe (s)he is you (do you really trust your sysadmin, your accounts' security, or the possibly outdated firewall you use to connect to the internet?). That is not possible with a passphrase.
|
| RE: major nuissance (posted by Delete me, Fri Mar 19 17:57:23 2004) |
It is always the end-users responsibility to verify integrity and security of downloaded source code. Part of the GNU GPL license is "without any warranty". |
| RE: major nuissance (posted by Delete me, Thu Mar 18 23:41:46 2004) |
I am considering moving the download and source code access to the webcvs just to avoid the GnuPg issue. But then they will force us to sign web tree uploads to I guess... |
| RE: major nuissance (posted by Delete me, Thu Mar 18 23:46:43 2004) |
Another solution is to use a blank passphrase for the key. For us not using, not wanting to use and not having a GnuPG key floating around, we could generate a new key for each upload, script its addition via the web interface, and then script an upload. Then remove the key, and reiterate for the next upload.
When there is a will, there is way. Security that hazzles users is circumvented, leaving the system more insecure than before. |
| Still having problems uploading (posted by Patrick Ohnewein, Mon Mar 1 10:28:21 2004) |
Hello all.
I have to reupload my files to the download area, because a lot of other portals, like freshmeat.net, are reporting broken links.
I generated the gpg key and uploaded it, to the page mentioned in the news. After that I tried to transfer the whole old content (including the directory structure) of my songanizer project with gftp.
It didn't work, so I assumed I had to wait a bit longer. But now after more than 3 days, I am getting afraid that there is something wrong.
Is it my fault or is it planned, that after connecting I don't get any directory listing? It may be for security, but it is even very much confusing me.
It would be a big help, if someone who got the things working could provide a good howto and maybe a script, which automates the transfer. I liked the old command line generator form very much.
Is it right to transfer the directory structure or should we now transfer only the files?
The structure of my project is (better was):
./songanizer.pkg/0.2/songanizer-0.2.tar.gz
Do I have to strip the directories?
What if we transfer something the wrong way, how can we delete files?
Happy hacking!
|
| RE: Still having problems uploading (posted by Patrick Ohnewein, Mon Mar 1 15:43:33 2004) |
I reply to myself.
It worked, but not with the subdirectories. That means the file area format has got very ugly. And I wasn't able to restore the original file structure. That meaned, I wasn't able to fix the broken links in the web and my project got removed from freshmeat :(
Couldn't you provide an rsync access to the second ftp server and transfer only files with valid sigs? It's nearly the same as now, only that on the second ftp server we would have the whole file structure, some sort of mirror. And if a user changes the structure on the second ftp server, the first get's updated. Of course I wouldn't provide anonymous access anymore. If you don't want rsync, just use ftp, but please allow subdirectories.
Happy hacking!
|
| RE: Still having problems uploading (posted by Sylvain Beucler, Mon Mar 1 21:26:27 2004) |
The file uploading system is temporary. We need to fix other issues and then we will provide a web interface to manage uploaded files in your download area. |
| RE: Still having problems uploading (posted by Delete me, Thu Mar 4 21:19:49 2004) |
That sounds great.
Luckily it is possible to change the download location in the project preferences to a new location until this is fixed.
Another possibility is of course to let users fetch directly from a tagged CVS branch. |
| Not working... (posted by Paca, Tue Feb 17 18:03:08 2004) |
Hi there,
I've put my gpg fingerprint in my account configuration page, I have wait 3 days and when I tried to upload a file or its signature I have the following error :
Logged in to savannah.gnu.org.
ncftp /incoming/savannah/opale > put OpaleV1b8.tar.gz.sig
Could anyone help ?
Thanks
|
| RE: Not working... (posted by Sylvain Beucler, Tue Feb 17 20:23:20 2004) |
I experienced the same issue with 'ncftp'. However, it worked perfectly with 'ftp'. Could you try again with that tool? |
| RE: Not working... (posted by Paca, Wed Feb 18 03:44:55 2004) |
I do not get an error when using ftp program but there is still nothing uploaded :
cf http://savannah.nongnu.org/download/opale/
Best regards
|
| RE: Not working... (posted by Sylvain Beucler, Wed Feb 18 14:06:39 2004) |
The upload procedure checks your GPG key, but, there is an old misleading text about "GPG key or fingerprint". It should work if you upload your GPG key (gpg --export -a your@email.com) instead of your fingerprint in your Savannah account. |
| RE: Not working... (posted by Paca, Fri Feb 20 16:34:48 2004) |
Yep
Thanks a lot
|
| working now for me too (posted by Joachim Wolfgang Kaltz, Fri Jan 23 16:49:43 2004) |
thx for your assistance - turns out my method was OK, but Savannah seemed to have intermittent problems. File uploading seems to work flawlessly now for the last couple of days. |
| Anonymous ftp for upload? (posted by James Hess, Wed Jan 21 03:25:03 2004) |
I'm really not enthused about this change: I found the rsync
This is aside from the rather obvious fact that members
(Old versions of files with known holes,
Verification of signatures ought to be done by the user
In fact, I prefer rsync for all file transfer purposes,
|
| RE: Anonymous ftp for upload? (posted by Delete me, Tue Feb 17 18:18:44 2004) |
Hear, hear! |
| RE: Anonymous ftp for upload? (posted by Delete me, Tue Feb 17 18:24:50 2004) |
Having to create a GPG key just to upload files (and in the future do CVS checkins) is starting to become a major hazzle. (How will people be sure it is a real good key when it is not signed by anyone but me?)
Maybe it is time to revoke my projects from Savannah and the web and just give up this free software thing. Just takes too much time and energy...
Why not support S/MIME signed files for upload? I already have a personal identify certficate from Thawte. I don't need a GPG key. |
| RE: Anonymous ftp for upload? (posted by Sylvain Beucler, Wed Feb 18 14:07:57 2004) |
Savannah and free software (http://www.gnu.org/philosophy/free-sw.html) are two different concepts. |
| RE: Anonymous ftp for upload? (posted by Delete me, Wed Feb 18 23:58:24 2004) |
To me its seems this is a way to drive away free software developers from Savannah. |
|
Next Messages |


