newsNews: Download areas

Latest News
Mercurial hg moved to new server posted by agn, Thu Jan 12 15:07:50 2017 - 0 replies
Bazaar bzr moved to new server posted by agn, Tue Jan 10 03:33:35 2017 - 0 replies
Subversion svn service moved to the new server. posted by rwp, Fri Jan 6 19:02:03 2017 - 0 replies
The cvs service has moved to the new server posted by agn, Fri Dec 16 03:14:26 2016 - 0 replies
The git service has moved to the new server posted by rwp, Sun Dec 4 00:38:44 2016 - 0 replies
[184 news in archive]

Download areas

Item posted by James E. Blair <corvus> on Thu Jan 15 22:15:29 2004.

Files that were in the download areas on Savannah before the
compromise can be downloaded from
We kindly ask project administrators to verify the integrity of those
files and use the following procedure to upload them to the new file
areas on Savannah.

Savannah has a new system to handle uploads of files to the download
area in a secure way. Project administrators are the only ones
allowed to upload files at this time.

To begin, please add your GPG key by logging in to Savannah and
visiting one of the following URLs:

Within 2 hours the system should have updated the files necessary for

After that time, use the following procedure to upload files:

For each upload destined for Savannah, two files need to be
uploaded via ftp to the site.

(1) File to distributed (eg. foo.tar.gz)

(2) Detached GPG binary signature for (1) (using gpg -b)
(eg. foo.tar.gz.sig)

The files should be uploaded via anonymous ftp to
and placed in the /incoming/savannah/<projectname> directory. For
example, to place foo.tar.gz in project bar's download area, upload
foo.tar.gz and foo.tar.gz.sig to:

Uploads are processed every five minutes. Uploads that are in
progress when the upload processing script is running are handled
properly, so do not worry about the timing of your upload.

Currently there is no easy way to manipulate (move, rename, delete, or
work in subdirectories) with the new system. If you are an
experienced PHP programmer and would like to help add this
functionality, please contact us.

If you have questions about this process, please contact us at

Thank you for your patience.


Does not work for me... (posted by Wolfgang Müller, Wed Jun 9 12:15:10 2004)

Hi, I tried Savannah-Helper on this, and it gives comparable results to those given below:

ftp> pwd
257 "/incoming/savannah/gift"
ftp> put gift-0.1.9+5epsilon.tar.gz
local: gift-0.1.9+5epsilon.tar.gz remote: gift-0.1.9+5epsilon.tar.gz
200 PORT command successful. Consider using PASV.
553 Could not create file.

Any suggestions?

major nuissance (posted by Sam Steingold, Sat Mar 13 17:00:39 2004)

this system is a major nuissance.

While I do appreciate your security concerns
and in no way do I claim to be a security expert,
I must make the following comments wrt the
described procedure.

1. It is absurdly complicated.
You require that for each file I release,
I type in my secret passphrase 2 times
and upload 3 files.

2. It does not let me create symbolic links.

3. It does not let me remove files.

4. It requires me to sign even plain text files like NEWS.

Consider this scenario: I want to put a nightly snapshot
on; this would include an automatically
generated tar ball and the html manual which contains 150
html files generated from DocBook/XML sources.
Do you expect me to type my secret passphrase 300
times every time I change the manual?!

The previous system (ssh to gnudist) was much more convenient,
and I am sure something similar can be devised in a secure way.

Remember, when people are unduly inconvenienced by security,
they circumvent it to get the job done,
and this defeats the purpose of your security measures.

Still having problems uploading (posted by Patrick Ohnewein, Mon Mar 1 10:28:21 2004)

Hello all.

I have to reupload my files to the download area, because a lot of other portals, like, are reporting broken links.

I generated the gpg key and uploaded it, to the page mentioned in the news. After that I tried to transfer the whole old content (including the directory structure) of my songanizer project with gftp.

It didn't work, so I assumed I had to wait a bit longer. But now after more than 3 days, I am getting afraid that there is something wrong.

Is it my fault or is it planned, that after connecting I don't get any directory listing? It may be for security, but it is even very much confusing me.

It would be a big help, if someone who got the things working could provide a good howto and maybe a script, which automates the transfer. I liked the old command line generator form very much.

Is it right to transfer the directory structure or should we now transfer only the files?

The structure of my project is (better was):


Do I have to strip the directories?

What if we transfer something the wrong way, how can we delete files?

Happy hacking!

Not working... (posted by Paca, Tue Feb 17 18:03:08 2004)

Hi there,

I've put my gpg fingerprint in my account configuration page, I have wait 3 days and when I tried to upload a file or its signature I have the following error :

Logged in to
Current remote directory is /incoming/savannah/opale.

ncftp /incoming/savannah/opale > put OpaleV1b8.tar.gz.sig
OpaleV1b8.tar.gz.sig: 65,00
B 1,15 kB/s
Could not preserve times for OpaleV1b8.tar.gz.sig: UTIME failed.

Could anyone help ?


working now for me too (posted by Joachim Wolfgang Kaltz, Fri Jan 23 16:49:43 2004)

thx for your assistance - turns out my method was OK, but Savannah seemed to have intermittent problems. File uploading seems to work flawlessly now for the last couple of days.

Anonymous ftp for upload? (posted by James Hess, Wed Jan 21 03:25:03 2004)

I'm really not enthused about this change: I found the rsync
interface to be a nice way for uploading and managing the files directory, and in particular, superior to ftp.

This is aside from the rather obvious fact that members
of the public, might if they like to be annoying, as some do from time to time, anonymously upload files to any project, files they have one of the admins' personal GPG signature for, but those still files not intended for upload to savannah nevertheless.

(Old versions of files with known holes,
unrelated signed e-mail, duplicates, whatever)

Verification of signatures ought to be done by the user
at download, and not mistaken for "authorization to upload";
the password used to login is the authorization for upload,
and security of the public_key field on the server can not
really be greater than that of the login password, anyhow,
(not without requiring key signing).

In fact, I prefer rsync for all file transfer purposes,
because I find that it is faster.

   Next Messages


Back to the top

Powered by Savane 3.1-cleanup