newsNews: Download areas

 
 
Latest News
Savannah VCS Storage Maintenance Completed posted by rwp, Wed 14 May 2014 10:19:51 PM UTC - 0 replies
Savannah VCS Maintenance posted by rwp, Sun 11 May 2014 08:05:38 PM UTC - 0 replies
Savannah https SSL Certificates Updated posted by rwp, Thu 06 Mar 2014 09:11:43 AM UTC - 0 replies
Bazaar upgraded posted by mjflick, Tue 22 May 2012 02:49:11 AM UTC - 0 replies
git / cgit updated posted by mjflick, Fri 09 Dec 2011 12:13:52 AM UTC - 0 replies
[174 news in archive]

Download areas

Item posted by James E. Blair <corvus> on Thu 15 Jan 2004 10:15:29 PM UTC.

Files that were in the download areas on Savannah before the
compromise can be downloaded from ftp://ftp.gnu.org/savannah/files.
We kindly ask project administrators to verify the integrity of those
files and use the following procedure to upload them to the new file
areas on Savannah.

Savannah has a new system to handle uploads of files to the download
area in a secure way. Project administrators are the only ones
allowed to upload files at this time.

To begin, please add your GPG key by logging in to Savannah and
visiting one of the following URLs:

https://savannah.gnu.org/account/change.php?item=gpgkey

https://savannah.nongnu.org/account/change.php?item=gpgkey

Within 2 hours the system should have updated the files necessary for
uploads.

After that time, use the following procedure to upload files:

For each upload destined for Savannah, two files need to be
uploaded via ftp to the site.

(1) File to distributed (eg. foo.tar.gz)

(2) Detached GPG binary signature for (1) (using gpg -b)
(eg. foo.tar.gz.sig)

The files should be uploaded via anonymous ftp to savannah.gnu.org.
and placed in the /incoming/savannah/<projectname> directory. For
example, to place foo.tar.gz in project bar's download area, upload
foo.tar.gz and foo.tar.gz.sig to:

ftp://savannah.gnu.org/incoming/savannah/bar

Uploads are processed every five minutes. Uploads that are in
progress when the upload processing script is running are handled
properly, so do not worry about the timing of your upload.

Currently there is no easy way to manipulate (move, rename, delete, or
work in subdirectories) with the new system. If you are an
experienced PHP programmer and would like to help add this
functionality, please contact us.

If you have questions about this process, please contact us at
<savannah-hackers@gnu.org>.

Thank you for your patience.

Comments:

Does not work for me... (posted by Wolfgang Müller, Wed 09 Jun 2004 12:15:10 PM UTC)

Hi, I tried Savannah-Helper on this, and it gives comparable results to those given below:

ftp> pwd
257 "/incoming/savannah/gift"
ftp> put gift-0.1.9+5epsilon.tar.gz
local: gift-0.1.9+5epsilon.tar.gz remote: gift-0.1.9+5epsilon.tar.gz
200 PORT command successful. Consider using PASV.
553 Could not create file.

Any suggestions?


major nuissance (posted by Sam Steingold, Sat 13 Mar 2004 05:00:39 PM UTC)

this system is a major nuissance.

While I do appreciate your security concerns
and in no way do I claim to be a security expert,
I must make the following comments wrt the
described procedure.

1. It is absurdly complicated.
You require that for each file I release,
I type in my secret passphrase 2 times
and upload 3 files.

2. It does not let me create symbolic links.

3. It does not let me remove files.

4. It requires me to sign even plain text files like NEWS.

Consider this scenario: I want to put a nightly snapshot
on alpha.gnu.org; this would include an automatically
generated tar ball and the html manual which contains 150
html files generated from DocBook/XML sources.
Do you expect me to type my secret passphrase 300
times every time I change the manual?!

The previous system (ssh to gnudist) was much more convenient,
and I am sure something similar can be devised in a secure way.

Remember, when people are unduly inconvenienced by security,
they circumvent it to get the job done,
and this defeats the purpose of your security measures.


Still having problems uploading (posted by Patrick Ohnewein, Mon 01 Mar 2004 10:28:21 AM UTC)

Hello all.

I have to reupload my files to the download area, because a lot of other portals, like freshmeat.net, are reporting broken links.

I generated the gpg key and uploaded it, to the page mentioned in the news. After that I tried to transfer the whole old content (including the directory structure) of my songanizer project with gftp.

It didn't work, so I assumed I had to wait a bit longer. But now after more than 3 days, I am getting afraid that there is something wrong.

Is it my fault or is it planned, that after connecting I don't get any directory listing? It may be for security, but it is even very much confusing me.

It would be a big help, if someone who got the things working could provide a good howto and maybe a script, which automates the transfer. I liked the old command line generator form very much.

Is it right to transfer the directory structure or should we now transfer only the files?

The structure of my project is (better was):

./songanizer.pkg/0.2/songanizer-0.2.tar.gz
./songanizer.pkg/0.2/songanizer-0.2.tar.gz.sig
./songanizer.pkg/0.4/songanizer-0.4-1.i386.rpm
./songanizer.pkg/0.4/songanizer-0.4-1.src.rpm
./songanizer.pkg/0.4/songanizer-0.4.tar.gz
./songanizer.pkg/0.4/songanizer-0.4-1.i386.rpm.sig
./songanizer.pkg/0.4/songanizer-0.4-1.src.rpm.sig
./songanizer.pkg/0.4/songanizer-0.4.tar.gz.sig
./songanizer.pkg/0.5/songanizer-0.5-1.i386.rpm
./songanizer.pkg/0.5/songanizer-0.5-1.src.rpm
./songanizer.pkg/0.5/songanizer-0.5.tar.gz
./songanizer.pkg/0.5/songanizer-0.5-1.i386.rpm.sig
./songanizer.pkg/0.5/songanizer-0.5-1.src.rpm.sig
./songanizer.pkg/0.5/songanizer-0.5.tar.gz.sig

Do I have to strip the directories?

What if we transfer something the wrong way, how can we delete files?

Happy hacking!
Patrick


Not working... (posted by Paca, Tue 17 Feb 2004 06:03:08 PM UTC)

Hi there,

I've put my gpg fingerprint in my account configuration page, I have wait 3 days and when I tried to upload a file or its signature I have the following error :

Logged in to savannah.gnu.org.
Current remote directory is /incoming/savannah/opale.

ncftp /incoming/savannah/opale > put OpaleV1b8.tar.gz.sig
OpaleV1b8.tar.gz.sig: 65,00
B 1,15 kB/s
Could not preserve times for OpaleV1b8.tar.gz.sig: UTIME failed.

Could anyone help ?

Thanks
Pac


working now for me too (posted by Joachim Wolfgang Kaltz, Fri 23 Jan 2004 04:49:43 PM UTC)

thx for your assistance - turns out my method was OK, but Savannah seemed to have intermittent problems. File uploading seems to work flawlessly now for the last couple of days.


Anonymous ftp for upload? (posted by James Hess, Wed 21 Jan 2004 03:25:03 AM UTC)

I'm really not enthused about this change: I found the rsync
interface to be a nice way for uploading and managing the files directory, and in particular, superior to ftp.

This is aside from the rather obvious fact that members
of the public, might if they like to be annoying, as some do from time to time, anonymously upload files to any project, files they have one of the admins' personal GPG signature for, but those still files not intended for upload to savannah nevertheless.

(Old versions of files with known holes,
unrelated signed e-mail, duplicates, whatever)

Verification of signatures ought to be done by the user
at download, and not mistaken for "authorization to upload";
the password used to login is the authorization for upload,
and security of the public_key field on the server can not
really be greater than that of the login password, anyhow,
(not without requiring key signing).

In fact, I prefer rsync for all file transfer purposes,
because I find that it is faster.


   Next Messages

 

Back to the top


Powered by Savane 3.1-cleanup