Uploading a signed release

Starting with OpenSSH 9.0, scp uses the SFTP protocol by default. As of 2024-01-13, SFTP is disabled on Savannah. Please add the -O option to scp command line if you use OpenSSH 9.0 or later. Alternatively, you can use rsync.

If your package is part of GNU and you want to upload at ftp.gnu.org or alpha.gnu.org, you currently need to follow the maintainers' guide.

On Savannah, you can use scp to upload your GPG signed files. To begin, please add your GPG keys to the Public Information of your group.

For each upload destined for Savannah, two files need to be uploaded.

  1. File to distributed (eg. foo.tar.gz)
  2. Detached GPG binary signature for that file (eg. foo.tar.gz.sig). To create it, use gpg -b.

For example this will produce a file named foo.tar.gz.sig:

gpg -b foo.tar.gz

To verify it:

$ gpg --verify foo.tar.gz.sig foo.tar.gz
gpg: Signature made sam 03 mai 2008 18:16:09 CEST using DSA key ID 81704B93
gpg: Good signature from "Sylvain Beucler (GNU Savannah Hacker) <beuc@gnu.org>"
gpg:                 aka "Sylvain Beucler (GNU Maintainer) <beuc@beuc.net>"

If you need to sign several files one after the other, we recommend gpg-agent, a program that will temporarily keep you passphrase in memory:

  • Debian GNU/Linux and derivates (Ubuntu, Knoppix...): gnupg-agent (install with apt-get or GUIs such as Synaptic)
  • RPM-based (RedHat, Fedora...): gnupg2 (install with yum or rpm)
  • Gentoo GNU/Linux: gpg-agent (install with emerge)

If you have signatures from more people, you can join them:

cat foo.tar.gz.sig1 foo.tar.gz.sig2 ... foo.tar.gz.sigN > foo.tar.gz.sig

Then you can use scp to upload your file:

# Give read permissions to your files!
chmod a+r ./*

# Upload the files
scp release.tar.gz release.tar.gz.sig YOUR_LOGIN@dl.sv.nongnu.org:/releases/GROUP_NAME/

Note that unlike ftp.gnu.org, Savannah doesn't enforce using GPG signatures for releases, and doesn't verify them when they are used.

If you upload subdirectories, be sure to chmod a+rx them.

For removing wrongly uploaded files and directories, use ssh rm and ssh rmdir.

SSH key fingerprints for dl.sv.nongnu.org:

1024 SHA256:FYkx0iik+iBeCLRzvUyUSTRT98TEBBJoYuQsTXbyGL8 (RSA)
1024 MD5:80:5a:b0:0c:ec:93:66:29:49:7e:04:2b:fd:ba:2c:d5 (RSA)

256 SHA256:pixIvUG9Q/okU3mcTAXlfU3LVJmIfADS17FnFJI5+uI (ECDSA)
256 MD5:38:25:b1:eb:de:9d:c9:40:23:93:a7:16:3e:37:ea:68 (ECDSA)

256 SHA256:2wHx6DGCR/h1Ch2m3wGGpDMWLbefE8m1SesHCTM26eY (ED25519)
256 MD5:92:97:1c:f3:c7:1a:3d:c8:53:67:94:51:21:9f:a8:12 (ED25519)

For example using scp and a bash command line:

scp foo-1.11.22.tar.gz{,.sig} dprice@dl.sv.nongnu.org:/releases/foogroup/

For example using rsync (do not use -a):

rsync -tv foo-1.11.22.tar.gz{,.sig} dprice@dl.sv.nongnu.org:/releases/foogroup/

For more details on rsync, see Services hosted on Savannah servers

For example removing files and directories:

ssh dprice@dl.sv.nongnu.org rm /releases/foogroup/foo-bad-file
ssh dprice@dl.sv.nongnu.org rmdir /releases/foogroup/foo-bad-directory

Note that rmdir will only remove empty directories.

The authentication method to use with scp is SSH public key (one of those that you registered in your Savannah account).

You can also use the gnupload script to upload multiple files, available from the build-aux directory of the Gnulib package.

Files will appear at http://download.savannah.nongnu.org/releases/GROUP_NAME/. This is multiplexed between all mirrors, hopefully picking a nearby and up-to-date one. Please expect a delay of up to 24 hours for an upload on Savannah to appear on all mirrors.

Mirrors

We are always happy to have more mirrors of the nongnu download area, see Information for new mirrors.