Uploading a signed release

If your project is part of GNU and you want to upload at ftp.gnu.org or alpha.gnu.org, you currently need to follow the maintainer guide.

On Savannah, you can use rsync+ssh, scp or sftp to upload your GPG signed files. To begin, please add your GPG key by logging in to Savannah using https://savannah.gnu.org/my/admin/change.php?item=gpgkey

For each upload destined for Savannah, two files need to be uploaded.

  1. File to distributed (eg. foo.tar.gz)
  2. Detached GPG binary signature for that file (eg. foo.tar.gz.sig). To create it, use gpg -b.

For example this will produce a file named foo.tar.gz.sig:

gpg -b --use-agent foo.tar.gz

To verify it:

$ gpg --verify foo.tar.gz.sig
gpg: Signature made sam 03 mai 2008 18:16:09 CEST using DSA key ID 81704B93
gpg: Good signature from "Sylvain Beucler (GNU Savannah Hacker) <beuc@gnu.org>"
gpg:                 aka "Sylvain Beucler (GNU Maintainer) <beuc@beuc.net>"

If you need to sign several files one after the other, we recommend gpg-agent, a program that will temporarily keep you passphrase in memory:

  • Debian GNU/Linux and derivates (Ubuntu, Knoppix...): gnupg-agent (install with apt-get or GUIs such as Synaptic)
  • RPM-based (RedHat, Fedora...): gnupg2 (install with yum or rpm)
  • Gentoo GNU/Linux: gpg-agent (install with emerge)

Then you can use rsync/scp/sftp to upload your file:

# Give read permissions to your files!
chmod 644 *

# Upload the files
scp release.tar.gz you@dl.sv.nongnu.org:/releases/project/
rsync release.tar.gz you@dl.sv.nongnu.org:/releases/project/
sftp you@dl.sv.nongnu.org:/releases/project/ # interactive mode

SSH key fingerprints for dl.sv.nongnu.org:

1024 SHA256:FYkx0iik+iBeCLRzvUyUSTRT98TEBBJoYuQsTXbyGL8 (RSA)
1024 MD5:80:5a:b0:0c:ec:93:66:29:49:7e:04:2b:fd:ba:2c:d5 (RSA)

256 SHA256:pixIvUG9Q/okU3mcTAXlfU3LVJmIfADS17FnFJI5+uI (ECDSA)
256 MD5:38:25:b1:eb:de:9d:c9:40:23:93:a7:16:3e:37:ea:68 (ECDSA)

256 SHA256:2wHx6DGCR/h1Ch2m3wGGpDMWLbefE8m1SesHCTM26eY (ED25519)
256 MD5:92:97:1c:f3:c7:1a:3d:c8:53:67:94:51:21:9f:a8:12 (ED25519)

For example:

scp cvs-1.11.22.tar.bz2 cvs-1.11.22.tar.bz2.sig dprice@dl.sv.nongnu.org:/releases/cvs/source/stable/1.11.22/

You can also use the gnupload script to upload multiple files, available from the build-aux directory of the Gnulib project, http://savannah.gnu.org/projects/gnulib.

Files will appear at http://download.savannah.nongnu.org/releases/project/. This is multiplexed between all mirrors, hopefully picking a nearby and up-to-date one. Please expect a delay of up to 24 hours for an upload on savannah to appear on all mirrors.

Using Konqueror

Type sftp://you@dl.sv.gnu.org/releases/yourproject in the Location bar.

Using lftp

lftp is a nice command-line tool with read-line support and shell-like commands, that can be used for SFTP.

Move files around with SFTP

Solution 1: use gFTP or Konqueror

Solution 2: with sftp:

  1. use the rename command (mv and move don't exist)

  2. specify the full destination, including the filename:

    # wrong rename hello-1.2.tar.gz old/ # right rename hello-1.2.tar.gz old/hello-1.2.tar.gz

Using sshfs

The program sshfs is based on FUSE. So FUSE must be compiled in your kernel and you have to have the privileges to use it. For example, under Debian GNU/Linux, you need to:

apt-get install sshfs
gpasswd -a your_account fuse
modprobe fuse  # add it at the end of /etc/modules to make this permanent

Create a mountpoint, for example mkdir mnt. You cannot simply use the system's /mnt for that, you have to be the owner of the mountpoint. Then enter sshfs you@dl.sv.gnu.org:/releases/yourproject mnt/. Please note, that there has to be a colon after the server name! Then you can access the files in that directory like in any other directory. To unmount use fusermount -u mnt.

If you are made member of a new project, you need to umount / remount the sshfs connection to take it into account.


We are always happy to have more mirrors of the nongnu download area. The webmasters may inform us, or people may come to us directly. Information for new mirrors is at http://www.gnu.org/server/mirror.html (GNU webmasters can edit).

When we are told of a new mirror, we should verify, and then 1) on mgt0, add contact information to /root/administration/mirrors-contacts.txt; 2) on olddownload.savannah.gnu.org, add the mirror url(s) to 2a) /srv/download/00_MIRRORS.html (alphabetical, check http://download.savannah.gnu.org/releases-noredirect/00_MIRRORS.html) and 2b) /srv/download/00_MIRRORS.txt (no order).