-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sunday 14 December 2003, 06:18 EST Regular Savannah services, including cvs commit access and Savannah's web interface, remain down. We continue to investigate a number of software vulnerabilities that we believe may have contributed to the crack on Savannah. We must be certain that any security problems are addressed before we put the software back up for public use. We will also publish our findings to assist other Free Software sites and to encourage general improvement of commonly used Free Software infrastructure. At this time, I am pleased to announce that the results of the automated comparison between the last trusted CVS trees and the current trees are available. You can download yours at: ftp://ftp.gnu.org/savannah/changsets/FOO-changes.tar.gz where "FOO" refers to the name of your package. GPG signed md5sums of all the FOO-changes.tar.gz files can be found at . Each package with changes made after the trusted backup has a corresponding file on ftp.gnu.org. If a package contains no changes, or subversions/savannah is not the canonical location of a package's CVS tree, then the tar file described above will not exist for that package. Each tar file contains a set of diff files. Each diff file corresponds to one CVS branch. The diffs start from the latest version in a branch and extend back to the last version of the file verified against a backup. These difference sets should assist you in auditing your software. Once you have audited your packages, please contact , and let us know the results. Some savannah users have noticed some inconsistencies in our backup. In some instances, while the tree itself is dated 16 September 2003, some files might be older because they were not properly copied due to an rsync bug. We believe that these problems were introduced by the deflate rsync bug (documented at ). So, we suggest you focus on the versions themselves, rather than by-date comparisons. The difference sets should help in that work. Finally, we have confirmed that the current tree, when its subversions are compared to the equivalent subversions in the "16 September" tree, match completely, or have trivial differences that can be explained. We continue working as quickly as we can to bring the services back online. We will post another update on the evening (EST) of Wednesday 17 December 2003. Sincerely, Bradley M. Kuhn Executive Director, Free Software Foundation -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE/3Ece53XjJNtBs4cRAqAtAJ9bAhrFh18lDbuuOiCxfZb/kouskACcCe8E BDPWQFrZ629Pd3b3SOHe150= =4O2D -----END PGP SIGNATURE-----