Uploading a signed release

If your project is part of GNU and you want to upload at ftp.gnu.org or alpha.gnu.org, you currently need to follow the maintainer guide.

On Savannah, you can use scp to upload your GPG signed files. To begin, please add your GPG key by logging in to Savannah using https://savannah.gnu.org/my/admin/change.php?item=gpgkey

For each upload destined for Savannah, two files need to be uploaded.

  1. File to distributed (eg. foo.tar.gz)
  2. Detached GPG binary signature for that file (eg. foo.tar.gz.sig). To create it, use gpg -b.

For example this will produce a file named foo.tar.gz.sig:

gpg -b --use-agent foo.tar.gz

To verify it:

$ gpg --verify foo.tar.gz.sig
gpg: Signature made sam 03 mai 2008 18:16:09 CEST using DSA key ID 81704B93
gpg: Good signature from "Sylvain Beucler (GNU Savannah Hacker) <beuc@gnu.org>"
gpg:                 aka "Sylvain Beucler (GNU Maintainer) <beuc@beuc.net>"

If you need to sign several files one after the other, we recommend gpg-agent, a program that will temporarily keep you passphrase in memory:

  • Debian GNU/Linux and derivates (Ubuntu, Knoppix...): gnupg-agent (install with apt-get or GUIs such as Synaptic)
  • RPM-based (RedHat, Fedora...): gnupg2 (install with yum or rpm)
  • Gentoo GNU/Linux: gpg-agent (install with emerge)

Then you can use scp to upload your file:

# Give read permissions to your files!
chmod 644 *

# Upload the files
scp release.tar.gz you@dl.sv.nongnu.org:/releases/project/

As of 2019-06-11, rsync for upload and sftp don't work. Use scp. Submit support requests to Savannah administration to delete or move files.

SSH key fingerprints for dl.sv.nongnu.org:

1024 SHA256:FYkx0iik+iBeCLRzvUyUSTRT98TEBBJoYuQsTXbyGL8 (RSA)
1024 MD5:80:5a:b0:0c:ec:93:66:29:49:7e:04:2b:fd:ba:2c:d5 (RSA)

256 SHA256:pixIvUG9Q/okU3mcTAXlfU3LVJmIfADS17FnFJI5+uI (ECDSA)
256 MD5:38:25:b1:eb:de:9d:c9:40:23:93:a7:16:3e:37:ea:68 (ECDSA)

256 SHA256:2wHx6DGCR/h1Ch2m3wGGpDMWLbefE8m1SesHCTM26eY (ED25519)
256 MD5:92:97:1c:f3:c7:1a:3d:c8:53:67:94:51:21:9f:a8:12 (ED25519)

For example:

scp cvs-1.11.22.tar.bz2 cvs-1.11.22.tar.bz2.sig dprice@dl.sv.nongnu.org:/releases/cvs/source/stable/1.11.22/

You can also use the gnupload script to upload multiple files, available from the build-aux directory of the Gnulib project, http://savannah.gnu.org/projects/gnulib.

Files will appear at http://download.savannah.nongnu.org/releases/project/. This is multiplexed between all mirrors, hopefully picking a nearby and up-to-date one. Please expect a delay of up to 24 hours for an upload on savannah to appear on all mirrors.


We are always happy to have more mirrors of the nongnu download area. The webmasters may inform us, or people may come to us directly. Information for new mirrors is at http://www.gnu.org/server/mirror.html (GNU webmasters can edit).

When we are told of a new mirror, we should verify, and then 1) on mgt0, add contact information to /root/administration/mirrors-contacts.txt; 2) on download0.savannah.gnu.org, add the mirror url(s) to 2a) /srv/download/00_MIRRORS.html (alphabetical, check http://download.savannah.gnu.org/releases-noredirect/00_MIRRORS.html) and 2b) /srv/download/00_MIRRORS.txt (no order).