When cvs is invoked with -R to treat the repository as read-only, it prints out a message warning about the dangers of doing this with repositories to which other users might write(*).  Unfortunately, it does this before the command has been identified, with the result that when a server mode is in use, the warning is emitted without encapsulation, which violates the protocol.

The attached patch defers the warning until after server_active has been initialized, and omits it entirely in that case (doing this right would be somewhat harder, and for little gain -- if the server admin has forced use of -R, it seems safe to assume (s)he understands the consequences, and if the command was 'server' as invoked by ext or fork, then the client should have already printed the warning anyway.

(*) Really, this is somewhat overstated.  There is no danger of
    corrupting the repository or even the user's working
    directory.  True, an update might get only some changed files
    from a simultaneous commit, but this can easily be corrected
    by running the update again, and atomicity has never been
    CVS's strong suit.