newsNews: Changesets for auditing software post-crack are available

Latest News
IP Address Changes posted by rwp, Thu 20 Dec 2018 08:53:05 PM UTC - 0 replies
Mercurial hg moved to new server posted by agn, Thu 12 Jan 2017 03:07:50 PM UTC - 0 replies
Bazaar bzr moved to new server posted by agn, Tue 10 Jan 2017 03:33:35 AM UTC - 0 replies
Subversion svn service moved to the new server. posted by rwp, Fri 06 Jan 2017 07:02:03 PM UTC - 0 replies
The cvs service has moved to the new server posted by agn, Fri 16 Dec 2016 03:14:26 AM UTC - 0 replies
[185 news in archive]

Changesets for auditing software post-crack are available

Item posted by Bradley M. Kuhn <bkuhn> on Tue 23 Dec 2003 12:49:18 AM UTC.

A GPG-signed text file of this message is available at:

Hash: SHA1

Sunday 14 December 2003, 06:18 EST

Regular Savannah services, including cvs commit access and Savannah's web
interface, remain down. We continue to investigate a number of software
vulnerabilities that we believe may have contributed to the crack on
Savannah. We must be certain that any security problems are addressed
before we put the software back up for public use. We will also publish
our findings to assist other Free Software sites and to encourage general
improvement of commonly used Free Software infrastructure.

At this time, I am pleased to announce that the results of the automated
comparison between the last trusted CVS trees and the current trees are
available. You can download yours at:

where "FOO" refers to the name of your package. GPG signed md5sums of all
the FOO-changes.tar.gz files can be found at

Each package with changes made after the trusted backup has a
corresponding file on If a package contains no changes, or
subversions/savannah is not the canonical location of a package's CVS
tree, then the tar file described above will not exist for that package.

Each tar file contains a set of diff files. Each diff file corresponds to
one CVS branch. The diffs start from the latest version in a branch and
extend back to the last version of the file verified against a backup.

These difference sets should assist you in auditing your software. Once
you have audited your packages, please contact
<>, and let us know the results.

Some savannah users have noticed some inconsistencies in our backup. In
some instances, while the tree itself is dated 16 September 2003, some
files might be older because they were not properly copied due to an rsync
bug. We believe that these problems were introduced by the deflate rsync
bug (documented at
<URL:>). So, we
suggest you focus on the versions themselves, rather than by-date
comparisons. The difference sets should help in that work.

Finally, we have confirmed that the current tree, when its subversions
are compared to the equivalent subversions in the "16 September" tree,
match completely, or have trivial differences that can be explained.

We continue working as quickly as we can to bring the services back
online. We will post another update on the evening (EST) of Wednesday 17
December 2003.


Bradley M. Kuhn
Executive Director, Free Software Foundation
Version: GnuPG v1.2.1 (GNU/Linux)


No messages in Changesets for auditing software post-crack are available


Back to the top

Powered by Savane 3.4