newsSavannah Administration - News: Download areas

Latest News
frontend upgraded posted by ineiev, Wed 31 Jan 2024 05:45:55 PM UTC
[download] SFTP disabled posted by ineiev, Mon 27 Nov 2023 11:00:33 AM UTC
git post-receive UDP syndication posted by carlc, Thu 31 Aug 2023 11:57:10 PM UTC
re-enabling reminders posted by ineiev, Tue 02 May 2023 11:40:13 AM UTC
frontend upgraded posted by ineiev, Fri 13 May 2022 06:43:50 AM UTC

Download areas

Item posted by James E. Blair <corvus> on Thu 15 Jan 2004 10:15:29 PM UTC.

Files that were in the download areas on Savannah before the
compromise can be downloaded from
We kindly ask project administrators to verify the integrity of those
files and use the following procedure to upload them to the new file
areas on Savannah.

Savannah has a new system to handle uploads of files to the download
area in a secure way.  Project administrators are the only ones
allowed to upload files at this time.

To begin, please add your GPG key by logging in to Savannah and
visiting one of the following URLs:

Within 2 hours the system should have updated the files necessary for

After that time, use the following procedure to upload files:

   For each upload destined for Savannah, two files need to be
   uploaded via ftp to the site.

         (1) File to distributed (eg. foo.tar.gz)

         (2) Detached GPG binary signature for (1) (using gpg -b)
            (eg. foo.tar.gz.sig)

   The files should be uploaded via anonymous ftp to
   and placed in the /incoming/savannah/<projectname> directory.  For
   example, to place foo.tar.gz in project bar's download area, upload
   foo.tar.gz and foo.tar.gz.sig to:

   Uploads are processed every five minutes.  Uploads that are in
   progress when the upload processing script is running are handled
   properly, so do not worry about the timing of your upload.

Currently there is no easy way to manipulate (move, rename, delete, or
work in subdirectories) with the new system.  If you are an
experienced PHP programmer and would like to help add this
functionality, please contact us.

If you have questions about this process, please contact us at

Thank you for your patience.

Does not work for me... (posted by Wolfgang Müller, Wed 09 Jun 2004 12:15:10 PM UTC)

Hi, I tried Savannah-Helper on this, and it gives comparable results to those given below:

ftp> pwd
257 "/incoming/savannah/gift"
ftp> put gift-0.1.9+5epsilon.tar.gz
local: gift-0.1.9+5epsilon.tar.gz remote: gift-0.1.9+5epsilon.tar.gz
200 PORT command successful. Consider using PASV.
553 Could not create file.

Any suggestions?

major nuissance (posted by Sam Steingold, Sat 13 Mar 2004 05:00:39 PM UTC)

this system is a major nuissance.

While I do appreciate your security concerns
and in no way do I claim to be a security expert,
I must make the following comments wrt the
described procedure.

1. It is absurdly complicated. 
   You require that for each file I release,
   I type in my secret passphrase 2 times
   and upload 3 files.

2. It does not let me create symbolic links.

3. It does not let me remove files.

4. It requires me to sign even plain text files like NEWS.

Consider this scenario: I want to put a nightly snapshot
on; this would include an automatically
generated tar ball and the html manual which contains 150
html files generated from DocBook/XML sources. 
Do you expect me to type my secret passphrase 300
times every time I change the manual?!

The previous system (ssh to gnudist) was much more convenient,
and I am sure something similar can be devised in a secure way.

Remember, when people are unduly inconvenienced by security,
they circumvent it to get the job done,
and this defeats the purpose of your security measures.

Still having problems uploading (posted by Patrick Ohnewein, Mon 01 Mar 2004 10:28:21 AM UTC)

Hello all.

I have to reupload my files to the download area, because a lot of other portals, like, are reporting broken links.

I generated the gpg key and uploaded it, to the page mentioned in the news. After that I tried to transfer the whole old content (including the directory structure) of my songanizer project with gftp.

It didn't work, so I assumed I had to wait a bit longer. But now after more than 3 days, I am getting afraid that there is something wrong.

Is it my fault or is it planned, that after connecting I don't get any directory listing? It may be for security, but it is even very much confusing me.

It would be a big help, if someone who got the things working could provide a good howto and maybe a script, which automates the transfer. I liked the old command line generator form very much.

Is it right to transfer the directory structure or should we now transfer only the files?

The structure of my project is (better was):


Do I have to strip the directories?

What if we transfer something the wrong way, how can we delete files?

Happy hacking!

Not working... (posted by Paca, Tue 17 Feb 2004 06:03:08 PM UTC)

Hi there,

I've put my gpg fingerprint in my account configuration page, I have wait 3 days and when I tried to upload a file or its signature I have the following error :

Logged in to                                                                                           
Current remote directory is /incoming/savannah/opale.

ncftp /incoming/savannah/opale > put OpaleV1b8.tar.gz.sig 
OpaleV1b8.tar.gz.sig:                                   65,00
B    1,15 kB/s 
Could not preserve times for OpaleV1b8.tar.gz.sig: UTIME failed.

Could anyone help ?


working now for me too (posted by Joachim Wolfgang Kaltz, Fri 23 Jan 2004 04:49:43 PM UTC)

thx for your assistance - turns out my method was OK, but Savannah seemed to have intermittent problems. File uploading seems to work flawlessly now for the last couple of days.

Anonymous ftp for upload? (posted by Mysid, Wed 21 Jan 2004 03:25:03 AM UTC)

I'm really not enthused about this change: I found the rsync
interface to be a nice way for uploading and managing the files directory, and in particular, superior to ftp.

This is aside from the rather obvious fact that members
of the public, might if they like to be annoying, as some do from time to time, anonymously upload files to any project, files they have one of the admins' personal GPG signature for, but those still files not intended for upload to savannah nevertheless.

(Old versions of files with known holes,
 unrelated signed e-mail, duplicates, whatever)

Verification of signatures ought to be done by the user
at download, and not mistaken for "authorization to upload";
the password used to login is the authorization for upload,
and security of the public_key field on the server can not
really be greater than that of the login password, anyhow,
(not without requiring key signing).

In fact, I prefer rsync for all file transfer purposes,
because I find that it is faster.

is it working ? (posted by Joachim Wolfgang Kaltz, Mon 19 Jan 2004 12:56:43 PM UTC)

I tried it out described, waited for a couple after setting my GPG key. Then uploaded using FTP, my project is "ironmailer", so this went to
The files were uploaded successfully. This was a couple of hours ago.

Where should uploaded files now appear ? In the traditional download part of the project ? Nothing appears there (
Or, should it be at the ftp site ( - nothing new appears there, although I do see the files I uploaded last year, using the old mechanisms.

Thanks for any insight on this.



Back to the top

Powered by Savane 3.13-4b48.
Corresponding source code