Rsync access to CVS repositories

Since we provide rsync read-only access to the CVS repository, one may expect to also get write access. But we do not provide direct write access to the CVS repository for several reasons:

• Integrity: changing or removing the history of a Savannah group should be exceptional, and moderated. For example, in the event a package goes proprietary, we would want to keep the repository of the latest published free version available. Changing the history can also lead to situations where it's not clear who exactly sent a given commit.
• Security: we do not provide shell access to Savannah, so that users cannot send arbitrary commands to the system (fork bombs, twisted calls to ptrace, many more). Granting CVS direct write access would provide a way to do so by creating a distinct CVSROOT/ directory. Such CVS root could also be used to trick CVS users into executing malicious hooks under their username.

So providing CVS write access is currently something we refuse.

Users actually need write access in few cases:

• CVS migration, CVS clean-up after first (misdone) import: this is quite rare, just file a support request
• -x permissions changes: CVS doesn't support permissions, and recommands that you set permissions using installation scripts (such as ./configure). CVS has a nasty feature, though, making a file executable if it is executable in the user working directory on first commit or import, without the ability to change that permission later on. However, there is a discussion about providing a way to change this permission from the CVS client, so if you really want this feature you should contact the CVS team and possibly offer help for its inclusion in the very next release :)

Last, if you want to work offline, we suggest you move to a different version control system. Savannah supports several.