Manually installed packages

Normally, packages are installed from Debian repositories:

• apt-get update
• apt-get install PKGNAME

In contrast, these packages were either installed from source, or through a patched Debian package. (At least before the 2011 updates; not sure of current story.) They need more attention wrt security updates and version bumps.

• CVS (vcs-noshell): prevent use of CVSROOT/passwd, restrict accessible CVSROOTs under /sources and /web (instead of listing each and every 2700 existing CVSROOTs). Those changes (at least the latest) should be properly merged in CVS, see CvS. Given that CVS development is dead, there's essentially no maintenance cost.
• commit_prep and log_accum (vcs-noshell) - from CVS's contrib directory, installed in /usr/local/bin; they're not available as packages, we contributed to their development
• ViewVC (vcs-noshell): the Etch version (still ViewCVS) doesn't support the new CVS date format; fixed in Lenny though, we can probably downgrade to packaged 1.0.5 when they include the 1.0.6 security fix (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=500779)
• Mirror redirector: Apache2::Geo::Mirror (using CPAN - /usr/local/share/perl/5.10.0/Apache2/Geo/)
• cgit (vcs-noshell): hard to package, as it requires a copy of the Git source code, so as to bundle private libgit.a. This is code duplication and distros don't like it much, although Fedora made some progress there. The easiest way to package it is probably to include it in the git-core main package. So currently it's installed manually.
• A few Git commit hooks, cf. /usr/src/git/
• Savane (all): we develop it :)