Savannah web interface has migrated from frontend1 (running Trisquel 10) to frontend2 (running Trisquel 11). Many thanks to Bob Proulx who upgraded frontend2 to Trisquel 11 back in 2022.
Please report any problems.
Recently, we discovered a vulnerability in our SFTP setup, and couldn't fix it otherwise than completely disabling SFTP. This affects uploading files to the download host, namely, the download area and audio-video.gnu.org.
The files still can be uploaded using SCP. What SCP can't do is removing erroneously uploaded files. Before enabling SFTP back in 2022, Savannah admins removed such files manually on request, but these days, we added restricted commands, rm and rmdir, that can be run via SSH to that end. For specific examples, please check Savannah documentation on uploading files.
Sorry for the inconvenience, and thank you for your work on free software!
A new commit-hook is available to install for git repositories that will send a single Datagram via UDP after each successful commit. This can be useful for continuous integration (CI) schemes and elsewise when a push driven model is prefered to (e.g) regularly repolling upstream when changes may or may not have occured.
To request installation please open a ticket with the Savannah Administration project:
https://sv.gnu.org/task/?group=administration&func=additem
To install the new git-udp-syndicate.post-receive hook for one (or more!) of your git repositories you must you must provide a destination host and port. We can install multiple copies of the script per git repo, if necessary, to send multiple hosts/ports.
The (sh, GPLv3+) post-receive script source, detail on how the Datagram is structured, and example "receiver" scripts (in perl) can be found here:
https://git.sr.ht/~mplscorwin/git-udp-syndicate
The periodical reminders weren't active since 2016-11-30.
Now they work again, powered by a rewritten script.
To minimize the surprise, all previously existing reminder settings were reset; please re-enable them if needed.
Coincidentally, the support for per-group reminders is dropped. It means that group administrators can't setup periodical mails to other people any more; the users who want them should configure them in their account preferences.
Savannah web interface has migrated from frontend1 (running Trisquel 8) to frontend2 (running Trisquel 9); please report any problems.
The server hosting svn, hg, and bzr services has been updated. This should resolve the OpenSSH obsolescence of SHA1. Please report any problems.
The server hosting git services has been updated. This should resolve the OpenSSH obsolescence of SHA1 that has been seen by early adopters. The switch to the new server produced some unexpected problems found by users due to incomplete setup. Please report any problems you find so they can be fixed.
The server hosting svn, hg, and bzr is still pending. Until then the mitigation for SHA1 previously posted will still be needed. This is getting attention and will be updated as well soonest.
OpenSSH 8.8 was released on September 26, 2021 and deprecated all use of the SHA-1 hash algorithm. This affects users using git, svn, hg repositories using ssh-rsa keys and who have upgraded to ssh 8.8. (The cvs repositories are not affected.) For user workarounds please see this documentation page.
https://savannah.gnu.org/maintenance/SshAccess/
Upgrading the services is a high priority but there are various entanglements which makes doing this immediately and quickly rather hard. It will take some time. Please be patient.
On September 30, 2021, as planned the DST Root CA X3 cross-sign has expired for the Let's Encrypt trust chain. That was a normal and planned event. However coupled with a verification error in the code of libraries authenticating certificates it caused some clients that have not been updated to fixed versions to have problems validating certificates.
If you are experiencing invalid certificate chain problems with Let's Encrypt certificates (not a Savannah problem) then please upgrade your client to the latest security patches for your system. Please reference these resources as to upstream information and discussion about the issue.
The storage array hosting much of the GNU and FSF infrastructure suffered problems this morning. The FSF admins are on the task and most services have been restored though issues linger. Please look to https://hostux.social/@fsfstatus for current status updates.
The web interfaces on several of the Savannah systems are getting hit with a high volume DDoS attack. This is browning out the web interfaces. When possible members are encouraged to use SSH protocols to avoid the web interfaces which are suffering severe performance degradation and timing out.
OpenSSH has deprecated DSA ssh keys. And therefore so has Savannah. Note that DSA keys have always been recommended against for Savannah use but were not actively blocked. If you are using a DSA ssh key it will no longer be possible to access the repositories using it. Please update your account to use an RSA or ECDSA key.
The move of the version control system back-end to the new storage array is now complete. All services are working normally.
Today the version control back-end data is moving from the old storage array onto the new storage array. Expect connection errors today during the transition.
The data is sync'ing live now. This will be followed by blocking commit access and a final sync of the read-only data and then switching the vcs frontend over to the new storage. Blocking commit access means blocking ssh access as all commit access is through ssh access. Expect ssh access both for commit and for read access to fail for a while today. Read-only access through https and other will still be active. There will be brief periods of time when connection errors to the server will be seen.
The version control system back end and the project download area back end systems are back online after the storage array maintenance. All systems should be operating normally.
The version control system back end and the project download area back end systems are currently offline for urgent file system storage maintenance. This is an urgent issue and is getting our full attention. We will have them back online as soon as possible. Please monitor https://quitter.im/fsfstatus for FSF system status updates. Note this also affects the mailing list server too therefore the mailing lists will be unavailable for the duration of the outage.
The Savannah systems along with GNU and FSF systems are changing IP addresses. We expect to make this change with a minimum of Savannah services downtime. However in the event of the unexpected your patience as we work through problems is greatly appreciated!
Our network provider TowardEX generously donated our bandwidth and IP addresses for many years and now we have a new donor: Hurricane Electric. We thank our donors for their support!
The mercurial hg services have been moved to the new server. All should be
working normally at the new server IP address.
Two improvements include https and rsync access ( https://hg.savannah.gnu.org and rsync://hg.savannah.gnu.org/hg/ , respectively).
If you encounter any hg related problems please report them to us.
The Bazaar bzr services have been moved to the new server. All should be
working normally at the new server IP address. If you encounter any svn
related problems please report them to us.
The Subversion svn services have been moved to the new server. All should be working normally at the new server IP address. If you encounter any svn related problems please report them to us.