Savannah Administration - News: Download areas

Nested Flat Threaded No Comments

Show 25 Show 50 Show 75 Show 100

Does not work for me... (posted by Wolfgang Müller, Wed 09 Jun 2004 12:15:10 PM UTC)

Hi, I tried Savannah-Helper on this, and it gives comparable results to those given below: ftp> pwd 257 "/incoming/savannah/gift" ftp> put gift-0.1.9+5epsilon.tar.gz local: gift-0.1.9+5epsilon.tar.gz remote: gift-0.1.9+5epsilon.tar.gz 200 PORT command successful. Consider using PASV. 553 Could not create file. Any suggestions?

Works for me now! (posted by Wolfgang Müller, Wed 09 Jun 2004 03:13:39 PM UTC)

Apparently my key was wrong?? In any case, it works now for me.

major nuissance (posted by Sam Steingold, Sat 13 Mar 2004 05:00:39 PM UTC)

this system is a major nuissance. While I do appreciate your security concerns and in no way do I claim to be a security expert, I must make the following comments wrt the described procedure. 1. It is absurdly complicated.     You require that for each file I release,    I type in my secret passphrase 2 times    and upload 3 files. 2. It does not let me create symbolic links. 3. It does not let me remove files. 4. It requires me to sign even plain text files like NEWS. Consider this scenario: I want to put a nightly snapshot on alpha.gnu.org; this would include an automatically generated tar ball and the html manual which contains 150 html files generated from DocBook/XML sources.  Do you expect me to type my secret passphrase 300 times every time I change the manual?! The previous system (ssh to gnudist) was much more convenient, and I am sure something similar can be devised in a secure way. Remember, when people are unduly inconvenienced by security, they circumvent it to get the job done, and this defeats the purpose of your security measures.

RE: major nuissance (posted by Sylvain Beucler, Sun 14 Mar 2004 07:57:34 PM UTC)

I would say this system, at least for Savannah, is temporary. We plan to provide an interface to manage files once they are uploaded. Symbolic links should be taken into account indeed. As mentioned in one of the news pages, this system is also not the perfect way to be secure. On the contrary, it is certainly one of the best way to avoid a cracker to counterfeit existing releases, which could lead to important legal matters (like SCO's). What I suggest is to keep these comments for when the system will be ready again, ie when people will be willing to changes things, with alpha|ftp.gnu.org in cc, since decisions at Savannah are independant. While I do not know whether it is ok to upload non-archive/release files at *.gnu.org (the Savannah cvsweb space may be more appropriate), you may want to do use an automated way to sign your files meanwhile, using: gpg --sign --passphrase-fd 0 foo.tar.gz < pass.txt or waiting for the forthcoming GPG-Agent. The directive file, which is not used to upload files at Savannah, can also be generated simply. The fact you cannot remove files at *.gnu.org is, if I am right, a GNU policy: each release should be kept/archived. This may be discussed at the GNU mailing lists.

RE: major nuissance (posted by Sam Steingold, Tue 16 Mar 2004 02:36:42 PM UTC)

1. there is nothing more permanent than something temporary. 2. I do not understand the paragraph mentioning SCO.  Could you please clarify it? 3. saving passphrase into a text file is exactly what I meant when I said "when people are unduly inconvenienced by security, they circumvent it to get the job done": this is extremely insecure and defeats the whole purpose of this process. 4. if I accidentally uploaded a wrong file, I should be able to remove it. 5. a tarball should be accompanied by a README file, right? (at least one README per subdirectory, symlinks to .message). or maybe you are saying that all files we distribute, source and binary tarballs &c, should be placed under savannah.gnu.org:/webcvs/? thanks.

RE: major nuissance (posted by Sylvain Beucler, Thu 18 Mar 2004 09:36:22 AM UTC)

I do not like that solution either, because of the "security risk" I mentioned (anybody can upload a signed file, eg emails). However, since authentication is taken very seriously and given our copyright laws, I think that ssh is not enough because it allows to upload non signed files. I also saw in a news item that signed CVS commits are planned, so uploading browsable documentation will be ok too. We sure miss gpg-agent for this to work, and my password text file is gross indeed, hehe. I wonder, though,  whether download areas are meant for uploading 150+ files. By the way, if we upload a wrong file at *.gnu.org, we still can contact the admins for now. SCO's example just came to my mind because a cracker could add some foreign code into one of our packages to start tedious lawsuits. Sorry if I was confusing.

Still having problems uploading (posted by Patrick Ohnewein, Mon 01 Mar 2004 10:28:21 AM UTC)

Hello all. I have to reupload my files to the download area, because a lot of other portals, like freshmeat.net, are reporting broken links. I generated the gpg key and uploaded it, to the page mentioned in the news. After that I tried to transfer the whole old content (including the directory structure) of my songanizer project with gftp. It didn't work, so I assumed I had to wait a bit longer. But now after more than 3 days, I am getting afraid that there is something wrong. Is it my fault or is it planned, that after connecting I don't get any directory listing? It may be for security, but it is even very much confusing me. It would be a big help, if someone who got the things working could provide a good howto and maybe a script, which automates the transfer. I liked the old command line generator form very much. Is it right to transfer the directory structure or should we now transfer only the files? The structure of my project is (better was): ./songanizer.pkg/0.2/songanizer-0.2.tar.gz ./songanizer.pkg/0.2/songanizer-0.2.tar.gz.sig ./songanizer.pkg/0.4/songanizer-0.4-1.i386.rpm ./songanizer.pkg/0.4/songanizer-0.4-1.src.rpm ./songanizer.pkg/0.4/songanizer-0.4.tar.gz ./songanizer.pkg/0.4/songanizer-0.4-1.i386.rpm.sig ./songanizer.pkg/0.4/songanizer-0.4-1.src.rpm.sig ./songanizer.pkg/0.4/songanizer-0.4.tar.gz.sig ./songanizer.pkg/0.5/songanizer-0.5-1.i386.rpm ./songanizer.pkg/0.5/songanizer-0.5-1.src.rpm ./songanizer.pkg/0.5/songanizer-0.5.tar.gz ./songanizer.pkg/0.5/songanizer-0.5-1.i386.rpm.sig ./songanizer.pkg/0.5/songanizer-0.5-1.src.rpm.sig ./songanizer.pkg/0.5/songanizer-0.5.tar.gz.sig Do I have to strip the directories? What if we transfer something the wrong way, how can we delete files? Happy hacking! Patrick

RE: Still having problems uploading (posted by Patrick Ohnewein, Mon 01 Mar 2004 03:43:33 PM UTC)

I reply to myself. It worked, but not with the subdirectories. That means the file area format has got very ugly. And I wasn't able to restore the original file structure. That meaned, I wasn't able to fix the broken links in the web and my project got removed from freshmeat :( Couldn't you provide an rsync access to the second ftp server and transfer only files with valid sigs? It's nearly the same as now, only that on the second ftp server we would have the whole file structure, some sort of mirror. And if a user changes the structure on the second ftp server, the first get's updated. Of course I wouldn't provide anonymous access anymore. If you don't want rsync, just use ftp, but please allow subdirectories. Happy hacking! Patrick

RE: Still having problems uploading (posted by Sylvain Beucler, Mon 01 Mar 2004 09:26:27 PM UTC)

The file uploading system is temporary. We need to fix other issues and then we will provide a web interface to manage uploaded files in your download area.

Not working... (posted by Paca, Tue 17 Feb 2004 06:03:08 PM UTC)

Hi there, I've put my gpg fingerprint in my account configuration page, I have wait 3 days and when I tried to upload a file or its signature I have the following error : Logged in to savannah.gnu.org.                                                                                            Current remote directory is /incoming/savannah/opale. ncftp /incoming/savannah/opale > put OpaleV1b8.tar.gz.sig  OpaleV1b8.tar.gz.sig:                                   65,00 B    1,15 kB/s  Could not preserve times for OpaleV1b8.tar.gz.sig: UTIME failed. Could anyone help ? Thanks Pac

RE: Not working... (posted by Sylvain Beucler, Tue 17 Feb 2004 08:23:20 PM UTC)

I experienced the same issue with 'ncftp'. However, it worked perfectly with 'ftp'. Could you try again with that tool?

RE: Not working... (posted by Paca, Wed 18 Feb 2004 03:44:55 AM UTC)

I do not get an error when using ftp program but there is still nothing uploaded : cf http://savannah.nongnu.org/download/opale/ Best regards Pac

RE: Not working... (posted by Sylvain Beucler, Wed 18 Feb 2004 02:06:39 PM UTC)

The upload procedure checks your GPG key, but, there is an old misleading text about "GPG key or fingerprint". It should work if you upload your GPG key (gpg --export -a your@email.com) instead of your fingerprint in your Savannah account.

RE: Not working... (posted by Paca, Fri 20 Feb 2004 04:34:48 PM UTC)

Yep it works !!! Thanks a lot Pac

working now for me too (posted by Joachim Wolfgang Kaltz, Fri 23 Jan 2004 04:49:43 PM UTC)

thx for your assistance - turns out my method was OK, but Savannah seemed to have intermittent problems. File uploading seems to work flawlessly now for the last couple of days.

Anonymous ftp for upload? (posted by Mysid, Wed 21 Jan 2004 03:25:03 AM UTC)

I'm really not enthused about this change: I found the rsync interface to be a nice way for uploading and managing the files directory, and in particular, superior to ftp. This is aside from the rather obvious fact that members of the public, might if they like to be annoying, as some do from time to time, anonymously upload files to any project, files they have one of the admins' personal GPG signature for, but those still files not intended for upload to savannah nevertheless. (Old versions of files with known holes,  unrelated signed e-mail, duplicates, whatever) Verification of signatures ought to be done by the user at download, and not mistaken for "authorization to upload"; the password used to login is the authorization for upload, and security of the public_key field on the server can not really be greater than that of the login password, anyhow, (not without requiring key signing). In fact, I prefer rsync for all file transfer purposes, because I find that it is faster.

is it working ? (posted by Joachim Wolfgang Kaltz, Mon 19 Jan 2004 12:56:43 PM UTC)

Hi, I tried it out described, waited for a couple after setting my GPG key. Then uploaded using FTP, my project is "ironmailer", so this went to ftp://savannah.nongnu.org/incoming/savannah/ironmailer The files were uploaded successfully. This was a couple of hours ago. Where should uploaded files now appear ? In the traditional download part of the project ? Nothing appears there (http://savannah.nongnu.org/download/ironmailer/). Or, should it be at the ftp site (ftp://ftp.gnu.org/savannah/files/ironmailer/) - nothing new appears there, although I do see the files I uploaded last year, using the old mechanisms. Thanks for any insight on this.

RE: is it working ? (posted by Sylvain Beucler, Mon 19 Jan 2004 06:48:00 PM UTC)

"It works for me." (tm) (http://savannah.nongnu.org/download/dink/)

RE: is it working ? (posted by Luca Saiu, Wed 21 Jan 2004 02:49:02 AM UTC)

It works also for me.   Maybe it's worth pointing out that I pasted my public GPG key in ASCII format complete with begin and end markers, i.e. from -----BEGIN PGP PUBLIC KEY BLOCK----- to -----END PGP PUBLIC KEY BLOCK----- included.   I don't know whether not including the markers may cause problems, but I included them and everything worked.   Bye,

RE: is it working ? (posted by Joachim Wolfgang Kaltz, Wed 21 Jan 2004 09:10:33 AM UTC)

Hi guys, since it´s working for you, could you check if my steps were correct ? I am completely new at this gpg stuff, so it´s very possible I´m doing something wrong. I generated a key with     gpg --gen-key and providing for email my project email (kaltz@ironmailer.org) Then, I saved the public key in text format using: gpg --output kaltz.asc --armor --export kaltz@ironmailer.org I pasted the contents of kaltz.asc into the Savannah area, this is the key that can be seen under my Savannah user. I sign the file I want to upload like this: gpg --output ironmailer-0.8.war.sig --detach-sig ironmailer-0.8.war I upload the files ironmailer-0.8.war and ironmailer-0.8.war.sig as described in the news above. No results. Any ideas ?

RE: is it working ? (posted by Sylvain Beucler, Wed 21 Jan 2004 01:39:09 PM UTC)

I already used the same system to upload to alpha.gnu.org, and I had to send my public key to somewhere else. Since Luca Saiu is also a GNU maintainer, though there is no upload of GNU epsilon at alpha|ftp.gnu.org, maybe the uploading system does not check the right place for public keys. However, I think there would have been more comments or support requests in that case. Just in case: did you check whether the signature is correct (gpg --verify ironmailer-0.8.war.sig)? I also checked the key you uploaded at savannah and I could import it in my key list, so it seems valid :)

RE: is it working ? (posted by Luca Saiu, Mon 26 Jan 2004 10:11:09 PM UTC)

Hi Beuc; sorry, I've seen your message late.   You hinted at the fact that because I'm a GNU maintainer my GPG public key could be searched for somewhere else.   Just to eliminate some misunderstandings I can say quite surely that the problem is not that: the upload procedure for ftp.gnu.org and alpha.gnu.org is similar to the one used at Savannah, but the GPG keys are managed separately; the download areas are distinct from the ones on Savannah.   Regards,

RE: is it working ? - It is! (posted by Kai Sterker, Wed 21 Jan 2004 08:34:19 PM UTC)

I also had problems for a while, but it turned out that they were caused by a problem with the gpg keys. As I was told, some project keyrings had not been created correctly. That is apparently fixed now. What I did was re-uploading my public key, so it could be added to the now existing keyring (not sure whether that was really necessary though). Afterwards, uploading the files worked fine, although it took far longer than 5 minutes for them to appear in the download area. Hope that helps the rest of you, who also faced problems. Kai P.S: The steps you've take seem okay, as far as I can see. It's the way I did it too.

RE: is it working ? (posted by Jonathan Bartlett, Fri 23 Jan 2004 06:09:11 AM UTC)

It looks like you did not use the "-b" option. To sign my packages, I just did gpg --sign -b MYPACKAGEFILE

RE: is it working ? (posted by Sylvain Beucler, Fri 23 Jan 2004 10:05:48 AM UTC)

-b <=> --detach-sig

 

Copyright © 2024 Free Software Foundation, Inc.
Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
Page source code