Uploading a signed release

If your project is part of GNU and you want to upload at ftp.gnu.org or alpha.gnu.org, you currently need to follow the maintainers' guide.

On Savannah, you can use scp to upload your GPG signed files. To begin, please add your GPG keys to the Public Information of your project.

For each upload destined for Savannah, two files need to be uploaded.

  1. File to distributed (eg. foo.tar.gz)
  2. Detached GPG binary signature for that file (eg. foo.tar.gz.sig). To create it, use gpg -b.

For example this will produce a file named foo.tar.gz.sig:

gpg -b foo.tar.gz

To verify it:

$ gpg --verify foo.tar.gz.sig foo.tar.gz
gpg: Signature made sam 03 mai 2008 18:16:09 CEST using DSA key ID 81704B93
gpg: Good signature from "Sylvain Beucler (GNU Savannah Hacker) <beuc@gnu.org>"
gpg:                 aka "Sylvain Beucler (GNU Maintainer) <beuc@beuc.net>"

If you need to sign several files one after the other, we recommend gpg-agent, a program that will temporarily keep you passphrase in memory:

  • Debian GNU/Linux and derivates (Ubuntu, Knoppix...): gnupg-agent (install with apt-get or GUIs such as Synaptic)
  • RPM-based (RedHat, Fedora...): gnupg2 (install with yum or rpm)
  • Gentoo GNU/Linux: gpg-agent (install with emerge)

If you have signatures from more people, you can join them:

cat foo.tar.gz.sig1 foo.tar.gz.sig2 ... foo.tar.gz.sigN > foo.tar.gz.sig

Then you can use scp to upload your file:

# Give read permissions to your files!
chmod a+r ./*

# Upload the files
scp release.tar.gz release.tar.gz.sig YOUR_LOGIN_HERE@dl.sv.nongnu.org:/releases/YOUR_PROJECT_NAME_HERE/

Note that unlike ftp.gnu.org, Savannah doesn't enforce using GPG signatures for releases, and doesn't verify them when they are used.

If you upload subdirectories, be sure to chmod a+rx them.

For removing wrongly uploaded files, use sftp.

OpenSSH 9.0 was released on 2022-04-08 and switches the scp from using the legacy scp/rcp protocol to using SFTP protocol by default. This has caused us to review the security issues and we believe this is okay to use in our case.

SSH key fingerprints for dl.sv.nongnu.org:

1024 SHA256:FYkx0iik+iBeCLRzvUyUSTRT98TEBBJoYuQsTXbyGL8 (RSA)
1024 MD5:80:5a:b0:0c:ec:93:66:29:49:7e:04:2b:fd:ba:2c:d5 (RSA)

256 SHA256:pixIvUG9Q/okU3mcTAXlfU3LVJmIfADS17FnFJI5+uI (ECDSA)
256 MD5:38:25:b1:eb:de:9d:c9:40:23:93:a7:16:3e:37:ea:68 (ECDSA)

256 SHA256:2wHx6DGCR/h1Ch2m3wGGpDMWLbefE8m1SesHCTM26eY (ED25519)
256 MD5:92:97:1c:f3:c7:1a:3d:c8:53:67:94:51:21:9f:a8:12 (ED25519)

For example using scp and a bash command line:

scp foo-1.11.22.tar.gz{,.sig} dprice@dl.sv.nongnu.org:/releases/fooproject/

For example using rsync (do not use -a):

rsync -tv foo-1.11.22.tar.gz{,.sig} dprice@dl.sv.nongnu.org:/releases/fooproject/

The authentication method to use with scp is SSH public key (one of those that you registered in your Savannah account).

You can also use the gnupload script to upload multiple files, available from the build-aux directory of the Gnulib project, http://savannah.gnu.org/projects/gnulib.

Files will appear at http://download.savannah.nongnu.org/releases/@PROJECT_NAME_HERE@/. This is multiplexed between all mirrors, hopefully picking a nearby and up-to-date one. Please expect a delay of up to 24 hours for an upload on savannah to appear on all mirrors.


We are always happy to have more mirrors of the nongnu download area. The webmasters may inform us, or people may come to us directly. Information for new mirrors is at http://www.gnu.org/server/mirror.html (GNU webmasters can edit).

When we are told of a new mirror, we should verify, and then 1) on mgt0, add contact information to /root/administration/mirrors-contacts.txt; 2) on download0.savannah.gnu.org, add the mirror url(s) to 2a) /srv/download/00_MIRRORS.html (alphabetical, check http://download.savannah.gnu.org/releases-noredirect/00_MIRRORS.html) and 2b) /srv/download/00_MIRRORS.txt (no order).