Re: CVS security

[Stephane Bortzmeyer]

On Thursday 20 July 2000, at 18 h 35, the keyboard of [EMAIL PROTECTED] wrote:

> I'm trying to decide between SSH and Kerberos.  The developers like SSH, but 
> our security team votes for Kerberos.

That's a very strange advice, giving the decreased popularity of Kerberos. How 
do they support this choice?

> 3) I'm told you can use OpenSSH for free on a Unix box,

OpenSSH is free "free as in free speech, not free as in free beer", true.

> but for Mac/PC you really
> have to go with a license from DataFellows.  

My PC has OpenSSH running. 

> that the 2 won't necessarily talk together (something about SSH vs. SSH2?)

SSH2 is a completely different thing. SSH1 and OpenSSH have no problem talking 
to each other.

> I've also heard about something called "SourceForge". 


A great service, highly recommended.


> the Internet?  Yow.  Are there corporations out there that do that with their
> Crown Jewels, or is it mainly used by Open Source projects?

You seem to think they are exclusive: many corporations manage free software 
projects (starting with VA which manages SourceForge).

Re: Java class and jar files

[Stephane Bortzmeyer]

On Monday 17 July 2000, at 16 h 24, the keyboard of Eric Chamberlain 
<[EMAIL PROTECTED]> wrote:

> That doesn't seem like a reasonable answer.  CVS should be able to handle
> the intermediate files just fine. I can certainly imagine scenarios in which
> one would want to put up sections of pre-compiled slowly-changing chunks of
> code (for efficiency reasons). 

Another good reason to put automatically-generated files under CVS is when 
they are generated by uncommon tools and when you have a wide user community.

"configure" scripts produced by autoconf are a typical example: if you want 
your CVS users to be able to install your software without having to install 
autoconf, it's a good idea (see   for an example, several files are automatically 
generated).

Re: Java class and jar files

[Stephane Bortzmeyer]

On Monday 17 July 2000, at 11 h 25, the keyboard of Annette Waters 
<[EMAIL PROTECTED]> wrote:

> Are there any special steps I need to take to put java class and jar files
> under CVS?

The '-ko' option is probably enough. But, as suggested by the discussion you 
triggered, think about it twice.

I'm fairly certain there was somewhere a text describing the pros and the cons 
of putting automatically generated files under CVS, but I cannot find it.

Re: Cvswebedit needs to be made GPL/open source. Any volunteers?

[Stephane Bortzmeyer]

On Tuesday 11 July 2000, at 2 h 0, the keyboard of Free Software Foundation 
<[EMAIL PROTECTED]> wrote:

> If you GPL the program, we at gnu.org would be happy to provide services to
> help your development. 

Well, the original poster apparently believed that he *had* to transfer the 
program to the FSF in order to put it under the GPL, which is obviously wrong.

> In fact, we are working right now on setting up
> services similar to those of of sourceforge, but targeted for the free
> software community (sourceforge is only targeted for the open source
> community). 

Could you precise what it means? 99 % of the projects at SourceForge are free 
software, according to  and 
most are GPL.

This really looks like FUD against SourceForge, but using a spurious 
difference between "free" and "open source".

> I am not sure what this service will be ready, though.

SourceForge works today but don't worry, their code is free 
, you can use it :-)

Re: Using cvs in a website

[Stephane Bortzmeyer]

On Wednesday 5 July 2000, at 18 h 28, the keyboard of Dirk Ruediger 
<[EMAIL PROTECTED]> wrote:

> If you are working with apache as web server, then you should configure
> it to exclude CVS from documents, e.g.
> "IndexIgnore .??* *~ *# HEADER HEADER.html README README.html RCS CVS"

I manage Web sites with CVS myself (if you read French, see 
) and I use the following:


order allow,deny
deny from all


order allow,deny
deny from all


On Wednesday 5 July 2000, at 16 h 55, the keyboard of 
=?x-user-defined?Q?W=2EPr=F6pper?= <[EMAIL PROTECTED]> wrote:
 
> Have look at
> 
> http://durak.org/cvswebsites/

There are several ways to manage Web sites with CVS. The above describes one where the 
update is not automatic on commit. I prefer it the other way: my loginfo cd into the 
Web server directory and 'cvs update' then.

Re: Integrating CVS to Nautilis (fwd)

[Stephane Bortzmeyer]

On Monday 17 April 2000, at 17 h 11, the keyboard of Mark Derricutt 
<[EMAIL PROTECTED]> wrote:

> I was just wondering, what do you people think about a nice integrated CVS
> client at the file manageer level?  

Emacs already do so, through its VC (version control) package (yes, Emacs is a file 
browser, too). 

I don't use this feature myself, but it would be interesting to get feedback from 
Emacs users in order to avoid making the same mistakes.

Re: Fine grained permissions?

[Stephane Bortzmeyer]

On Friday 14 April 2000, at 18 h 41, the keyboard of Gregory Propf 
<[EMAIL PROTECTED]> wrote:

> I want to know how I can set it up so that I can specifiy access
> permissions on a per module and per file basis. 

Well, you can always put whatever permissions you wish in $CVSROOT. But it is 
easier to manage different permissions on a per-directory basis.

> some that have PHP and HTML.  I do not want non-programmers to be able
> to modify the PHP pages but I want them to be able to change HTML docs. 

Put them in two different Unix groups and set different group-write authorizations. 
Since it is the standard Unix way, I assume there is something special in your 
requirments which I do not see.

Re: Cannot commit as root

[Stephane Bortzmeyer]

On Tuesday 4 April 2000, at 13 h 50, the keyboard of Marius Oancea 
<[EMAIL PROTECTED]> wrote:

[Why two identical requests from sec.sibnet.ro?]

>   If I want to use cvs from my workstation ( and here I am root )

You shouldn't.

Re: cvs [commit aborted]: cannot commit files as 'root'

[Stephane Bortzmeyer]

On Monday 3 April 2000, at 16 h 42, the keyboard of Crosby 
<[EMAIL PROTECTED]> wrote:

>  I'm a beginner user of CVS and I don't know to resolve this error.I've
> setup a CVS server (I use SuSE Linux 6.3) and I am always logged as root. 

This is certainly one of the most awful errors an Unix user can make.

Re: Dec-alpha version

[Stephane Bortzmeyer]

On Monday 27 March 2000, at 15 h 4, the keyboard of Paul Nelson 
<[EMAIL PROTECTED]> wrote:

> Hi! We here at the Roslin Institute are considering using CVS as a source
> control for our bioinformatics developments. Can you indicate which of the
> many downloadable versions we can use on out Dec-alpha machines?

cvs compiles and runs fine on Alpha/Linux and on Alpha/Tru64, which we use here (where 
we do a bit of bioinformatics, too).

Re: Python CVS interface?

[Stephane Bortzmeyer]

On Tuesday 21 March 2000, at 16 h 26, the keyboard of Brian Macy 
<[EMAIL PROTECTED]> wrote:

> Also, anyway to login via a script? 

If you use SSH with an account on the CVS server, it's easy. 

> Basically I need to write an
> interface to CVS 

Otherwise, "expect" was invented for that (yes, it's written in TCL and not 
Python).

Re: new guy - hopefully easy questions

[Stephane Bortzmeyer]

On Thursday 2 March 2000, at 16 h 40, the keyboard of "Michael R. Salazar" 
<[EMAIL PROTECTED]> wrote:

> 1.Have a centralized repository where each user can branch out of
> and create their own repository with the whole code in it.
> 
> 2.After the individuals make their improvements, then they may
> update the centralized repository.

Basically, CVS is not able to have more than two levels (the user's working 
directory and the Repository). Hierarchical repositories are not a feature of 
CVS.

> I don't want a repository that each user has access to and is being
> updated often by the individual users,

This is a policy matter, not a technical one. CVS is policy-free. Some 
organizations say to their contributors "commit as soon as you changed a 
comma", other say "commit *only* when you are *sure* you didn't break the f... 
thing".

More technically, commit rules could say "thou shall commit only code that 
compiles" or "thou shall commit only code when you recompile the whole project 
and pass the whole regression test".

> and checkout and commited as necessary, this wouldn't be a problem.  The
> problem will come when the users attempt to update the centralized
> repository, but this won't be that often. 

Again, "often" depends on your commiting rules, not on CVS. 

Re: CVS in an integrated environment? please help...

[Stephane Bortzmeyer]

On Monday 21 February 2000, at 15 h 43, the keyboard of "Mike Amburn" 
<[EMAIL PROTECTED]> wrote:

> - should development commit changes to the main HEAD or in a development
> "branch"?
> - does a QA department have their own branch or do they use the development
> branch?

CVS is policy-free. Which means you can do what you want. I suggest to adopt the 
scheme stable/releasecandidate/unstable, with a branch for each, most developers will 
work on "unstable" and QA/bugfixers will work on "stable", except when a release is 
close, where they will work mostly on "releasecandidate".

Just be sure the guy who does the merge is knowledgeable, it is not obvious the first 
time you do it!