Hi Mr. Dmitry and GNU-config members,
I'm writing to you as a member and maintainer of the "config" project.
I'm reaching out to discuss a related issue regarding the distribution
of "config" snapshots.
I started this thread on Savannah's git maintainer forum:
https://lists.gnu.org/archive/html/savannah-hackers/2026-09/msg00018.html
In that thread, I explained that Conan C/C++ package manager is having
trouble downloading a Git commit snapshot for *gnu-config* (version
cci.20210814) from the Savannah cgit interface.
Savannah infrastructure maintainer Bob Proulx informed us that this
feature was disabled on 2026-02-15 due to abuse by AI scraper bots.
Since then, the feature has been unsupported because the unsustainable
workload caused by scraper bots overloading Git servers via the cgit
interface to obtain snapshots of revisions.
Consequently, we can't distribute Git snapshots as "releases" of the
"config" project as we did previously.
However, Bob Proulx suggest “config” project to use the releases area;
that static files are fully supported by Savannah and prevents overload
Git servers retrieving snapshots:
https://lists.gnu.org/archive/html/savannah-hackers/2026-10/msg00012.html
A quote:
Ariel Machado wrote:
Each recipe has the urls of mirrors to retrieve the source code,
for example zlib package:
https://github.com/conan-io/conan-center-index/blob/master/recipes/zlib/all/conandata.yml
sources:
"1.3.2":
url:
- "https://zlib.net/fossils/zlib-1.3.2.tar.gz";;
That's a URL to an actual static file. Those are fully supported by
Savannah.
The issue, however, is that this only solves the problem for me;
everyone
else in the community relying on the Conan Center recipes would be
unable to
compile that specific recipe.
Why doesn't the maintainer upload to the releases area on Savannah?
Then it would be an actual file, distributed to the Savannah mirrors,
and available from the mirror pool?
Furthermore, having someone create an unofficial community mirror,
poses a
security risk of trust for anyone downloading source code.
Put releases into the official releases directory.
Savannah doesn't have (and nor are there plans for) public read-only
mirrors
(like those on GitHub, GitLab, etc.), correct?
Savannah has long had public read-only mirrors.
https://download.savannah.gnu.org/
See the mirmon page for all of the details.
https://download.savannah.gnu.org/mirmon/allgnu/
Bob
I'm reaching out to you to ask if you could take a closer look at this
issue.
I've explained it in more detail in the mailing list and would like to
evaluate the possibility of publishing static files of "config"
releases, similar to how other GNU projects do, due to the policy with
Savannah Git to mitigate AI scraper activity.
Thank you in advance.
Ariel Machado
