The mailing list archive view for SourceForge projects are currently in read-only mode for maintenance. Message sent to the mailing list continue to work, but until the maintenance is complete, the archives will not update. We expect this to complete sometime tomorrow.

Best Regards,
Chris Tsai, SourceForge.net Support

Apologies for the late notice. We are performing backend upgrades to the site shortly, and parts of the set will be set to read-only. We anticipate that this will take approximately 2 hours, and during this time, new user registrations, new login sessions will be not be possible. Additionally, various aspects of the classic SourceForge system will be read-only as well. Thank you for bearing with us as we complete this upgrade.

The front page, directory, projects, and download flow will remain online.

Best Regards,
Chris Tsai, SourceForge.net Support

We are expecting some previously unplanned downtime for the Project web and VHOST services to commence shortly. We are working to keep this downtime to as short a duration as possible.

Best Regards,
Chris Tsai, SourceForge.net Support

For example, in the Allura project source repository, you’ll notice a History link at the top right.

This will give you a history of just the ‘command’ directory.

Or, in a single file view, you’ll get the history of just that one file.

Since the CVS downtime yesterday, we’ve been experiencing poor performance for CVS. As such, we’ve disabled ViewVC and anonymous pserver access for the time being to prioritize developer read/write access while we address the performance issue. We do not have an estimate for the completion of this yet, but we will keep this post updated as this develops.

UPDATE: ViewVC is now available again, however, the data in ViewVC is still from before the previous downtime. Anonymous pserver is still offline. We’re working to get both these caught up with the latest updates as soon as we can.

UPDATE 2: As of 2012-12-06, anonymous pserver is back online. Note however that both anonymous access methods (ViewVC and pserver) will now lag behind developer changes. Under normal operation, they should be no more than one (1) hour behind. Developer access will always be current.

Best Regards,
Chris Tsai, SourceForge.net Support

We’re currently sorting through a scale-up of capacity for the project web and project DB services, and increasing scaling in our LDAP directory infrastructure. As this work, and testing of the platform with modern app revisions, is not complete, we are postponing the end of life of the Hosted Apps offering.

We will continue to update the Hosted Apps Retirement status page as we have more information, and ample notice will be provided when the new end of life date for the Hosted Apps service is announced.

The Project Databases for the Project Web will have some downtime for hardware maintenance tomorrow starting at 16:00 UTC on 2012-11-27.

This downtime will be a 12-hour rolling outage, with less than 60 minutes downtime for any given project.

The ability to update mysql passwords will be disabled during this entire window, and any password change attempts during that time will be processed after the downtime is complete.

Best Regards,
Chris Tsai, SourceForge.net Support

Databases for the project web service is currently offline, we’re troubleshooting this now, and are working to bring this service back up as soon as possible.

Best regards,
Chris Tsai, SourceForge.net Support

1. Project web (ie., projectname.sourceforge.net pages) and associated shell and database services. This also includes access through sftp, scp, and rsync via ssh. – Project web is back online.
2. Source Code Management repositories on Classic SourceForge platform. Repositories on the new SourceForge system are online. – code repositories are back online.
3. Hosted Apps. – Hosted Apps are back online.
4. Download Statistics updates, historical data is online, but updates aren’t running. No statistics are being lost. – Statistics updates are running again.

We will keep this post updated as we continue to diagnose and turn these services back on. We do not have an estimate for when this will be complete, but getting this resolved is our top priority right now.

Thank you for your patience as we work through this.

Best Regards,
Chris Tsai, SourceForge.net Support

We’ll be moving to an upgraded environment for Project web 21:00 UTC today. This will upgrade various packages, though php will be staying on 5.3, so many web-apps shouldn’t need updating. Python for cgi scripts will be upgraded to 2.6 as the default, with 2.7 available (2.4 will no longer be supported).

If you have any issues after this is complete, please let us know: http://sourceforge.net/support

Best Regards,
Chris Tsai, SourceForge.net Support

The mirror provider has confirmed the attack vector has been identified and is limited to their mirror; with exploit having occurred on or around September 22nd.

Through validation we have confirmed the corrupted file (a modified copy of phpMyAdmin-3.5.2.2-all-languages.zip) was served only via the ‘cdnetworks-kr-1′ mirror.

While we believe that only one file was modified on the ‘cdnetworks-kr-1′ mirror, we are conducting additional validation to confirm and will provide update once this process concludes. The mirror remains out of rotation.

Through logs, we have identified that approximately 400 users downloaded this corrupted file. Notice of this corrupted file has been transmitted through security notice by the phpMyAdmin project and direct email to those users we were able to identify through our logs.

This corrupted copy of phpMyAdmin included a backdoor which permitted execution of arbitrary commands by the web server user. The notice from phpMyAdmin may be seen at:
http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php

It is our recommendation that downloaders of this corrupted file (which contains ‘server_sync.php’) assess risk and take action as they deem appropriate, including deletion of the corrupted file and downloading a fresh copy.

Downloaders are at risk only if a corrupt copy of this software was obtained, installed on a server, and serving was enabled. Examination of web logs and other server data should help confirm whether this backdoor was accessed.

SourceForge thanks the phpMyAdmin team and the Tencent security team for escalating this issue.

Thank you,
The SourceForge team

We’re working on optimizing this so these items are processed more quickly. Thank you for your patience as we work through this.

UPDATE: the task queue has worked its way down to normal levels, and we’ve made some changes to the task processing so upgrades won’t cause as much delay with regular processing.

Best regards,

Chris Tsai, SourceForge.net Support

UPDATE: We are now fully accessible again from China.

Best Regards,
Chris Tsai, SourceForge.net Support

Sometimes this means that we need to retire a service that has outlived its usefulness, and is no longer maintainable. Today we’re announcing the end of life of the Hosted Apps platform. Effective immediately, we’re not allowing any new creation of Hosted Apps, and we’re asking you to migrate those hosted apps into your own project web space.

Some of these apps were taken offline temporarily a few weeks ago, and two apps – WordPress and phpwebsite – remain offline.

Hosted Apps will go offline permanently on September 1, 2012. This gives you all Summer to plan and migrate your data. UPDATE: we’re pushing the date on this back. Move detail on the new timeline is on our Hosted Apps Retirement information page.

There’s a variety of reasons that this is necessary, but what they come down to is that the effort required to maintain this feature has come to outweigh the benefits. Furthermore, with a single installation of each of these apps, we weren’t able to offer you the flexibility of configuration, plugins, and themes that many projects wanted and expected.

For those of you that are using the Hosted App functionality, you can already get backups of that data for your own uses. That data is yours, not ours, and we want to be sure that you have a way to get it out.

For Classic projects, you can get a backup from: Project Admin > Features > "Backups" row > "Hosted Apps"

For new or upgraded projects, it’s in: Admin > Tools > Hosted Apps, Admin Hosted Apps > backup link.

At this time we have detailed migration documents for moving WordPress to your project web space. Docs for the next most popular apps (phpBB, MediaWiki and Trac) will follow shortly. Because these were customized versions of these applications, there’s a few tricks in migrating your data.

One major aspect of this customization was the ability to authenticate against SourceForge.net accounts, and we’ll be adding OpenID support very soon in order to replace the functionality that you’d otherwise be losing here.

Also, our new Allura platform has many core features that were provided by the Hosted Apps platform. You can migrate your project to the new platform by going to https://sourceforge.net/p/upgrade/ and pressing the “Upgrade” button.

We also have a data API which could be used to migrate your data directly to your upgraded SourceForge project. If you write such a migration script before we get around to it, please let us know.

We apologize for any inconvenience this causes you, but we’re confident that the time and resources that this frees up will allow us to move forward even more quickly on developing features to make project development even better. As always, please let us know if you have any comments or suggestions.

Please continue to check back for ongoing updates on this issue. We’ll be posting updated migration documents as soon as they are completed and tested, and we’ll continue to update you on the status of the OpenID implementation, as well as other features that will smooth the path of migration.

If you’re familiar with using our download stats, you’ll see that we’ve upgraded the stats system to have a more consistent and clean look.

You can show stats for any custom date range you choose. (Please note, historical data prior to April 1, 2011 is still available via the original interface, and is currently being imported into the new system).

We have completely revamped the way our stats are calculated using our own homegrown open source project called Zarkov. You can expect to read more about this in an upcoming blog post, but in a nutshell, Zarkov is an event logger and aggregator we use internally. It’s written in Python and uses MongoDB.

Currently, we are working on importing old data from before April 1, 2011 and tweaking the project rankings and sitewide stats (to include SCM data for Bazaar and Mercurial, and fixing a few minor bugs).

We greatly appreciate everyone’s patience while we make things better.