Mirror SourceForge svn repositories

[ryandesign (Ryan Carsten Schmidt)]

SourceForge's uptime has been bad for the past two weeks. They moved to a new data center, and have experienced downtime and DDoS attacks since then. See ​https://twitter.com/sfnet_ops. For ports that fetch directly from a code repository hosted on SourceForge, such as netpbm, this means the port can't be installed, for users who for whatever reason don't receive a binary archive. See #55930, #55853, #54918.

There have also been many reports of fetch failures that were the result of restrictive user network configurations. We used to fetch from svn using the svn protocol, but some networks blocked that port number. See #41023. We tried using http, until we found that some proxies interfered with that, since svn uses WebDAV's additional HTTP verbs that some proxies are unfamiliar with. See #28590. We switched to https, but recently SourceForge disabled support for older SSL protocols, making fetches fail using the version of svn included on OS X El Capitan and earlier. See #55933.

When SourceForge comes back online, I propose that MacPorts provide mirrors of the SourceForge svn repositories we use. Currently that's the following 10 ports:

• AtomicParsley-devel
• PsyncX
• cmuclmtk
• codeblocks
• cotvnc
• despotify
• flashdot
• netpbm
• pymol
• spim

Such mirrors can be easily created using svnsync and kept up to date by rerunning svnsync periodically. Once a day is probably sufficient. They can be hosted on svn.macports.org, where we already host our own archived svn repo. Ports that fetch from svn can then either always use the MacPorts svn mirror, or it can just be available as something we can switch ports to if the original server goes offline.

I know other solutions to the vcs fetch problem have been proposed and are partially implemented, such as MacPorts automatically generating a tarball. See macports-base@vcs-fetch. But until such solutions are finished and available to users, mirroring the repos could be a quick simple solution.

There are also 4 ports fetching from git repositories hosted on SourceForge:

• SSHKeychain
• gcs-java
• ttk
• xchm

Offering mirrors of those is something we could discuss separately, though since git makes it easy to clone repos, there may already be mirrors of them on GitHub or elsewhere that we could use.