Skip to main content
ZeroPath supports Concurrent Versions System (CVS) repositories as full-scan targets. CVS does not expose a project-discovery API, so you enter each module’s server path explicitly instead of choosing it from a list. CVS repositories support full scans, scheduled scans, SCA, and secrets scanning. CVS has no pull request concept, so PR scanning, review comments, and patch pull requests do not apply.

​
Before you begin

Collect the following information from the CVS administrator:
  • The CVS server’s DNS name or IPv4 address and, if non-standard, its port.
  • A username and either a pserver password or an SSH private key.
  • For SSH, a trusted known_hosts public-key line for the server.
  • The absolute CVS root on the server, such as /srv/cvsroot.
  • Each relative module path below that root, such as payments/api.
  • Optionally, a CVS branch or tag to check out.
CVS pserver authentication is a legacy protocol and does not provide modern transport security. Prefer SSH key authentication whenever the server supports it.

​
Import modules

1

Open the CVS import flow

In ZeroPath, go to Add Repositories, select the CVS tab, and click Import CVS modules.
2

Choose or connect a server

Reuse an existing CVS server credential, or choose Connect a new CVS server. A connection is scoped to one host and username and can be reused by modules in unrelated directories.
3

Configure authentication

Choose one of these methods:
  • SSH keypair — paste the private key and the server’s trusted SSH host public key. SSH connections can perform a CVS checkout or copy a directory with SCP.
  • CVS pserver password — enter the account’s pserver password. Pserver connections can perform CVS checkouts only.
To collect an SSH host key, an administrator can run:
Verify the returned fingerprint through a trusted channel before saving it. ZeroPath pins this key so a scan worker does not silently trust a different server.
4

Enter module locations

For each repository, provide:
  • CVS root — an absolute POSIX path, such as /srv/cvsroot.
  • Module path — a relative path below that root, such as payments/api.
  • Fetch method — CVS checkout, or Copy directory with SCP for SSH servers.
  • Branch or tag — optional for CVS checkouts; blank selects trunk. SCP snapshots have no branch or tag.
  • Repository name — optional; by default, ZeroPath uses the final module-path segment.
Click Add module to import several paths with the same server credential in one operation.
5

Import

Click Import CVS modules. Each root/path pair becomes a separate ZeroPath repository and full-scan target.

​
How scanning works

CVS does not provide the Git commit objects expected by the rest of the scanner. Before each scan, ZeroPath checks out or copies the requested tree and materializes it as a local, single-branch Git snapshot. Downstream SAST, SCA, secrets, worktree, and scan-history behavior can then use the same pipeline as other repositories. Because the snapshot commit has a synthetic author, CVS repositories are excluded from Git-blame contributor attribution.

​
Path and credential behavior

  • CVS roots must be absolute POSIX paths.
  • Module paths must be relative and cannot contain traversal segments.
  • SCP directory imports require SSH-key authentication.
  • Credentials are encrypted at rest. SSH private keys and pserver passwords are never included in command-line arguments.
  • Deleting a CVS server connection also removes its repositories from ZeroPath.