> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CVS Integration

> Import CVS modules or server directories into ZeroPath for full scans

ZeroPath supports [Concurrent Versions System (CVS)](https://www.nongnu.org/cvs/) repositories as
full-scan targets. CVS does not expose a project-discovery API, so you enter each module's server
path explicitly instead of choosing it from a list.

CVS repositories support full scans, scheduled scans, SCA, and secrets scanning. CVS has no pull
request concept, so PR scanning, review comments, and patch pull requests do not apply.

## Before you begin

Collect the following information from the CVS administrator:

* The CVS server's DNS name or IPv4 address and, if non-standard, its port.
* A username and either a pserver password or an SSH private key.
* For SSH, a trusted `known_hosts` public-key line for the server.
* The absolute CVS root on the server, such as `/srv/cvsroot`.
* Each relative module path below that root, such as `payments/api`.
* Optionally, a CVS branch or tag to check out.

<Warning>
  CVS pserver authentication is a legacy protocol and does not provide modern
  transport security. Prefer SSH key authentication whenever the server supports
  it.
</Warning>

## Import modules

<Steps>
  <Step title="Open the CVS import flow">
    In ZeroPath, go to **Add Repositories**, select the **CVS** tab, and click **Import CVS
    modules**.
  </Step>

  <Step title="Choose or connect a server">
    Reuse an existing CVS server credential, or choose **Connect a new CVS
    server**. A connection is scoped to one host and username and can be reused by
    modules in unrelated directories.
  </Step>

  <Step title="Configure authentication">
    Choose one of these methods:

    * **SSH keypair** — paste the private key and the server's trusted SSH host public key. SSH
      connections can perform a CVS checkout or copy a directory with SCP.
    * **CVS pserver password** — enter the account's pserver password. Pserver connections can
      perform CVS checkouts only.

    To collect an SSH host key, an administrator can run:

    ```bash theme={null}
    ssh-keyscan -p 22 cvs.example.com
    ```

    Verify the returned fingerprint through a trusted channel before saving it. ZeroPath pins this
    key so a scan worker does not silently trust a different server.
  </Step>

  <Step title="Enter module locations">
    For each repository, provide:

    * **CVS root** — an absolute POSIX path, such as `/srv/cvsroot`.
    * **Module path** — a relative path below that root, such as `payments/api`.
    * **Fetch method** — **CVS checkout**, or **Copy directory with SCP** for SSH servers.
    * **Branch or tag** — optional for CVS checkouts; blank selects trunk. SCP snapshots have no
      branch or tag.
    * **Repository name** — optional; by default, ZeroPath uses the final module-path segment.

    Click **Add module** to import several paths with the same server credential in one operation.
  </Step>

  <Step title="Import">
    Click **Import CVS modules**. Each root/path pair becomes a separate ZeroPath repository and
    full-scan target.
  </Step>
</Steps>

## How scanning works

CVS does not provide the Git commit objects expected by the rest of the scanner. Before each scan,
ZeroPath checks out or copies the requested tree and materializes it as a local, single-branch Git
snapshot. Downstream SAST, SCA, secrets, worktree, and scan-history behavior can then use the same
pipeline as other repositories.

Because the snapshot commit has a synthetic author, CVS repositories are excluded from Git-blame
contributor attribution.

## Path and credential behavior

* CVS roots must be absolute POSIX paths.
* Module paths must be relative and cannot contain traversal segments.
* SCP directory imports require SSH-key authentication.
* Credentials are encrypted at rest. SSH private keys and pserver passwords are never included in
  command-line arguments.
* Deleting a CVS server connection also removes its repositories from ZeroPath.