> First question: is CVS over SSH or CVS over cleartext preferred?

Privacy is not an issue (it's anonymous CVS after all), but integrity
might be an issue, and ssh will give you that.  However, I'd just use
cleartext, to reduce the CPU load on what I assume are busy servers.

> What I did:
> 
> [First get tarballs and extract them, then:]
> # cd /usr/pkgsrc
> # cvs update -dP
> # cd /usr/src
> # cvs update -dP

That will work fine, provided the tarballs were for the correct branch,
and have an appropriaet CVSROOT.  If there's any doubt about whether
the tarballs were for the correct branch, add "-A" to the update flags.
If there's any doubt about whether all the "CVS" directories scattered
around contain references to the correct CVSROOT, then add "-d $CVSROOT"
to teh cvs flags.

> I've received comments about doing the following instead.  I believe
> these all work, but which is the most correct?
> 
> option 1:
> 
> cd /usr
> cvs co pkgsrc
> cvs co src

In this context, "co" is just another way of spelling "checkout".  I
always use the "checkout" spelling, but it makes no difference.

If you start from scratch, then you want "cvs checkout".  In your case,
you are recommending that people start with tarballs that effectively
contain the results from an earlier "cvs checkout", so the next step
would usually be "cvs update".

> option 2:
> 
> cd /usr/src
> cvs update -dAP
> cd /usr/pkgsrc
> cvs update -dAP
> 
> option 3:
> 
> cd /usr/src
> cvs -d $CVSROOT update -APd
> cd /usr/pkgsrc
> cvs -d $CVSROOT update -APd

There's no difference between "-dAP" and "-APd".  (I tend to use "-A -dP",
which also means the same thing.)

The CVSROOT setting can come from one of the following places (in
descending order of priority):

1) The cvs "-d" option;
2) Information in the .../CVS/Root files scattered around;
3) The environment.

If the .../CVS/Root files scattered around contain the wrong CVSROOT,
then it has to be fixed somehow.  Some people write an ad-hoc shell
script to find and overwrite all the .../CVS/Root files, some people
use "-d $CVSROOT" the first time, and some people are lucky and don't
need to change it.  It depends on which anoncvs mirror you want to
use, and on where the tarballs came from (do they refer to an anoncvs
mirror close to you, or to the master anoncvs server that might be more
distant?).

Once the .../CVS/Root files have been fixed once, they should not need
to be changed again, so you can omit any "-d $CVSROOT" options on the
second and subsequent "cvs update" operations.  Well, until you change
your mind about which anoncvs mirror to use.

if your target audience will be chopping and changing from one anoncvs
mirror to another (to see which one is fastest or most up to date),
then they should probably use "-d $CVSROOT" all the time.  If they will
pick one anoncvs mirror and stick with it, they should probably use "-d
$CVSROOT" at least the first time they do a "cvs update".

--apb (Alan Barrett)