Since yesterday, it is possible to access the public source code repository for DeforaOS more securely, via CVS over the SSH protocol. This procedure is documented in the DeforaOS project page [1].

Note that the password is simply "anoncvs", while the fingerprint for the server's RSA public key is the following:
2f:0f:d7:cb:88:be:24:a1:3d:02:23:dc:42:db:cd:50

[1] http://www.defora.org/os/project/download/11/DeforaOS