So finally SourceForge posted the instructions for putting access control on the cvs respository:
https://sourceforge.net/docman/ display_doc.php?docid=772&group_id=1#scriptcvsacls
Basically, I think that cvs_acls would work well for us. It only restricts commits, so we would be free to import new sources. We need to come up with a "avail" file, which defines who has access to what. Here's a simple example:
unavail avail|bob, alice|server avail|alice|docs avail|blackbart|website avail|cookiemonster
Who wants want restricted? I'll set it up once we agree on the setup.
.hc