I discovered today that it is now possible to do anonymous checkouts of Eclipse projects behind a firewall. There has been (for a long time) a CVS server running on proxy.eclipse.org on port 80 (for anonymous access) and port 443 (for committer access). However, the anonymous access only works if you have only a firewall (i.e. which lets any traffic through on port 80).
Most large organisations however don't employ only a firewall - they also have an HTTP proxy sitting in the middle. The problem is that the HTTP proxy only knows how to speak HTTP, and gets confused when network clients start declaring their affections.
HTTPS isn't so encumbered, however; what happens is that the client sends a HTTP Connect message, and thereafter all the bits are opaque to the proxy. But also, most HTTPS proxies will only permit CONNECT calls through to port 443; which is why the committee proxy works.
Fortunately, those nice people at Eclipse have set up a second box, pebbles.eclipse.org, which runs an anonymous CVS client on port 443. This means if you use "pebbles.eclipse.org" as the host, /cvsroot/eclipse (etc) as the CVSRoot, pserver as the method, anonymous as the user, and change the port to 443, and Bam! Bam! You can checkout code from behind the firewall.
I don't know how long it's been in place - I know I've wanted it for a while - but thanks to the Eclipse Webmasters I can now checkout from CVS. At least I'll get some use out of it before everyone migrates to Git ...