CVSTrac's home [L1 ] advertises it as "A Web-Based Bug And Patch-Set Tracking System For CVS". To developers, it offers SCM functionality, layered over CVS. It's roughly comparable to Bonsai. It improves on CVS with the key abstraction of "change sets" or "patch-sets".
Key to effective use of CVSTrac is its "timeline" - a chronological history of all activity on the site - CVS check-ins, tickets, wiki edits, etc. This [L2 ] is the live timeline for SQLite, which illustrates the idea. Another example is here [L3 ], the Open SSL project. When you have multiple people working on a project, the timeline is invaluable for keeping up with what others are doing. A timeline quickly answers such questions as, "What's new since release X.XX?" or "What has happened in the last 24 hours?"
CVSTrac builds in a convenient Wiki. It has bug reports (called "tickets"). Users can construct arbitrary SQL queries of tickets. The wiki, the tickets and the check-ins are all interlinked. If your CVS check-in comment contains text of the form "#NNNN" (wheree N is a digit) then it generates a hyperlink to ticket number NNNN. And the ticket automatically points back to he check-in. Similarly, text like [NNNN] in a ticket or in the wiki generates a hyperlink to check-in number NNNN.
CVSTrac was originally written in Tcl, but later rewritten as a standalone C program. There are plans afoot to rewrite it yet again (in TCL again) and this time add a built-in versioning system to replace CVS. The idea is to store the entire source code repository, wiki, and tickets in a single SQLite database. Even though written in TCL, the new system would be a standalone program that administrators just drop in any cgi-bin. The same standalone program would serve as the client-side check-in/ check-out tool. Transport would be over ordinary HTTP so that users behind restrictive corporate firewalls would still be able to access repositories on the web. By bundling TK, a client-side GUI could also be added.
Startup instructions for the current CVSTrac are here [L4 ].
What will it take so that CVSTrac uses HTTP authentication?
DRH writes: CVSTrac uses cookies for authentication because this provides more control. Cookies can be expired easily. Anonymous login is easier to do. Login is restricted to a single IP address. Do you have some problem with cookies?
MAKR 2009-02-01: CVSTrac nowadays also supports Subversion and to some degree git.
DKF: Note that it's author now uses fossil for this sort of thing, which is rather inspired by the things that CVSTrac does.