Usually, CVS is installed from prebuilt binaries from http://www.sunfreeware.com
Or, if there is a security problem with CVS, you can install by hand:
  1. Obtain the latest source from http://ftp.gnu.org/non-gnu/cvs/source/stable/ and place it in /export/home/tools/downloads
  2. cd /export/home/tools
    wget http://ftp.gnu.org/non-gnu/cvs/source/stable/1.11.22/cvs-1.11.22.tar.gz
    tar -zxf downloads/cvs-1.11.22.tar.gz
    cd cvs-1.11.22
    ./configure
    make >& make.out &
    
  3. Before installing the new version, check to see if there is a version installed as a package.
    If
    pkginfo | grep cvs
    
    Returns
    application SMCcvs         cvs
    
    Then do
    pkgrm SMCcvs
    
  4. Run
    make install
    
  5. The /usr/local/bin/cvs binary is about 3Mb in size, so run
    /usr/ccs/bin/strip /usr/local/bin/cvs
    
    to reduce it to about 600K.
Note that the cvs binary is copied in two locations so that it can be run suid. For details, see http://www.gigascale.org/infrax/faq/95.html

Also, be sure to update /usr/slocal/cvsusers/bin/cvs on gigasource

On gigasource, be sure to update the individual copies of cvs that the cvs users have in their directories:

cd /export/home
ls -1 */bin/cvs > /tmp/f
awk '{print "cp /usr/local/bin/cvs", $1}' /tmp/f > /tmp/f2
verify that /tmp/f2 has lines like:
cp /usr/local/bin/cvs acataldo/bin/cvs
and then run
sh -x /tmp/f2
and verify the results with
ls -l */bin/cvs

pserver

After upgrading cvs, be sure that pserver is working.

The easiest way to do this is to check out the ptII repository using pserver, see http://chess.eecs.berkeley.edu/ptexternal/. where basically you do

cd c:/directoryofyourchoice
cvs -d :pserver:anon@source.eecs.berkeley.edu:/home/cvs/cvsanon login
# No password needed, hit enter
cvs -d :pserver:anon@source.eecs.berkeley.edu:/home/cvs/cvsanon co ptII

CVSROOT/loginfo

Make syntax changes to CVSROOT/loginfo that appear to be necessary as of version 1.11.5: The quotes used to surround the argument to the -s option in all the mailx commands need to be escaped by preceding each one with a back-slash. Not doing this causes the filenames of files being committed to be taken as email addresses for the notifications to be sent to. (Make these changes by checking out CVSROOT
cvs co CVSROOT
editing loginfo and committing the change.)

See How do I set up CVS mail?