* redistributing IT as part of e.g. a CVS repository, via anonymous
      CVS, anonymous RSYNC, on CDs (commercially or non-commercially)
    * redistributing IT via a secure channel (such as CVS over SSH, or
      RSYNC over SSH)
    * storing IT in a directory on a multi-user machine which is not
      globally readable (e.g. 0750 user:group)
    * storing IT on an encrypted filesystem (on a multi-user machine)

All of those ways of storing and/or redistributing the source
are ok.