CVS access from behind the firewall

[hanasaki]

I have a bunch of developers behind a squid firewall.  Only http/https 
are allowed out.  What is a simple/secure way to let the at least pull 
CVS down from the Internet (ex: sourceforge) and preferable do CVS 
checkins too.  An iptables masquerade is not at the top of the list of 
options.