You can't repair such a breach of trust, sourceforge is forever tainted.

Not just that, SF's infrastructure is incredibly obsolete.

Before the malware shenanigans started, they could have tried to relaunch with a full rewrite, keeping just the brand. Now even the brand is tainted, there is nothing left except a large database of users and SSH keys (and Slashdot, which apparently is still read by some people).

I think that's a bit harsh.. there is still a ton of software hosted only on sourceforge. And plenty of people that need the software that don't know about sourceforge's bad behavior. When I am researching random software or libraries, I find myself on an almost daily basis temporarily overriding the ublock rule for sourceforge.

Not only that but it's incredibly difficult to build up trust as a host of installers/exes from scratch.