mbox series

[wrynose,0/1] rsync: upgrade 3.4.1 -> 3.5.1

Message ID 20261030042054.1345082-1-dkelaiya@cisco.com
Headers show
Series rsync: upgrade 3.4.1 -> 3.5.1 | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 30, 2026, 4:20 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Upgrade rsync on Wrynose directly from 3.4.1 to 3.5.1 in one commit.
This consolidates four OE-Core master upgrades; their commit references
and original contributor credits are retained in the patch.

The TSC approved an exception to the stable branch policy for rsync on
Scarthgap and Wrynose [1]. The maintainers concluded that upgrading is
preferable to carrying the large security backport series or leaving
the CVEs unpatched. They recommended 3.5.1 to align with master and
Blacksail and include the regression fixes following 3.5.0. This patch
implements that approved upgrade using published release tarballs.

Version 3.4.2 includes the fix carried by CVE-2025-10158.patch, so the
backport is removed. Version 3.4.4 includes the six security fixes from
3.4.3 and subsequent regression fixes. Version 3.5.0 fixes 33 further
security issues with differing affected-version ranges. Version 3.5.1
addresses reported 3.5.0 regressions, including path handling and
access to standard-stream file descriptors [2]. The recipe patches are
refreshed for the new sources.

Compatibility considerations: 3.5.1 changes the wire protocol number
to 33 and adds logical-block statistics when both peers use protocol
33. Rsync documents negotiation of the newest protocol shared by both
peers [3]; mixed-version transfer behavior still needs local runtime
validation. Internationalized domain name support is behind the new
optional idn PACKAGECONFIG, which remains disabled by default.

[1] https://lists.openembedded.org/g/openembedded-core/message/248203
[2] https://download.samba.org/pub/rsync/NEWS
[3] https://download.samba.org/pub/rsync/rsync.1

Darsh Kelaiya (1):
  rsync: upgrade 3.4.1 -> 3.5.1

 ...-prototypes-to-function-declarations.patch | 78 ++++---------------
 .../rsync/files/CVE-2025-10158.patch          | 36 ---------
 .../rsync/files/determism.patch               |  6 +-
 .../rsync/files/makefile-no-rebuild.patch     |  6 +-
 .../rsync/{rsync_3.4.1.bb => rsync_3.5.1.bb}  |  4 +-
 5 files changed, 23 insertions(+), 107 deletions(-)
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2025-10158.patch
 rename meta/recipes-devtools/rsync/{rsync_3.4.1.bb => rsync_3.5.1.bb} (95%)