mbox series

[scarthgap,0/1] rsync: upgrade 3.2.7 -> 3.5.1

Message ID 20261030050243.1395053-1-dkelaiya@cisco.com
Headers show
Series rsync: upgrade 3.2.7 -> 3.5.1 | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 30, 2026, 5:02 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Upgrade rsync on Scarthgap directly from 3.2.7 to 3.5.1 in one commit.
This consolidates six OE-Core master upgrades; their commit references
and original contributor credits are retained in the patch.

The TSC approved an exception to the stable branch policy for rsync on
Scarthgap and Wrynose [1]. The maintainers concluded that upgrading is
preferable to carrying the large security backport series or leaving
the CVEs unpatched. They recommended 3.5.1 to align with master and
Blacksail and include the regression fixes following 3.5.0. This patch
implements that approved upgrade using published release tarballs.

Versions 3.4.1 and 3.4.2 include the fixes carried by Scarthgap's
existing CVE patches. Remove all fourteen redundant source patches,
including CVE-2025-10158.patch and CVE-2026-41035.patch.
Version 3.4.4 includes the security fixes from 3.4.3 and subsequent
regression fixes. Version 3.5.0 fixes 33 further security issues with
differing affected-version ranges. Version 3.5.1 addresses reported
3.5.0 regressions, including path handling and access to
standard-stream file descriptors [2]. The three retained source patches
are refreshed for the new releases.

The backport retains Scarthgap's WORKDIR-based installation and existing
build configuration. Internationalized domain name support is exposed
through the optional idn PACKAGECONFIG and is disabled by default.

Compatibility considerations: 3.5.1 changes the wire protocol number
to 33 and adds logical-block statistics when both peers use protocol
33. Rsync documents negotiation of the newest protocol shared by both
peers [3]. Mixed-version transfer behavior still needs runtime
validation.

[1] https://lists.openembedded.org/g/openembedded-core/message/248203
[2] https://download.samba.org/pub/rsync/NEWS
[3] https://download.samba.org/pub/rsync/rsync.1

Darsh Kelaiya (1):
  rsync: upgrade 3.2.7 -> 3.5.1

 ...-prototypes-to-function-declarations.patch | 126 ++----------
 .../rsync/files/CVE-2024-12084-0001.patch     | 156 --------------
 .../rsync/files/CVE-2024-12084-0002.patch     |  43 ----
 .../rsync/files/CVE-2024-12085.patch          |  32 ---
 .../rsync/files/CVE-2024-12086-0001.patch     |  42 ----
 .../rsync/files/CVE-2024-12086-0002.patch     | 108 ----------
 .../rsync/files/CVE-2024-12086-0003.patch     | 108 ----------
 .../rsync/files/CVE-2024-12086-0004.patch     |  41 ----
 .../rsync/files/CVE-2024-12087-0001.patch     |  49 -----
 .../rsync/files/CVE-2024-12087-0002.patch     |  31 ---
 .../rsync/files/CVE-2024-12087-0003.patch     |  40 ----
 .../rsync/files/CVE-2024-12088.patch          | 141 -------------
 .../rsync/files/CVE-2024-12747.patch          | 192 ------------------
 .../rsync/files/CVE-2025-10158.patch          |  36 ----
 .../rsync/files/CVE-2026-41035.patch          |  39 ----
 .../rsync/files/determism.patch               |  20 +-
 .../rsync/files/makefile-no-rebuild.patch     |  11 +-
 .../rsync/{rsync_3.2.7.bb => rsync_3.5.1.bb}  |  17 +-
 18 files changed, 37 insertions(+), 1195 deletions(-)
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2025-10158.patch
 delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-41035.patch
 rename meta/recipes-devtools/rsync/{rsync_3.2.7.bb => rsync_3.5.1.bb} (79%)