@@ -1,4 +1,4 @@
-From c05cc113f925bda645c8e51b83e9dc30b0543bad Mon Sep 17 00:00:00 2001
+From 64e62c659649593239ed39ed40a3ae689bf2d593 Mon Sep 17 00:00:00 2001
From: Khem Raj <raj.khem@gmail.com>
Date: Mon, 29 Aug 2022 19:53:28 -0700
Subject: [PATCH] Add missing prototypes to function declarations
@@ -24,10 +24,10 @@ Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/checksum.c b/checksum.c
-index 24e46bf..6ae3178 100644
+index 4c91c2b..b3635a0 100644
--- a/checksum.c
+++ b/checksum.c
-@@ -778,7 +778,7 @@ static void verify_digest(struct name_num_item *nni, BOOL check_auth_list)
+@@ -796,7 +796,7 @@ static void verify_digest(struct name_num_item *nni, BOOL check_auth_list)
}
#endif
@@ -37,10 +37,10 @@ index 24e46bf..6ae3178 100644
#if defined SUPPORT_XXH3 || defined USE_OPENSSL
struct name_num_item *nni;
diff --git a/exclude.c b/exclude.c
-index 24de64f..a787488 100644
+index 7476f6a..b939a0c 100644
--- a/exclude.c
+++ b/exclude.c
-@@ -363,7 +363,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end)
+@@ -460,7 +460,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end)
memcpy(partial_string_buf, s_start, partial_string_len);
}
@@ -50,10 +50,10 @@ index 24de64f..a787488 100644
if (partial_string_buf) {
if (partial_string_len)
diff --git a/log.c b/log.c
-index b948f16..afca81d 100644
+index 889b57b..19e5e98 100644
--- a/log.c
+++ b/log.c
-@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf)
+@@ -140,7 +140,7 @@ static void logit(int priority, const char *buf)
}
}
@@ -63,10 +63,10 @@ index b948f16..afca81d 100644
int options = LOG_PID;
diff --git a/main.c b/main.c
-index 229a889..aa158ad 100644
+index 6050d0e..45722c4 100644
--- a/main.c
+++ b/main.c
-@@ -246,7 +246,7 @@ void read_del_stats(int f)
+@@ -250,7 +250,7 @@ void read_del_stats(int f)
stats.deleted_files += stats.deleted_specials = read_varint_bounded(f, 0, MAX_WIRE_DEL_STAT, "deleted_specials");
}
@@ -1,4 +1,4 @@
-From 32852028e95cdf78d09f1bd867f3b46b4728f9e3 Mon Sep 17 00:00:00 2001
+From c4c9b52a864c3b9ff67771b9d881a78276448100 Mon Sep 17 00:00:00 2001
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Date: Sun, 21 Feb 2021 09:45:48 +0000
Subject: [PATCH] rsync: Fix a file sorting determinism issue
@@ -25,7 +25,7 @@ https://github.com/WayneD/rsync/commit/d3085f7add38a5cf833a0b31cb0637ff46c80f8d
1 file changed, 5 insertions(+)
diff --git a/Makefile.in b/Makefile.in
-index 0ba2d5c..b9c5438 100644
+index 91807d6..c18b4be 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -27,6 +27,11 @@ MKDIR_P=@MKDIR_P@
@@ -1,4 +1,4 @@
-From 50ef5ccd9149cee27bae29e767ff1c2e76bdc879 Mon Sep 17 00:00:00 2001
+From bab7abb3c7c1c1db8ef6c3084c1ffb5152f5bf1e Mon Sep 17 00:00:00 2001
From: Ross Burton <ross.burton@intel.com>
Date: Tue, 12 Apr 2016 15:51:54 +0100
Subject: [PATCH] rsync: remove upstream's rebuild logic
@@ -13,10 +13,10 @@ Signed-off-by: Ross Burton <ross.burton@intel.com>
1 file changed, 54 deletions(-)
diff --git a/Makefile.in b/Makefile.in
-index 79060b3..0ba2d5c 100644
+index 801e864..91807d6 100644
--- a/Makefile.in
+++ b/Makefile.in
-@@ -200,60 +200,6 @@ conf: configure.sh config.h.in
+@@ -265,60 +265,6 @@ conf: configure.sh config.h.in
.PHONY: gen
gen: conf proto.h man git-version.h
similarity index 97%
rename from meta/recipes-devtools/rsync/rsync_3.4.4.bb
rename to meta/recipes-devtools/rsync/rsync_3.5.0.bb
@@ -16,7 +16,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://determism.patch \
file://0001-Add-missing-prototypes-to-function-declarations.patch \
"
-SRC_URI[sha256sum] = "bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96"
+SRC_URI[sha256sum] = "c7ffd1ef653e99540f661e47cb00b7f9cad1ee6b972399b16f93d672656e0d33"
# Out-of-tree builds don't install the documentation currently
# https://github.com/RsyncProject/rsync/issues/846
Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *rsync* to *3.5.0* has Succeeded. Next steps: - apply the patch: git am 0001-rsync-upgrade-3.4.4-3.5.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From e80bf8769d1c091525c39ae1ae76d5753fbf4782 Mon Sep 17 00:00:00 2001 From: Upgrade Helper <auh@yoctoproject.org> Date: Thu, 13 Aug 2026 05:15:34 +0000 Subject: [PATCH] rsync: upgrade 3.4.4 -> 3.5.0 Source: NEWS.md # NEWS for rsync 3.5.0 (13 Aug 2026) ## Changes in this version: ### Thanks! This has been an extraordinary release developed over several months and I'd like to thank everyone who has helped make it possible. The volume of security issues we had to deal with would have been quite overwhelming without the help that I've received. I'm particularly grateful to Zen Dodd (Tao), Omar Elsayed (seks99x), Will Sargeant, Paul Mackerras, Aleksa Sarai and Leonid Bugaev (buger) who joined the rsync admins group helping to triage all the issues, develop new tests, review PRs and helped develop the guidelines we used for where to draw the line between a security issue and expected behaviour (a surprisingly difficult thing to do in some cases). You've all been a huge help and rsync is much better off for your assistance. A big thank you also to Filipe Casal from Trail of Bits who worked with us on the "Patch the Planet" program. Filipe provided a huge trove of valuable tests and security reports. Also a big thank you to Greg Kroah-Hartman for invaluable advice and security reports and to Stuart Inglis for particularly high quality bug reports and testing. Many thanks to everyone who submitted bug reports, credits are listed below against individual items. Finally, thank you to everyone who joined in the discussion and testing on the rsync-security mailing list, and to the rsync user community for your patience in waiting for this release. ### SECURITY FIXES: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory, and many are much narrower than "everything before 3.5.0". Every fix ships with a regression test in the test suite that fails on the unfixed tree. Many thanks to the external researchers credited below. Link following (CWE-59/61) -- a local user who controls a path component plants a symlink that a privileged rsync then follows: - CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked operator-supplied input files. rsync followed attacker-planted symlinks in `--filter` merge files (including per-directory merges and `-C` `.cvsignore`), `--files-from` / `--include-from` / `--exclude-from`, and the client `--password-file` / daemon secrets file -- reading an arbitrary file as filter rules, or sending a victim file's contents as the daemon authentication response. Operator-supplied paths are now resolved component-by-component with `openat(O_PATH|O_NOFOLLOW)`, allowing a symlink component only when it is owned by uid 0 or the effective uid. - CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via symlinked operator-supplied output paths -- `--log-file`, `--write-batch`/`--read-batch` [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- ...g-prototypes-to-function-declarations.patch | 18 +++++++++--------- .../rsync/files/determism.patch | 4 ++-- .../rsync/files/makefile-no-rebuild.patch | 6 +++--- .../rsync/{rsync_3.4.4.bb => rsync_3.5.0.bb} | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) rename meta/recipes-devtools/rsync/{rsync_3.4.4.bb => rsync_3.5.0.bb} (97%)