From patchwork Thu Aug 13 05:55:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 95067 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A9D1C5DF6B for ; Thu, 13 Aug 2026 05:56:00 +0000 (UTC) Received: from a27-33.smtp-out.us-west-2.amazonses.com (a27-33.smtp-out.us-west-2.amazonses.com [54.240.27.33]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.12996.1786600551674333918 for ; Wed, 12 Aug 2026 22:55:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=V73yqE/9; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=oSy/UdAK; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.33, mailfrom: 0101019ff9b0f126-51dac1bb-78ba-4a28-bd72-3321ffb5f333-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1786600550; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=u0j9EroOVSF+fRTR75DalvaK8GOiwKO82W2nxWMxpok=; b=V73yqE/9cRE2R+BHe5E8Tn61L9CpVJQ7gQCPJQBX6OybaTAOF96CRRk2JxAzyFtj TYKKySjrPXqePXSvuQRIhN5gta1YlBT5ycpDPRn1i0d3h7CVUmBXNtA7V/oGBliaWF8 IjBTlGV5NnlpqylVHmfz7o0vr/S8l+y2NOsejXIg= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1786600550; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=u0j9EroOVSF+fRTR75DalvaK8GOiwKO82W2nxWMxpok=; b=oSy/UdAK5OnaplmeuWK3ORGX9Dib7jrtVDb0yNZbTTo2iwIkAVCoFGsOu8CvGICI 2CwSd6Mr/yiVV/h7Sr5afR8dqnBDysKcDnsg43tXbDwxe48q5MVI41t3DUDYT7sMuq/ rUs43BTPvhrQasO1krWwlw0RtEECx7zuUs8qINCs= MIME-Version: 1.0 From: auh@yoctoproject.org To: Yi Zhao Cc: openembedded-core@lists.openembedded.org Subject: [AUH] rsync: upgrading to 3.5.0 SUCCEEDED Message-ID: <0101019ff9b0f126-51dac1bb-78ba-4a28-bd72-3321ffb5f333-000000@us-west-2.amazonses.com> Date: Thu, 13 Aug 2026 05:55:50 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.08.13-54.240.27.33 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 13 Aug 2026 05:56:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243326 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *rsync* to *3.5.0* has Succeeded. Next steps: - apply the patch: git am 0001-rsync-upgrade-3.4.4-3.5.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From e80bf8769d1c091525c39ae1ae76d5753fbf4782 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Thu, 13 Aug 2026 05:15:34 +0000 Subject: [PATCH] rsync: upgrade 3.4.4 -> 3.5.0 Source: NEWS.md # NEWS for rsync 3.5.0 (13 Aug 2026) ## Changes in this version: ### Thanks! This has been an extraordinary release developed over several months and I'd like to thank everyone who has helped make it possible. The volume of security issues we had to deal with would have been quite overwhelming without the help that I've received. I'm particularly grateful to Zen Dodd (Tao), Omar Elsayed (seks99x), Will Sargeant, Paul Mackerras, Aleksa Sarai and Leonid Bugaev (buger) who joined the rsync admins group helping to triage all the issues, develop new tests, review PRs and helped develop the guidelines we used for where to draw the line between a security issue and expected behaviour (a surprisingly difficult thing to do in some cases). You've all been a huge help and rsync is much better off for your assistance. A big thank you also to Filipe Casal from Trail of Bits who worked with us on the "Patch the Planet" program. Filipe provided a huge trove of valuable tests and security reports. Also a big thank you to Greg Kroah-Hartman for invaluable advice and security reports and to Stuart Inglis for particularly high quality bug reports and testing. Many thanks to everyone who submitted bug reports, credits are listed below against individual items. Finally, thank you to everyone who joined in the discussion and testing on the rsync-security mailing list, and to the rsync user community for your patience in waiting for this release. ### SECURITY FIXES: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory, and many are much narrower than "everything before 3.5.0". Every fix ships with a regression test in the test suite that fails on the unfixed tree. Many thanks to the external researchers credited below. Link following (CWE-59/61) -- a local user who controls a path component plants a symlink that a privileged rsync then follows: - CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked operator-supplied input files. rsync followed attacker-planted symlinks in `--filter` merge files (including per-directory merges and `-C` `.cvsignore`), `--files-from` / `--include-from` / `--exclude-from`, and the client `--password-file` / daemon secrets file -- reading an arbitrary file as filter rules, or sending a victim file's contents as the daemon authentication response. Operator-supplied paths are now resolved component-by-component with `openat(O_PATH|O_NOFOLLOW)`, allowing a symlink component only when it is owned by uid 0 or the effective uid. - CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via symlinked operator-supplied output paths -- `--log-file`, `--write-batch`/`--read-batch` [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- ...g-prototypes-to-function-declarations.patch | 18 +++++++++--------- .../rsync/files/determism.patch | 4 ++-- .../rsync/files/makefile-no-rebuild.patch | 6 +++--- .../rsync/{rsync_3.4.4.bb => rsync_3.5.0.bb} | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) rename meta/recipes-devtools/rsync/{rsync_3.4.4.bb => rsync_3.5.0.bb} (97%) diff --git a/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch b/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch index ede0238b2e..5aed93e458 100644 --- a/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch +++ b/meta/recipes-devtools/rsync/files/0001-Add-missing-prototypes-to-function-declarations.patch @@ -1,4 +1,4 @@ -From c05cc113f925bda645c8e51b83e9dc30b0543bad Mon Sep 17 00:00:00 2001 +From 64e62c659649593239ed39ed40a3ae689bf2d593 Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Mon, 29 Aug 2022 19:53:28 -0700 Subject: [PATCH] Add missing prototypes to function declarations @@ -24,10 +24,10 @@ Signed-off-by: Archana Polampalli 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/checksum.c b/checksum.c -index 24e46bf..6ae3178 100644 +index 4c91c2b..b3635a0 100644 --- a/checksum.c +++ b/checksum.c -@@ -778,7 +778,7 @@ static void verify_digest(struct name_num_item *nni, BOOL check_auth_list) +@@ -796,7 +796,7 @@ static void verify_digest(struct name_num_item *nni, BOOL check_auth_list) } #endif @@ -37,10 +37,10 @@ index 24e46bf..6ae3178 100644 #if defined SUPPORT_XXH3 || defined USE_OPENSSL struct name_num_item *nni; diff --git a/exclude.c b/exclude.c -index 24de64f..a787488 100644 +index 7476f6a..b939a0c 100644 --- a/exclude.c +++ b/exclude.c -@@ -363,7 +363,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end) +@@ -460,7 +460,7 @@ void implied_include_partial_string(const char *s_start, const char *s_end) memcpy(partial_string_buf, s_start, partial_string_len); } @@ -50,10 +50,10 @@ index 24de64f..a787488 100644 if (partial_string_buf) { if (partial_string_len) diff --git a/log.c b/log.c -index b948f16..afca81d 100644 +index 889b57b..19e5e98 100644 --- a/log.c +++ b/log.c -@@ -131,7 +131,7 @@ static void logit(int priority, const char *buf) +@@ -140,7 +140,7 @@ static void logit(int priority, const char *buf) } } @@ -63,10 +63,10 @@ index b948f16..afca81d 100644 int options = LOG_PID; diff --git a/main.c b/main.c -index 229a889..aa158ad 100644 +index 6050d0e..45722c4 100644 --- a/main.c +++ b/main.c -@@ -246,7 +246,7 @@ void read_del_stats(int f) +@@ -250,7 +250,7 @@ void read_del_stats(int f) stats.deleted_files += stats.deleted_specials = read_varint_bounded(f, 0, MAX_WIRE_DEL_STAT, "deleted_specials"); } diff --git a/meta/recipes-devtools/rsync/files/determism.patch b/meta/recipes-devtools/rsync/files/determism.patch index a8fee5ba0a..2eea267bb2 100644 --- a/meta/recipes-devtools/rsync/files/determism.patch +++ b/meta/recipes-devtools/rsync/files/determism.patch @@ -1,4 +1,4 @@ -From 32852028e95cdf78d09f1bd867f3b46b4728f9e3 Mon Sep 17 00:00:00 2001 +From c4c9b52a864c3b9ff67771b9d881a78276448100 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Sun, 21 Feb 2021 09:45:48 +0000 Subject: [PATCH] rsync: Fix a file sorting determinism issue @@ -25,7 +25,7 @@ https://github.com/WayneD/rsync/commit/d3085f7add38a5cf833a0b31cb0637ff46c80f8d 1 file changed, 5 insertions(+) diff --git a/Makefile.in b/Makefile.in -index 0ba2d5c..b9c5438 100644 +index 91807d6..c18b4be 100644 --- a/Makefile.in +++ b/Makefile.in @@ -27,6 +27,11 @@ MKDIR_P=@MKDIR_P@ diff --git a/meta/recipes-devtools/rsync/files/makefile-no-rebuild.patch b/meta/recipes-devtools/rsync/files/makefile-no-rebuild.patch index 914b50a7b7..4ff070ea3c 100644 --- a/meta/recipes-devtools/rsync/files/makefile-no-rebuild.patch +++ b/meta/recipes-devtools/rsync/files/makefile-no-rebuild.patch @@ -1,4 +1,4 @@ -From 50ef5ccd9149cee27bae29e767ff1c2e76bdc879 Mon Sep 17 00:00:00 2001 +From bab7abb3c7c1c1db8ef6c3084c1ffb5152f5bf1e Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Tue, 12 Apr 2016 15:51:54 +0100 Subject: [PATCH] rsync: remove upstream's rebuild logic @@ -13,10 +13,10 @@ Signed-off-by: Ross Burton 1 file changed, 54 deletions(-) diff --git a/Makefile.in b/Makefile.in -index 79060b3..0ba2d5c 100644 +index 801e864..91807d6 100644 --- a/Makefile.in +++ b/Makefile.in -@@ -200,60 +200,6 @@ conf: configure.sh config.h.in +@@ -265,60 +265,6 @@ conf: configure.sh config.h.in .PHONY: gen gen: conf proto.h man git-version.h diff --git a/meta/recipes-devtools/rsync/rsync_3.4.4.bb b/meta/recipes-devtools/rsync/rsync_3.5.0.bb similarity index 97% rename from meta/recipes-devtools/rsync/rsync_3.4.4.bb rename to meta/recipes-devtools/rsync/rsync_3.5.0.bb index fa9a61778f..d9a4884d96 100644 --- a/meta/recipes-devtools/rsync/rsync_3.4.4.bb +++ b/meta/recipes-devtools/rsync/rsync_3.5.0.bb @@ -16,7 +16,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ file://determism.patch \ file://0001-Add-missing-prototypes-to-function-declarations.patch \ " -SRC_URI[sha256sum] = "bd88cf82fa653da32314fb229136407c5c90f80d1758d8f4b091767877d8fa96" +SRC_URI[sha256sum] = "c7ffd1ef653e99540f661e47cb00b7f9cad1ee6b972399b16f93d672656e0d33" # Out-of-tree builds don't install the documentation currently # https://github.com/RsyncProject/rsync/issues/846