rsync (3.5.0+ds1-2) unstable; urgency=medium

  * d/rsync.NEWS: Fix date in latest entry
  * d/p/testsuite_make_basis_xname...: Pull patch to fix the hurd-i386 FTBFS
  * d/p/testsuite_interpose_lfs...: New patch to fix the i386 and alpha FTBFS
  * d/p/testsuite_punch_granularity...: New patch to fix the loong64 FTBFS

 -- Samuel Henrique <samueloph@debian.org>  Tue, 18 Aug 2026 20:48:16 -0700

rsync (3.5.0+ds1-1) unstable; urgency=medium

  [ Sylvain Beucler ]
  * autopkgtest improvements
  * Drop allow-stderr autopkgtest restriction

  [ Samuel Henrique ]
  * New upstream version 3.5.0+ds1, fixing 33 CVEs:
    - CVE-2026-53783: rrsync restricted-directory escape
      (validation-vs-exec race + unsafe option allowlist)
    - CVE-2026-53784: Daemon module-root chdir escape under "use chroot =
      no"
    - CVE-2026-53785: --relative implied-parent creation escapes the
      destination tree
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter
      list
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names
      into its line protocol
    - CVE-2026-53789: Malicious sender expands --delete scope by
      reclassifying an implied parent
    - CVE-2026-53790: Command / argument injection via unquoted peer- or
      host-controlled values
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the
      daemon's source address
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives
      sender matching negative
    - CVE-2026-53793: Chroot "/./" inner-module escape via a
      parent-component symlink
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap
      via --max-alloc=0
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir /
      --link-dest disabling rename/link confinement
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race
      (TOCTOU)
    - CVE-2026-53797: Sender source-tree parent-component symlink race ->
      out-of-tree disclosure
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown
      name to uid/gid 0
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race
      -> arbitrary ACL set (local privilege escalation)
    - CVE-2026-53800: Sender --remove-source-files unlink follows a
      parent-component symlink race -> arbitrary file deletion outside the
      source tree
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the
      transfer root / module -> out-of-tree disclosure
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked
      operator-supplied input files
    - CVE-2026-53803: Arbitrary file write / privilege escalation via
      symlinked operator-supplied output paths
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname
      cannot be resolved, admitting the host it was meant to block
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a
      crafted equal-weak-checksum chain
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS
      connection (no CA verification; no stunnel hostname binding)
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an
      rsync daemon
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when
      the argument count lands exactly on maxargs
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg()
      error formatting
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry
      accepted without -H
    - CVE-2026-70459: Per-connection daemon child crash from a crafted
      first incremental file list with a non-directory transfer root
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied
      --partial-dir / --backup-dir resolving via an in-module symlink
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in
      add_implied_include()
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own
      I/O timeout (signed overflow, and a non-positive value)
    - CVE-2026-70463: "auth users" ignores documented comma-only parsing,
      silently skipping a deny/read-only rule
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out
      an rsync daemon module
  * d/p/skip_devices_test_non_linux.patch: Drop patch applied upstream
  * d/patches:
     - Pull 3 patches for regression fixes:
       ~ Honor_STRIP_in_install-strip_for_cross-compilation.patch
       ~ rrsync_support_fd_pins_in_user_namespaces.patch
       ~ testsuite_bound_the_unshare_probe.patch
  * d/rsync.NEWS: Add a NEWS entry about all the behavior changes

 -- Samuel Henrique <samueloph@debian.org>  Sun, 16 Aug 2026 11:00:00 -0700

rsync (3.4.4+ds1-1) unstable; urgency=medium

  * New upstream version 3.4.4+ds1

 -- Samuel Henrique <samueloph@debian.org>  Sun, 07 Jun 2026 22:07:25 -0700

rsync (3.4.3+ds1-2) unstable; urgency=high

  * d/t/upstream-tests: Build t_chmod_secure and t_secure_relpath

 -- Samuel Henrique <samueloph@debian.org>  Tue, 19 May 2026 18:23:33 -0700

rsync (3.4.3+ds1-1) unstable; urgency=high

  * New upstream version 3.4.3+ds1
  * d/p/syscall_use_openat2...: Drop merged patch

 -- Samuel Henrique <samueloph@debian.org>  Tue, 19 May 2026 17:47:34 -0700

rsync (3.4.2+ds1-2) unstable; urgency=medium

  * d/p/syscall_use_openat2...: New patch to fix symlink handling on the
    receiver (closes: #1093160)

 -- Samuel Henrique <samueloph@debian.org>  Thu, 30 Apr 2026 09:50:10 -0300

rsync (3.4.2+ds1-1) unstable; urgency=medium

  [ Samuel Henrique ]
  * New upstream version 3.4.2+ds1
    - Fix CVE-2026-41035 (closes: #1134617)
  * Drop patches merged upstream.
     - fix-flaky-hardlinks-test.patch
     - reproducible-build.patch
     - gcc_15.patch
     - CVE-2025-10158.patch
  * d/copyright: runtests.sh was refactored to runtests.py
  * d/t/upstream-tests: runtests.sh was refactored to runtests.py

  [ Alexandre Detiste ]
  * delete d/rules-pre-dh that shows up on Debian Code Search

 -- Samuel Henrique <samueloph@debian.org>  Wed, 29 Apr 2026 11:58:29 -0300

rsync (3.4.1+ds1-7) unstable; urgency=medium

  * Team upload.

  [ Arnaud Rebillout ]
  * d/control: Switch back to python3-cmarkgfm for all architectures

  [ Matheus Polkorny ]
  * d/p/CVE-2025-10158.patch: Import upstream patch to fix CVE-2025-10158

    A malicious client acting as the receiver of an rsync file transfer
    can trigger an out of bounds read of a heap based buffer,
    via a negative array index. (Closes: #1121442)

 -- Matheus Polkorny <mpolkorny@gmail.com>  Thu, 27 Nov 2025 21:01:55 -0300

rsync (3.4.1+ds1-6) unstable; urgency=medium

  [ Samuel Henrique ]
  * d/p/reproducible-build.patch: New patch to fix reproducible builds, thanks
    to lamby (closes: #1093201)
  * gcc_15.patch: New patch to support building with GCC 15 (closes: #1097811)

  [ Arnaud Rebillout ]
  * d/tests/remote-tests: start the SSH service if ever it's not up

  [ Alex ]
  * d/tests/local-tests: remove test skip

 -- Samuel Henrique <samueloph@debian.org>  Wed, 22 Oct 2025 19:22:21 +0100

rsync (3.4.1+ds1-5) unstable; urgency=medium

  * Team upload.
  * d/tests/local-tests: beautify test script
  * d/tests: run rsync tests over ssh
  * d/tests/local-tests: add test for --exclude flag
  * d/copyright: add contributor

 -- Alex <alex@puer-robustus.eu>  Sat, 26 Jul 2025 11:26:07 +0200

rsync (3.4.1+ds1-5~exp1) experimental; urgency=medium

  * Team upload.
  * d/tests: add Debian-specific local rsync tests

 -- Alex <alex@puer-robustus.eu>  Thu, 03 Jul 2025 22:28:36 +0200

rsync (3.4.1+ds1-4) unstable; urgency=medium

  * Upload to unstable

 -- Samuel Henrique <samueloph@debian.org>  Mon, 09 Jun 2025 19:41:23 +0100

rsync (3.4.1+ds1-4~exp2) experimental; urgency=medium

  * Team upload.
  * d/control: Add acl and attr packages to Build-Depends
  * d/tests: Add "upstream-tests-as-root" test with needs-root restriction

 -- Alex <alex@puer-robustus.eu>  Fri, 06 Jun 2025 16:40:59 +0200

rsync (3.4.1+ds1-4~exp1) experimental; urgency=medium

  * Team upload.
  * docs(debian/copyright): consistently point to GNU licenses website
  * d/tests: add superficial test for "rsync -h"

 -- Alex <alex@puer-robustus.eu>  Wed, 04 Jun 2025 21:46:47 +0200

rsync (3.4.1+ds1-3) unstable; urgency=medium

  * Team upload.
  * python3-cmarkgfm is currently broken for hppa architecture

 -- Arnaud Rebillout <arnaudr@kali.org>  Fri, 07 Mar 2025 17:59:15 +0700

rsync (3.4.1+ds1-2) unstable; urgency=medium

  * Team upload.
  * Update skip_devices_test patch to be non-linux
  * Add patch to fix flaky hardlinks test
  * d/watch: Drop filenamemangle and uversionmangle, simplify dversionmangle

 -- Arnaud Rebillout <arnaudr@kali.org>  Thu, 06 Mar 2025 14:10:57 +0700

rsync (3.4.1+ds1-1) unstable; urgency=medium

  * Team upload.

  [ Samuel Henrique ]
  * Swap Maintainer with Uploaders, so samueloph can get email notifications

  [ Arnaud Rebillout ]
  * d/watch: Adjust url to point to the src dir with all the releases
  * Update upstream signing key, metadata and email address
  * New upstream version 3.4.1+ds1 (Closes: #1093081)
  * Drop patches applied upstream
  * Update shebang patch

 -- Arnaud Rebillout <arnaudr@kali.org>  Wed, 05 Mar 2025 09:02:19 +0700

rsync (3.3.0+ds1-4) unstable; urgency=critical

  [ Salvatore Bonaccorso ]
  * Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED
    (Closes: #1093089, #1093052)

  [ Samuel Henrique ]
  * d/p/Fix_use-after-free_in_generator: New patch to fix UAF

 -- Samuel Henrique <samueloph@debian.org>  Wed, 15 Jan 2025 18:34:49 +0000

rsync (3.3.0+ds1-3) unstable; urgency=critical

  * Import upstream patches for CVE-2024-12084, CVE-2024-12085,
    CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, CVE-2024-12747
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12084
       ~ 0001-Some-checksum-buffer-fixes.patch
       ~ 0002-Another-cast-when-multiplying-integers.patch
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12085
       ~ 0001-prevent-information-leak-off-the-stack.patch
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12086
       ~ 0001-refuse-fuzzy-options-when-fuzzy-not-selected.patch
       ~ 0002-added-secure_relative_open.patch
       ~ 0003-receiver-use-secure_relative_open-for-basis-file.patch
       ~ 0004-disallow-.-elements-in-relpath-for-secure_relative_o.patch
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12087
       ~ 0001-Refuse-a-duplicate-dirlist.patch
       ~ 0002-range-check-dir_ndx-before-use.patch
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12088
       ~ 0001-make-safe-links-stricter.patch
     - d/p/rsync-upstream-CVE-patches-v3/CVE-2024-12747
       ~ 0001-fixed-symlink-race-condition-in-sender.patch
     - d/p/rsync-upstream-CVE-patches-v3/version_update
       ~ 0001-raise-protocol-version-to-32.patch
       ~ 0002-change-version-to-3.4.0.patch
       ~ 0003-update-NEWS-for-3.4.0.patch

 -- Samuel Henrique <samueloph@debian.org>  Sun, 12 Jan 2025 15:40:14 +0000

rsync (3.3.0+ds1-2) unstable; urgency=medium

  * d/watch: Set repacksuffix to +ds1 to fix salsa CI
  * d/p/configure_ac...: New patch to fix IPv6 support, thanks to Simon
    Ruderich for the bug report (closes: #1090328)

 -- Samuel Henrique <samueloph@debian.org>  Tue, 17 Dec 2024 18:56:13 +0000

rsync (3.3.0+ds1-1) unstable; urgency=medium

  * Team upload.

  [ Samuel Henrique ]
  * New upstream version 3.3.0+ds
    - Repack to remove the zlib bundled library

  [ Matheus Polkorny ]
  * New upstream version 3.3.0+ds1
    - Repack to remove the popt bundled library
  * d/copyright: Update to comply with 1.0 format and exclude popt/*
  * d/gbp.conf: Remove export-dir configuration
  * d/rules: fix build failure due to missing zlib/dummy.in and popt/dummy.in
  * d/t/upstream-tests: Run d/rules override_dh_auto_configure during setup
  * d/watch: add +ds suffix to version

 -- Matheus Polkorny <mpolkorny@gmail.com>  Sat, 07 Dec 2024 20:54:11 -0300

rsync (3.3.0-1) unstable; urgency=medium

  [ Aquila Macedo Costa ]
  * d/control: Bump Standards-Version to 4.6.2

  [ Samuel Henrique ]
  * New upstream version 3.3.0 (closes: #1068630)
  * Bump Standards-Version to 4.7.0
  * Update patches
  * d/patches: Drop merged patches
  * d/control: Drop dependency on lsb-base
  * d/rsync.lintian-overrides: Update overrides

 -- Samuel Henrique <samueloph@debian.org>  Fri, 12 Apr 2024 00:28:29 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog rsync`.
