Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rsync: 3.3.0 -> 3.4.1 #373845

Merged
merged 1 commit into from
Jan 16, 2025
Merged

rsync: 3.3.0 -> 3.4.1 #373845

merged 1 commit into from
Jan 16, 2025

Conversation

LeSuisse
Copy link
Contributor

@LeSuisse LeSuisse commented Jan 14, 2025 •
edited
Loading

Follow-up to edccf51.

Changes:
https://github.com/RsyncProject/rsync/blob/v3.4.1/NEWS.md

The PGP key change is expected and has been confirmed by the maintainers.
In a effort to provide traceability the new key has been signed by Wayne Davison,
another rsync maintainer, see https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6c859fb14b96a8c5 (or other keyservers...)

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@nix-owners nix-owners bot requested review from ehmry and ivan January 14, 2025 20:51
@LeSuisse LeSuisse marked this pull request as ready for review January 14, 2025 21:12
@LeSuisse LeSuisse requested a review from mweinelt January 14, 2025 21:13
@LeSuisse
Copy link
Contributor Author

Moving back to draft, the security fixes are in (#373784), this can take the long way in. I will re-target at staging tomorrow.

@LeSuisse LeSuisse marked this pull request as draft January 14, 2025 23:02
@LeSuisse LeSuisse changed the base branch from master to staging January 15, 2025 16:33
@LeSuisse LeSuisse changed the title rsync: 3.3.0 -> 3.4.0 rsync: 3.3.0 -> 3.4.0 and patch for a regression in the hard links management Jan 15, 2025
@LeSuisse
Copy link
Contributor Author

I changed the target and added a fix for a regression (RsyncProject/rsync#702) introduced by one of the security fixes.

We also might want the fix for RsyncProject/rsync#704 before moving forward with this.

@de11n
Copy link

de11n commented Jan 15, 2025

rsync 3.4.1 was released with the regression fixed.

@LeSuisse LeSuisse changed the title rsync: 3.3.0 -> 3.4.0 and patch for a regression in the hard links management rsync: 3.3.0 -> 3.4.1 Jan 16, 2025
@LeSuisse LeSuisse added 1.severity: security Issues which raise a security issue, or PRs that fix one backport staging-24.11 Backport PR automatically labels Jan 16, 2025
@LeSuisse
Copy link
Contributor Author

Bumped to 3.4.1 with the regression fix. Flagged the PR as security related, out of caution, for the new use-after-free even if it does not look exploitable.

@LeSuisse LeSuisse marked this pull request as ready for review January 16, 2025 00:19
@winterqt winterqt removed the request for review from ehmry January 16, 2025 00:20
@winterqt
Copy link
Member

The PGP key change is expected and has been confirmed by the maintainers.

It might be worthwhile to cite this confirmation in the commit message for future reference, as I can't immediately find anything.

@nix-owners nix-owners bot requested a review from ehmry January 16, 2025 00:23
@LeSuisse
rsync: 3.3.0 -> 3.4.1
79a3e76 
Follow-up to edccf51.

Changes:
https://github.com/RsyncProject/rsync/blob/v3.4.1/NEWS.md

The PGP key change is expected and has been confirmed by the
maintainers. In a effort to provide traceability the new key
has been signed by Wayne Davison, another rsync maintainer,
see https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6c859fb14b96a8c5
@LeSuisse
Copy link
Contributor Author

The PGP key change is expected and has been confirmed by the maintainers.

It might be worthwhile to cite this confirmation in the commit message for future reference, as I can't immediately find anything.

AFAIK no public communication has been done but this has been confirmed in private channels and the key has been signed by an existing rsync maintainer. I edited the commit message to mention the publicly verifiable information.

@D-u-c-k-s-e-l D-u-c-k-s-e-l mentioned this pull request Jan 16, 2025
Open
13 tasks
@vcunat vcunat merged commit 0c5891d into NixOS:staging Jan 16, 2025
40 of 43 checks passed
@nixpkgs-ci nixpkgs-ci bot mentioned this pull request Jan 16, 2025
Merged
1 task
@nixpkgs-ci
Copy link
Contributor

nixpkgs-ci bot commented Jan 16, 2025

Successfully created backport PR for staging-24.11:

@dellagd dellagd mentioned this pull request Jan 16, 2025
Closed
2 tasks
vcunat added a commit that referenced this pull request Jan 16, 2025
@vcunat
rsync: 3.3.0 -> 3.4.1 (#373845)
7c2121c 
(cherry picked from commit 0c5891d)
@LeSuisse LeSuisse deleted the rsync-3.4.0 branch January 16, 2025 08:25
@vcunat
Copy link
Member

vcunat commented Jan 16, 2025

Also picked to staging-next PR #371501

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ivan ivan Awaiting requested review from ivan

@mweinelt mweinelt Awaiting requested review from mweinelt

@ehmry ehmry Awaiting requested review from ehmry

Assignees
No one assigned
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 10.rebuild-darwin: 501-1000 10.rebuild-linux: 5001+ backport staging-24.11 Backport PR automatically
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@LeSuisse @de11n @winterqt @vcunat