With the new OW release approaching, it might be better to get an officially
tagged upstream release in as PR#19087 just contained a fix for CVE-2022-29154
which itself introduced a few bugs.
Signed-off-by: John Audia <therealgraysky@proton.me>
The rsync package is vulnerable to CVE-2022-29154[1], which is not yet in a
non-preview release. This commit applies the upstream commit to fix it and
several subsequent commits needed to fix bugs the initial fix introduced[2].
1. https://rsync.samba.org/ftp/rsync/NEWS#SECURITY_FIXES-3.2.5
2. https://bugs.archlinux.org/task/75558
Signed-off-by: John Audia <therealgraysky@proton.me>
Disable several options to enable compilation.
Simplified several configure options.
Remove pointless configure var.
Added ssh hinting patch. Some SSH incompatibility.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
https://rsync.samba.org/security.html#s3_1_2:
If you're using a version of rsync older than 3.1.2 as a client and
receiving files from an rsync server that you might not fully trust,
this version adds extra checking to the file list to prevent the sender
from tweaking the paths and/or the transfer requests in a way that could
cause a file to be received outside the transfer destination.
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
