Unpatched security issues

[JoelLinn]

rsync 3.4.0 has been released with a lot of security fixes https://download.samba.org/pub/rsync/NEWS#3.4.0
From a first glance it looks like there are also security fixes in older versions after 3.1.3.

These fixes should be cherry picked.
Is there a general plan forward? Maybe it is a good idea to rebase all the commits against rsync upstream git for easier maintenance in the future.

[peterthomassen]

Note also that one of the fixes introduced a regression for --hard-links, which is heavily used in backups. It is fixed here: RsyncProject/rsync#705

[GWHAYWOOD]

Hi, I took over the maintenance of BackupPC in around the middle of 2025. I'm sorry that it's taken so long for me to get to this.

@JoelLinn - well I have some ideas but it's a little early to call them a plan because they require co-operation with the authors of other packages. I'm beginning to think that's going to take more time than I'd expected.

Ideally for BackupPC's uses of both rsync and zlib we would find a way to avoid re-distributing large chunks of code with BackupPC and instead use the upstream versions. This sort of thinking applies also to BackupPC's use of smbclient, where although the issues are not quite the same they still result in maintenance issues because of code changes other than in BackupPC.

Right now I'm afraid the immediate way forward has to be Yet Another Version of rsync-bpc based on a very recent rsync. Using the system zlib is an attractive option, Debian seems to manage, but I worry that there may be unforeseen consequences so I'm investigating when I have the time.

@peterthomassen - thanks for that pointer, very helpful.

[GWHAYWOOD]

My browser crashed while I was writing that last message. I added a couple of words which somehow got lost but more importantly:

Note that it is not rsync-bpc which originally bundled zlib, but the upstream rsync.

The source (the build system files) for versions of rsync-bpc before version 3.1.2.0 by default used the zlib which was bundled with rsync - just as did the upstream rsync. To prevent this would have required that, at the start of the build process, the user passed the argument --with-included-zlib=no to the configure script.

Since 1 Dec 2018 with the release of rsync-bpc version 3.1.2.0, the source build by default does not use the bundled zlib. See commit f10130c of 30 May 2017. This means that to use it, the user would have had to deliberately have made the choice to pass the argument --with-included-zlib=yes to the configure script before running make.

Debian (and so presumably Ubuntu) does not use the rsync-bundled zlib in its package build. I don't know about other distributions.

BackupPC-XS also bundles zlib. In the master branch of BackupPC-XS I have today committed a change to configure.ac in the build scripts which also will by default not use the bundled zlib. This is untested at the moment, I'd be pleased for any help with that.

[GWHAYWOOD]

...
BackupPC-XS also bundles zlib. In the master branch of BackupPC-XS I have today committed a change to configure.ac in the build scripts which also will by default not use the bundled zlib. This is untested at the moment, I'd be pleased for any help with that.

See my comment in the BackupPC-XS issues.

[GWHAYWOOD]

Version 3.4.1.0 of rsync-bpc is now being tested by interested parties. At the time of writing it is not available on Github.

As the version number implies this is based on rsync-3.4.1.

Amongst other things this version eliminates the bundled zlib and popt libraries.

Please see the BackupPC Users' Mailing List for more information.