CVS commit: pkgsrc/net/rsync

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Jan 14 19:30:05 UTC 2025

Modified Files:
        pkgsrc/net/rsync: Makefile distinfo

Log Message:
rsync: update to 3.4.0.

Release 3.4.0 is a security release that fixes a number of important vulnerabilities.

For more details on the vulnerabilities please see the CERT report
https://kb.cert.org/vuls/id/952657

## Changes in this version:

### PROTOCOL NUMBER:

 - The protocol number was changed to 32 to make it easier for
   administrators to check their servers have been updated

### SECURITY FIXES:

Many thanks to Simon Scannell, Pedro Gallegos, and Jasiel Spelman at
Google Cloud Vulnerability Research and Aleksei Gorban (Loqpa) for
discovering these vulnerabilities and working with the rsync project
to develop and test fixes.

- CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing.

- CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats ASLR.

- CVE-2024-12086 - Server leaks arbitrary client files.

- CVE-2024-12087 - Server can make client write files outside of destination directory using symbolic links.

- CVE-2024-12088 - --safe-links Bypass.

- CVE-2024-12747 - symlink race condition.

### BUG FIXES:

- Fixed the included popt to avoid a memory error on modern gcc versions.

- Fixed an incorrect extern variable's type that caused an ACL issue on macOS.

- Fixed IPv6 configure check

### INTERNAL:

- Updated included popt to version 1.19.

### DEVELOPER RELATED:

- Various improvements to the release scripts and git setup.

- Improved packaging/var-checker to identify variable type issues.

- added FreeBSD and Solaris CI builds


To generate a diff of this commit:
cvs rdiff -u -r1.128 -r1.129 pkgsrc/net/rsync/Makefile
cvs rdiff -u -r1.61 -r1.62 pkgsrc/net/rsync/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/rsync/Makefile
diff -u pkgsrc/net/rsync/Makefile:1.128 pkgsrc/net/rsync/Makefile:1.129
--- pkgsrc/net/rsync/Makefile:1.128     Wed May 22 09:49:36 2024
+++ pkgsrc/net/rsync/Makefile   Tue Jan 14 19:30:05 2025
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.128 2024/05/22 09:49:36 bouyer Exp $
+# $NetBSD: Makefile,v 1.129 2025/01/14 19:30:05 wiz Exp $
 
-DISTNAME=      rsync-3.3.0
-PKGREVISION=   1
+DISTNAME=      rsync-3.4.0
 CATEGORIES=    net
 MASTER_SITES=  http://rsync.samba.org/ftp/rsync/
 MASTER_SITES+= http://rsync.samba.org/ftp/rsync/old-versions/

Index: pkgsrc/net/rsync/distinfo
diff -u pkgsrc/net/rsync/distinfo:1.61 pkgsrc/net/rsync/distinfo:1.62
--- pkgsrc/net/rsync/distinfo:1.61      Mon Jul 15 17:20:03 2024
+++ pkgsrc/net/rsync/distinfo   Tue Jan 14 19:30:05 2025
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.61 2024/07/15 17:20:03 hauke Exp $
+$NetBSD: distinfo,v 1.62 2025/01/14 19:30:05 wiz Exp $
 
-BLAKE2s (rsync-3.3.0.tar.gz) = 0b750564ba4fac3d52f0855633d8976902d040f335012bb99a72d7f95f7992e7
-SHA512 (rsync-3.3.0.tar.gz) = df5c53bc2f2b0e7e30f475903e5e4296dc2fbcf08e9ea6c3c61462d0e52b067c27e82deeb4be79102c86e9aa55a825182e126f22df44dabf5b7328acb2a01d10
-Size (rsync-3.3.0.tar.gz) = 1153969 bytes
+BLAKE2s (rsync-3.4.0.tar.gz) = 932747c893b77c2588e5b10664f97b3903f3d00570f11fbd98039c4f4f87a1de
+SHA512 (rsync-3.4.0.tar.gz) = 4a0e7817e6e71e0173713ddd6b6bc7ee86237d092bd0a8c830a69f9993b76b5712a13a3ca60c7bbf42162cdc837df8783e07f8cd65c32fcb12c35f751043c56b
+Size (rsync-3.4.0.tar.gz) = 1167983 bytes
 SHA1 (patch-Makefile.in) = 34c3cc57846e451a0adbd19fcb19ae682b7e1ae3
 SHA1 (patch-acls.c) = 9be60c0c1abedc961fa95bba2bb23d802a09bc62