Pullup ticket #6665 - requested by khorben

net/rsync: security update

Revisions pulled up:
- net/rsync/Makefile                                            1.122,1.121
- net/rsync/distinfo                                            1.56

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   wiz
   Date:           Mon Aug 22 11:11:49 UTC 2022

   Modified Files:
           pkgsrc/net/rsync: Makefile distinfo

   Log Message:
   rsync: update to 3.2.5.

   # NEWS for rsync 3.2.5 (14 Aug 2022)

   ## Changes in this version:

   ### SECURITY FIXES:

   - Added some file-list safety checking that helps to ensure that a rogue
     sending rsync can't add unrequested top-level names and/or include recursive
     names that should have been excluded by the sender.  These extra safety
     checks only require the receiver rsync to be updated.  When dealing with an
     untrusted sending host, it is safest to copy into a dedicated destination
     directory for the remote content (i.e. don't copy into a destination
     directory that contains files that aren't from the remote host unless you
     trust the remote host). Fixes CVE-2022-29154.

    - A fix for CVE-2022-37434 in the bundled zlib (buffer overflow issue).

   ### BUG FIXES:

   - Fixed the handling of filenames specified with backslash-quoted wildcards
     when the default remote-arg-escaping is enabled.

   - Fixed the configure check for signed char that was causing a host that
     defaults to unsigned characters to generate bogus rolling checksums. This
     made rsync send mostly literal data for a copy instead of finding matching
     data in the receiver's basis file (for a file that contains high-bit
     characters).

   - Lots of manpage improvements, including an attempt to better describe how
     include/exclude filters work.

   - If rsync is compiled with an xxhash 0.8 library and then moved to a system
     with a dynamically linked xxhash 0.7 library, we now detect this and disable
     the XX3 hashes (since these routines didn't stabilize until 0.8).

   ### ENHANCEMENTS:

   - The [`--trust-sender`](rsync.1#opt) option was added as a way to bypass the
     extra file-list safety checking (should that be required).

   ### PACKAGING RELATED:

   - A note to those wanting to patch older rsync versions: the changes in this
     release requires the quoted argument change from 3.2.4. Then, you'll want
     every single code change from 3.2.5 since there is no fluff in this release.

   - The build date that goes into the manpages is now based on the developer's
     release date, not on the build's local-timezone interpretation of the date.

   ### DEVELOPER RELATED:

   - Configure now defaults GETGROUPS_T to gid_t when cross compiling.

   - Configure now looks for the bsd/string.h include file in order to fix the
     build on a host that has strlcpy() in the main libc but not defined in the
     main string.h file.


   To generate a diff of this commit:
   cvs rdiff -u -r1.121 -r1.122 pkgsrc/net/rsync/Makefile
   cvs rdiff -u -r1.55 -r1.56 pkgsrc/net/rsync/distinfo

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   wiz
   Date:           Sat Jul 23 06:55:30 UTC 2022

   Modified Files:
           pkgsrc/net/rsync: Makefile

   Log Message:
   rsync: remove reference to non-existent file


   To generate a diff of this commit:
   cvs rdiff -u -r1.120 -r1.121 pkgsrc/net/rsync/Makefile

2 files changed, 6 insertions, 7 deletions

diff --git a/net/rsync/Makefile b/net/rsync/Makefile
index c4a000aca56..a027bdeb336 100644
--- a/net/rsync/Makefile
+++ b/net/rsync/Makefile
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.120 2022/04/20 20:09:55 wiz Exp $
+# $NetBSD: Makefile,v 1.120.2.1 2022/08/27 15:42:20 spz Exp $
 
-DISTNAME=	rsync-3.2.4
+DISTNAME=	rsync-3.2.5
 CATEGORIES=	net
 MASTER_SITES=	http://rsync.samba.org/ftp/rsync/
 MASTER_SITES+=	http://rsync.samba.org/ftp/rsync/old-versions/
@@ -17,7 +17,6 @@ CONFIGURE_ARGS+=	--with-included-zlib=no
 PKG_SYSCONFSUBDIR=	rsync
 TEST_TARGET=		test
 
-REPLACE_SH=		cmdormsg
 REPLACE_BASH=		rsync-ssl
 
 RCD_SCRIPTS=		rsyncd
diff --git a/net/rsync/distinfo b/net/rsync/distinfo
index c823166fbb2..c924b96ffb6 100644
--- a/net/rsync/distinfo
+++ b/net/rsync/distinfo
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.55 2022/04/20 20:09:55 wiz Exp $
+$NetBSD: distinfo,v 1.55.2.1 2022/08/27 15:42:20 spz Exp $
 
-BLAKE2s (rsync-3.2.4.tar.gz) = e4d3fb4ecb3be5c31f011ba9dd2d8f5081395d74b474d73fd0e41c5579e8608c
-SHA512 (rsync-3.2.4.tar.gz) = 96318e2754fbddf84d16df671c721e577766969dfa415925c4dc1be2e4e60a51246623747a8aec0c6e9c0824e6aa7335235ccd07f3d6fd901f8cf28e2d6e91b6
-Size (rsync-3.2.4.tar.gz) = 1114853 bytes
+BLAKE2s (rsync-3.2.5.tar.gz) = f712d59eed2c74180634ecb1cb1700f06913e334e6e624c0d6f3b8611c814f75
+SHA512 (rsync-3.2.5.tar.gz) = 6d115acb5bae546cd2b5df2c11390f8609107b7a45aa649158d8daa0c9290ab5f15640fdd4000b21d1ab39f7385b85d77cd8fe4628fa13b2adeea6fcd53d057a
+Size (rsync-3.2.5.tar.gz) = 1129957 bytes
 SHA1 (patch-Makefile.in) = 34c3cc57846e451a0adbd19fcb19ae682b7e1ae3