Re: [wrynose][patch] rsync: Security fixes from v3.4.1-sec-patches3

["Siddharth Doshi" <sdoshi@mvista.com>]

[-- Attachment #1: Type: text/plain, Size: 1822 bytes --]

Hi Yoann, Paul and Vijay,

v3.4.1-sec-patches3 and v3.2.7-sec-patches3 both the branches are part of official security release afaik.

these versions corresponds to ubuntu/launchpad PPA for racoon and noble respectively so i see them being maintained till 2031 and 2029 atleast(unless ubuntu decides on bumping those versions up in unforseen situations).

with that being said, yes it is trade-off between maintaining 34 kLOC patch and minor upgrade which we need to figure out.
upgrading to 3.4.4 is less favourable as it still leaves 33 CVE's open and for that we would still have a larger patch to maintain rather than patches getting applied directly.

Since rsync does not expose an architecture-wide library ( librsync is a completely distinct project), upgrading it will *never break the ABI of other compiled packages* in rootfs. No other binary links against rsync dynamically at the linker level. on top of it, rsync is maintaining backword compatability. So upgrading to 3.5.x wouldn't be an issue too.

To talk about the regressions in 3.5.0, they are being fixed in 3.5.1 which is planned to release on 21st september.

we have 2 ways in front of us:
1) maintain the 34 kLOC patch for 3.4.1.
Pros: we will mostly have maintainence till 2031( 1 year more than wrynose EOL).
cons: large patches to be maintained. (we can locally tar it though but still has to be maintained)

2) upgrade the 3.5.1
Pros: no need to maintain large patches and we would be in line with upstream.
Cons: we will be violating the stable upgrade policy of no new features and there are chances we would encounter same situation in future when more CVE's are found affecting the newer version.

i am fine with either of the way as one of fellow contributor. But, let me know your thoughts.

Regards,
Siddharth

[-- Attachment #2: Type: text/html, Size: 7258 bytes --]