#1138799 rsync --link-dest broken

Package:
rsync
Source:
rsync
Description:
fast, versatile, remote (and local) file-copying tool
Submitter:
Marc F. Clemente
Date:
2026-09-14 00:55:02 UTC
Severity:
normal
#1138799#5
Date:
2026-06-03 21:03:58 UTC
From:
To:
I use rsync for remote "incremental" backups.  Something like:

rsync --verbose --relative --archive --delete-excluded \
       --numeric-ids \
       --link-dest=../daily.1 \
        /home \[::1]::backup/daily.0

Normally this would backup only the files that have changed, and
hard-link the unchanged files.

With version 3.4.3+ds1-2 this does not work, and all the files are
backed up.

Downgrading to 3.4.2+ds1-2 restores normal functionality.
#1138799#10
Date:
2026-07-22 09:42:50 UTC
From:
To:
Hello, I believe the latest fix in upstream should correct this behavior
as well:

pull request:

https://github.com/RsyncProject/rsync/pull/953

patch:

https://github.com/RsyncProject/rsync/commit/5972ebdaf83b7e4ed2dbdbd696ba4b35318f5932

  It's going to be included in the next 3.4.4 version.


Hope this gets to debian soon.


Best Tom.K
#1138799#15
Date:
2026-07-23 20:32:05 UTC
From:
To:
Hello everyone,

I'm planning to upload a fix for this issue before the next Trixie (deb13)
point release, scheduled for 12 Sep 2026.

Cheers,
#1138799#20
Date:
2026-09-13 08:51:07 UTC
From:
To:
Hi,

I don't see rsync mentioned in the 13.7 release notes.
#1138799#25
Date:
2026-09-14 00:53:32 UTC
From:
To:
Hello Vincent,

The changes were not ready in time for the point release. The fix for this
issue will arrive with 33 CVE fixes, which also introduced a few regressions
and delayed everything.

I've just uploaded rsync 3.5.0+ds1-3 to Debian Unstable. It contains the
regression fixes I was waiting for, I'm going to wait a couple of days and then
send the same changes to Debian 13/Trixie as a security update, so you won't
have to wait until the next point release.

I had the choice of just backporting the patches to Debian 13, but my judgment
call is that it's less risky to just bump to 3.5.0, backporting all of the
fixes it's already quite close to 3.5.0 in practice. 

Regarding behavior changes for the update, you can read them
here: https://salsa.debian.org/debian/rsync/-/blob/debian/master/debian/rsync.NEWS?ref_type=heads#L1-94

The behavior changes stem from the CVE fixes themselves, not from the
3.5.0-only changes.

I'm looking into backporting the same fixes to Debian 12/Bookworm, but one
issue with the backports is still pending, so I'm prioritizing 13/Trixie first.

Thanks,