Hi,

The following vulnerabilities were published for rclone.

CVE-2026-88013[0]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.49.0 until
| 1.75.1, the HTTP backend attaches headers configured through --http-
| headers or headers= to requests in backend/http/http.go, while its
| fshttp.NewClient client follows redirects without a backend-specific
| http.Client.CheckRedirect policy. A configured remote that redirects
| to another host can therefore cause custom secrets such as X-Api-Key
| to be resent to that untrusted destination, and a same-host HTTPS-
| to-HTTP redirect can expose Authorization or Cookie headers in
| cleartext. Listing, stat, download, mount, and serve operations can
| trigger the leak during normal use. This issue is fixed in version
| 1.75.1.


CVE-2026-88014[1]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.72.0 until
| 1.75.1, the archive ZIP backend method (*Fs).readZip in
| backend/archive/zip/zip.go accepts archive/zip.File.Name values from
| an untrusted central directory and exposes cleaned entry names
| without ensuring that they remain inside the archive namespace.
| Entries such as ../../etc/cron.d/evil can survive path.Clean and
| become Object.Remote() values that fs/sync and fs/operations use as
| destination-relative paths, allowing rclone copy or sync to write
| outside the selected destination on backends that do not
| independently confine the path. The non-empty root check also used
| strings.HasPrefix without a path boundary, so root foo could
| incorrectly include sibling foobar entries. This issue is fixed in
| version 1.75.1.


CVE-2026-88015[2]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.1,
| backend/local with --links or links=true exposes symlink targets as
| .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked
| positive Range start through Object.Open and openTranslatedLink. The
| function slices the target string as linkdst[offset:], so a Range
| start larger than the target length causes a deterministic slice-
| bounds panic when lib/http/serve exposes the object through HTTP or
| WebDAV. Go net/http normally recovers the panic per connection,
| causing request-level denial of service rather than terminating the
| entire process. This issue is fixed in version 1.75.1.


CVE-2026-88016[3]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.1, when
| backend/local runs with --links, a source .rclonelink object can
| plant a symlink in the destination and later directory metadata is
| applied through that path. MkdirMetadata, writeMetadataToFile, and
| setTimes operate when Directory.translatedLink=false, so os.Chown,
| os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root
| confinement and follow the symlink. An attacker controlling source
| contents can therefore apply selected ownership, permissions,
| modification times, or birth times to a file or directory outside
| the destination, with --metadata required for chmod and chown while
| modification time is applied by the normal directory workflow. This
| issue is fixed in version 1.75.1.


CVE-2026-88017[4]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.64.0 until
| 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one
| obscured password per username in the server-wide userPass
| map[string]string instead of binding the credential or VFS to the
| authenticated session. If two accepted credentials use the same
| username but resolve to different proxy backends, a later
| CheckPasswd login overwrites userPass[user], and subsequent getVFS
| operations on the first session are reauthorized with the later
| password. The first session can then read, create, overwrite,
| rename, or delete objects using the second credential’s backend
| authority. Exploitation requires the later same-username login to
| occur while the first session remains open. This issue is fixed in
| version 1.75.1.


CVE-2026-88018[5]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.1, rclone
| serve s3 configured with --auth-proxy but without --auth-key allows
| authPairMiddleware to register any client-chosen accessKeyID with an
| empty ws.s3Secret. gofakes3 then verifies the request’s SigV4
| signature against that same empty secret, while Server.auth passes
| the access key identifier as both the user and authentication value
| to the proxy without an independent per-identity secret. An
| unauthenticated network attacker can therefore choose an arbitrary
| access key, sign with an empty secret, and reach whatever backend
| the auth-proxy script resolves for that identity. This issue is
| fixed in version 1.75.1.


CVE-2026-88044[6]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.70.0 until
| 1.75.1, the serve/start RC interface accepts per-server
| proxyOpt.AuthProxy settings, and the FTP and S3 constructors in
| cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check
| the process-global proxy.Opt.AuthProxy value instead. When the
| global value is empty, the request-local authentication proxy is
| ignored: FTP falls back to the fixed filesystem with username
| anonymous and any password, while S3 with AuthKey serves the fixed
| RC fs rather than the backend selected by the proxy. The dedicated
| command-line servers that configure the global option are not
| affected. This issue is fixed in version 1.75.1.


CVE-2026-88045[7]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. From 1.75.0 until
| 1.75.1, the serve S3 streamed multipart path in
| cmd/serve/s3/multipart.go passes attacker-controlled contentLength
| to multipart.NewRW().Reserve before reading request-body bytes.
| waitForTurn admits the current part and one oversized part when the
| buffer is empty despite --multipart-streaming-buffer-limit, and
| lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-
| Decoded-Content-Length. A network client can retain or multiply
| these reservations without sending the declared body, exhausting
| process or host memory or permanently blocking request handlers.
| Anonymous S3 deployments require no credentials, while deployments
| using auth_key require an accepted S3 key. This issue is fixed in
| version 1.75.1.


CVE-2026-88046[8]:
| rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.75.1, rclone
| core does not reject parent-directory segments in source
| Object.Remote() values before fs/list, fs/walk, fs/sync, and
| fs/operations pass those values to destination backends. A flat-
| keyspace source object store populated with native non-rclone
| tooling can contain a raw .. key segment, and affected b2, swift,
| qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp,
| webdav, ftp, filelu, shade, and sia destinations use path.Join(root,
| remote) before EncodeDot can neutralize the segment. A copy or
| upload can therefore escape the configured root into another bucket,
| share, or path reachable by the victim credential, with sftp and smb
| potentially reaching other filesystem or share locations under the
| same login authority. This issue is fixed in version 1.75.1.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-88013
https://www.cve.org/CVERecord?id=CVE-2026-88013
[1] https://security-tracker.debian.org/tracker/CVE-2026-88014
https://www.cve.org/CVERecord?id=CVE-2026-88014
[2] https://security-tracker.debian.org/tracker/CVE-2026-88015
https://www.cve.org/CVERecord?id=CVE-2026-88015
[3] https://security-tracker.debian.org/tracker/CVE-2026-88016
https://www.cve.org/CVERecord?id=CVE-2026-88016
[4] https://security-tracker.debian.org/tracker/CVE-2026-88017
https://www.cve.org/CVERecord?id=CVE-2026-88017
[5] https://security-tracker.debian.org/tracker/CVE-2026-88018
https://www.cve.org/CVERecord?id=CVE-2026-88018
[6] https://security-tracker.debian.org/tracker/CVE-2026-88044
https://www.cve.org/CVERecord?id=CVE-2026-88044
[7] https://security-tracker.debian.org/tracker/CVE-2026-88045
https://www.cve.org/CVERecord?id=CVE-2026-88045
[8] https://security-tracker.debian.org/tracker/CVE-2026-88046
https://www.cve.org/CVERecord?id=CVE-2026-88046

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
rclone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147404@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated rclone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 19 Oct 2026 06:13:44 -0400
Source: rclone
Architecture: source
Version: 1.75.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1134734 1134735 1140817 1142269 1143842 1145670 1147404 1148669 1150968
Changes:
 rclone (1.75.2-1) unstable; urgency=medium
 .
   * Team upload.
   * Fixes security vulnerabilities:
     - CVE-2026-41176 (Closes: #1134734)
     - CVE-2026-41179 (Closes: #1134735)
     - CVE-2026-49980 (Closes: #1140817)
     - CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269)
     - CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312,
       CVE-2026-71313 (Closes: #1143842)
     - CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778,
       CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782,
       CVE-2026-79783 (Closes: #1145670)
     - CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016,
       CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045,
       CVE-2026-88046 (Closes: #1147404)
     - CVE-2026-93986, CVE-2026-93987 (Closes: #1148669)
   * Refresh patches against upstream 1.75.2.
   * dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968).
   * debian/control:
     - Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends.
     - Replace obsolete golang-gopkg-yaml.v2-dev with
       golang-gopkg-yaml.v3-dev.
     - Drop obsolete golang-github-anacrolix-log-dev.
   * Disable backends with dependencies not yet updated/available in Debian:
     - backend/dropbox: disabled because it requires
       golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with
       ContextClient support (Debian currently has 6.0.5).
     - backend/mega: disabled because it requires
       golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or
       newer for LoginWithKeys and session export APIs.
     - backend/compress: disabled due to unpackaged zstd-seekable-format-go.
     - backend/archive, backend/filen, backend/internxt, backend/protondrive,
       cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged
       dependencies.
     - dropbox and mega backends, drop unused log in dlna
   * debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends.
   * d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1
   * d/rules, d/changelog: fix lintian warnings for nproc, changelog line
     length, and privacy breaches
   * debian/patches: amend FTP patch to drop cmd/all import, renumber and
     DEP-3 hygiene
   * d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop
     anacrolix-log
   * debian/patches: consolidate and fold backend/dlna patches via gbp pq
   * debian/control: upgrade debhelper-compat to 14
Checksums-Sha1:
 5bff1129813963ea029e52d64217c615e29cdd85 5406 rclone_1.75.2-1.dsc
 6771ed84a736fafe11afe988369263b809a15046 13684312 rclone_1.75.2.orig.tar.xz
 758d8ed0b7964a2b6d99092ca8b3c07526acd722 30800 rclone_1.75.2-1.debian.tar.xz
Checksums-Sha256:
 dd3f87c563986e70f020b7c32a8fe0ec217144308c857b76b770baa4ccbcf48d 5406 rclone_1.75.2-1.dsc
 4686f58c8a530ab40be693fce81aaae8125a692012123a5a45981bad48d8a62d 13684312 rclone_1.75.2.orig.tar.xz
 4e60798a2fefd557c6cd0284113b88b629c1f60b22e2aa623a338545aca00966 30800 rclone_1.75.2-1.debian.tar.xz
Files:
 e78558580647a4acdfa73318574e3018 5406 net optional rclone_1.75.2-1.dsc
 17560887fd4fb71ceae80fad70718c46 13684312 net optional rclone_1.75.2.orig.tar.xz
 fda7e2aad58858d1abdd2692158b4cdd 30800 net optional rclone_1.75.2-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrV7l8UHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsuJzg/8CbHh5QY0dqNmJhS41ew16M5TrrPn
+OHC+OusBJ4U9SACdCYD8FJNdOHrjvv6LITWUbb0a/RkPssKAj0NZQFXZS2lcbYV
Uf5oIGs/oI5CLvwQKnUAn1MRzrIsnY+m+FfXdwlADhnJ2J7j28oBqR7MKfnXyOdS
cqInUDUuCcvYxg7geVWOEr34qleonL9ZUzS4OWOWdAUUixZIUn7Gq9MEQC38sVZp
D8RV/8HUgKX1XLQjbNlxYkYOYIqgeOEaHF6osRk2G7fRXSPA0eh/dzFhM8H6gisZ
d5vWU255QgIQNhsr39LLUtHDOYQUWnzWh48UP6JcUP9Bs9sbgP7nTKoZrJ2TkC71
eQC4CqXzWGeBNmk6GQUmEMx6ia2mp+RrWvBlNgdKduoEwnHIV3t3fec6PdpQyD8h
BSaBNHzrlMHsuK1jEueCwuOBJuPD0+VQPR3m/HLmUKwi7NVKqYEqcOJnvasL4CdD
WOe7O9mtVYhMbqIVT9EcoGmoc9nXTlFGsRmZoGTZVDjD5uYhINPnN0xIWBgqbATi
kltmSWnB9x5QBolW3/o6L+5uxlGZRuaE1WKAGlEpyaVRMjhfqmiGO0BOf/Ok2kXS
9fRaL8waAOzo78UcFY2hf0wrTM96V4Syzzjr/P3gWDL2TxpUO+/BOwgLl/Pf5avU
8cQrLV4RzqknTpE=
=xfug
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
rclone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147404@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Drew Parsons <dparsons@debian.org> (supplier of updated rclone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 02:22:40 +0200
Source: rclone
Architecture: source
Version: 1.75.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Drew Parsons <dparsons@debian.org>
Closes: 1134470 1134734 1134735 1135744 1140817 1142269 1143842 1145670 1147404 1148669 1150418 1150968
Changes:
 rclone (1.75.2-2) unstable; urgency=medium
 .
   * Team upload.
   * drop deprecated Depends: golang-github-artyom-mtab-dev
   * update 0018-Disable-unsupported-backends-and-commands-in-Debian.patch
     to reinstate supported backends: compress, dropbox, iclouddrive, mega
     - Depends: golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0~)
   * drop deprecated patches
     0019-Disable-extsort-and-adjust-go-ordered-map-import.patch
     0020-Disable-IBM-Cloud-IAM-authenticator.patch
   * disable_backend_archive_no_diskfs.patch and disable_backend_internxt.patch
     are merged into
     0018-Disable-unsupported-backends-and-commands-in-Debian.patch
   * new release updates pcloud support. Closes: #1134470
   * golang-github-rclone-proton-api-bridge-dev replaces
     golang-github-henrybear327-proton-api-bridge-dev supporting Proton Drive.
     Closes: #1135744
 .
 rclone (1.75.2-1) unstable; urgency=medium
 .
   * Team upload.
   * Fixes security vulnerabilities:
     - CVE-2026-41176 (Closes: #1134734)
     - CVE-2026-41179 (Closes: #1134735)
     - CVE-2026-49980 (Closes: #1140817)
     - CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269)
     - CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312,
       CVE-2026-71313 (Closes: #1143842)
     - CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778,
       CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782,
       CVE-2026-79783 (Closes: #1145670)
     - CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016,
       CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045,
       CVE-2026-88046 (Closes: #1147404)
     - CVE-2026-93986, CVE-2026-93987 (Closes: #1148669)
   * Refresh patches against upstream 1.75.2.
   * dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968).
   * debian/control:
     - Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends.
     - Replace obsolete golang-gopkg-yaml.v2-dev with
       golang-gopkg-yaml.v3-dev.
     - Drop obsolete golang-github-anacrolix-log-dev.
   * Disable backends with dependencies not yet updated/available in Debian:
     - backend/dropbox: disabled because it requires
       golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with
       ContextClient support (Debian currently has 6.0.5).
     - backend/mega: disabled because it requires
       golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or
       newer for LoginWithKeys and session export APIs.
     - backend/compress: disabled due to unpackaged zstd-seekable-format-go.
     - backend/archive, backend/filen, backend/internxt, backend/protondrive,
       cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged
       dependencies.
     - dropbox and mega backends, drop unused log in dlna
   * debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends.
   * d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1
   * d/rules, d/changelog: fix lintian warnings for nproc, changelog line
     length, and privacy breaches
   * debian/patches: amend FTP patch to drop cmd/all import, renumber and
     DEP-3 hygiene
   * d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop
     anacrolix-log
   * debian/patches: consolidate and fold backend/dlna patches via gbp pq
   * debian/control: upgrade debhelper-compat to 14
 .
 rclone (1.74.3-1) experimental; urgency=medium
 .
   * Team upload.
 .
   [ Drew Parsons ]
   * New upstream version 1.74.3
     - fixes RC authentication [CVE-2026-41176][CVE-2026-41179]
       Closes: #1134734, #1134735
     - fixes authentication vulnerability [CVE-2026-49980].
       Closes: #1140817
   * README.Debian documents backends, commands and other features
     disabled in the debian build since dependencies are not (yet)
     packaged for Debian.
   * update patches disabling features due to missing dependencies
     - disable_backend_archive_no_diskfs.patch: disables the new
       archive (squashfs) backend (requires diskfs)
     - disable_backend_internxt.patch: internxt backend requres
       internxt/rclone-adapter
     - update disable_backend_file.patch to disable filen backend
       (requires FilenCloudDienste/filen-sdk-go)
     - serve_dlna_slog.patch uses slog instead of anacrolix/log with
       serve/dlna (for anacrolix/dms 1.8.0). See upstream commit 8a91f15.
   * drop Files-Excluded from debian/copyright and Repack from debian/watch
   * update Dependencies against current go.mod
     - new Depends:
       golang-github-adrg-xdg-dev
       golang-github-a1ex3-zstd-seekable-format-go-dev
       golang-github-golang-jwt-jwt-v5-dev (>= 5.3.1~)
       golang-github-ibm-go-sdk-core-v5-dev
       golang-github-lanrat-extsort-dev
       golang-github-mattn-go-runewidth-dev
       golang-github-mholt-archives-dev
       golang-github-minio-minio-go-v7-dev
       golang-github-muesli-reflow-dev
       golang-github-peterh-liner-dev
       golang-github-pmezard-go-difflib-dev
       golang-github-prometheus-client-golang-dev
       golang-github-rclone-go-proton-api-dev
       golang-github-rclone-proton-api-bridge-dev
       golang-github-rivo-uniseg-dev
       golang-github-rogpeppe-go-internal-dev
       golang-github-wk8-go-ordered-map-dev
       golang-github-zeebo-blake3-dev
       golang-github-zeebo-xxh3-dev
       golang-golang-x-oauth2-dev
       golang-golang-x-sync-dev
       golang-gopkg-natefinch-lumberjack.v2-dev
       golang-gopkg-yaml.v3-dev
       golang-github-moul-http2curl-dev
       golang-github-protonmail-go-crypto-dev
       golang-github-pkg-xattr-dev
       golang-github-pquerna-otp-dev
       golang-golang-x-mobile-dev
       golang-golang-x-term-dev
     - update versioned Dependencies:
       golang-github-aalpar-deheap-dev (>= 1.1.2~)
       golang-github-anacrolix-dms-dev (>= 1.7.2~)
       golang-github-anacrolix-log-dev (>= 0.17.0~)
       golang-github-atotto-clipboard-dev (>= 0.1.4~)
       golang-github-aws-aws-sdk-go-v2-dev (>= 1.41.5~)
       golang-github-cloudsoda-go-smb2-dev (>= 0.0~20250228.d4c70e6~)
       golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.0.5~)
       golang-github-go-chi-chi-dev (>= 5.2.5~)
       golang-github-hanwen-go-fuse-dev (>= 2.9.0~)
       golang-github-klauspost-compress-dev (>= 1.18.5~)
       golang-github-mattn-go-colorable-dev (>= 0.1.14~)
       golang-github-ncw-swift-v2-dev (>= 2.0.5~)
       golang-github-pkg-sftp-dev (>= 1.13.10~)
       golang-github-rfjakob-eme-dev (>= 1.2.0~)
       golang-github-shirou-gopsutil-dev (>= 4.26.3~)
       golang-github-spf13-cobra-dev (>= 1.10.2~)
       golang-github-spf13-pflag-dev (>= 1.0.10~)
       golang-github-stretchr-testify-dev (>= 1.11.1~)
       golang-github-t3rm1n4l-go-mega-dev (>= 0.0~git20251120.6845944~)
       golang-golang-x-text-dev (>= 0.37.0~)
       golang-google-api-dev (>= 0.275.0~)
       golang-github-golang-jwt-jwt-dev (>= 5.0.0+really4.5.2~)
     - removed Dependencies no longer required
       golang-github-djherbis-times-dev
       golang-github-henrybear327-go-proton-api-dev
       golang-github-henrybear327-proton-api-bridge-dev
       golang-github-hirochachacha-go-smb2-dev
       golang-github-iguanesolutions-go-systemd-dev
       golang-github-go-chi-chi-dev
       golang-github-ncw-go-acd-dev
       golang-github-nsf-termbox-go-dev
       golang-github-okzk-sdnotify-dev
       golang-github-pkg-errors-dev
       golang-github-pkg-sftp-dev
       golang-github-pkg-xattr-dev
       golang-github-protonmail-go-crypto-dev
       golang-github-rclone-ftp-dev
       golang-github-sevlyar-go-daemon-dev
       golang-github-sirupsen-logrus-dev
       golang-golang-x-oauth2-google-dev
       golang-gopkg-yaml.v2-dev
   * update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~)
     Closes: #1150418
   * update DH_GOLANG_INSTALL_EXTRA installing extra files required
     during build
   * enable iclouddrive backend: remove iclouddrive skips in
     disable_backend_file.patch
 .
   [ Marcos Talau ]
   * debian/salsa-ci.yml: Add to provide CI tests for Salsa
   * Enable Salsa CI using default template
Checksums-Sha1:
 71df31c0ff87c5c2249311297653e77477815f1d 5507 rclone_1.75.2-2.dsc
 b205fd5072c7fe68f06a58cad150b0cd22a64e0e 27984 rclone_1.75.2-2.debian.tar.xz
 bc4d08702e89ecf4460d8f12ed3b519c556d4e32 27302 rclone_1.75.2-2_amd64.buildinfo
Checksums-Sha256:
 2f70f4ed51dbd20bc8772b1621a2b0bac760cea032b531c38c91d3883dd34670 5507 rclone_1.75.2-2.dsc
 5c45ec7749cbd921cefbeaff2cc86e779afd0df92f05539adea95b8ad30afb61 27984 rclone_1.75.2-2.debian.tar.xz
 eef476407cb26d3a92bb25992087a3faa2a51a945afe6d950e719615ab7056ef 27302 rclone_1.75.2-2_amd64.buildinfo
Files:
 735dbf44246caccf46af936a76fda4e8 5507 net optional rclone_1.75.2-2.dsc
 c5f89030d94fbda8a2ff3f348abe2c91 27984 net optional rclone_1.75.2-2.debian.tar.xz
 4aae5205fa8ae7e5fb32bd49b59d8599 27302 net optional rclone_1.75.2-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEI8mpPlhYGekSbQo2Vz7x5L1aAfoFAmrZYzsACgkQVz7x5L1a
AfqmSw/+Jzt1tTuFRR5mQ4W6nH+E+AadrhKZCbY2IynyUkDzAtGSSkkaF2nqhlGh
Vize2Cp9HEdeFpQFSZ5wn77TGvXMD3CST8MJgx5OKKiniqDNPthTUVMsk5OwWAYo
ml5C0WFTxWkJPLg4gqz0/LqsfUoC20T5C4CBM3OQLBzXTC+3S7JmOtV71sGwOM9O
DwfPjiQ29g0f+urhIdU67aU3Ik8BHMdXOjIApghCncXHJG8kAwzPx4wouunfiZpk
YjBiix4cyfEL4kcqCo3KdvnBPFLfZaGeBPo2qcbARyGXpXK4eUQuWBtKyEiGacJs
8rbN9zukoocjwuLzcTihzXjqPhhKdmL5YW9vWVoXBmLKbxqgJp3uOcCyxzMBuNsg
j6NinbAELNh891OX559lcqJ+6ThZX8BFzcW36c/O1Q7eNceJftjTWtvBpmvll+EU
jezJrCcd6dcZ/rmHFPyjOoiTxQZ0BCyGTPWmksO3bWdKTg/isdH1rVMadB08a/bF
v1umw3udYgrm/+7d+zPtuWSD0lbvjge86AEOfvMYByn480cfUutf3S1jxReUf0aK
w+h7kEglz5fkNnRx7PncBGh71dZP3HVktCJ7VP4Q8LSHBPwVzrWB7ClX3ok6bq0u
8UUiFeVIBPsZfaDTVipwD7uWT28UUTx+ncWIRbjzW2Byfy9KJEw=
=6v+V
-----END PGP SIGNATURE-----