Dear maintainers,

rclone mount built from Debian sources answers FUSE xattr requests with
EIO instead of ENOSYS/EOPNOTSUPP, which makes tools that probe for
xattrs/ACLs (ls -l, getfattr, cp -a, rsync -X, tar --xattrs, ...) print
spurious "Input/output error" messages and return non-zero exit codes.

This is a packaging-combination bug between rclone and the very old
golang-bazil-fuse (2016 snapshot), not an upstream rclone bug.

# How to reproduce

    rclone config create test webdav url=... vendor=other user=... pass=...
    rclone mount test: /mnt/test &
    touch /mnt/test/file
    ls -l /mnt/test

Output:

    ls: '/mnt/test/file': Input/output error
    -rw-r--r-- 1 user user 0 ... file        <- entry is still listed, stat is fine

Direct syscall check:

    $ python3 -c "import os; os.listxattr('/mnt/test/file')"
    OSError: [Errno 5] Input/output error: '/mnt/test/file'

Directories behave correctly (EOPNOTSUPP), only regular files fail.

# Root cause analysis

rclone's FUSE handlers for regular files return a bare syscall.Errno
(cmd/mount/file.go, both 1.60.1+dfsg-4 and current sid 1.69.3+dfsg-3):

    func (f *File) Listxattr(ctx context.Context, req *fuse.ListxattrRequest, resp *fuse.ListxattrResponse) error {
        return syscall.ENOSYS // we never implement this
    }

(same for Getxattr/Setxattr/Removexattr; introduced by upstream commit
"mount: replace deprecated fuse.ENOSYS with syscall.ENOSYS", 2022-06-13,
first released in v1.60).

Upstream rclone pins bazil.org/fuse v0.0.0-20200524192727-fb710f7dfd05,
whose ToErrno() explicitly handles bare syscall.Errno:

    func ToErrno(err error) Errno {
        if err, ok := err.(syscall.Errno); ok {
            return Errno(err)
        }
        ...

However, the Debian build uses golang-bazil-fuse
0.0~git20160811.0.371fbbd-4 (2016-08-11), whose Header.RespondError only
recognizes types implementing the bazil ErrorNumber interface:

    func (h *Header) RespondError(err error) {
        errno := DefaultErrno                  // == EIO
        if ferr, ok := err.(ErrorNumber); ok {
            errno = ferr.Errno()
        }
        ...
    }

syscall.Errno does not implement bazil's ErrorNumber, so the assertion
fails and the kernel gets -EIO. (Directories work because the serve
layer returns fuse.ENOTSUP, which is a bazil Errno and thus implements
ErrorNumber.)

Confirmation with --debug-fuse:

    fuse: <- Listxattr [ID=0x12 Node=0x2 ...] 256 @0
    fuse: -> [ID=0x12] Listxattr error=EIO: function not implemented

Note the contradiction: errno says EIO while the underlying error string
is "function not implemented" (ENOSYS).

golang-bazil-fuse is at the same 2016 revision in trixie, forky and sid,
so upgrading rclone alone does not fix this; every rclone release since
v1.60 packaged in Debian is affected.

# Possible fixes

A) Minimal one-line-per-symbol patch to rclone: return fuse.ENOSYS
   instead of syscall.ENOSYS in cmd/mount/file.go xattr handlers. The
   fuse.ENOSYS constant exists in both the 2016 and current library
   versions, so this is safe regardless of library version.

B) Alternatively, update golang-bazil-fuse to a newer upstream snapshot
   (>= 2020-05-24, e.g. current master with FUSE protocol 7.33), whose
   ToErrno handles bare syscall.Errno. This may need a rebuild of other
   reverse dependencies.

I verified the analysis against both the trixie rclone 1.60.1+dfsg-4
(reproduced locally) and the sid source package 1.69.3+dfsg-3 (code
inspection via sources.debian.org).

No data corruption is involved: reads/writes/stat all work fine; the
impact is diagnostic noise and polluted exit codes for xattr-probing
tools.

Thanks for maintaining rclone in Debian!

Option B is best.  Packages should be maintained as up-to-date as
possible.  So updating golang-bazil-fuse is the correct action here
(rclone also needs updating)

Hello,

Bug #1150418 in rclone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/rclone/-/commit/f4e7004c07b647e650c77ed5149a54446e4d4a51
------------------------------------------------------------------------
update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~)

Closes: #1150418
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1150418

Hello,

Bug #1150418 in rclone reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/go-team/packages/rclone/-/commit/f4e7004c07b647e650c77ed5149a54446e4d4a51
------------------------------------------------------------------------
update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~)

Closes: #1150418
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1150418

We believe that the bug you reported is fixed in the latest version of
rclone, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150418@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Drew Parsons <dparsons@debian.org> (supplier of updated rclone package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 02:22:40 +0200
Source: rclone
Architecture: source
Version: 1.75.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Drew Parsons <dparsons@debian.org>
Closes: 1134470 1134734 1134735 1135744 1140817 1142269 1143842 1145670 1147404 1148669 1150418 1150968
Changes:
 rclone (1.75.2-2) unstable; urgency=medium
 .
   * Team upload.
   * drop deprecated Depends: golang-github-artyom-mtab-dev
   * update 0018-Disable-unsupported-backends-and-commands-in-Debian.patch
     to reinstate supported backends: compress, dropbox, iclouddrive, mega
     - Depends: golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0~)
   * drop deprecated patches
     0019-Disable-extsort-and-adjust-go-ordered-map-import.patch
     0020-Disable-IBM-Cloud-IAM-authenticator.patch
   * disable_backend_archive_no_diskfs.patch and disable_backend_internxt.patch
     are merged into
     0018-Disable-unsupported-backends-and-commands-in-Debian.patch
   * new release updates pcloud support. Closes: #1134470
   * golang-github-rclone-proton-api-bridge-dev replaces
     golang-github-henrybear327-proton-api-bridge-dev supporting Proton Drive.
     Closes: #1135744
 .
 rclone (1.75.2-1) unstable; urgency=medium
 .
   * Team upload.
   * Fixes security vulnerabilities:
     - CVE-2026-41176 (Closes: #1134734)
     - CVE-2026-41179 (Closes: #1134735)
     - CVE-2026-49980 (Closes: #1140817)
     - CVE-2026-54572, CVE-2026-59732, CVE-2026-59733 (Closes: #1142269)
     - CVE-2026-71309, CVE-2026-71310, CVE-2026-71311, CVE-2026-71312,
       CVE-2026-71313 (Closes: #1143842)
     - CVE-2026-79775, CVE-2026-79776, CVE-2026-79777, CVE-2026-79778,
       CVE-2026-79779, CVE-2026-79780, CVE-2026-79781, CVE-2026-79782,
       CVE-2026-79783 (Closes: #1145670)
     - CVE-2026-88013, CVE-2026-88014, CVE-2026-88015, CVE-2026-88016,
       CVE-2026-88017, CVE-2026-88018, CVE-2026-88044, CVE-2026-88045,
       CVE-2026-88046 (Closes: #1147404)
     - CVE-2026-93986, CVE-2026-93987 (Closes: #1148669)
   * Refresh patches against upstream 1.75.2.
   * dlna: use slog.Default() for ssdp.Server.Logger (Closes: #1150968).
   * debian/control:
     - Add golang-github-wk8-go-ordered-map-dev to Build-Depends and Depends.
     - Replace obsolete golang-gopkg-yaml.v2-dev with
       golang-gopkg-yaml.v3-dev.
     - Drop obsolete golang-github-anacrolix-log-dev.
   * Disable backends with dependencies not yet updated/available in Debian:
     - backend/dropbox: disabled because it requires
       golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.4.0) with
       ContextClient support (Debian currently has 6.0.5).
     - backend/mega: disabled because it requires
       golang-github-t3rm1n4l-go-mega-dev updated to commit c6acd6a5bd04 or
       newer for LoginWithKeys and session export APIs.
     - backend/compress: disabled due to unpackaged zstd-seekable-format-go.
     - backend/archive, backend/filen, backend/internxt, backend/protondrive,
       cmd/archive, cmd/serve/nfs, cmd/serve/s3: disabled due to unpackaged
       dependencies.
     - dropbox and mega backends, drop unused log in dlna
   * debian/rules: expand DH_GOLANG_EXCLUDES to include all disabled backends.
   * d/changelog, d/watch, d/copyright: drop +dfsg suffix for 1.75.2-1
   * d/rules, d/changelog: fix lintian warnings for nproc, changelog line
     length, and privacy breaches
   * debian/patches: amend FTP patch to drop cmd/all import, renumber and
     DEP-3 hygiene
   * d/control, d/changelog: replace obsolete yaml.v2 with yaml.v3, drop
     anacrolix-log
   * debian/patches: consolidate and fold backend/dlna patches via gbp pq
   * debian/control: upgrade debhelper-compat to 14
 .
 rclone (1.74.3-1) experimental; urgency=medium
 .
   * Team upload.
 .
   [ Drew Parsons ]
   * New upstream version 1.74.3
     - fixes RC authentication [CVE-2026-41176][CVE-2026-41179]
       Closes: #1134734, #1134735
     - fixes authentication vulnerability [CVE-2026-49980].
       Closes: #1140817
   * README.Debian documents backends, commands and other features
     disabled in the debian build since dependencies are not (yet)
     packaged for Debian.
   * update patches disabling features due to missing dependencies
     - disable_backend_archive_no_diskfs.patch: disables the new
       archive (squashfs) backend (requires diskfs)
     - disable_backend_internxt.patch: internxt backend requres
       internxt/rclone-adapter
     - update disable_backend_file.patch to disable filen backend
       (requires FilenCloudDienste/filen-sdk-go)
     - serve_dlna_slog.patch uses slog instead of anacrolix/log with
       serve/dlna (for anacrolix/dms 1.8.0). See upstream commit 8a91f15.
   * drop Files-Excluded from debian/copyright and Repack from debian/watch
   * update Dependencies against current go.mod
     - new Depends:
       golang-github-adrg-xdg-dev
       golang-github-a1ex3-zstd-seekable-format-go-dev
       golang-github-golang-jwt-jwt-v5-dev (>= 5.3.1~)
       golang-github-ibm-go-sdk-core-v5-dev
       golang-github-lanrat-extsort-dev
       golang-github-mattn-go-runewidth-dev
       golang-github-mholt-archives-dev
       golang-github-minio-minio-go-v7-dev
       golang-github-muesli-reflow-dev
       golang-github-peterh-liner-dev
       golang-github-pmezard-go-difflib-dev
       golang-github-prometheus-client-golang-dev
       golang-github-rclone-go-proton-api-dev
       golang-github-rclone-proton-api-bridge-dev
       golang-github-rivo-uniseg-dev
       golang-github-rogpeppe-go-internal-dev
       golang-github-wk8-go-ordered-map-dev
       golang-github-zeebo-blake3-dev
       golang-github-zeebo-xxh3-dev
       golang-golang-x-oauth2-dev
       golang-golang-x-sync-dev
       golang-gopkg-natefinch-lumberjack.v2-dev
       golang-gopkg-yaml.v3-dev
       golang-github-moul-http2curl-dev
       golang-github-protonmail-go-crypto-dev
       golang-github-pkg-xattr-dev
       golang-github-pquerna-otp-dev
       golang-golang-x-mobile-dev
       golang-golang-x-term-dev
     - update versioned Dependencies:
       golang-github-aalpar-deheap-dev (>= 1.1.2~)
       golang-github-anacrolix-dms-dev (>= 1.7.2~)
       golang-github-anacrolix-log-dev (>= 0.17.0~)
       golang-github-atotto-clipboard-dev (>= 0.1.4~)
       golang-github-aws-aws-sdk-go-v2-dev (>= 1.41.5~)
       golang-github-cloudsoda-go-smb2-dev (>= 0.0~20250228.d4c70e6~)
       golang-github-dropbox-dropbox-sdk-go-unofficial-dev (>= 6.0.5~)
       golang-github-go-chi-chi-dev (>= 5.2.5~)
       golang-github-hanwen-go-fuse-dev (>= 2.9.0~)
       golang-github-klauspost-compress-dev (>= 1.18.5~)
       golang-github-mattn-go-colorable-dev (>= 0.1.14~)
       golang-github-ncw-swift-v2-dev (>= 2.0.5~)
       golang-github-pkg-sftp-dev (>= 1.13.10~)
       golang-github-rfjakob-eme-dev (>= 1.2.0~)
       golang-github-shirou-gopsutil-dev (>= 4.26.3~)
       golang-github-spf13-cobra-dev (>= 1.10.2~)
       golang-github-spf13-pflag-dev (>= 1.0.10~)
       golang-github-stretchr-testify-dev (>= 1.11.1~)
       golang-github-t3rm1n4l-go-mega-dev (>= 0.0~git20251120.6845944~)
       golang-golang-x-text-dev (>= 0.37.0~)
       golang-google-api-dev (>= 0.275.0~)
       golang-github-golang-jwt-jwt-dev (>= 5.0.0+really4.5.2~)
     - removed Dependencies no longer required
       golang-github-djherbis-times-dev
       golang-github-henrybear327-go-proton-api-dev
       golang-github-henrybear327-proton-api-bridge-dev
       golang-github-hirochachacha-go-smb2-dev
       golang-github-iguanesolutions-go-systemd-dev
       golang-github-go-chi-chi-dev
       golang-github-ncw-go-acd-dev
       golang-github-nsf-termbox-go-dev
       golang-github-okzk-sdnotify-dev
       golang-github-pkg-errors-dev
       golang-github-pkg-sftp-dev
       golang-github-pkg-xattr-dev
       golang-github-protonmail-go-crypto-dev
       golang-github-rclone-ftp-dev
       golang-github-sevlyar-go-daemon-dev
       golang-github-sirupsen-logrus-dev
       golang-golang-x-oauth2-google-dev
       golang-gopkg-yaml.v2-dev
   * update Depends: golang-bazil-fuse-dev (>= 0.0~git20230120.62a210f~)
     Closes: #1150418
   * update DH_GOLANG_INSTALL_EXTRA installing extra files required
     during build
   * enable iclouddrive backend: remove iclouddrive skips in
     disable_backend_file.patch
 .
   [ Marcos Talau ]
   * debian/salsa-ci.yml: Add to provide CI tests for Salsa
   * Enable Salsa CI using default template
Checksums-Sha1:
 71df31c0ff87c5c2249311297653e77477815f1d 5507 rclone_1.75.2-2.dsc
 b205fd5072c7fe68f06a58cad150b0cd22a64e0e 27984 rclone_1.75.2-2.debian.tar.xz
 bc4d08702e89ecf4460d8f12ed3b519c556d4e32 27302 rclone_1.75.2-2_amd64.buildinfo
Checksums-Sha256:
 2f70f4ed51dbd20bc8772b1621a2b0bac760cea032b531c38c91d3883dd34670 5507 rclone_1.75.2-2.dsc
 5c45ec7749cbd921cefbeaff2cc86e779afd0df92f05539adea95b8ad30afb61 27984 rclone_1.75.2-2.debian.tar.xz
 eef476407cb26d3a92bb25992087a3faa2a51a945afe6d950e719615ab7056ef 27302 rclone_1.75.2-2_amd64.buildinfo
Files:
 735dbf44246caccf46af936a76fda4e8 5507 net optional rclone_1.75.2-2.dsc
 c5f89030d94fbda8a2ff3f348abe2c91 27984 net optional rclone_1.75.2-2.debian.tar.xz
 4aae5205fa8ae7e5fb32bd49b59d8599 27302 net optional rclone_1.75.2-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEI8mpPlhYGekSbQo2Vz7x5L1aAfoFAmrZYzsACgkQVz7x5L1a
AfqmSw/+Jzt1tTuFRR5mQ4W6nH+E+AadrhKZCbY2IynyUkDzAtGSSkkaF2nqhlGh
Vize2Cp9HEdeFpQFSZ5wn77TGvXMD3CST8MJgx5OKKiniqDNPthTUVMsk5OwWAYo
ml5C0WFTxWkJPLg4gqz0/LqsfUoC20T5C4CBM3OQLBzXTC+3S7JmOtV71sGwOM9O
DwfPjiQ29g0f+urhIdU67aU3Ik8BHMdXOjIApghCncXHJG8kAwzPx4wouunfiZpk
YjBiix4cyfEL4kcqCo3KdvnBPFLfZaGeBPo2qcbARyGXpXK4eUQuWBtKyEiGacJs
8rbN9zukoocjwuLzcTihzXjqPhhKdmL5YW9vWVoXBmLKbxqgJp3uOcCyxzMBuNsg
j6NinbAELNh891OX559lcqJ+6ThZX8BFzcW36c/O1Q7eNceJftjTWtvBpmvll+EU
jezJrCcd6dcZ/rmHFPyjOoiTxQZ0BCyGTPWmksO3bWdKTg/isdH1rVMadB08a/bF
v1umw3udYgrm/+7d+zPtuWSD0lbvjge86AEOfvMYByn480cfUutf3S1jxReUf0aK
w+h7kEglz5fkNnRx7PncBGh71dZP3HVktCJ7VP4Q8LSHBPwVzrWB7ClX3ok6bq0u
8UUiFeVIBPsZfaDTVipwD7uWT28UUTx+ncWIRbjzW2Byfy9KJEw=
=6v+V
-----END PGP SIGNATURE-----