corrections and release plan
corrections and release plan
Posted Jun 5, 2026 9:32 UTC (Fri) by tridge (subscriber, #26906)In reply to: corrections and release plan by rrolls
Parent article: Tridgell: rsync and outrage
Hi rrols,
Good questions delivered without vitriol, thank you!
The old test suite was unfortunately not fit for purpose. It was OK when rsync was developing slowly and not dealing with the mass influx of issues that the AI scanners have generated. It was quickly becoming a hindrance to me. For a start it did a poor job of checking that the result of an rsync operation was exactly what was expected. It is quite hard in shell syntax to check things that carefully but easy in python. It was also slow, and I'm running the test suite many hundreds of times a day now, across a fleet of VMs at home plus in CI. The new test suite is designed from the ground up to be parallel, and on my 24 core laptop I can run many instances of it at once when validating different trees.
The first cut of the test suite was a faithful translation from shell to python of the old tests, including all of its issues. Since then I've built on it a lot, driven by gcov coverage and ensuring that every single option in rsync and rsyncd.conf is tested. Keeping the old suite around would have been quite painful for development.
One thing the community is not seeing is the huge number of pending issues I'm still working on. The CVEs in 3.4.3 was just the tip of the iceberg. At the time of release it covered every security issue I knew of. I now pine for those days as I see the much larger pile of issues that have flowed in over the last couple of weeks.
The old binaries in the tree are something I've wanted to do for a while now. The previous approach to tacking the issue of backwards compatibility with an eclectic (to put it politely) protocol like rsync is to ask the new version to use an old protocol revision. That helps, but it isn't really the solid evidence that the new version does work with an old build that we want. The binaries are only used in the CI tests (you can easily verify this for yourself with a quick git grep) so there is no way that they can introduce issues outside of that simple CI test. Rebuilding the old binaries is quite tricky due to changes in compilers, libraries etc, and doing that in each build would be a pain and just wouldn't win anything.
As to why the sudden jump in development, it's all down to the AI security scanners. Most people who use LLMs casually have no idea what is actually happening in the world of AI for security. The little chat prompts one has with chatgpt or claude are a joke compared to true AI driven security scans. I just ran a scan on rsync master that took over 6 hours of continuous running and produced an enormous report that I am still working my way through. If you have experience with AIs in "normal" use then I'm afraid that gives you not the slightest inkling of what the new security scan systems are doing now. All of this only became possible in the last few weeks. We're on a different planet now when it comes to IT security and people like me are learning to adapt quickly.
As to validating who I am, you could trust the lwn.net login system I suppose! Surely that is utterly reliable :-)
Or you could send me an email at rsync.project@gmail.com and ask me to send a reply signed with the GPG key that is linked back a long way and co-signed by people who know me.
Cheers, Tridge
Good questions delivered without vitriol, thank you!
The old test suite was unfortunately not fit for purpose. It was OK when rsync was developing slowly and not dealing with the mass influx of issues that the AI scanners have generated. It was quickly becoming a hindrance to me. For a start it did a poor job of checking that the result of an rsync operation was exactly what was expected. It is quite hard in shell syntax to check things that carefully but easy in python. It was also slow, and I'm running the test suite many hundreds of times a day now, across a fleet of VMs at home plus in CI. The new test suite is designed from the ground up to be parallel, and on my 24 core laptop I can run many instances of it at once when validating different trees.
The first cut of the test suite was a faithful translation from shell to python of the old tests, including all of its issues. Since then I've built on it a lot, driven by gcov coverage and ensuring that every single option in rsync and rsyncd.conf is tested. Keeping the old suite around would have been quite painful for development.
One thing the community is not seeing is the huge number of pending issues I'm still working on. The CVEs in 3.4.3 was just the tip of the iceberg. At the time of release it covered every security issue I knew of. I now pine for those days as I see the much larger pile of issues that have flowed in over the last couple of weeks.
The old binaries in the tree are something I've wanted to do for a while now. The previous approach to tacking the issue of backwards compatibility with an eclectic (to put it politely) protocol like rsync is to ask the new version to use an old protocol revision. That helps, but it isn't really the solid evidence that the new version does work with an old build that we want. The binaries are only used in the CI tests (you can easily verify this for yourself with a quick git grep) so there is no way that they can introduce issues outside of that simple CI test. Rebuilding the old binaries is quite tricky due to changes in compilers, libraries etc, and doing that in each build would be a pain and just wouldn't win anything.
As to why the sudden jump in development, it's all down to the AI security scanners. Most people who use LLMs casually have no idea what is actually happening in the world of AI for security. The little chat prompts one has with chatgpt or claude are a joke compared to true AI driven security scans. I just ran a scan on rsync master that took over 6 hours of continuous running and produced an enormous report that I am still working my way through. If you have experience with AIs in "normal" use then I'm afraid that gives you not the slightest inkling of what the new security scan systems are doing now. All of this only became possible in the last few weeks. We're on a different planet now when it comes to IT security and people like me are learning to adapt quickly.
As to validating who I am, you could trust the lwn.net login system I suppose! Surely that is utterly reliable :-)
Or you could send me an email at rsync.project@gmail.com and ask me to send a reply signed with the GPG key that is linked back a long way and co-signed by people who know me.
Cheers, Tridge