Bug 13669

Summary: build rsync with system zlib (was: external zlib breaks compatibility with rsync-3.1.1)
Product: Mageia Reporter: Atilla ÖNTAŞ <tarakbumba>
Component: RPM PackagesAssignee: All Packagers <pkg-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: Normal CC: ngompa13, pkg-bugs, thierry.vignaud
Version: Cauldron   
Target Milestone: ---   
Hardware: All   
OS: Linux   
See Also: https://bugzilla.samba.org/show_bug.cgi?id=10677
https://bugzilla.samba.org/show_bug.cgi?id=10332
https://bugzilla.samba.org/show_bug.cgi?id=10372
https://bugzilla.redhat.com/show_bug.cgi?id=1043965
Whiteboard:
Source RPM: rsync-3.1.1-1.mga5.src.rpm CVE:
Status comment:

Description Atilla ÖNTAŞ 2014-07-03 22:46:32 CEST 
Description of problem:
rsync 3.1.1 has two compress methods, "old" and "new". The old method (-z) depends on the internal modified zlib, while the new one (-zz) can use stock zlib.

Since Arch's rsync is built using "--with-included-zlib=no", the old compress method (-z) is unavailable, and attempting to use it results in this error:

"This rsync lacks old-style --compress due to its external zlib. Try -zz"
"Continuing without compression."

However, if I use -zz, it stops working with *older* rsync (backing up a server that has 3.1.0):

"rsync: on remote machine: --new-compress: unknown option"

Our Cauldron package is compiled with "--without-included-zlib" configure option by default. But with rsync-3.1.1 and newer, we should use inclued zlib to get backwards compability. Otherwise, we' ll got pretty errors with servers which are used rsync < 3.1.0.

Version-Release number of selected component (if applicable):
rsync-3.1.1-1

Steps to Reproduce:
1. Use rsync with -z option you get first error output and compression is disabled.
2. Use -zz option and you'll get second error for remote server.


I'll fix this by enabling included zlib.

Reproducible: 

Steps to Reproduce:
Atilla ÖNTAŞ 2014-07-03 22:47:52 CEST

See Also: (none) => https://bugzilla.samba.org/show_bug.cgi?id=10677

Comment 1 Atilla ÖNTAŞ 2014-07-03 22:53:29 CEST 
Fixed in rsync-3.1.1-1.mga5 and submitted to repositories.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 2 David Walser 2014-07-03 22:59:52 CEST 
This violates policy.  We build against system libraries.  Isn't there a better solution for this problem?

Status: RESOLVED => REOPENED
Resolution: FIXED => (none)

Comment 3 Atilla ÖNTAŞ 2014-07-03 23:20:51 CEST 
(In reply to David Walser from comment #2)
> This violates policy.  We build against system libraries.  Isn't there a
> better solution for this problem?

Unfortunately, no. As you can see from the samba bug report, they suggest to use internal zlib. Until a solution comes out, we either use rsync without compression support or use internal zlib. Older rsync installations does not aware new -zz or new compression options.
Comment 4 Atilla ÖNTAŞ 2014-07-03 23:23:50 CEST 
(In reply to Atilla ÃNTAÅ from comment #3)
> (In reply to David Walser from comment #2)
> > This violates policy.  We build against system libraries.  Isn't there a
> > better solution for this problem?
> 
> Unfortunately, no. As you can see from the samba bug report, they suggest to
> use internal zlib. Until a solution comes out, we either use rsync without
> compression support or use internal zlib. Older rsync installations does not
> aware new -zz or new compression options.

Also, Fedora too enabled internal zlib. See:
http://pkgs.fedoraproject.org/cgit/rsync.git/tree/rsync.spec
Comment 5 Atilla ÖNTAŞ 2014-07-03 23:30:25 CEST 
(In reply to Atilla ÃNTAÅ from comment #4)
> (In reply to Atilla ÃNTAÅ from comment #3)
> > (In reply to David Walser from comment #2)
> > > This violates policy.  We build against system libraries.  Isn't there a
> > > better solution for this problem?
> > 
> > Unfortunately, no. As you can see from the samba bug report, they suggest to
> > use internal zlib. Until a solution comes out, we either use rsync without
> > compression support or use internal zlib. Older rsync installations does not
> > aware new -zz or new compression options.
> 
> Also, Fedora too enabled internal zlib. See:
> http://pkgs.fedoraproject.org/cgit/rsync.git/tree/rsync.spec

Also see:

https://bugzilla.samba.org/show_bug.cgi?id=10372

and

https://bugzilla.redhat.com/show_bug.cgi?id=1043965

It seems to me that we should wait until rsync-3.1.1 used wider before disabling internal zlib.
Comment 6 Samuel Verschelde 2015-05-19 20:20:27 CEST 
Keeping this bug report open with a new summary.

Summary: external zlib breaks compatibility with rsync-3.1.1 => build rsync with system zlib (was: external zlib breaks compatibility with rsync-3.1.1)
Status: REOPENED => NEW

Samuel Verschelde 2015-06-06 15:58:39 CEST

Target Milestone: --- => Mageia 6

Comment 7 Atilla ÖNTAŞ 2016-03-11 08:04:42 CET 
(In reply to Atilla ÃNTAÅ from comment #5)
> 
> Also see:
> 
> https://bugzilla.samba.org/show_bug.cgi?id=10372
> 
> and
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1043965
> 
> It seems to me that we should wait until rsync-3.1.1 used wider before
> disabling internal zlib.

Replyin myself. Is it time to disable internal zlib? What do you think? Also see:
https://bugzilla.redhat.com/show_bug.cgi?id=1102637 about this issue.
Comment 8 Marja Van Waes 2016-06-30 09:05:42 CEST 
CC'ing all packagers collectively because tarakbumba, the assignee, will be MIA for ± 11 weeks.

CC: (none) => pkg-bugs

Thierry Vignaud 2016-06-30 09:32:28 CEST

See Also: (none) => https://bugzilla.samba.org/show_bug.cgi?id=10332, https://bugzilla.samba.org/show_bug.cgi?id=10372, https://bugzilla.redhat.com/show_bug.cgi?id=1043965
CC: (none) => thierry.vignaud

Comment 9 Neal Gompa 2016-06-30 13:36:47 CEST 
I don't think it would be a good idea to disable the internal zlib. As a somewhat bad close-to-home example, distrib-coffee is using Mandriva 2010 to serve the mirror.

There are quite a few systems out there running older versions. It's likely going to be a long time before we could reasonably disable internal zlib... :(

CC: (none) => ngompa13

Samuel Verschelde 2016-10-10 22:18:23 CEST

Target Milestone: Mageia 6 => ---

Comment 10 Samuel Verschelde 2018-09-21 09:40:06 CEST 
Reassigning to all packagers collectively as the original maintainer is not available anymore (thanks for all your work Atilla!).

Assignee: tarakbumba => pkg-bugs

Comment 11 David Walser 2020-02-25 14:28:58 CET 
Well this was unfortunately "fixed" and as expected, it has caused security issues:
https://usn.ubuntu.com/4292-1/

Status: NEW => RESOLVED
Resolution: (none) => FIXED