Log message:
rsync: use pkgsrc zlib
rsync uses its bundled zlib unless
--with-included-zlib is set to no.
bump pkgrevision.

Log message:
rsync: Add an option for disabling ACL support

Log message:
rsync: REPLACE_SH needed on Solaris 10 according to pekdon

Log message:
net: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Not committed (merge conflicts...):

net/radsecproxy/distinfo

The following distfiles could not be fetched (fetched conditionally?):

./net/citrix_ica/distinfo citrix_ica-10.6.115659/en.linuxx86.tar.gz
./net/djbdns/distinfo dnscache-1.05-multiple-ip.patch
./net/djbdns/distinfo djbdns-1.05-test28.diff.xz
./net/djbdns/distinfo djbdns-1.05-ignoreip2.patch
./net/djbdns/distinfo djbdns-1.05-multiip.diff
./net/djbdns/distinfo djbdns-cachestats.patch

Log message:
net: Remove SHA1 hashes for distfiles

Log message:
rsync: fix CVE-2020-14387 using upstream patch.

Bump PKGREVISION.

Log message:
rsync: updated to 3.2.3

NEWS for rsync 3.2.3

Changes in this version:

BUG FIXES:

Fixed a bug in the xattr code that was freeing the wrong object when trying to \ 
cleanup the xattr list.

Fixed a bug in the xattr code that was not leaving room for the \ 
"rsync." prefix in some instances where it needed to be added.

Restored the ability to use ‑‑bwlimit=0 to specify no bandwidth limit. (It \ 
was accidentally broken in 3.2.2.)

Fix a bug when combining ‑‑delete-missing-args with ‑‑no-implied-dirs \ 
& ‑R where rsync might create the destination path of a missing arg. The \ 
code also avoids some superfluous warnings for nested paths of removed args.

Fixed an issue where hard-linked devices could cause the rdev_major value to get \ 
out of sync between the sender and the receiver, which could cause a device to \ 
get created with the wrong major value in its major,minor pair.

Rsync now complains about a missing ‑‑temp-dir before starting any file \ 
transfers.

A completely empty source arg is now a fatal error. This doesn't change the \ 
handling of implied dot-dir args such as "localhost:" and such.

ENHANCEMENTS:

Allow ‑‑max-alloc=0 to specify no limit to the alloc sanity check.

Allow ‑‑block-size=SIZE to specify the size using units (e.g. "100K").

The name of the id-0 user & group are now sent to the receiver along with \ 
the other user/group names in the transfer (instead of assuming that both sides \ 
have the same id-0 names).

Added the ‑‑stop-after=MINS and ‑‑stop-at=DATE_TIME options (with the \ 
‑‑time-limit=MINS option accepted as an alias for ‑‑stop-after). This is \ 
an enhanced version of the time-limit patch from the patches repo.

Added the name converter daemon parameter to make it easier to convert user \ 
& group names inside a chrooted daemon module. This is based on the \ 
nameconverter patch with some improvements, including a tweak to the request \ 
protocol (so if you used this patch in the past, be sure to update your \ 
converter script to use newlines instead of null chars).

Added ‑‑crtimes (‑N) option for preserving the file's create time (I \ 
believe that this is macOS only at the moment).

Added ‑‑mkpath option to tell rsync that it should create a non-existing \ 
path component of the destination arg.

Added ‑‑stderr=errors|all|client to replace the ‑‑msgs2stderr and \ 
‑‑no-msgs2stderr options (which are still accepted). The default use of \ 
stderr was changed to be ‑‑stderr=errors where all the processes that have \ 
stderr available output directly to stderr, which should help error messages get \ 
to the user more quickly, especially when doing a push (which includes local \ 
copying). This also allows rsync to exit quickly when a receiver failure occurs, \ 
since rsync doesn't need to try to keep the connection alive long enough for the \ 
fatal error to go from the receiver to the generator to the sender. The old \ 
default can be requested via ‑‑stderr=client. Also changed is that a \ 
non-default stderr mode is conveyed to the remote rsync (using the older option \ 
names) instead of requiring the user to use ‑‑remote-option (‑M) to tell \ 
the remote rsync what to do.

Added the ability to specify "@netgroup" names to the hosts allow and \ 
hosts deny daemon parameters. This is a finalized version of the netgroup-auth \ 
patch from the patches repo.

Rsync can now hard-link symlinks on FreeBSD due to it making ues of the linkat() \ 
function when it is available.

Output file+line info on out-of-memory & overflow errors while also avoiding \ 
the output of alternate build-dir path info that is not useful to the user.

Change configure to know that Cygwin supports Linux xattrs.

Improved the testsuite on FreeBSD & Cygwin.

Added some compatibility code for HPE NonStop platforms.

Improved the INSTALL.md info.

Added a few more suffixes to the default skip-compress list.

Improved configure's error handling to notify about several issues at once \ 
instead of one by one (for the newest optional features).

INTERNAL:

Use a simpler overflow check idiom in a few spots.

Use a C99 Flexible Array for a trailing variable-size filename in a struct (with \ 
a fallback to the old 1-char string kluge for older compilers).

Log message:
rsync: updated to 3.2.2

NEWS for rsync 3.2.2

BUG FIXES:

- Avoid a crash when a daemon module enables `transfer logging` without
  setting a `log format` value.

- Fixed installing rsync-ssl script from an alternate build dir.

- Fixed the updating of configure.sh from an alternate build dir.

- Apple requires the asm function name to begin with an underscore.

- Avoid a test failure in the daemon test when --atimes is disabled.

ENHANCEMENTS:

- Allow the server side to restrict checksum & compression choices via the
  same environment variables the client uses.  The env vars can be divided
  into "client list & server list" by the "`&`" char \ 
or the same list can
  apply to both.

- Simplify how the negotiation environment variables apply when interacting
  with an older rsync and also when a list contains only invalid names.

- Do not allow a negotiated checksum or compression choice of "none" unless
  the user authorized it via an environment variable or command-line option.

- Added the `--max-alloc=SIZE` option to be able to override the memory
  allocator's sanity-check limit.  It defaults to 1G (as before) but the error
  message when exceeding it specifically mentions the new option so that you
  can differentiate an out-of-memory error from a failure of this limit.  It
  also allows you to specify the value via the RSYNC_MAX_ALLOC environment
  variable.

- Add the "open atime" daemon parameter to allow a daemon to always \ 
enable or
  disable the use of O_NOATIME (the default is to let the user control it).

- The default systemd config was changed to remove the `ProtectHome=on`
  setting since rsync is often used to serve files in /home and /root and this
  seemed a bit too strict.  Feel free to use `systemctl edit rsync` to add
  that restriction (or maybe `ProtectHome=read-only`), if you like.  See the
  3.2.0 NEWS for the other restrictions that were added compared to 3.1.3.

- The memory allocation functions now automatically check for a failure and
  die when out of memory.  This eliminated some caller-side check-and-die
  code and added some missing sanity-checking of allocations.

- Put optimizations into their own list in the `--version` output.

- Improved the man page a bit more.

PACKAGING RELATED:

- Prepared the checksum code for an upcoming xxHash release that provides new
  XXH3 (64-bit) & XXH128 (128-bit) checksum routines.  These will not be
  compiled into rsync until the xxhash v0.8.0 include files are installed on
  the build host, and that release is a few weeks away at the time this was
  written.  So, if it's now the future and you have packaged and installed
  xxhash-0.8.0-devel, a fresh rebuild of rsync 3.2.2 will give you the new
  checksum routines.  Just make sure that the new rsync package depends on
  xxhash >= 0.8.0.

DEVELOPER RELATED:

- Moved the version number out of configure.ac into its own version.h file so
  that we don't need to reconfigure just because the version number changes.

- Moved the daemon parameter list into daemon-parm.txt so that an awk script
  can create the interrelated structs and accessors that loadparm.c needs.

Log message:
rsync: updated to 3.2.1

NEWS for rsync 3.2.1 (22 Jun 2020)

Protocol: 31 (unchanged)

Changes since 3.2.0:

BUG FIXES:

Fixed a potential build issue with the MD5 assembly-language code by removing \ 
some non-portable directives.

Use the preprocessor with the asm file to ensure that if the code is unneeded, \ 
it doesn't get built.

Avoid the stack getting set to executable when including the asm code.

Some improvements in the SIMD configure testing to try to avoid build issues, \ 
such as avoiding a clang++ core dump when ‑g is combined with ‑O2. Note that \ 
clang++ is quite buggy in this area, and it does still crash for some folks, so \ 
just use ‑‑disable-simd if you need to avoid their buggy compiler (since the \ 
configure test is apparently not finding all the compilers that will to crash \ 
and burn).

Fixed an issue in the md2man script when building from an alternate dir.

Disable ‑‑atimes on macOS (it apparently just ignores the atime change).

ENHANCEMENTS:

The use of ‑‑backup-dir=STR now implies ‑‑backup.

Added ‑‑zl=NUM as a short-hand for ‑‑compress-level=NUM.

Added ‑‑early-input=FILE option that allows the client to send some data to \ 
a daemon's (optional) "early exec" script on its stdin.

Mention atimes in the capabilities list that ‑‑version outputs.

Mention either "default protect-args" or "optional \ 
protect-args" in the ‑‑version capabilities depending on how rsync was \ 
configured.

Some info on optimizations is now elided from the ‑‑version capabilities \ 
since they aren't really user-facing capabilities. You can still see the info \ 
(plus the status of a couple extra optimizations) by repeating the ‑‑version \ 
option (e.g. ‑VV).

Updated various URLs to be https instead of http.

Some documentation improvements.

PACKAGING RELATED:

If you had to use ‑‑disable-simd for 3.2.0, you might want to try removing \ 
that and see if it will succeed or auto-disable. Some buggy clang++ compilers \ 
are still not auto disabled, though.

The MD5 asm code is now under its own configure flag (not shared with the SIMD \ 
setting), so if you have any issues compiling it, re-run configure with \ 
‑‑disable-asm.

Merged the OLDNEWS.md file into NEWS.md.

NEWS for rsync 3.2.0 (19 Jun 2020)

Protocol: 31 (unchanged)

Changes since 3.1.3:

BUG FIXES:

Avoid a potential out-of-bounds read in daemon mode if argc can be made to become 0.

Fix the default list of skip-compress files for non-daemon transfers.

Fix xattr filter rules losing an 'x' attribute in a non-local transfer.

Avoid an error when a check for a potential fuzzy file happens to reference a \ 
directory.

Make the atomic-rsync helper script have a more consistent error-exit.

Make sure that a signal handler's use of exit_cleanup() calls _exit() instead of \ 
exit().

Various zlib fixes, including security fixes for CVE-2016-9843, CVE-2016-9842, \ 
CVE-2016-9841, and CVE-2016-9840.

Fixed an issue with ‑‑remove-source-files not removing a source symlink when \ 
combined with ‑‑copy-links.

Fixed a bug where the daemon would fail to write early fatal error messages to \ 
the client, such as refused or unknown command-line options.

Fixed the block-size validation logic when dealing with older protocols.

Some rrsync fixes and enhancements to handle the latest options.

Fixed a problem with the ‑‑link-dest|‑‑copy-dest code when ‑‑xattrs \ 
was specified along with multiple alternate-destination directories (it could \ 
possibly choose a bad file match while trying to find a better xattr match).

Fixed a couple bugs in the handling of files with the ‑‑sparse option.

Fixed a bug in the writing of the batch.sh file (w/‑‑write-batch) when the \ 
source & destination args were not last on the command-line.

Avoid a hang when an overabundance of messages clogs up all the I/O buffers.

Fixed a mismatch in the RSYNC_PID values put into the environment of pre-xfer \ 
exec and a post-xfer exec.

Fixed a crash in the ‑‑iconv code.

Fixed a rare crash in the popt_unalias() code.

ENHANCEMENTS:

Various checksum enhancements, including the optional use of openssl's MD4 & \ 
MD5 checksum algorithms, some x86-64 optimizations for the rolling checksum, \ 
some x86-64 optimizations for the (non-openssl) MD5 checksum, the addition of \ 
xxHash checksum support, and a negotiation heuristic that ensures that it is \ 
easier to add new checksum algorithms in the future. The environment variable \ 
RSYNC_CHECKSUM_LIST can be used to customize the preference order of the \ 
negotiation, or use ‑‑checksum-choice (‑‑cc) to force a choice.

Various compression enhancements, including the addition of zstd and lz4 \ 
compression algorithms and a negotiation heuristic that picks the best \ 
compression option supported by both sides. The environment variable \ 
RSYNC_COMPRESS_LIST can be used to customize the preference order of the \ 
negotiation, or use ‑‑compress-choice (‑‑zc) to force a choice.

Added a ‑‑debug=NSTR option that outputs details of the new negotiation \ 
strings (for checksums and compression). The first level just outputs the result \ 
of each negotiation on the client, level 2 outputs the values of the strings \ 
that were sent to and received from the server, and level 3 outputs all those \ 
values on the server side too (when the server was given the debug option).

The ‑‑debug=OPTS command-line option is no longer auto-forwarded to the \ 
remote rsync which allows for the client and server to have different levels of \ 
debug specified. This also allows for newer debug options to be specified, such \ 
as using ‑‑debug=NSTR to see the negotiated hash result, without having the \ 
command fail if the server version is too old to handle that debug item. Use \ 
‑M‑‑debug=OPTS to send the options to the remote side.

Added the ‑‑atimes option based on the long-standing patch (just with some \ 
fixes that the patch has been needing).

Added ‑‑open-noatime option to open files using O_NOATIME.

Added the ‑‑write-devices option based on the long-standing patch.

Added openssl & preliminary gnutls support to the rsync-ssl script, which is \ 
now installed by default. This was unified with the old stunnel-rsync helper \ 
script to simplify packaging. Note that the script accepts the use of \ 
‑‑type=gnutls for gnutls testing, but does not look for gnutls-cli on the \ 
path yet. The use of ‑‑type=gnutls will not work right until gnutls-cli no \ 
longer drops data.

Rsync was enhanced to set the RSYNC_PORT environment variable when running a \ 
daemon-over-rsh script. Its value is the user-specified port number (set via \ 
‑‑port or an rsync:// URL) or 0 if the user didn't override the port.

Added the proxy protocol daemon parameter that allows your rsyncd to know the \ 
real remote IP when it is setup behind a proxy.

Added negated matching to the daemon's refuse options setting by using match \ 
strings that start with a ! (such as !compress*). This lets you refuse all \ 
options except for a particular approved list, for example. It also lets rsync \ 
refuse certain options by default (such as write-devices) while allowing the \ 
config to override that, as desired.

Added the early exec daemon parameter that runs a script before the transfer \ 
parameters are known, allowing some early setup based on module name.

Added status output in response to a signal (via both SIGINFO & SIGVTALRM).

Added ‑‑copy-as=USER option to give some extra security to root-run rsync \ 
commands into/from untrusted directories (such as backups and restores).

When resuming the transfer of a file in the ‑‑partial-dir, rsync will now \ 
update that partial file in-place instead of creating yet another tmp file copy. \ 
This requires both sender & receiver to be at least v3.2.0.

Added support for RSYNC_SHELL & RSYNC_NO_XFER_EXEC environment variables \ 
that affect the early, pre-xfer, and post-xfer exec rsync daemon parameters.

Optimize the ‑‑fuzzy ‑‑fuzzy heuristic to avoid the fuzzy directory scan \ 
until all other basis-file options are exhausted (such as ‑‑link-dest).

Have the daemon log include the normal-exit sent/received stats when the \ 
transfer exited with an error when possible (i.e. if it is the sender).

The daemon now locks its pid file (when configured to use one) so that it will \ 
not fail to start when the file exists but no daemon is running.

Various man page improvements, including some html representations (that aren't \ 
installed by default).

Made ‑V the short option for ‑‑version and improved its information.

Pass the ‑4 or ‑6 option to the ssh command, making it easier to type than \ 
‑‑rsh='ssh ‑4' (or the ‑6 equivalent).

Added example config for rsyncd SSL proxy configs to rsyncd.conf.

More errors messages now mention if the error is coming from the sender or the \ 
receiver.

PACKAGING RELATED:

Add installed binary: /usr/bin/rsync-ssl

Add installed man page: /usr/man/man1/rsync-ssl.1

Tweak auxiliary doc file names, such as: README.md, INSTALL.md, & NEWS.md.

The rsync-ssl script wants to run openssl or stunnel4, so consider adding a \ 
dependency for one of those options (though it's probably fine to just let it \ 
complain about being unable to find the program and let the user decide if they \ 
want to install one or the other).

If you packaged rsync + rsync-ssl + rsync-ssl-daemon as separate packages, the \ 
rsync-ssl package is now gone (rsync-ssl should be considered to be mainstream \ 
now that Samba requires SSL for its rsync daemon).

Add build dependency for liblz4-dev, libxxhash-dev, libzstd-dev, and libssl-dev. \ 
These development libraries will give rsync extra compression algorithms, extra \ 
checksum algorithms, and allow use of openssl's crypto lib for (potentially) \ 
faster MD4/MD5 checksums.

Add build dependency for g++ or clang++ on x86_64 systems to enable the SIMD \ 
checksum optimizations.

Add build dependency for either python3-cmarkcfm or python3-commonmark to allow \ 
for patching of man pages or building a git release. This is not required for a \ 
release-tar build, since it comes with pre-built man pages. Note that cmarkcfm \ 
is faster than commonmark, but they generate the same data. The commonmark \ 
dependency is easiest to install since it's native python, and can even be \ 
installed via pip3 install ‑‑user commonmark if you want to just install it \ 
for the build user.

Remove yodl build dependency (if it was even listed before).

DEVELOPER RELATED:

Silenced some annoying warnings about major() & minor() by improving an \ 
autoconf include-file check.

Converted the man pages from yodl to markdown. They are now processed via a \ 
simple python3 script using the cmarkgfm or commonmark library. This should make \ 
it easier to package rsync, since yodl has gotten obscure.

Improved some configure checks to work better with strict C99 compilers.

Some perl building/packaging scripts were recoded into awk and python3.

Some defines in byteorder.h were changed into static inline functions that will \ 
help to ensure that the args don't get evaluated multiple times on "careful \ 
alignment" hosts.

Some code typos were fixed (as pointed out by a Fossies run).

Log message:
all: migrate homepages from http to https

pkglint -r --network --only "migrate"

As a side-effect of migrating the homepages, pkglint also fixed a few
indentations in unrelated lines. These and the new homepages have been
checked manually.