After the release of the rsync 3.4.3 update, which fixed 6 vulnerabilities, regressions that disrupt previously used configurations have been noted. Additionally, the addition of approximately 50 changes prepared using the AI model Claude over the last two weeks has caused misunderstanding and dissatisfaction among users. Some users have linked the emergence of these regressions to the generation of low-quality vulnerability fixes using AI.
Some of the regressions in rsync 3.4.3:
- Incremental backup commands specifying multiple '--compare-dest' options started to fail with errors;
- Became
it's impossible to build rsync on systems with Linux kernels older than version 5.6 due to the invocation of the openat2 system call (commit 1, commit 2); - The 'host::module/path' format has stopped working (commit).
- Commands using the option
'--delete-missing-args' together with '--files-from' (commit) are no longer recognized. - During synchronization, errors about finding modtime_nsec values outside the permitted range began to appear.
- Builds on older versions of macOS were disrupted.
- The behavior of the '--link-dest' option has changed (commit).
- Crashes occurred when starting in the terminal multiplexer tmux.
Andrew Tridgell, founder of the Samba and rsync projects, who returned to maintain rsync two years ago and added the problematic commits, published a note explaining the current situation. According to Andrew, the rsync project faced a flood of vulnerability reports, many of which were generated by AI. In the release of rsync 3.4.3, the emergence of regressions became the price of eliminating vulnerabilities. Andrew consciously chose to fix the vulnerabilities, despite the fact that the fixes might disrupt some rare but valid use cases of rsync. Such scenarios were not covered by the old test suite and manual checks, so the regressions went unnoticed and will be addressed in the next release, 3.4.4.
The situation prompted Andrew to upgrade the test suite, implement code coverage checks, and establish testing within the continuous integration system across various platforms, along with conducting potential vulnerability analyses. As Andrew is nearly 60 years old and would prefer to sail on a yacht rather than spend his time patching vulnerabilities in rsync, he decided to bring in AI assistants for routine tasks amidst an avalanche of vulnerability reports. Andrew devised the architecture, testing plan, and structure for the new test suite, after which he used AI to generate it in Python, replacing the previously used test shell script. The development employed the Claude model with manual result checks and cross-verification in Codex and Gemini.
Source: opennet.ru
