28045,28049d
27898,27935d
27827,27833d
8999,9012d
8950,8961d
6931a
Package: gokr-rsync
Description-md5: e8a85d2e23c36ee64f7636d5032458dc
Description-en: rsync client and daemon, implemented in Go
 gokr-rsync is a native Go implementation of the rsync file transfer
 protocol, wire-compatible with the original tridge rsync (from the Samba
 project) and openrsync (used on OpenBSD and macOS 15+). It implements
 both client and server roles and can send or receive files in either
 direction.
 .
 The same gokr-rsync binary can run as:
  * a one-shot client, similar to rsync(1);
  * a server invoked by a remote rsync(1) client over SSH;
  * a standalone daemon, served either directly on port 873/tcp or
    wrapped in anonymous or authorized SSH.
 .
 On Linux, gokr-rsync sandboxes itself using the Landlock LSM,
 restricting filesystem access to only the source and destination paths
 involved in each transfer. When started as root in daemon mode, it
 additionally enters a mount namespace with the configured rsync modules
 bind-mounted read-only, chroots into it, and drops privileges. These
 layers limit the blast radius of bugs in the protocol handler.
 .
 Example systemd unit and socket files from upstream are installed under
 /usr/share/doc/gokr-rsync/examples/ as a starting point for running
 gokr-rsync as a hardened daemon (DynamicUser, RestrictNamespaces,
 system call filtering, etc.). They are not enabled by default; copy
 them into /etc/systemd/system/ and adjust ExecStart for your modules.
 .
 Note that this implementation is younger and less battle-tested than
 the C rsync from the Samba project; users are encouraged to verify
 their transfers and report discrepancies upstream.

.
6866,6882d
4401,4430d
2549,2556d
