Hostux/github.com_burnett01_rsync-deployments
1
0
Fork 1
mirror of https://github.com/Burnett01/rsync-deployments.git synced 2025-11-04 09:29:04 +01:00
Code Issues Projects Releases Packages Wiki Activity
119 commits 9 branches 15 tags 375 KiB
Commit graph

119 commits

This branch
This branch
All branches
Author SHA1 Message Date
Steven Agyekum
3cccb68511
Update SECURITY.md 2025-01-19 15:32:42 +01:00
Steven Agyekum
e642759b84
new version 7.0.2 (with rsync 3.4.0), deprecate old versions, remove dead links 
The latest rsync version 3.4.0 fixes a wide variety of CVE's:

CVE-2024-12084 -⁠ Heap Buffer Overflow in Checksum Parsing.

CVE-2024-12085 -⁠ Info Leak via uninitialized Stack contents defeats ASLR.

CVE-2024-12086 -⁠ Server leaks arbitrary client files.

CVE-2024-12087 -⁠ Server can make client write files outside of destination directory using symbolic links.

CVE-2024-12088 -⁠ -⁠-⁠safe-⁠links Bypass.

CVE-2024-12747 -⁠ symlink race condition.

See their press release: https://download.samba.org/pub/rsync/NEWS#3.4.0

The latest action version 7.0.2 is using rsync 3.4.0, so please use that.
 2025-01-19 15:29:07 +01:00
Steven Agyekum
76404482ea
always force-upgrade rsync to get the latest security upgrades 2025-01-19 15:19:29 +01:00
Steven Agyekum
d19dd4a0be
Merge pull request #68 from ilyabrin/patch-1 
Update README.md
 2024-09-22 11:35:23 +02:00
Ilya Brin
f825a1ed74
Update README.md 
added syntax highlighting
 2024-09-14 14:32:58 +03:00
Steven Agyekum
796cf0d5e4
Merge pull request #61 from Burnett01/release/7.0.1 
- Pin @JoshPiper [drinternet/rsync](https://github.com/JoshPiper/rsync-docker) image by SHA-256 hash rather than version.  (Immutability)
Added via #60 

The docker image of this action is now pinned to the specific SHA-256 hash of the version rather than just the version.
This means for the latest `drinternet/rsync:v1.4.4` the corresponding hash is `drinternet/rsync@sha256:15b2949838074bd93c49421c22380396a0cd53a322439e799ac87afcadcfe234`

Check for validation: https://hub.docker.com/layers/drinternet/rsync/v1.4.4/images/sha256-15b2949838074bd93c49421c22380396a0cd53a322439e799ac87afcadcfe234

With that, usage of this action is even more secure due to a consistent dependency chain of trust,
since changes accompanied by a docker image hash are immutable.

Thanks to @XComp
 2024-03-31 18:11:10 +02:00
Steven Agyekum
b2bc75ad2c
Merge pull request #60 from XComp/use-hash-instead-of-version-tag 
Use SHA instead of Docker version tag for base image to allow for consistent code execution.
 2024-03-31 17:50:56 +02:00
Steven Agyekum
93c0d7acae
upd: mention version 7.0.1 2024-03-30 10:49:50 +01:00
Steven Agyekum
13aa4f9f57
update year to 2024 2024-03-30 10:46:13 +01:00
Matthias Pohl
b16614048b
Use SHA instead of Docker version tag for base image to allow for consistent code execution. 2024-03-28 17:53:03 +01:00
Steven Agyekum
e1c5b900e9
Merge pull request #59 from Burnett01/release/7.0.0 
Release/7.0.0
 2024-03-06 15:06:24 +01:00
Steven Agyekum
93f02b856f
chore: adjust readme for release 7.0.0 2024-03-06 15:04:26 +01:00
Steven Agyekum
21c0e5a9d9
chore: mention latest Alpine 3.19.1 2024-03-06 14:33:58 +01:00
Steven Agyekum
c88a1dbded
chore: adjust for EOL, DEPRECATION and MAINTENANCE 2024-03-06 14:33:02 +01:00
Steven Agyekum
b9a68ac619
chore!: Versions 4.x EOL, 5.x DEPRECATED, 6.x MAINTENANCE 
- All versions 4.x are now EOL and no longer maintained
- All versions 5.x are now DEPRECATED and will become EOL within Q2 2024
- All versions  6.x are now MAINTENANCE and will become DEPRECATED within Q4 2024
 2024-03-06 12:35:07 +01:00
Steven Agyekum
f479c97783
chore: mention new legacy_allow_rsa_hostkeys option 2024-03-06 12:29:40 +01:00
Steven Agyekum
008719532f
feat: configuarable legacy RSA hostkeys support 
Ability to configure legacy rsa hostkeys support for
OpenSSH servers < 8.8.
Related to #24 and  9603fc8
 2024-03-06 12:20:39 +01:00
Steven Agyekum
9603fc8186
feat: Make usage of legacy rsa hostkeys conditional 
The usage of RSA host keys introduced with c7baefdc23 
was adjusted to make it conditional/configurable and to keep
backward compatibility
 2024-03-06 12:16:35 +01:00
Steven Agyekum
580c98fc2e
Merge pull request #58 from Burnett01/release/5.3 
Backmerge unofficial release/5.3 into new upcoming rlease/7.0.0
 2024-03-06 12:04:45 +01:00
Steven Agyekum
ee287eb1f0
feat: Update base image to latest 1.4.4 (apline 3.19.1) 2024-03-06 11:58:08 +01:00
Steven Agyekum
c04732dab2
added v6 as new major 2023-06-08 18:05:17 +02:00
Steven Agyekum
fb06973f0e
Merge pull request #45 from Burnett01/release/6.0.0 
Release/6.0.0
 2023-06-08 17:54:57 +02:00
Steven Agyekum
45d84ad5f6
New version 6.0.0 
- It is no longer possible to use an empty string as remote_path (Fixes #44) (Thanks to @maximilliangeorge)
- Updated checkout action in examples from v2 to v3
- Added disclaimer to media site-links
- Overall readme improvements
 2023-06-08 17:54:10 +02:00
Steven Agyekum
d732b39732
improved string empty check for remote_path 2023-06-08 17:35:29 +02:00
Steven Agyekum
570fd6bb52
fix empty string check 2023-06-08 17:27:31 +02:00
Steven Agyekum
bef106d127
validate remote_path is not empty 2023-06-08 17:23:41 +02:00
Steven Agyekum
b247bfd3af
versions correction 2023-06-01 11:49:29 +02:00
Steven Agyekum
f17a58e4ba
adjust readme with correct versions 2023-06-01 11:48:45 +02:00
Steven Agyekum
8bb79ee6b5
Merge pull request #42 from Burnett01/dependabot/docker/drinternet/rsync-v1.4.3 2023-04-01 17:59:03 +02:00
dependabot[bot]
b2007e683f
Bump drinternet/rsync from v1.4.2 to v1.4.3 
Bumps drinternet/rsync from v1.4.2 to v1.4.3.

---
updated-dependencies:
- dependency-name: drinternet/rsync
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-04-01 02:56:43 +00:00
Steven Agyekum
48dde0d741
Merge pull request #35 from Burnett01/dependabot/docker/drinternet/rsync-v1.4.2 
Bump drinternet/rsync from v1.4.1 to v1.4.2
 2022-12-11 20:22:59 +01:00
dependabot[bot]
4b36c0937b
Bump drinternet/rsync from v1.4.1 to v1.4.2 
Bumps drinternet/rsync from v1.4.1 to v1.4.2.

---
updated-dependencies:
- dependency-name: drinternet/rsync
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-09-01 02:03:49 +00:00
Steven Agyekum
2651e3eecb
Merge pull request #34 from Burnett01/release/5.2.1 
Release/5.2.1
 2022-08-01 18:02:21 +02:00
Steven Agyekum
a9c15493e0
mention version 5.2.1 2022-08-01 17:59:24 +02:00
Steven Agyekum
b107255845
Merge pull request #33 from Burnett01/dependabot/docker/drinternet/rsync-v1.4.1 
Bump drinternet/rsync from v1.4.0 to v1.4.1
 2022-08-01 17:50:38 +02:00
Steven Agyekum
d987a9a536
Merge pull request #32 from Burnett01/dependabot/docker/drinternet/rsync-v1.4.1 
Bump drinternet/rsync from v1.4.0 to v1.4.1
 2022-08-01 17:31:49 +02:00
dependabot[bot]
de20664c6e
Bump drinternet/rsync from v1.4.0 to v1.4.1 
Bumps drinternet/rsync from v1.4.0 to v1.4.1.

---
updated-dependencies:
- dependency-name: drinternet/rsync
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-08-01 02:08:20 +00:00
Steven Agyekum
d2a4efa87c
Update with suggestions from #31 
#31
 2022-07-30 10:19:44 +02:00
Steven Agyekum
a078b62820
Merge pull request #24 from jasongill/patch-1 
Re-allow RSA host keys with SSH
 2022-03-24 19:06:39 +01:00
Jason Gill
c7baefdc23
Allow RSA host keys 
RSA host keys are disabled by default on OpenSSH 8.8+ which is used by the base Alpine image, but many servers still use RSA host keys
 2022-03-02 12:29:53 -05:00
Steven Agyekum
9f40ee1996
version 3.0 is EOL (see #23) 2022-01-01 19:29:16 +01:00
Steven Agyekum
0dc935cdec
Merge pull request #23 from Burnett01/feature/maintenance-2022 
Version 5.2
 2022-01-01 19:16:33 +01:00
dependabot[bot]
4afbe87441
Bump drinternet/rsync from v1.3.0 to v1.4.0 (#22) 
Bumps drinternet/rsync from v1.3.0 to v1.4.0.

---
updated-dependencies:
- dependency-name: drinternet/rsync
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2022-01-01 19:07:48 +01:00
Steven Agyekum
6ae12186da
bump version to 5.2 in Readme 2022-01-01 19:07:03 +01:00
Steven Agyekum
4a950331e5
dropped support for 3.0 2022-01-01 19:02:50 +01:00
Steven Agyekum
057a69d147
Update LICENSE 2022-01-01 19:00:50 +01:00
Steven Agyekum
164dafd7fc
Create dependabot.yml 2021-09-01 12:47:46 +02:00
Steven Agyekum
b943ffe476
Release/v5.1 (#15) 
* update base image drinternet/rsync:v1.3.0

* Base Image updates:  alpine 3.14.1 latest

* use v5.1 in examples

* support for v5.x

* mention Alpine version
 2021-08-12 18:45:01 +02:00
Steven Agyekum
342e70b07e
Release/v5 (#13) 
* Reference JoshPiper/rsync-docker @ 1.1.0

* See: https://github.com/JoshPiper/rsync-docker/tree/1.1.0
* New features: Support passphrase protected keys

* supply SSH_PASS (key passphrase) to agent-add

Read more about the behavior: https://github.com/JoshPiper/rsync-docker#agent-askpass

* add new remote_key_pass config option

* Update README.md

* Update README.md

* 2.0 is EOL

* support 5.0, drop 2.0

* default to empty string

* reference JoshPiper/rsync-docker @ v1.2.0
 2021-08-02 21:57:01 +02:00
Steven Agyekum
a93a577f3f
add more blogs/media 2021-04-03 15:02:42 +02:00