DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: gokr-rsync 0.3.3-1

Package Information

Descriptionrsync client and daemon, implemented in Go

gokr-rsync is a native Go implementation of the rsync file transfer protocol, wire-compatible with the original tridge rsync (from the Samba project) and openrsync (used on OpenBSD and macOS 15+). It implements both client and server roles and can send or receive files in either direction.

The same gokr-rsync binary can run as: * a one-shot client, similar to rsync(1); * a server invoked by a remote rsync(1) client over SSH; * a standalone daemon, served either directly on port 873/tcp or wrapped in anonymous or authorized SSH.

On Linux, gokr-rsync sandboxes itself using the Landlock LSM, restricting filesystem access to only the source and destination paths involved in each transfer. When started as root in daemon mode, it additionally enters a mount namespace with the configured rsync modules bind-mounted read-only, chroots into it, and drops privileges. These layers limit the blast radius of bugs in the protocol handler.

Example systemd unit and socket files from upstream are installed under /usr/share/doc/gokr-rsync/examples/ as a starting point for running gokr-rsync as a hardened daemon (DynamicUser, RestrictNamespaces, system call filtering, etc.). They are not enabled by default; copy them into /etc/systemd/system/ and adjust ExecStart for your modules.

Note that this implementation is younger and less battle-tested than the C rsync from the Samba project; users are encouraged to verify their transfers and report discrepancies upstream.

MaintainerDebian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed BySamuel Henrique <samueloph@debian.org>
Sponsorsamueloph@debian.org
Distributionexperimental
Architectureany
VCSgit: https://salsa.debian.org/go-team/packages/rsync.git (browse)
Closes#1101076
Trackerhttps://tracker.debian.org/pkg/gokr-rsync
Uploaded2 months, 6 days ago

New Package Report

.changes
Sourcegokr-rsync
Version0.3.3-1
Changed-BySamuel Henrique
Architecturesource amd64
Distributionexperimental
DateSun, 31 May 2026 08:39:00 -0700
Changelog
gokr-rsync (0.3.3-1) experimental; urgency=medium
 .
   * Initial release (Closes: #1101076)
.dsc
Componentmain
Package-Listgokr-rsync deb net optional arch=any
Sectionnet
Priorityoptional
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: gokrazy/rsync
Upstream-Contact: Michael Stapelberg <michael@stapelberg.de>
 https://github.com/gokrazy/rsync/issues
Source: https://github.com/gokrazy/rsync

Files: *
Copyright: 2021-2026 The gokrazy authors
License: BSD-3-clause
Comment: Upstream uses the collective copyright statement
 "the gokrazy authors" (see the LICENSE file). The git history shows
 contributions from Michael Stapelberg, Joonas Loppi, Justin Hawkins,
 and others between 2021 and 2026.

Files: internal/rsyncopts/testdata/_tridge_rsync_dump_table.patch
Copyright: 1992-2001 Andrew Tridgell <tridge@samba.org>
           2000-2002 Martin Pool <mbp@samba.org>
           2002-2023 Wayne Davison <wayne@opencoder.net>
           2021-2026 The gokrazy authors
License: GPL-3+
Comment: This file is a small unified diff against rsync's main.c and
 options.c. The diff's context lines are unmodified extracts of rsync
 (https://rsync.samba.org/, packaged in Debian as src:rsync), which is
 licensed under the GNU General Public License version 3 or, at the
 user's option, any later version. The added hunks introduce a
 dump_long_options() helper used by gokrazy/rsync's option-parser
 tests; the patch as a whole is a derivative work of rsync and is
 therefore distributed under GPL-3+.
 .
 The rsync copyright holders and license terms applicable to main.c
 and options.c are reproduced verbatim from
 /usr/share/doc/rsync/copyright in Debian.

Files: debian/*
Copyright: 2025-2026 Samuel Henrique <samueloph@debian.org>
License: BSD-3-clause
Comment: The Debian packaging is licensed under the same terms as the
 upstream source.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above
      copyright notice, this list of conditions and the following
      disclaimer in the documentation and/or other materials provided
      with the distribution.
    * Neither the name of gokrazy nor the names of its contributors
      may be used to endorse or promote products derived from this
      software without specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-3+
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 3 of the License, or
 (at your option) any later version.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 You should have received a copy of the GNU General Public License
 along with this program; if not, see <https://www.gnu.org/licenses/>.
 .
 On Debian systems, the complete text of version 3 of the GNU General
 Public License can be found in "/usr/share/common-licenses/GPL-3".

Review Information

accepted — allocated to awm 2 months, 6 days ago, started 2 months, 6 days ago, completed 2 months, 6 days ago.

Final Comment

Back to Dashboard | View all reviews for this package