v4.2.13

blitcp 4.2.13

v4.2.10 was the last public release, so this one carries three versions of
work. Two of the changes below can stop a job that used to run — read them
before upgrading an automated task.

An ordinary local copy is unchanged. blitcp /src /dst without
--use-sudo behaves as it did in 4.2.10, symlinked destination directories
included.

• A symlinked directory inside the destination is refused when blitcp is
  elevated, and for every remote destination — pull, push or relay,
  elevated or not, on both SFTP and the tar-over-SSH transport.
• A destination that is itself a symlink is refused everywhere. Nothing is
  created on the far side at all.

A symlink that was already there is not consent: it is planted before the run,
because the attacker knows the run is coming. Name the real path instead — a
server that reaches /home through a link, as Synology does, needs the target
path written out.

• A pull over plain SSH now validates the tar members it extracts: traversal,
  symlink/device/hard-link members, symlinked ancestors, setuid/setgid.

• The tarfile filter fallback no longer falls through in silence.

• --use-sudo carries the credentials path through the re-exec, and checks it
  before carrying it.

• A run that refused every file could still be recorded as a success.

• An upload to an object store skipped files the destination did not have.

• A cloud download re-fetched everything, every time.

• --preserve owner, xattr and acl were dropped on every file on a
  reflink-capable filesystem (XFS reflink=1, btrfs, bcachefs, APFS).

• A pull dropped ownership in silence; an elevated pull left no audit trail.

• --log-file produced no file on four paths.

• A name an SMB share cannot store is now reported as refused, with its name.

• An HTTP URL naming a directory was turned into a file name; an HTTP download
  into an SMB directory could write the directory as a file.

• --smb-port was ignored.

Full notes: CHANGELOG.md

---

上一个公开发布版本是 v4.2.10，因此这一版包含三个版本的改动。下面有两项会让原本
能跑通的任务停下来——在升级自动化任务之前请先读。

普通的本地复制没有变化。 不带 --use-sudo 的 blitcp /src /dst 与 4.2.10
一致，包括目标中的符号链接目录。

• 提权运行时，目标中的符号链接目录会被拒绝，并且所有远程目标都适用——
  拉取、推送或中继，无论是否提权，SFTP 和 tar-over-SSH 两种传输都涵盖。
• 目标本身是符号链接时，在所有场景下都会被拒绝。 对端不会产生任何东西。

早就存在的符号链接并不等于同意：它是在运行之前被埋下的，因为攻击者知道这次运行
即将发生。请直接写出真实路径——像群晖（Synology）那样通过链接访问 /home 的
服务器，需要把目标路径本身写出来。

• 通过普通 SSH 的拉取现在会校验它解包的 tar 成员：路径穿越、符号链接/设备/硬链接
  成员、符号链接祖先目录、setuid/setgid 剥离。

• tarfile 过滤器的回退路径不再静默穿透。

• --use-sudo 会把凭据路径带过重新执行，并在带过去之前先做检查。

• 一次拒绝了所有文件的运行，仍可能被记录为成功。

• 上传到对象存储时，会跳过目标上并不存在的文件。

• 云端下载每次都重新拉取全部内容。

• 目标支持 reflink 时（XFS reflink=1、btrfs、bcachefs、APFS），
  --preserve owner、xattr 和 acl 对每个文件都被丢弃。

• 拉取会静默丢失属主信息；提权拉取没有留下审计痕迹。

• --log-file 在四条路径上不产生文件。

• SMB 共享无法保存的文件名，现在会被指名报告为「拒绝」。

• 指向目录的 HTTP URL 被当成文件名；下载到 SMB 目录的 HTTP 传输可能把目录写成文件。

• --smb-port 被忽略。

完整说明见 CHANGELOG.zh-CN.md