Since updating rsync a few weeks ago, I've been getting this error. I'm hosting a gentoo mirror and it's split into 2 parts ("releases" dir is symlinked into a different file system). Syncing the mirror was working fine before, but the new rsync is not updating files correctly through the symlink anymore (with -K). I found that the same issue has been reported upstream (see the provided URL). Wonder if it's possible to patch this until they fix it properly. Reproducible: Always Steps to Reproduce: See upstream issue Actual Results: "failed verification -- update discarded" errors for various files. It appears to affect only modified files, not new or deleted files. Expected Results: No error (yeah yeah, old profile...) # emerge --info !!! Your current profile is deprecated and not supported anymore. !!! Use eselect profile to update your profile. !!! Please upgrade to the following profile if possible: default/linux/amd64/23.0/split-usr To upgrade do the following steps: A profile upgrade to version 23.0 is available for your architecture. The new 23.0 profiles enable some toolchain hardening features and performance enhancements by default, and standardize settings. You can find the list of changes on the wiki tracking page [1]. Upgrade instructions Note 1: If you have manually changed your CHOST to a value different from what the stages and profiles set, you may have to do that in the future too. In that case you should know what you are doing, hopefully; please read the instructions with a critical eye then. Note 2: In case you are already familiar with binary packages, you should be able to add "--getbinpkg" to the emerge calls to speed things up. The use of binary packages is completely optional though, and also not as much tested as the source-based upgrade path yet. 1. Ensure your system backups are up to date. Please also update your system fully and depclean before proceeding. glibc older than 2.36 and musl older than 1.2.4 is not supported anymore. 2. If you are still using one of the long-deprecated amd64 17.0 profiles (other than x32 or musl), then first complete the migration to the corresponding 17.1 profile. Instructions can be found at [3]. 3. If you are currently using systemd in a split-usr configuration, then first complete the migration to the corresponding merged-usr profile of the same profile version. Details on how to do this can be found in the news item [4]. If you are currently using openrc, migrate to 23.0 first, keeping your disk layout. If you want to move from split-usr to merged-usr, do that afterwards. 4. Run "emerge --info" and note down the value of the CHOST variable. 5. Edit /etc/portage/make.conf; if there is a line defining the CHOST variable, remove it. Also delete all lines defining CHOST_... variables. 6. Select the 23.0 profile corresponding to your current profile, either using "eselect profile" or by manually setting the profile symlink. Note that old profiles are by default split-usr and the 23.0 profiles by default merged-usr. Do NOT change directory scheme now, since this will mess up your system! Instead, make sure that the new profile has the same property: for example, OLD default/linux/amd64/17.1 ==> NEW default/linux/amd64/23.0/split-usr (added "split-usr") OLD default/linux/amd64/17.1/systemd/merged-usr ==> NEW default/linux/amd64/23.0/systemd (removed "merged-usr") A detailed table of the upgrade paths can be found at [5]. Please consult it. In some cases (hppa, x86) the table will tell you to pick between two choices. What you need should be obvious from your *old* CHOST value (from step 4). 7. Delete the contents of your binary package cache at ${PKGDIR} rm -r /var/cache/binpkgs/* 8. In the file or directory /etc/portage/binrepos.conf (if existing), update the URI in all configuration such that they point to 23.0 profile binhost directories. The exact paths can be found in the table at [5], too. 9. Rebuild or reinstall from binary (if available) the following packages in this order, with the same version as already active: emerge --ask --oneshot sys-devel/binutils (you may have to run binutils-config and re-select your binutils now) emerge --ask --oneshot sys-devel/gcc (IMPORTANT: If this command wants to rebuild glibc first, do *not* let it do that; instead, abort and try again with --nodeps added to the command line.) (you may have to run gcc-config and re-select your gcc now) and the C library, i.e. for glibc-based systems emerge --ask --oneshot sys-libs/glibc or for musl-based systems emerge --ask --oneshot sys-libs/musl 10. Re-run "emerge --info" and check if CHOST has changed compared to step 4. If the CHOST has NOT changed, skip to step 13 (env-update). Otherwise, 11. Recheck with binutils-config and gcc-config that valid installed versions of binutils and gcc are selected. 12. Check /etc/env.d, /etc/env.d/binutils, and /etc/env.d/gcc for files that refer to the *OLD* CHOST value, and remove them. Examples how to do this can be found in the similar procedure at [6]. 13. Run env-update && source /etc/profile 14. Re-emerge libtool: emerge --ask --oneshot libtool 15. Just for safety, delete the contents of your binary package cache at ${PKGDIR} again: rm -r /var/cache/binpkgs/* 16. Rebuild world: emerge --ask --emptytree @world [1] https://wiki.gentoo.org/wiki/Project:Toolchain/23.0_profile_transition [2] https://wiki.gentoo.org/wiki/Project:Toolchain/23.0_profile_timeline [3] https://www.gentoo.org/support/news-items/2019-06-05-amd64-17-1-profiles-are-now-stable.html [4] https://www.gentoo.org/support/news-items/2022-12-01-systemd-usrmerge.html [5] https://wiki.gentoo.org/wiki/Project:Toolchain/23.0_update_table [6] https://wiki.gentoo.org/wiki/Changing_the_CHOST_variable#Verifying_things_work Portage 3.0.66.1 (python 3.12.7-final-0, default/linux/amd64/17.1, gcc-13, glibc-2.40-r5, 5.15.41-gentoo x86_64) ================================================================= System uname: Linux-5.15.41-gentoo-x86_64-Intel-R-_Core-TM-_i3_CPU_550_@_3.20GHz-with-glibc2.40 KiB Mem: 8143380 total, 812432 free KiB Swap: 5847648 total, 5809700 free Timestamp of repository gentoo: Wed, 29 Jan 2025 14:00:00 +0000 Head commit of repository gentoo: aa3e477897014e4a9bb374fb39e30f81b74929dc sh bash 5.2_p37 ld GNU ld (Gentoo 2.42 p6) 2.42.0 app-misc/pax-utils: 1.3.7::gentoo app-shells/bash: 5.2_p37::gentoo dev-build/autoconf: 2.71-r7::gentoo dev-build/automake: 1.15.1-r2::gentoo, 1.16.5-r2::gentoo dev-build/cmake: 3.30.5::gentoo dev-build/libtool: 2.4.7-r4::gentoo dev-build/make: 4.4.1-r100::gentoo dev-build/meson: 1.5.2::gentoo dev-java/java-config: 2.3.4::gentoo dev-lang/perl: 5.40.0::gentoo dev-lang/python: 3.10.15_p1::gentoo, 3.11.10_p1::gentoo, 3.12.7_p1::gentoo, 3.13.0::gentoo dev-lang/rust-bin: 1.81.0-r100::gentoo llvm-core/llvm: 14.0.4::gentoo, 17.0.6::gentoo sys-apps/baselayout: 2.17::gentoo sys-apps/openrc: 0.54.2::gentoo sys-apps/sandbox: 2.39::gentoo sys-devel/binutils: 2.42-r2::gentoo sys-devel/binutils-config: 5.5.2::gentoo sys-devel/gcc: 11.3.0::gentoo, 13.2.1_p20240210::gentoo sys-devel/gcc-config: 2.11::gentoo sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers) sys-libs/glibc: 2.40-r5::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 volatile: True sync-rsync-verify-metamanifest: yes sync-rsync-verify-jobs: 1 sync-rsync-extra-opts: -4 sync-rsync-verify-max-age: 3 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /var/bind" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -pipe -march=native" DISTDIR="/usr/portage/distfiles" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg-live config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync merge-wait multilib-strict network-sandbox news parallel-fetch pid-sandbox pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="/storage/gentoo/distfiles http://ftp.jaist.ac.jp/pub/Linux/Gentoo/" LANG="en_US.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LEX="flex" MAKEOPTS="-j3" PKGDIR="/var/cache/binpkgs" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_EXTRA_OPTS="-4" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/mnt/md1/tmp/portage" SHELL="/bin/zsh" USE="acl amd64 bzip2 cdda cdio cjk cli crypt dovecot-sasl dri dvd elogind extensions gcj gdbm hal iconv icu ipv6 java javascript jpeg libtirpc managesieve mp3 multilib ncurses nls opengl openmp pam pcre png ppds qt3support readline samba seccomp semantic-desktop sieve split-usr sql sqlite ssl svg symlink test-rust threads truetype unicode usb vhosts webkit xattr zlib zsh-completion" ABI_X86="64" ADA_TARGET="gcc_13" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 sse3 sse4_1 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GUILE_SINGLE_TARGET="3-0" GUILE_TARGETS="3-0" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6" POSTGRES_TARGETS="postgres16" PYTHON_SINGLE_TARGET="python3_12" PYTHON_TARGETS="python3_12" RUBY_TARGETS="ruby32" VIDEO_CARDS="intel" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account" Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EMERGE_DEFAULT_OPTS, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, LINGUAS, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PYTHONPATH, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS
Unfortunately, this is indeed a consequence of the vulnerability fixes for bug 948106.
Found a workaround: using a bind mount instead of a symlink (no -K needed)
