native: harden rsync and SSH transport

Update rsync to 3.5.0 and Go to 1.26.6. Bound SSH handshakes, pin
host-key types, and build 16 KB-aligned hardened executables.

1 files changed, 29 insertions, 7 deletions

diff --git a/rsh/build.sh b/rsh/build.sh
index a3b2cad..f91343a 100755
--- a/rsh/build.sh
+++ b/rsh/build.sh
@@ -9,9 +9,15 @@
 # build targets glibc's linker and will not exec on a phone.
 set -eu
 
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+# shellcheck source=versions
 . "$root/versions"
 
+command -v bash >/dev/null 2>&1 || {
+	echo "rsh: bash is required by the Android NDK compiler launchers" >&2
+	exit 1
+}
+
 # Locate the NDK toolchain.
 ndk=${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}
 if [ -z "$ndk" ] && [ -n "${ANDROID_HOME:-}" ]; then
@@ -34,28 +40,44 @@ if [ ! -d "$tc" ]; then
 	echo "rsh: NDK toolchain not found at $tc" >&2
 	exit 1
 fi
+output=
+trap 'if [ -n "$output" ]; then rm -f "$output"; fi' 0 1 2 3 15
 
+# -buildvcs=false as well as -trimpath: Go otherwise stamps the commit, the
+# commit time and a dirty flag into the binary, so the same source builds
+# differently depending on the checkout it was built from, or on whether git is
+# even installed. ci/verify-repro.sh cannot catch that, because it builds twice
+# from one tree.
 ldflags="-s -w -buildid="
+# NDK r27 needs both page-size flags for 16 KB Android devices.
+android_ldflags="$ldflags -extldflags=-Wl,-z,relro,-z,now,-z,noexecstack,-z,max-page-size=16384,-z,common-page-size=16384"
 
 cd "$root/rsh"
 
 for abi in $ABIS; do
 	case "$abi" in
-	arm64-v8a)   goarch=arm64 goarm= cc="aarch64-linux-android${ANDROID_MIN_SDK}-clang" ;;
+	arm64-v8a)   goarch=arm64 goarm='' cc="aarch64-linux-android${ANDROID_MIN_SDK}-clang" ;;
 	armeabi-v7a) goarch=arm   goarm=7 cc="armv7a-linux-androideabi${ANDROID_MIN_SDK}-clang" ;;
-	x86_64)      goarch=amd64 goarm= cc="x86_64-linux-android${ANDROID_MIN_SDK}-clang" ;;
-	x86)         goarch=386   goarm= cc="i686-linux-android${ANDROID_MIN_SDK}-clang" ;;
+	x86_64)      goarch=amd64 goarm='' cc="x86_64-linux-android${ANDROID_MIN_SDK}-clang" ;;
+	x86)         goarch=386   goarm='' cc="i686-linux-android${ANDROID_MIN_SDK}-clang" ;;
 	*) echo "rsh: unknown ABI $abi" >&2; exit 1 ;;
 	esac
 	dest="$root/app/src/main/jniLibs/$abi"
 	mkdir -p "$dest"
 	echo "rsh: building $abi (android/$goarch)"
+	output="$dest/libxrsh.so.part.$$"
 	CGO_ENABLED=1 GOOS=android GOARCH="$goarch" GOARM="$goarm" \
-		CC="$tc/$cc" GOFLAGS=-trimpath CGO_CFLAGS="-ffile-prefix-map=$root=." \
-		go build -buildmode=pie -ldflags "$ldflags" -o "$dest/libxrsh.so" .
+		CC="$tc/$cc" GOFLAGS=-trimpath \
+		CGO_CFLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -ffile-prefix-map=$root=." \
+		go build -buildvcs=false -buildmode=pie -ldflags "$android_ldflags" -o "$output" .
+	mv "$output" "$dest/libxrsh.so"
+	output=
 done
 
 # Host binary (no NDK, cgo off) for tests and manual debugging.
 mkdir -p "$root/out"
 echo "rsh: building host binary -> out/rsh"
-CGO_ENABLED=0 GOFLAGS=-trimpath go build -ldflags "$ldflags" -o "$root/out/rsh" .
+output="$root/out/rsh.part.$$"
+CGO_ENABLED=0 GOFLAGS=-trimpath go build -buildvcs=false -ldflags "$ldflags" -o "$output" .
+mv "$output" "$root/out/rsh"
+output=