From beaa0c970d6c3538119b8a34a3f2f754b45e54cf Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Sun, 16 Aug 2026 00:00:00 +0000
Subject: native: harden rsync and SSH transport

Update rsync to 3.5.0 and Go to 1.26.6. Bound SSH handshakes, pin
host-key types, and build 16 KB-aligned hardened executables.
---
 versions | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'versions')

diff --git a/versions b/versions
index a778bb9..f6b2f7b 100644
--- a/versions
+++ b/versions
@@ -5,12 +5,14 @@
 
 # Native rsync, built from source via the Android NDK. The tarball sha256 lives
 # in rsync/rsync-${RSYNC_VERSION}.tar.gz.sha256, which the build verifies.
-RSYNC_VERSION=3.4.1
+RSYNC_VERSION=3.5.0
 RSYNC_URL=https://download.samba.org/pub/rsync/src/rsync-${RSYNC_VERSION}.tar.gz
 
-# Go SSH transport (rsh). Matches the go.mod go directive; x/crypto needs 1.25+.
-GO_VERSION=1.25.0
-GO_SHA256=2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613
+# Go SSH transport (rsh). Matches the go.mod go directive.
+GO_VERSION=1.26.6
+GO_SHA256=708effb774be8237570d0add163225abbdfaf4fca28b2611df167beba4feef89
+X_CRYPTO_VERSION=0.54.0
+X_SYS_VERSION=0.47.0
 
 # Android toolchain. ANDROID_NDK is the sdkmanager package revision.
 # JDK_RELEASE is the exact Temurin GA build; JDK_VERSION its major.
-- 
cgit v1.2.3