Skip to content

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 3mo Backup & Recovery
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

backup cli copy-tool cross-platform deduplication file-copy
+14 more
file-transfer linux macos nas python remote-copy rsync-alternative scp-alternative ssh ssh-transfer synology tar-streaming usb-copy windows

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Performance, Reliability, and CLI across a mixed release.

Full changelog

What's New

Performance

  • Raw SSH tar streaming replaces SFTP for all remote transfers — 3-5x faster (4-5 MB/s on 100 Mbps LAN vs 1.2 MB/s with SFTP)
  • Chunked 100 MB tar batches with streaming extraction — files extracted as data arrives, no temp files
  • Per-byte progress for large files during tar extraction (e.g., a 4.8 GB file shows smooth progress instead of freezing)
  • Threaded stdin/stdout on SSH channels to prevent deadlocks with large file lists
  • Batched remote hashing — 5,000 files per SSH command to avoid channel timeouts on large repos (91k+ files)
  • Remote link creation via batched Python script (5,000 links/batch) instead of individual shell commands

Security

  • Hardened tar extraction — explicitly blocks symlinks, hard links, device files, FIFOs, null bytes in filenames
  • 50 GB per-file size limit during tar extraction to prevent tar bomb attacks
  • SSH host key warning with SHA256 fingerprint and MITM attack guidance
  • SFTP-free manifest — read/write manifests via exec commands with SFTP fallback (works on servers with SFTP disabled, e.g., Synology NAS)

Windows

  • Long path support (>260 characters) via \\?\ prefix for scan, copy, extract, verify, and hard link creation
  • Path separator fix in verification — forward/backslash mismatch no longer causes false "MISSING" reports

Reliability

  • Auth retry — prompts for password up to 3 times on failure; catches "No authentication methods available" errors
  • Graceful Ctrl+C — clean "Interrupted." message, no tracebacks
  • Remote space check walks parent directories when destination doesn't exist yet
  • Incremental check fallback — if remote check fails (e.g., SFTP disabled), reconnects and copies all files instead of crashing

CLI

  • Renamed SSH arguments for clarity: --ssh-src-port, --ssh-src-password, --ssh-dst-port, --ssh-dst-password
  • Professional README with architecture docs, diagrams, and real-world benchmarks

Benchmarks

| Mode | Files | Data | Speed |
|------|-------|------|-------|
| Local → Local | 59,925 | 500.7 MB | 41.2 MB/s |
| Remote → Local | 91,669 | 509.8 MB | 619.5 KB/s |
| Local → Remote | 91,663 | 509.8 MB | 4.0 MB/s |
| Remote → Remote | 3 | 1.7 GB | 5.2 MB/s |

SHA-256 Checksums

8d31d13f45c81b80ea298a19f94c9ce74299623bbc4551159724803227e3c194  fast_copy-linux
d7b96de0a940a24a32ccc2da50047b2abf7ff36b5de8a8e7d5f5830857ca9b21  fast_copy-macos
fd5788cbecde3fab361eb07b14fb6f74c78d97bb1fd5456a560e4d6f697f86df  fast_copy-windows.exe
6ab6eec4e073209ba279999857decd1b757adae19014dc7d7c85d38b89f4d515  fast_copy.py

Breaking Changes

  • Renamed SSH CLI arguments: `--ssh-src-port`, `--ssh-src-password`, `--ssh-dst-port`, `--ssh-dst-password` replace previous names

Security Fixes

  • Hardened tar extraction explicitly blocks symlinks, hard links, device files, FIFOs, and null‑byte filenames
  • Enforced 50 GB per‑file size limit during tar extraction to mitigate tar bomb attacks
  • SSH host key verification now shows SHA256 fingerprint with MITM guidance

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Fast_copy new release with new features

Get notified when new releases ship.

Sign up free

About Fast_copy new release with new features

All releases →

Related context

Beta — feedback welcome: [email protected]