This release includes 3 security fixes for security teams reviewing exposed deployments.
Published 3mo
Backup & Recovery
✓ No known CVEs patched
This release patches 3 known CVEs
Topics
backup
cli
copy-tool
cross-platform
deduplication
file-copy
+14 more
file-transfer
linux
macos
nas
python
remote-copy
rsync-alternative
scp-alternative
ssh
ssh-transfer
synology
tar-streaming
usb-copy
windows
Affected surfaces
auth
rce_ssrf
Summary
AI summaryUpdates Performance, Reliability, and CLI across a mixed release.
Full changelog
What's New
Performance
- Raw SSH tar streaming replaces SFTP for all remote transfers — 3-5x faster (4-5 MB/s on 100 Mbps LAN vs 1.2 MB/s with SFTP)
- Chunked 100 MB tar batches with streaming extraction — files extracted as data arrives, no temp files
- Per-byte progress for large files during tar extraction (e.g., a 4.8 GB file shows smooth progress instead of freezing)
- Threaded stdin/stdout on SSH channels to prevent deadlocks with large file lists
- Batched remote hashing — 5,000 files per SSH command to avoid channel timeouts on large repos (91k+ files)
- Remote link creation via batched Python script (5,000 links/batch) instead of individual shell commands
Security
- Hardened tar extraction — explicitly blocks symlinks, hard links, device files, FIFOs, null bytes in filenames
- 50 GB per-file size limit during tar extraction to prevent tar bomb attacks
- SSH host key warning with SHA256 fingerprint and MITM attack guidance
- SFTP-free manifest — read/write manifests via exec commands with SFTP fallback (works on servers with SFTP disabled, e.g., Synology NAS)
Windows
- Long path support (>260 characters) via
\\?\prefix for scan, copy, extract, verify, and hard link creation - Path separator fix in verification — forward/backslash mismatch no longer causes false "MISSING" reports
Reliability
- Auth retry — prompts for password up to 3 times on failure; catches "No authentication methods available" errors
- Graceful Ctrl+C — clean "Interrupted." message, no tracebacks
- Remote space check walks parent directories when destination doesn't exist yet
- Incremental check fallback — if remote check fails (e.g., SFTP disabled), reconnects and copies all files instead of crashing
CLI
- Renamed SSH arguments for clarity:
--ssh-src-port,--ssh-src-password,--ssh-dst-port,--ssh-dst-password - Professional README with architecture docs, diagrams, and real-world benchmarks
Benchmarks
| Mode | Files | Data | Speed |
|------|-------|------|-------|
| Local → Local | 59,925 | 500.7 MB | 41.2 MB/s |
| Remote → Local | 91,669 | 509.8 MB | 619.5 KB/s |
| Local → Remote | 91,663 | 509.8 MB | 4.0 MB/s |
| Remote → Remote | 3 | 1.7 GB | 5.2 MB/s |
SHA-256 Checksums
8d31d13f45c81b80ea298a19f94c9ce74299623bbc4551159724803227e3c194 fast_copy-linux
d7b96de0a940a24a32ccc2da50047b2abf7ff36b5de8a8e7d5f5830857ca9b21 fast_copy-macos
fd5788cbecde3fab361eb07b14fb6f74c78d97bb1fd5456a560e4d6f697f86df fast_copy-windows.exe
6ab6eec4e073209ba279999857decd1b757adae19014dc7d7c85d38b89f4d515 fast_copy.py
Breaking Changes
- Renamed SSH CLI arguments: `--ssh-src-port`, `--ssh-src-password`, `--ssh-dst-port`, `--ssh-dst-password` replace previous names
Security Fixes
- Hardened tar extraction explicitly blocks symlinks, hard links, device files, FIFOs, and null‑byte filenames
- Enforced 50 GB per‑file size limit during tar extraction to mitigate tar bomb attacks
- SSH host key verification now shows SHA256 fingerprint with MITM guidance
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Fast_copy new release with new features
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]