fix(rclone): replace the forked binary with upstream v1.75.0

[DeepDiver1975]

Why

bin/rclone_linux_amd64 was a custom fork build — v1.67.0-beta.8042.483c2feed.kiteworks-backend, Go 1.22.4, built 2024-07-01. Trivy reports 23 HIGH/CRITICAL vulnerabilities against it, 16 of them Go stdlib CVEs, including:

• CVE-2025-68121 — CRITICAL, crypto/tls certificate validation
• CVE-2024-45337 — CRITICAL, golang.org/x/crypto
• CVE-2026-33186 — CRITICAL, gRPC

None of this showed up in CI or in the owncloud/server image scan, for a separate reason fixed in owncloud/server-release#52: the complete tarball normalized the binary to 0644, and Trivy's gobinary analyzer only inspects files with an exec bit set, so it was never analyzed at all.

Why upstream is safe here

The fork was not needed:

• The app runs only rclone sync (lib/MigrationState/StateMigrateFiles.php:172) and rclone obscure (:255), against type=webdav,vendor=owncloud remotes.
• The fork's kiteworks-backend is never referenced anywhere in the app.
• Both non-obvious flags the app passes exist upstream — --webdav-owncloud-exclude-shares / --webdav-owncloud-exclude-mounts (backend/webdav/webdav.go:158,163).

Verified by running the exact flag set from StateMigrateFiles against v1.75.0:

$ rclone sync src dst --dry-run --no-check-certificate --create-empty-src-dirs \
    --ignore-case --ignore-case-sync --webdav-owncloud-exclude-shares=true \
    --webdav-owncloud-exclude-mounts=true --config= -v
INFO  : There was nothing to transfer      # exit 0
$ rclone obscure secretpassword            # exit 0

What

Replace the binary with the official rclone-v1.75.0-linux-amd64.zip artifact:

	old	new
version	v1.67.0-beta (fork)	v1.75.0 (upstream)
Go	1.22.4	1.26.5
size	61,657,240	85,323,938
git mode	100755	100755
Trivy HIGH/CRITICAL	23	0

sha256 of the downloaded zip: aa2804e08f48250e71009c727124b6341cd0288465804a9a09d14663cabafbaa (checked against the release SHA256SUMS).

Also documents why appinfo/install.php keeps its runtime chmod 0755 — it is a safety net for installs from tarballs built before owncloud/server-release#52.

Testing

$ trivy rootfs --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 old/   # exit 1
$ trivy rootfs --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 new/   # exit 0

(rootfs, not fs — the fs scanner does not run the gobinary analyzer.)

php -l appinfo/install.php clean.

Still to run before merge: the acceptance suite (make test-acceptance, ownCloud Classic → oCIS) — the flag check above covers argument parsing, but an end-to-end migration is the real confirmation for a binary swap.

Follow-up (not in this PR)

An 85 MB binary in git is avoidable — fetching it at make dist time with a pinned checksum would keep the repo small and make future bumps trivial.

🤖 Generated with Claude Code

[DeepDiver1975]

Acceptance suite run locally against this branch (make test-acceptance, ownCloud Classic → oCIS in docker): 36 assertions passed, 0 failed, exit 0.

The file-migration assertions are the ones that exercise upstream rclone rather than just its argument parsing:

running 40_files.sh
PASS: file 'alice:/folder/hello.txt' migrated with size 77
PASS: never-logged-in user 'carol' has no migrated /ownCloud (files skipped)

Users, groups, app roles and all five share shapes (user, group, public link, password-protected link, file-drop, expiring) also migrated clean.

So the swap is verified end-to-end, not just at the flag level.

[DeepDiver1975]

CI evidence for the swap, from the new Trivy scan

Ran the reusable Trivy workflow (owncloud/reusable-workflows#92) against both sides, in real CI with a current vulnerability DB:

Tree scanned	bin/rclone_linux_amd64 (gobinary)	Job
master — the fork build v1.67.0-beta…kiteworks-backend, go1.22.4	48 (HIGH 46, CRITICAL 2) — incl. CVE-2025-68121 (crypto/tls), CVE-2026-33186 (gRPC)	fails, exit 1
this branch — upstream v1.75.0, go1.26.5	8 (HIGH 8, CRITICAL 0), all stdlib	fails, exit 1
this branch + .trivyignore.yaml	none reported	passes

(48 rather than the 23 I reported earlier: my local Trivy DB is frozen at 2026-06-05, so those numbers were a lower bound.)

Why an ignorefile is still needed

v1.75.0 is the newest rclone release (2026-07-31) and upstream built it with go1.26.5. The eight remaining findings are all fixed in go 1.25.13 / 1.26.6 — no rclone release exists today that does not report them. All are denial-of-service / XSS class, none CRITICAL, and none is reachable from how this app drives rclone (rclone sync / rclone obscure against one trusted ownCloud WebDAV endpoint; no untrusted ASN.1, DNS, XML, HTML-template or inbound HTTP/2 input).

So .trivyignore.yaml accepts exactly those eight, path-scoped to the binary and each with expired_at: 2026-11-01. Verified that Trivy stops suppressing an entry once its date passes, and that the path scope actually matches — an acceptance that expires by itself rather than one that gets buried.

The structural point, worth its own issue

Vendoring a prebuilt third-party Go binary means the stdlib in this repo is always as old as the upstream release, so every Go security release turns this scan red until rclone cuts a new build. Two ways out, both bigger than this PR:

1. Build rclone from source at make dist with the current toolchain — always-current stdlib, and it also removes the 85 MB binary from git history.
2. Fetch the release binary at make dist with a pinned version + checksum — keeps the repo small and makes bumps a one-line change, but does not fix the stdlib lag.

Happy to file (1) as a follow-up if you want it pursued.