openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File master.patch of Package rsync (Revision d38f0167e81d64819212d664ad2d0d81)

Currently displaying revision d38f0167e81d64819212d664ad2d0d81 , Show latest

diff --git a/COPYING b/COPYING
index 104c5831..fb19ef2e 100644
--- a/COPYING
+++ b/COPYING
@@ -1,7 +1,16 @@
+REGARDING OPENSSL AND XXHASH
+
+In addition, as a special exception, the copyright holders give
+permission to dynamically link rsync with the OpenSSL and xxhash
+libraries when those libraries are being distributed in compliance
+with their license terms, and to distribute a dynamically linked
+combination of rsync and these libraries.  This is also considered
+to be covered under the GPL's System Libraries exception.
+
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -645,7 +654,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -664,20 +673,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
-
-REGARDING OPENSSL AND XXHASH
-
-In addition, as a special exception, the copyright holders give
-permission to dynamically link rsync with the OpenSSL and xxhash
-libraries when those libraries are being distributed in compliance
-with their license terms, and to distribute a dynamically linked
-combination of rsync and these libraries.  This is also considered
-to be covered under the GPL's System Libraries exception.
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
diff --git a/INSTALL.md b/INSTALL.md
index 932acc23..5b23ed0e 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -13,22 +13,22 @@ You need to have a C compiler installed and optionally a C++ compiler in order
 to try to build some hardware-accelerated checksum routines.  Rsync also needs
 a modern awk, which might be provided via gawk or nawk on some OSes.
 
-## Autoconf & man pages
+## Autoconf & manpages
 
 If you're installing from the git repo (instead of a release tar file) you'll
 also need the GNU autotools (autoconf & automake) and your choice of 2 python3
-markdown libraries: cmarkgfm or commonmark (needed to generate the man pages).
+markdown libraries: cmarkgfm or commonmark (needed to generate the manpages).
 If your OS doesn't provide a python3-cmarkgfm or python3-commonmark package,
 you can run the following to install the commonmark python library for your
 build user (after installing python3's pip package):
 
->     pip3 install --user commonmark
+>     python3 -mpip install --user commonmark
 
-You can test if you've got it fixed by running (from the src dir):
+You can test if you've got it fixed by running (from the rsync checkout):
 
 >     ./md2man --test rsync-ssl.1.md
 
-Alternately, you can avoid generating the man pages by fetching the very latest
+Alternately, you can avoid generating the manpages by fetching the very latest
 versions (that match the latest git source) from the [generated-files][6] dir.
 One way to do that is to run:
 
@@ -53,7 +53,8 @@ installed to manipulate xattrs and to run the rsync testsuite.
 The [xxHash library][1] provides extremely fast checksum functions that can
 make the "rsync algorithm" run much more quickly, especially when matching
 blocks in large files.  Installing this development library adds xxhash
-checksums as the default checksum algorithm.
+checksums as the default checksum algorithm.  You'll need at least v0.8.0
+if you want rsync to include the full range of its checksum algorithms.
 
 [1]: https://cyan4973.github.io/xxHash/
 
@@ -100,7 +101,7 @@ like.
     >     sudo apt install -y attr libattr1-dev
     >     sudo apt install -y libxxhash-dev
     >     sudo apt install -y libzstd-dev
-    >     sudo apt install -y libzlz4-dev
+    >     sudo apt install -y liblz4-dev
     >     sudo apt install -y libssl-dev
 
  -  For CentOS (use EPEL for python3-pip):
@@ -113,7 +114,7 @@ like.
     >     sudo yum -y install libzstd-devel
     >     sudo yum -y install lz4-devel
     >     sudo yum -y install openssl-devel
-    >     pip3 install --user commonmark
+    >     python3 -mpip install --user commonmark
 
  -  For Fedora 33:
 
@@ -141,12 +142,18 @@ like.
 
  -  For Cygwin (with all cygwin programs stopped, run the appropriate setup program from a cmd shell):
 
-    >     setup-x86_64 --quiet-mode -P make,gawk,autoconf,automake,gcc-core,python3,python36-commonmark
+    >     setup-x86_64 --quiet-mode -P make,gawk,autoconf,automake,gcc-core,python38,python38-pip
     >     setup-x86_64 --quiet-mode -P attr,libattr-devel
     >     setup-x86_64 --quiet-mode -P libzstd-devel
     >     setup-x86_64 --quiet-mode -P liblz4-devel
     >     setup-x86_64 --quiet-mode -P libssl-devel
 
+    Sometimes cygwin has commonmark packaged and sometimes it doesn't. Now that
+    its python38 has stabilized, you could install python38-commonmark. Or just
+    avoid the issue by running this from a bash shell as your build user:
+
+    >     python3 -mpip install --user commonmark
+
 ## Build and install
 
 After installing the various libraries, you need to configure, build, and
@@ -171,9 +178,9 @@ config.h, or just override them in your /etc/rsyncd.conf file.
 As of 2.4.7, rsync uses Eric Troan's popt option-parsing library.  A
 cut-down copy of a recent release is included in the rsync distribution,
 and will be used if there is no popt library on your build host, or if
-the --with-included-popt option is passed to ./configure.
+the `--with-included-popt` option is passed to ./configure.
 
-If you configure using --enable-maintainer-mode, then rsync will try
+If you configure using `--enable-maintainer-mode`, then rsync will try
 to pop up an xterm on DISPLAY=:0 if it crashes.  You might find this
 useful, but it should be turned off for production builds.
 
@@ -187,7 +194,7 @@ This is helpful when using the branch-from-patch and patch-update scripts
 to maintain the official rsync patches.  If you ever need to build from
 a "detached head" git position then you'll need to manually chdir into
 the build dir to run make.  I also like to create 2 more symlinks in the
-source dir:  ln -s build/rsync . ; ln -s build/testtmp .
+source dir:  `ln -s build/rsync . ; ln -s build/testtmp .`
 
 ## Make compatibility
 
@@ -221,7 +228,7 @@ Some versions of Mac OS X (Darwin) seem to have an IPv6 stack, but do
 not completely implement the "New Sockets" API.
 
 [This site][5] says that Apple started to support IPv6 in 10.2 (Jaguar).  If
-your build fails, try again after running configure with --disable-ipv6.
+your build fails, try again after running configure with `--disable-ipv6`.
 
 [5]: http://www.ipv6.org/impl/mac.html
 
diff --git a/Makefile.in b/Makefile.in
index d935651a..3cde9557 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -6,6 +6,7 @@ exec_prefix=@exec_prefix@
 bindir=@bindir@
 libdir=@libdir@/rsync
 mandir=@mandir@
+with_rrsync=@with_rrsync@
 
 LIBS=@LIBS@
 CC=@CC@
@@ -29,28 +30,30 @@ SHELL=/bin/sh
 .SUFFIXES:
 .SUFFIXES: .c .o
 
-SIMD_x86_64=simd-checksum-x86_64.o
-ASM_x86_64=lib/md5-asm-x86_64.o
+ROLL_SIMD_x86_64=simd-checksum-x86_64.o
+ROLL_ASM_x86_64=simd-checksum-avx2.o
+MD5_ASM_x86_64=lib/md5-asm-x86_64.o
 
 GENFILES=configure.sh aclocal.m4 config.h.in rsync.1 rsync.1.html \
-	 rsync-ssl.1 rsync-ssl.1.html rsyncd.conf.5 rsyncd.conf.5.html
+	 rsync-ssl.1 rsync-ssl.1.html rsyncd.conf.5 rsyncd.conf.5.html \
+	 @GEN_RRSYNC@
 HEADERS=byteorder.h config.h errcode.h proto.h rsync.h ifuncs.h itypes.h inums.h \
-	lib/pool_alloc.h lib/mdigest.h lib/md-defines.h version.h
+	lib/pool_alloc.h lib/mdigest.h lib/md-defines.h
 LIBOBJ=lib/wildmatch.o lib/compat.o lib/snprintf.o lib/mdfour.o lib/md5.o \
 	lib/permstring.o lib/pool_alloc.o lib/sysacls.o lib/sysxattrs.o @LIBOBJS@
 zlib_OBJS=zlib/deflate.o zlib/inffast.o zlib/inflate.o zlib/inftrees.o \
 	zlib/trees.o zlib/zutil.o zlib/adler32.o zlib/compress.o zlib/crc32.o
 OBJS1=flist.o rsync.o generator.o receiver.o cleanup.o sender.o exclude.o \
-	util.o util2.o main.o checksum.o match.o syscall.o log.o backup.o delete.o
+	util1.o util2.o main.o checksum.o match.o syscall.o log.o backup.o delete.o
 OBJS2=options.o io.o compat.o hlink.o token.o uidlist.o socket.o hashtable.o \
 	usage.o fileio.o batch.o clientname.o chmod.o acls.o xattrs.o
-OBJS3=progress.o pipe.o @ASM@
+OBJS3=progress.o pipe.o @MD5_ASM@ @ROLL_SIMD@ @ROLL_ASM@
 DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
 popt_OBJS=popt/findme.o  popt/popt.o  popt/poptconfig.o \
 	popt/popthelp.o popt/poptparse.o
-OBJS=$(OBJS1) $(OBJS2) $(OBJS3) @SIMD@ $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
+OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
 
-TLS_OBJ = tls.o syscall.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
+TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
 
 # Programs we must have to run the test cases
 CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
@@ -67,7 +70,7 @@ CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o trimslash.
 	$(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) -c $< @CC_SHOBJ_FLAG@
 @OBJ_RESTORE@
 
-all: Makefile rsync$(EXEEXT) stunnel-rsyncd.conf @MAKE_MAN@
+all: Makefile rsync$(EXEEXT) stunnel-rsyncd.conf @MAKE_RRSYNC@ @MAKE_MAN@
 .PHONY: all
 
 .PHONY: install
@@ -80,6 +83,10 @@ install: all
 	if test -f rsync.1; then $(INSTALLMAN) -m 644 rsync.1 $(DESTDIR)$(mandir)/man1; fi
 	if test -f rsync-ssl.1; then $(INSTALLMAN) -m 644 rsync-ssl.1 $(DESTDIR)$(mandir)/man1; fi
 	if test -f rsyncd.conf.5; then $(INSTALLMAN) -m 644 rsyncd.conf.5 $(DESTDIR)$(mandir)/man5; fi
+	if test "$(with_rrsync)" = yes; then \
+	    $(INSTALLCMD) -m 755 rrsync $(DESTDIR)$(bindir); \
+	    if test -f rrsync.1; then $(INSTALLMAN) -m 644 rrsync.1 $(DESTDIR)$(mandir)/man1; fi; \
+	fi
 
 install-ssl-daemon: stunnel-rsyncd.conf
 	-$(MKDIR_P) $(DESTDIR)/etc/stunnel
@@ -96,10 +103,13 @@ install-strip:
 rsync$(EXEEXT): $(OBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
+rrsync: support/rrsync
+	cp -p $(srcdir)/support/rrsync rrsync
+
 $(OBJS): $(HEADERS)
 $(CHECK_OBJS): $(HEADERS)
 tls.o xattrs.o: lib/sysxattrs.h
-usage.o: latest-year.h help-rsync.h help-rsyncd.h git-version.h default-cvsignore.h
+usage.o: version.h latest-year.h help-rsync.h help-rsyncd.h git-version.h default-cvsignore.h
 loadparm.o: default-dont-compress.h daemon-parm.h
 
 flist.o: rounding.h
@@ -131,17 +141,20 @@ rounding.h: rounding.c rsync.h proto.h
 	fi
 	@rm -f rounding.out
 
-# While $(wildcard ...) is a GNU make idiom, at least other makes should just turn it into an
-# empty string (we need something that will vanish if we're not building a git checkout).
-# If you want an updated git version w/o GNU make, remove git-version.h after a pull.
-git-version.h: mkgitver $(wildcard $(srcdir)/.git/logs/HEAD)
+git-version.h: ALWAYS_RUN
 	$(srcdir)/mkgitver
 
+.PHONY: ALWAYS_RUN
+ALWAYS_RUN:
+
 simd-checksum-x86_64.o: simd-checksum-x86_64.cpp
-	@$(srcdir)/cmdormsg disable-simd $(CXX) -I. $(CXXFLAGS) $(CPPFLAGS) -c -o $@ $(srcdir)/simd-checksum-x86_64.cpp
+	@$(srcdir)/cmd-or-msg disable-roll-simd $(CXX) -I. $(CXXFLAGS) $(CPPFLAGS) -c -o $@ $(srcdir)/simd-checksum-x86_64.cpp
 
-lib/md5-asm-x86_64.o: lib/md5-asm-x86_64.S config.h lib/md-defines.h
-	@$(srcdir)/cmdormsg disable-asm $(CC) -I. @NOEXECSTACK@ -c -o $@ $(srcdir)/lib/md5-asm-x86_64.S
+simd-checksum-avx2.o: simd-checksum-avx2.S
+	@$(srcdir)/cmd-or-msg disable-roll-asm $(CC) $(CFLAGS) -I. @NOEXECSTACK@ -c -o $@ $(srcdir)/simd-checksum-avx2.S
+
+lib/md5-asm-x86_64.o: lib/md5-asm-x86_64.S lib/md-defines.h
+	@$(srcdir)/cmd-or-msg disable-md5-asm $(CC) -I. @NOEXECSTACK@ -c -o $@ $(srcdir)/lib/md5-asm-x86_64.S
 
 tls$(EXEEXT): $(TLS_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TLS_OBJ) $(LIBS)
@@ -155,11 +168,11 @@ getgroups$(EXEEXT): getgroups.o
 getfsdev$(EXEEXT): getfsdev.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ getfsdev.o $(LIBS)
 
-TRIMSLASH_OBJ = trimslash.o syscall.o t_stub.o lib/compat.o lib/snprintf.o
+TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o
 trimslash$(EXEEXT): $(TRIMSLASH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TRIMSLASH_OBJ) $(LIBS)
 
-T_UNSAFE_OBJ = t_unsafe.o syscall.o util.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
 t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS)
 
@@ -167,11 +180,15 @@ t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
 conf: configure.sh config.h.in
 
 .PHONY: gen
-gen: conf proto.h man
+gen: conf proto.h man git-version.h
 
 .PHONY: gensend
 gensend: gen
-	rsync -aic $(GENFILES) $${SAMBA_HOST-samba.org}:/home/ftp/pub/rsync/generated-files/
+	if ! diff git-version.h $(srcdir)/gists/rsync-git-version.h >/dev/null; then \
+	    ./rsync -ai git-version.h $(srcdir)/gists/rsync-git-version.h && \
+	    (cd $(srcdir)/gists && git commit --allow-empty-message -m '' rsync-git-version.h && git push) ; \
+	fi
+	rsync -aic $(GENFILES) git-version.h $${SAMBA_HOST-samba.org}:/home/ftp/pub/rsync/generated-files/ || true
 
 aclocal.m4: $(srcdir)/m4/*.m4
 	aclocal -I $(srcdir)/m4
@@ -193,7 +210,7 @@ configure.sh config.h.in: configure.ac aclocal.m4
 	else \
 	    echo "config.h.in has CHANGED."; \
 	fi
-	@if test -f configure.sh.old -o -f config.h.in.old; then \
+	@if test -f configure.sh.old || test -f config.h.in.old; then \
 	    if test "$(MAKECMDGOALS)" = reconfigure; then \
 		echo 'Continuing with "make reconfigure".'; \
 	    else \
@@ -240,22 +257,25 @@ proto.h-tstamp: $(srcdir)/*.c $(srcdir)/lib/compat.c daemon-parm.h
 	$(AWK) -f $(srcdir)/mkproto.awk $(srcdir)/*.c $(srcdir)/lib/compat.c daemon-parm.h
 
 .PHONY: man
-man: rsync.1 rsync-ssl.1 rsyncd.conf.5
+man: rsync.1 rsync-ssl.1 rsyncd.conf.5 @MAKE_RRSYNC_1@
+
+rsync.1: rsync.1.md md-convert version.h Makefile
+	@$(srcdir)/maybe-make-man rsync.1.md
 
-rsync.1: rsync.1.md md2man version.h Makefile
-	@$(srcdir)/maybe-make-man $(srcdir) rsync.1.md
+rsync-ssl.1: rsync-ssl.1.md md-convert version.h Makefile
+	@$(srcdir)/maybe-make-man rsync-ssl.1.md
 
-rsync-ssl.1: rsync-ssl.1.md md2man version.h Makefile
-	@$(srcdir)/maybe-make-man $(srcdir) rsync-ssl.1.md
+rsyncd.conf.5: rsyncd.conf.5.md md-convert version.h Makefile
+	@$(srcdir)/maybe-make-man rsyncd.conf.5.md
 
-rsyncd.conf.5: rsyncd.conf.5.md md2man version.h Makefile
-	@$(srcdir)/maybe-make-man $(srcdir) rsyncd.conf.5.md
+rrsync.1: support/rrsync.1.md md-convert Makefile
+	@$(srcdir)/maybe-make-man support/rrsync.1.md
 
 .PHONY: clean
 clean: cleantests
-	rm -f *~ $(OBJS) $(CHECK_PROGS) $(CHECK_OBJS) $(CHECK_SYMLINKS) \
-		rounding rounding.h *.old rsync*.1 rsync*.5 rsync*.html \
-		daemon-parm.h help-*.h default-*.h proto.h proto.h-tstamp
+	rm -f *~ $(OBJS) $(CHECK_PROGS) $(CHECK_OBJS) $(CHECK_SYMLINKS) @MAKE_RRSYNC@ \
+		git-version.h rounding rounding.h *.old rsync*.1 rsync*.5 @MAKE_RRSYNC_1@ \
+		*.html daemon-parm.h help-*.h default-*.h proto.h proto.h-tstamp
 
 .PHONY: cleantests
 cleantests:
diff --git a/NEWS.md b/NEWS.md
index a3e6b9b4..72a62780 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,4 +1,270 @@
-<a name="3.2.3"></a>
+# NEWS for rsync 3.2.4 (UNRELEASED)
+
+## Changes in this version:
+
+### BEHAVIOR CHANGES:
+
+ - A new form of arg protection was added that works similarly to the older
+   [`--protect-args`](rsync.1#opt) (`-s`) option but in a way that avoids
+   breaking things like rrsync (the restricted rsync script): rsync now uses
+   backslash escaping for sending "shell-active" characters to the remote
+   shell. This includes spaces, so fetching a remote file via a simple quoted
+   filename value now works by default without any extra quoting:
+
+   ```shell
+       rsync -aiv host:'a simple file.pdf' .
+   ```
+
+   Wildcards are not escaped in filename args, but they are escaped in options
+   like the [`--suffix`](rsync.1#opt) and [`--usermap`](rsync.1#opt) values.
+   If your rsync script depends on the old arg-splitting behavior, either run
+   it with the [`--old-args`](rsync.1#opt) option or `export RSYNC_OLD_ARGS=1`
+   in the script's environment.  See also the [ADVANCED USAGE](rsync.1#)
+   section of rsync's manpage for how to use a more modern arg style.
+
+ - A long-standing bug was preventing rsync from figuring out the current
+   locale's decimal point character, which made rsync always output numbers
+   using the "C" locale.  Since this is now fixed in 3.2.4, a script that
+   parses rsync's decimal numbers (e.g. from the verbose footer) may want to
+   setup the environment in a way that the output continues to be in the C
+   locale.  For instance, one of the following should work fine:
+
+   ```shell
+       export LC_ALL=C.UTF-8
+   ```
+
+   or if iconv translations are needed:
+
+   ```shell
+       if [ "${LC_ALL:-}" ]; then
+           export LANG="$LC_ALL"
+           export LC_CTYPE="$LC_ALL"
+           unset LC_ALL
+       fi
+       export LC_NUMERIC=C.UTF-8
+   ```
+
+### SECURITY FIXES:
+
+ - A fix for CVE-2018-25032 in the bundled zlib (memory corruption issue).
+
+### BUG FIXES:
+
+ - Fixed a bug with [`--inplace`](rsync.1#opt) + [`--sparse`](rsync.1#opt) (and
+   a lack of [`--whole-file`](rsync.1#opt)) where the destination file could
+   get reconstructed with bogus data.  Since the bug can also be avoided by
+   using (the seemingly redundant) [`--no-W`](rsync.1#opt) on the receiving
+   side, the latest rsync will now send `--no-W` to a remote receiver when this
+   option combination occurs.  If your client rsync is not new enough to do
+   this for you (or if you're just paranoid), you can manually specify `--no-W
+   -M--no-W` (when not using [`--whole-file`](rsync.1#opt)) to make sure the
+   bug is avoided.
+
+ - Fixed a bug with [`--mkpath`](rsync.1#opt) if a single-file copy specifies
+   an existing destination dir with a non-existing destination filename.
+
+ - Fixed `--update -vv` to output "is uptodate" instead of "is newer" messages
+   for files that are being skipped due to an identical modify time.  (This was
+   a new output quirk in 3.2.3.)
+
+ - When doing an append transfer, the sending side's file must not get shorter
+   or it is skipped. Fixes a crash that could occur when the size changes to 0
+   in the middle of the send negotiations.
+
+ - When dealing with special files (see [`--specials`](rsync.1#opt)) in an
+   alt-dest hierarchy, rsync now checks the non-permission mode bits to ensure
+   that the 2 special files are really the same before hard-linking them
+   together.
+
+ - Fixed a bug where [`--delay-updates`](rsync.1#opt) with stale partial data
+   could cause a file to fail to update.
+
+ - Fixed a few places that would output an INFO message with
+   [`--info=NAME`](rsync.1#opt) that should only have been output given
+   [`--verbose`](rsync.1#opt) or [`--itemize-changes`](rsync.1#opt).
+
+ - Avoid a weird failure if you run a local copy with a (useless)
+   [`--rsh`](rsync.1#opt) option that contains a `V` in the command.
+
+ - Fixed a long-standing compression bug where the compression level of the
+   first file transferred affected the level for all future files.  Also, the
+   per-file compression skipping has apparently never worked, so it is now
+   documented as being ineffective.
+
+ - Fixed a truncate error when a `--write-devices` copy wrote a file onto a
+   device that was shorter than the device.
+
+ - Made `--write-devices` support both `--checksum` and `--no-whole-file` when
+   copying to a device.
+
+ - Improved how the [`--stop-at`](rsync.1#opt), [`--stop-after`](rsync.1#opt),
+   and (the deprecated) [`--time-limit`](rsync.1#opt) options check to see if
+   the allowed time is over, which should make rsync exit more consistently.
+
+ - Tweak --progress to display "`??:??:??`" when the time-remaining value is so
+   large as to be meaningless.
+
+ - Silence some chmod warnings about symlinks when it looks like we have a
+   function to set their permissions but they can't really be set.
+
+ - Fixed a potential issue in git-set-file-times when handling commits with
+   high-bit characters in the description & when handling a description that
+   might mimick the git raw-commit deliniators.  (See the support dir.)
+
+ - The bundled systemd/rsync.service file now includes `Restart=on-failure`.
+
+### ENHANCEMENTS:
+
+ - Use openssl's `-verify_hostname` option in the rsync-ssl script.
+
+ - Added extra info to the "FILENAME exists" output of
+   [`--ignore-existing`](rsync.1#opt) when [`--info=skip2`](rsync.1#opt) is
+   used.  The skip message becomes "FILENAME exists (INFO)" where the INFO is
+   one of "type change", "sum change" (requires [`--checksum`](rsync.1#opt)),
+   "file change" (based on the quick check), "attr change", or "uptodate".
+   Prior versions only supported `--info=skip1`.
+
+ - Added the [`--fsync`](rsync.1#opt) option (promoted from the patches repo).
+
+ - Added the [`--copy-devices`](rsync.1#opt) option.  Compared to the
+   historical version from the rsync-patches repo, this version: properly
+   handles `--checksum`; fixes a truncation bug when doing an `--inplace` copy
+   onto a longer file; fixes several bugs in the `--itemize` output; and only
+   the sending side needs the enhanced rsync for the copy to work.
+
+ - Reduced memory usage for an incremental transfer that has a bunch of small
+   directories.
+
+ - The rsync daemon can now handle a client address with an implied "%scope"
+   suffix.
+
+ - Added support for [`--atimes`](rsync.1#opt) on macOS and fixed a bug where
+   it wouldn't work without [`--times`](rsync.1#opt).
+
+ - Rsync can now update the xattrs on a read-only file when your user can
+   temporarily add user-write permission to the file. (It always worked for a
+   root transfer.)
+
+ - Rsync can now work around an [`--inplace`](rsync.1#opt) update of a file
+   that is being refused due to the Linux fs.protected_regular sysctl setting.
+
+ - When [`--chown`](rsync.1#opt), [`--usermap`](rsync.1#opt), or
+   [`--groupmap`](rsync.1#opt) is specified, rsync now makes sure that the
+   appropriate [`--owner`](rsync.1#opt) and/or [`--group`](rsync.1#opt) options
+   are enabled.
+
+ - Added the [`--info=NONREG`](rsync.1#opt) setting to control if rsync should
+   warn about non-regular files in the transfer.  This is enabled by default
+   (keeping the behavior the same as before), so specifying `--info=nonreg0`
+   can be used to turn the warnings off.
+
+ - An optional asm optimization for the rolling checksum from Shark64. Enable
+   it with `./configure --enable-roll-asm`.
+
+ - Using `--debug=FILTER` now outputs a caution message if a filter rule
+   has trailing whitespace.
+
+ - Transformed rrsync into a python script with improvements:
+   - Security has been beefed up.
+   - The known rsync options were updated to include recent additions.
+   - Make rrsync reject [`--copy-links`](rsync.1#opt) (`-L`),
+     [`--copy-dirlinks`](rsync.1#opt) (`-k`), &
+     [`--keep-dirlinks`](rsync.1#opt) (`-K`) by default to make it harder to
+     exploit any out-of-subdir symlinks.
+   - A new rrsync option of [`-munge`](rrsync.1#opt) tells rrsync to always
+     enable rsync's [`--munge-links`](rsync.1#opt) option on the server side.
+   - A new rrsync option of [`-no-lock`](rrsync.1#opt) disables a new
+     single-use locking idiom that is the default when [`-ro`](rrsync.1#opt) is
+     not used (useful with [`-munge`](rrsync.1#opt)).
+   - A new rrsync option of [`-no-del`](rrsync.1#opt) disables all `--remove*`
+     and `--delete*` rsync options on the server side.
+   - The log format has been tweaked slightly to add seconds to the timestamp
+     and to output the command executed as a tuple (making the args clearer).
+   - An rrsync.1 manpage was added (in the support dir with rrsync).
+
+ - Added options to the lsh script to facilitate rrsync testing. (See the
+   support dir.)
+
+ - Transformed the atomic-rsync script into a python script and added the
+   ability to ignore one or more non-zero exit codes.  By default, it now
+   ignores code 24, the file-vanished exit code. (See the support dir.)
+
+ - Transformed the munge-symlinks script into python. (See the support dir.)
+
+ - Improved the rsync-no-vanished script to not join stdout & stderr together.
+   (See the support dir.)
+
+ - Work around a glibc bug where lchmod() breaks in a chroot w/o /proc mounted.
+
+ - Try to support a client that sent a remote rsync a wacko stderr file handle
+   (such as an older File::RsyncP perl library used by BackupPC).
+
+ - Lots of manpage improvements, including better HTML versions.
+
+### PACKAGING RELATED:
+
+ - Give configure the `--with-rrsync` option if you want `make install` to
+   install the (now python3) rrsync script and its new manpage.
+
+ - If the rrsync script is installed, its package should be changed to depend
+   on python3 and the (suggested but not mandatory) python3 braceexpand lib.
+
+ - When creating a package from a non-release version (w/o a git checkout), the
+   packager can elect to create git-version.h and define RSYNC_GITVER to the
+   string they want `--version` to output.  (The file is still auto-generated
+   using the output of `git describe` when building inside a non-shallow git
+   checkout, though.)
+
+ - Renamed configure's `--enable-simd` option to `--enable-roll-simd` and added
+   the option `--enable-roll-asm` to use the new asm version of the code.  Both
+   are x86_64/amd64 only.
+
+ - Renamed configure's `--enable-asm` option to `--enable-md5-asm` to avoid
+   confusion with the asm option for the rolling checksum.  It is also honored
+   even when openssl crypto is in use.  This allows: normal MD4 & MD5, normal
+   MD4 + asm MD5, openssl MD4 & MD5, or openssl MD4 + asm MD5 depending on the
+   configure options selected.
+
+ - Made SIMD & asm configure checks default to "no" on non-Linux hosts due to
+   various reports of problems on NetBSD & macOS hosts.  These were also
+   tweaked to allow enabling the feature on a host_cpu of amd64 (was only
+   allowed on x86_64 before).
+
+ - Fixed configure to not fail at the SIMD check when cross-compiling.
+
+ - Improved the IPv6 determination in configure.
+
+ - Compile the C files with `-pedantic-errors` (when possible) so that we will
+   get warned if a static initialization overflows in the future (among other
+   things).
+
+ - When linking with an external zlib, rsync renames its `read_buf()` function
+   to `read_buf_()` to avoid a symbol clash on an unpatched zlib.
+
+ - Added a SECURITY.md file.
+
+### DEVELOPER RELATED:
+
+ - Made it easier to write rsync tests that diff the output while also checking
+   the status code, and used the idiom to improve the existing tests. (See the
+   `checkdiff` and `checkdiff2` idioms in the `testsuite/*.test` files.
+
+ - The packaging scripts & related python lib got some minor enhancements.
+
+### INTERNAL
+
+ - Use setenv() instead of putenv() when it is available.
+
+ - Improve the logic in compat.c so that we don't need to try to remember to
+   sprinkle `!local_server` exceptions throughout the protocol logic.
+
+ - One more C99 Flexible Array improvement (started in the last release) and
+   make use of the C99 `%zd` format string when printing size_t values (when
+   possible).
+
+ - Use mallinfo2() instead of mallinfo(), when available.
+
+------------------------------------------------------------------------------
 
 # NEWS for rsync 3.2.3 (6 Aug 2020)
 
@@ -12,67 +278,72 @@
  - Fixed a bug in the xattr code that was not leaving room for the "rsync."
    prefix in some instances where it needed to be added.
 
- - Restored the ability to use `--bwlimit=0` to specify no bandwidth limit.  (It
-   was accidentally broken in 3.2.2.)
+ - Restored the ability to use [`--bwlimit=0`](rsync.1#opt) to specify no
+   bandwidth limit.  (It was accidentally broken in 3.2.2.)
 
- - Fix a bug when combining `--delete-missing-args` with `--no-implied-dirs` &
-   `-R` where rsync might create the destination path of a missing arg.  The
-   code also avoids some superfluous warnings for nested paths of removed args.
+ - Fixed a bug when combining [`--delete-missing-args`](rsync.1#opt) with
+   [`--no-implied-dirs`](rsync.1#opt) & [`-R`](rsync.1#opt) where rsync might
+   create the destination path of a missing arg.  The code also avoids some
+   superfluous warnings for nested paths of removed args.
 
  - Fixed an issue where hard-linked devices could cause the rdev_major value to
    get out of sync between the sender and the receiver, which could cause a
    device to get created with the wrong major value in its major,minor pair.
 
- - Rsync now complains about a missing `--temp-dir` before starting any file
-   transfers.
+ - Rsync now complains about a missing [`--temp-dir`](rsync.1#opt) before
+   starting any file transfers.
 
  - A completely empty source arg is now a fatal error.  This doesn't change
    the handling of implied dot-dir args such as "localhost:" and such.
 
 ### ENHANCEMENTS:
 
- - Allow `--max-alloc=0` to specify no limit to the alloc sanity check.
+ - Allow [`--max-alloc=0`](rsync.1#opt) to specify no limit to the alloc sanity
+   check.
 
- - Allow `--block-size=SIZE` to specify the size using units (e.g. "100K").
+ - Allow [`--block-size=SIZE`](rsync.1#opt) to specify the size using units
+   (e.g. "100K").
 
  - The name of the id-0 user & group are now sent to the receiver along with
    the other user/group names in the transfer (instead of assuming that both
    sides have the same id-0 names).
 
- - Added the `--stop-after=MINS` and `--stop-at=DATE_TIME` options (with the
-   `--time-limit=MINS` option accepted as an alias for `--stop-after`).  This
-   is an enhanced version of the time-limit patch from the patches repo.
-
- - Added the `name converter` daemon parameter to make it easier to convert
-   user & group names inside a chrooted daemon module.  This is based on the
-   nameconverter patch with some improvements, including a tweak to the request
-   protocol (so if you used this patch in the past, be sure to update your
-   converter script to use newlines instead of null chars).
-
- - Added `--crtimes` (`-N`) option for preserving the file's create time (I
-   believe that this is macOS only at the moment).
-
- - Added `--mkpath` option to tell rsync that it should create a non-existing
-   path component of the destination arg.
-
- - Added `--stderr=errors|all|client` to replace the `--msgs2stderr` and
-   `--no-msgs2stderr` options (which are still accepted).  The default use of
-   stderr was changed to be `--stderr=errors` where all the processes that have
-   stderr available output directly to stderr, which should help error messages
-   get to the user more quickly, especially when doing a push (which includes
-   local copying).  This also allows rsync to exit quickly when a receiver
-   failure occurs, since rsync doesn't need to try to keep the connection alive
-   long enough for the fatal error to go from the receiver to the generator to
-   the sender.  The old default can be requested via `--stderr=client`.  Also
-   changed is that a non-default stderr mode is conveyed to the remote rsync
-   (using the older option names) instead of requiring the user to use
-   `--remote-option` (`-M`) to tell the remote rsync what to do.
-
- - Added the ability to specify "@netgroup" names to the `hosts allow` and
-   `hosts deny` daemon parameters.  This is a finalized version of the
-   netgroup-auth patch from the patches repo.
-
- - Rsync can now hard-link symlinks on FreeBSD due to it making ues of the
+ - Added the [`--stop-after`](rsync.1#opt) and [`--stop-at`](rsync.1#opt)
+   options (with a [`--time-limit`](rsync.1#opt) alias for `--stop-after`).
+   This is an enhanced version of the time-limit patch from the patches repo.
+
+ - Added the [`name converter`](rsyncd.conf.5#opt) daemon parameter to make it
+   easier to convert user & group names inside a chrooted daemon module.  This
+   is based on the nameconverter patch with some improvements, including a
+   tweak to the request protocol (so if you used this patch in the past, be
+   sure to update your converter script to use newlines instead of null chars).
+
+ - Added [`--crtimes`](rsync.1#opt) (`-N`) option for preserving the file's
+   create time (I believe that this is macOS only at the moment).
+
+ - Added [`--mkpath`](rsync.1#opt) option to tell rsync that it should create a
+   non-existing path component of the destination arg.
+
+ - Added [`--stderr=errors|all|client`](rsync.1#opt) to replace the
+   `--msgs2stderr` and `--no-msgs2stderr` options (which are still accepted).
+   The default use of stderr was changed to be `--stderr=errors` where all the
+   processes that have stderr available output directly to stderr, which should
+   help error messages get to the user more quickly, especially when doing a
+   push (which includes local copying).  This also allows rsync to exit quickly
+   when a receiver failure occurs, since rsync doesn't need to try to keep the
+   connection alive long enough for the fatal error to go from the receiver to
+   the generator to the sender.  The old default can be requested via
+   `--stderr=client`.  Also changed is that a non-default stderr mode is
+   conveyed to the remote rsync (using the older option names) instead of
+   requiring the user to use [`--remote-option`](rsync.1#opt) (`-M`) to tell
+   the remote rsync what to do.
+
+ - Added the ability to specify "@netgroup" names to the [`hosts
+   allow`](rsyncd.conf.5#opt) and [`hosts deny`](rsyncd.conf.5#opt) daemon
+   parameters.  This is a finalized version of the netgroup-auth patch from the
+   patches repo.
+
+ - Rsync can now hard-link symlinks on FreeBSD due to it making use of the
    linkat() function when it is available.
 
  - Output file+line info on out-of-memory & overflow errors while also avoiding
@@ -99,7 +370,6 @@
    (with a fallback to the old 1-char string kluge for older compilers).
 
 ------------------------------------------------------------------------------
-<a name="3.2.2"></a>
 
 # NEWS for rsync 3.2.2 (4 Jul 2020)
 
@@ -153,7 +423,7 @@
 
  - Put optimizations into their own list in the `--version` output.
 
- - Improved the man page a bit more.
+ - Improved the manpage a bit more.
 
 ### PACKAGING RELATED:
 
@@ -175,7 +445,6 @@
    can create the interrelated structs and accessors that loadparm.c needs.
 
 ------------------------------------------------------------------------------
-<a name="3.2.1"></a>
 
 # NEWS for rsync 3.2.1 (22 Jun 2020)
 
@@ -238,7 +507,6 @@
  - Merged the OLDNEWS.md file into NEWS.md.
 
 ------------------------------------------------------------------------------
-<a name="3.2.0"></a>
 
 # NEWS for rsync 3.2.0 (19 Jun 2020)
 
@@ -382,7 +650,7 @@
  - The daemon now locks its pid file (when configured to use one) so that it
    will not fail to start when the file exists but no daemon is running.
 
- - Various man page improvements, including some html representations (that
+ - Various manpage improvements, including some html representations (that
    aren't installed by default).
 
  - Made `-V` the short option for `--version` and improved its information.
@@ -399,7 +667,7 @@
 
  - Add installed bash script: /usr/bin/rsync-ssl
 
- - Add installed man page: /usr/man/man1/rsync-ssl.1
+ - Add installed manpage: /usr/man/man1/rsync-ssl.1
 
  - Tweak auxiliary doc file names, such as: README.md, INSTALL.md, & NEWS.md.
 
@@ -421,8 +689,8 @@
    SIMD checksum optimizations.
 
  - Add _build_ dependency for _either_ python3-cmarkcfm or python3-commonmark
-   to allow for patching of man pages or building a git release.  This is not
-   required for a release-tar build, since it comes with pre-built man pages.
+   to allow for patching of manpages or building a git release.  This is not
+   required for a release-tar build, since it comes with pre-built manpages.
    Note that cmarkcfm is faster than commonmark, but they generate the same
    data.  The commonmark dependency is easiest to install since it's native
    python, and can even be installed via `pip3 install --user commonmark` if
@@ -435,7 +703,7 @@
  - Silenced some annoying warnings about major() & minor() by improving an
    autoconf include-file check.
 
- - Converted the man pages from yodl to markdown. They are now processed via a
+ - Converted the manpages from yodl to markdown. They are now processed via a
    simple python3 script using the cmarkgfm **or** commonmark library.  This
    should make it easier to package rsync, since yodl is rather obscure.
 
@@ -450,7 +718,6 @@
  - Some code typos were fixed (as pointed out by a Fossies run).
 
 ------------------------------------------------------------------------------
-<a name="3.1.3"></a>
 
 # NEWS for rsync 3.1.3 (28 Jan 2018)
 
@@ -468,7 +735,8 @@
 
  - Don't output about a new backup dir without appropriate info verbosity.
 
- - Fixed some issues with the sort functions in support/rsyncstats script.
+ - Fixed some issues with the sort functions in the rsyncstats script (in the
+   support dir).
 
  - Added a way to specify daemon config lists (e.g. users, groups, etc) that
    contain spaces (see `auth users` in the latest rsyncd.conf manpage).
@@ -513,14 +781,13 @@
 
 ### DEVELOPER RELATED:
 
- - Tweak the `make` output when yodl isn't around to create the man pages.
+ - Tweak the `make` output when yodl isn't around to create the manpages.
 
  - Changed an obsolete autoconf compile macro.
 
- - Support newer yodl versions when converting man pages.
+ - Support newer yodl versions when converting manpages.
 
 ------------------------------------------------------------------------------
-<a name="3.1.2"></a>
 
 # NEWS for rsync 3.1.2 (21 Dec 2015)
 
@@ -586,7 +853,6 @@
  - Improved the m4 generation rules and some autoconf idioms.
 
 ------------------------------------------------------------------------------
-<a name="3.1.1"></a>
 
 # NEWS for rsync 3.1.1 (22 Jun 2014)
 
@@ -679,7 +945,7 @@
    non-bundled zlib. See the `--new-compress` and `--old-compress` options in
    the manpage.
 
- - Added the support/rsync-no-vanished wrapper script.
+ - Added the rsync-no-vanished shell script. (See the support dir.)
 
  - Made configure more prominently mention when we failed to find yodl (in case
    the user wants to be able to generate manpages from `*.yo` files).
@@ -706,7 +972,6 @@
    and/or zlib code is put early in the CFLAGS.
 
 ------------------------------------------------------------------------------
-<a name="3.1.0"></a>
 
 # NEWS for rsync 3.1.0 (28 Sep 2013)
 
@@ -752,7 +1017,7 @@
  - Fixed a bug in the iconv code when EINVAL or EILSEQ is returned with a full
    output buffer.
 
- - Fixed some rare bugs in `--iconv` processing that might cause a multibyte
+ - Fixed some rare bugs in `--iconv` processing that might cause a multi-byte
    character to get translated incorrectly.
 
  - Fixed a bogus `vanished file` error if some files were specified with `./`
@@ -858,7 +1123,7 @@
    hard-link it into place so that the upcoming replacement of the destination
    file will be atomic (for the normal, non-inplace logic).
 
- - Added the ability to synchronize nano-second modified times.
+ - Added the ability to synchronize nanosecond modified times.
 
  - Added a few more default suffixes for the `dont compress` settings.
 
@@ -957,7 +1222,6 @@
  - Fixed some build issues for Android and Minix.
 
 ------------------------------------------------------------------------------
-<a name="3.0.9"></a>
 
 # NEWS for rsync 3.0.9 (23 Sep 2011)
 
@@ -1010,14 +1274,13 @@
 
  - Avoid trying to reference `SO_BROADCAST` if the OS doesn't support it.
 
- - Fix some issues with the post-processing of the man pages.
+ - Fix some issues with the post-processing of the manpages.
 
- - Fixed the user home-dir handling in the support/lsh script.
+ - Fixed the user home-dir handling in the lsh script. (See the support dir.)
 
  - Some minor manpage improvements.
 
 ------------------------------------------------------------------------------
-<a name="3.0.8"></a>
 
 # NEWS for rsync 3.0.8 (26 Mar 2011)
 
@@ -1130,10 +1393,10 @@
    reject an attempt to supply one (can configure `--with-included-popt` if
    your system's popt library doesn't yet have this fix).
 
- - A couple minor option tweaks to the support/rrsync script, and also some
-   regex changes that make vim highlighting happier.
+ - A couple minor option tweaks to the rrsync script, and also some regex
+   changes that make vim highlighting happier. (See the support dir.)
 
- - Fixed some issues in the support/mnt-excl script.
+ - Fixed some issues in the mnt-excl script. (See the support dir.)
 
  - Various manpage improvements.
 
@@ -1156,7 +1419,6 @@
  - Fixed the testsuite/xattrs.test script on OS X.
 
 ------------------------------------------------------------------------------
-<a name="3.0.7"></a>
 
 # NEWS for rsync 3.0.7 (31 Dec 2009)
 
@@ -1170,7 +1432,7 @@
    that hasn't really been created.
 
  - Fixed a problem with `--compress` (`-z`) where the receiving side could
-   return the error "inflate (token) returned -5".
+   return the error "`inflate (token) returned -5`".
 
  - Fixed a bug where `--delete-during` could delete in a directory before it
    noticed that the sending side sent an I/O error for that directory (both
@@ -1189,7 +1451,7 @@
  - An absolute-path filter rule (i.e. with a '/' modifier) no longer loses its
    modifier when sending the filter rules to the remote rsync.
 
- - Improved the "--delete does not work without -r or -d" message.
+ - Improved the "`--delete does not work without -r or -d`" message.
 
  - Improved rsync's handling of `--timeout` to avoid a weird timeout case where
    the sender could timeout even though it has recently written data to the
@@ -1224,7 +1486,6 @@
  - The testsuite no longer uses `id -u`, so it works better on Solaris.
 
 ------------------------------------------------------------------------------
-<a name="3.0.6"></a>
 
 # NEWS for rsync 3.0.6 (8 May 2009)
 
@@ -1283,7 +1544,6 @@
  - Fixed an failure transferring special files from Solaris to Linux.
 
 ------------------------------------------------------------------------------
-<a name="3.0.5"></a>
 
 # NEWS for rsync 3.0.5 (28 Dec 2008)
 
@@ -1343,12 +1603,11 @@
 
 ### ENHANCEMENTS:
 
- - Made the support/atomic-rsync script able to perform a fully atomic update
-   of the copied hierarchy when the destination is setup using a particular
-   symlink idiom.
+ - Made the atomic-rsync script able to perform a fully atomic update of the
+   copied hierarchy when the destination is setup using a particular symlink
+   idiom. (See the support dir.)
 
 ------------------------------------------------------------------------------
-<a name="3.0.4"></a>
 
 # NEWS for rsync 3.0.4 (6 Sep 2008)
 
@@ -1416,7 +1675,6 @@
    even more consistency checks on the files.
 
 ------------------------------------------------------------------------------
-<a name="3.0.3"></a>
 
 # NEWS for rsync 3.0.3 (29 Jun 2008)
 
@@ -1496,18 +1754,17 @@
    of files, and the ensuring that daemon excludes can't affect a dot-dir arg.
 
  - Improved some build rules for those that build in a separate directory from
-   the source, including better install rules for the man pages, and the fixing
+   the source, including better install rules for the manpages, and the fixing
    of a proto.h-tstamp rule that could make the binaries get rebuild without
    cause.
 
- - Improved the testsuite to work around a problem with some utilities (e.g. cp
-   -p & touch -r) rounding sub-second timestamps.
+ - Improved the testsuite to work around a problem with some utilities (e.g.
+   `cp -p` & `touch -r`) rounding sub-second timestamps.
 
  - Ensure that the early patches don't cause any generated-file hunks to
    bleed-over into patches that follow.
 
 ------------------------------------------------------------------------------
-<a name="3.0.2"></a>
 
 # NEWS for rsync 3.0.2 (8 Apr 2008)
 
@@ -1529,7 +1786,6 @@
    packaging dir.
 
 ------------------------------------------------------------------------------
-<a name="3.0.1"></a>
 
 # NEWS for rsync 3.0.1 (3 Apr 2008)
 
@@ -1613,8 +1869,9 @@
 
  - Fixed the inclusion of per-dir merge files from implied dirs.
 
- - Fixed the support/rrsync script to work with the latest options that rsync
-   sends (including its flag-specifying use of `-e` to the server).
+ - Fixed the rrsync script to work with the latest options that rsync sends,
+   including its flag-specifying use of `-e` to the server. (See the support
+   dir.)
 
 ### ENHANCEMENTS:
 
@@ -1667,7 +1924,6 @@
  - Updated the build scripts to work with a revised FTP directory structure.
 
 ------------------------------------------------------------------------------
-<a name="3.0.0"></a>
 
 # NEWS for rsync 3.0.0 (1 Mar 2008)
 
@@ -2018,7 +2274,6 @@
    the 3.0.0 release.
 
 ------------------------------------------------------------------------------
-<a name="2.6.9"></a>
 
 # NEWS for rsync 2.6.9 (6 Nov 2006)
 
@@ -2107,7 +2362,7 @@
 
  - Added the `--log-file=FILE` and `--log-file-format=FORMAT` options. These
    can be used to tell any rsync to output what it is doing to a log file.
-   They work with a client rsync, a non-daemon server rsync (see the man page
+   They work with a client rsync, a non-daemon server rsync (see the manpage
    for instructions), and also allows the overriding of rsyncd.conf settings
    when starting a daemon.
 
@@ -2178,7 +2433,6 @@
    consistent opening comments.
 
 ------------------------------------------------------------------------------
-<a name="2.6.8"></a>
 
 # NEWS for rsync 2.6.8 (22 Apr 2006)
 
@@ -2248,7 +2502,6 @@
    actions to a file (something that only a daemon supports at present).
 
 ------------------------------------------------------------------------------
-<a name="2.6.7"></a>
 
 # NEWS for rsync 2.6.7 (11 Mar 2006)
 
@@ -2263,7 +2516,7 @@
    option, below.
 
  - The way rsync escapes unreadable characters has changed. First, rsync now
-   has support for recognizing valid multibyte character sequences in your
+   has support for recognizing valid multi-byte character sequences in your
    current locale, allowing it to escape fewer characters than before for a
    locale such as UTF-8. Second, it now uses an escape idiom of `\#123`, which
    is the literal string `\#` followed by exactly 3 octal digits. Rsync no
@@ -2403,7 +2656,7 @@
  - Added two config items to the rsyncd.conf parsing: `pre-xfer exec` and
    `post-xfer exec`. These allow a command to be specified on a per-module
    basis that will be run before and/or after a daemon-mode transfer. (See the
-   man page for a list of the environment variables that are set with
+   manpage for a list of the environment variables that are set with
    information about the transfer.)
 
  - When using the `--relative` option, you can now insert a dot dir in the
@@ -2572,7 +2825,6 @@
    ~/.popt.
 
 ------------------------------------------------------------------------------
-<a name="2.6.6"></a>
 
 # NEWS for rsync 2.6.6 (28 Jul 2005)
 
@@ -2618,10 +2870,10 @@
  - Made the `max verbosity` setting in the rsyncd.conf file settable on a
    per-module basis (which now matches the documentation).
 
- - The support/rrsync script has been upgraded to verify the args of options
-   that take args (instead of rejecting any such options). The script was also
-   changed to try to be more secure and to fix a problem in the parsing of a
-   pull operation that has multiple sources.
+ - The rrsync script has been upgraded to verify the args of options that take
+   args (instead of rejecting any such options). It was also changed to try to
+   be more secure and to fix a problem in the parsing of a pull operation that
+   has multiple source args. (See the support dir.)
 
  - Improved the documentation that explains the difference between a normal
    daemon transfer and a daemon-over remote-shell transfer.
@@ -2638,7 +2890,6 @@
    (log-format w/%i) and some double-verbose messages.
 
 ------------------------------------------------------------------------------
-<a name="2.6.5"></a>
 
 # NEWS for rsync 2.6.5 (1 Jun 2005)
 
@@ -2773,7 +3024,7 @@
    usually run with the `--no-detach` option that was necessary to see the
    error on stderr).
 
- - The man pages now consistently refer to an rsync daemon as a `daemon`
+ - The manpages now consistently refer to an rsync daemon as a `daemon`
    instead of a `server` (to distinguish it from the server process in a
    non-daemon transfer).
 
@@ -2819,7 +3070,6 @@
    enables the optional copying of extended attributes.
 
 ------------------------------------------------------------------------------
-<a name="2.6.4"></a>
 
 # NEWS for rsync 2.6.4 (30 March 2005)
 
@@ -3201,7 +3451,6 @@
  - Improved configure to better handle cross-compiling.
 
 ------------------------------------------------------------------------------
-<a name="2.6.3"></a>
 
 # NEWS for rsync 2.6.3 (30 Sep 2004)
 
@@ -3342,12 +3591,12 @@
    without using a temporary file. The matching of existing data in the
    destination file can be severely limited by this, but there are also cases
    where this is more efficient (such as appending data).  Use only when needed
-   (see the man page for more details).
+   (see the manpage for more details).
 
  - Added the `write only` option for the daemon's config file.
 
  - Added long-option names for `-4` and `-6` (namely `--ipv4` and `--ipv6`) and
-   documented all these options in the man page.
+   documented all these options in the manpage.
 
  - Improved the handling of the `--bwlimit` option so that it's less bursty,
    more accurate, and works properly over a larger range of values.
@@ -3422,7 +3671,7 @@
 ### BUILD CHANGES:
 
  - Added a `gen` target to rebuild most of the generated files, including
-   configure, config.h.in, the man pages, and proto.h.
+   configure, config.h.in, the manpages, and proto.h.
 
  - If `make proto` doesn't find some changes in the prototypes, the proto.h
    file is left untouched (its time-stamp used to always be updated).
@@ -3445,7 +3694,6 @@
    removed.
 
 ------------------------------------------------------------------------------
-<a name="2.6.2"></a>
 
 # NEWS for rsync 2.6.2 (30 Apr 2004)
 
@@ -3487,7 +3735,6 @@
  - Two new diffs were added to the patches dir.
 
 ------------------------------------------------------------------------------
-<a name="2.6.1"></a>
 
 # NEWS for rsync 2.6.1 (26 Apr 2004)
 
@@ -3679,7 +3926,6 @@
    applied, and rebuilt the rest.
 
 ------------------------------------------------------------------------------
-<a name="2.6.0"></a>
 
 # NEWS for rsync 2.6.0 (1 Jan 2004)
 
@@ -3819,7 +4065,6 @@
    other side (primarily for testing purposes).  (Wayne Davison)
 
 ------------------------------------------------------------------------------
-<a name="2.5.7"></a>
 
 # NEWS for rsync 2.5.7 (4 Dec 2003)
 
@@ -3831,7 +4076,6 @@
    Andrea Barisani)
 
 ------------------------------------------------------------------------------
-<a name="2.5.6"></a>
 
 # NEWS for rsync 2.5.6, aka "the dwd-between-jobs release" (26 Jan 2003)
 
@@ -3926,7 +4170,6 @@
    should build on more platforms. (Paul Green)
 
 ------------------------------------------------------------------------------
-<a name="2.5.5"></a>
 
 # NEWS for rsync 2.5.5, aka Snowy River (2 Apr 2002)
 
@@ -3965,7 +4208,6 @@
  - Improved network error handling. (Greg A. Woods)
 
 ------------------------------------------------------------------------------
-<a name="2.5.4"></a>
 
 # NEWS for rsync 2.5.4, aka "Imitation lizard skin" (13 Mar 2002)
 
@@ -3985,7 +4227,6 @@
  - Additional test cases for `--compress`. (Martin Pool)
 
 ------------------------------------------------------------------------------
-<a name="2.5.3"></a>
 
 # NEWS for rsync 2.5.3, aka "Happy 26" (11 Mar 2002)
 
@@ -4028,13 +4269,12 @@
  - Added `--no-whole-file` and `--no-blocking-io` options (Dave Dykstra)
 
  - Made the `--write-batch` and `--read-batch` options actually work and added
-   documentation in the man page (Jos Backus)
+   documentation in the manpage (Jos Backus)
 
  - If the daemon is unable to fork a child to accept a connection, print an
    error message. (Colin Walters)
 
 ------------------------------------------------------------------------------
-<a name="2.5.2"></a>
 
 # NEWS for rsync 2.5.2 (26 Jan 2002)
 
@@ -4083,7 +4323,6 @@
    Razor. (Debian #124286)
 
 ------------------------------------------------------------------------------
-<a name="2.5.1"></a>
 
 # NEWS for rsync 2.5.1 (3 Jan 2002)
 
@@ -4118,7 +4357,6 @@
  - Clearer error messages for some conditions.
 
 ------------------------------------------------------------------------------
-<a name="2.5.0"></a>
 
 # NEWS for rsync 2.5.0 (30 Nov 2001)
 
@@ -4210,7 +4448,7 @@
    - HP PA-RISC HP-UX 11.11 cc
    - IRIX 6.5 MIPS cc
    - IRIX 6.5 MIPS gcc
-   - Mac OS X PPC (--disable-ipv6) cc
+   - Mac OS X PPC (`--disable-ipv6`) cc
    - NetBSD 1.5 i386 gcc
    - NetBSD Current i386 cc
    - OpenBSD 2.5 Sparc gcc
@@ -4244,6 +4482,7 @@
 
 | RELEASE DATE | VER.   | DATE OF COMMIT\* | PROTOCOL    |
 |--------------|--------|------------------|-------------|
+| ?? Apr 2022  | 3.2.4  |                  | 31          |
 | 06 Aug 2020  | 3.2.3  |                  | 31          |
 | 04 Jul 2020  | 3.2.2  |                  | 31          |
 | 22 Jun 2020  | 3.2.1  |                  | 31          |
@@ -4314,3 +4553,5 @@
 
 \* DATE OF COMMIT is the date the protocol change was committed to version
 control.
+
+@USE_GFM_PARSER@
diff --git a/README.md b/README.md
index 45c3d74d..a86c7710 100644
--- a/README.md
+++ b/README.md
@@ -23,8 +23,9 @@ options.  To get a complete list of supported options type:
 
     rsync --help
 
-See the manpage for more detailed information.
+See the [manpage][0] for more detailed information.
 
+[0]: https://download.samba.org/pub/rsync/rsync.1
 
 BUILDING AND INSTALLING
 -----------------------
@@ -64,8 +65,8 @@ RSYNC DAEMONS
 -------------
 
 Rsync can also talk to "rsync daemons" which can provide anonymous or
-authenticated rsync.  See the rsyncd.conf(5) man page for details on how
-to setup an rsync daemon.  See the rsync(1) man page for info on how to
+authenticated rsync.  See the rsyncd.conf(5) manpage for details on how
+to setup an rsync daemon.  See the rsync(1) manpage for info on how to
 connect to an rsync daemon.
 
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..c2435741
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+
+Only the current release of the software is actively supported.  If you need
+help backporting fixes into an older release, feel free to ask.
+
+## Reporting a Vulnerability
+
+Email your vulnerability information to rsync's maintainer:
+
+  Wayne Davison <wayne@opencoder.net>
diff --git a/access.c b/access.c
index 39a7752a..b6afce37 100644
--- a/access.c
+++ b/access.c
@@ -2,7 +2,7 @@
  * Routines to authenticate access to a daemon (hosts allow/deny).
  *
  * Copyright (C) 1998 Andrew Tridgell
- * Copyright (C) 2004-2020 Wayne Davison
+ * Copyright (C) 2004-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -20,6 +20,9 @@
 
 #include "rsync.h"
 #include "ifuncs.h"
+#ifdef HAVE_NETGROUP_H
+#include <netgroup.h>
+#endif
 
 static int allow_forward_dns;
 
diff --git a/acls.c b/acls.c
index 4303c2a7..12e662cf 100644
--- a/acls.c
+++ b/acls.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2006-2020 Wayne Davison
+ * Copyright (C) 2006-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -763,6 +763,7 @@ static int recv_rsync_acl(int f, item_list *racl_list, SMB_ACL_TYPE_T type, mode
 #ifdef HAVE_OSX_ACLS
 	/* If we received a superfluous mask, throw it away. */
 	duo_item->racl.mask_obj = NO_ENTRY;
+	(void)mode;
 #else
 	if (duo_item->racl.names.count && duo_item->racl.mask_obj == NO_ENTRY) {
 		/* Mask must be non-empty with lists. */
diff --git a/backup.c b/backup.c
index be406bef..686cb297 100644
--- a/backup.c
+++ b/backup.c
@@ -2,7 +2,7 @@
  * Backup handling code.
  *
  * Copyright (C) 1999 Andrew Tridgell
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -304,7 +304,8 @@ int make_backup(const char *fname, BOOL prefer_rename)
 #endif
 
 	if (!ret && !S_ISREG(file->mode)) {
-		rprintf(FINFO, "make_bak: skipping non-regular file %s\n", fname);
+		if (INFO_GTE(NONREG, 1))
+			rprintf(FINFO, "make_bak: skipping non-regular file %s\n", fname);
 		unmake_file(file);
 #ifdef SUPPORT_ACLS
 		uncache_tmp_acls();
diff --git a/checksum.c b/checksum.c
index 1ed76828..b723109c 100644
--- a/checksum.c
+++ b/checksum.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2004-2020 Wayne Davison
+ * Copyright (C) 2004-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -179,7 +179,7 @@ int canonical_checksum(int csum_type)
 	return 0;
 }
 
-#ifndef HAVE_SIMD /* See simd-checksum-*.cpp. */
+#ifndef USE_ROLL_SIMD /* See simd-checksum-*.cpp. */
 /*
   a simple 32 bit checksum that can be updated from either end
   (inspired by Mark Adler's Adler-32 checksum)
@@ -222,23 +222,23 @@ void get_checksum2(char *buf, int32 len, char *sum)
 	  }
 #endif
 	  case CSUM_MD5: {
-		MD5_CTX m5;
+		md5_context m5;
 		uchar seedbuf[4];
-		MD5_Init(&m5);
+		md5_begin(&m5);
 		if (proper_seed_order) {
 			if (checksum_seed) {
 				SIVALu(seedbuf, 0, checksum_seed);
-				MD5_Update(&m5, seedbuf, 4);
+				md5_update(&m5, seedbuf, 4);
 			}
-			MD5_Update(&m5, (uchar *)buf, len);
+			md5_update(&m5, (uchar *)buf, len);
 		} else {
-			MD5_Update(&m5, (uchar *)buf, len);
+			md5_update(&m5, (uchar *)buf, len);
 			if (checksum_seed) {
 				SIVALu(seedbuf, 0, checksum_seed);
-				MD5_Update(&m5, seedbuf, 4);
+				md5_update(&m5, seedbuf, 4);
 			}
 		}
-		MD5_Final((uchar *)sum, &m5);
+		md5_result(&m5, (uchar *)sum);
 		break;
 	  }
 	  case CSUM_MD4:
@@ -374,18 +374,18 @@ void file_checksum(const char *fname, const STRUCT_STAT *st_p, char *sum)
 	  }
 #endif
 	  case CSUM_MD5: {
-		MD5_CTX m5;
+		md5_context m5;
 
-		MD5_Init(&m5);
+		md5_begin(&m5);
 
 		for (i = 0; i + CHUNK_SIZE <= len; i += CHUNK_SIZE)
-			MD5_Update(&m5, (uchar *)map_ptr(buf, i, CHUNK_SIZE), CHUNK_SIZE);
+			md5_update(&m5, (uchar *)map_ptr(buf, i, CHUNK_SIZE), CHUNK_SIZE);
 
 		remainder = (int32)(len - i);
 		if (remainder > 0)
-			MD5_Update(&m5, (uchar *)map_ptr(buf, i, remainder), remainder);
+			md5_update(&m5, (uchar *)map_ptr(buf, i, remainder), remainder);
 
-		MD5_Final((uchar *)sum, &m5);
+		md5_result(&m5, (uchar *)sum);
 		break;
 	  }
 	  case CSUM_MD4:
@@ -443,7 +443,7 @@ static union {
 #ifdef USE_OPENSSL
 	MD4_CTX m4;
 #endif
-	MD5_CTX m5;
+	md5_context m5;
 } ctx;
 #ifdef SUPPORT_XXHASH
 static XXH64_state_t* xxh64_state;
@@ -482,7 +482,7 @@ void sum_init(int csum_type, int seed)
 		break;
 #endif
 	  case CSUM_MD5:
-		MD5_Init(&ctx.m5);
+		md5_begin(&ctx.m5);
 		break;
 	  case CSUM_MD4:
 #ifdef USE_OPENSSL
@@ -532,7 +532,7 @@ void sum_update(const char *p, int32 len)
 		break;
 #endif
 	  case CSUM_MD5:
-		MD5_Update(&ctx.m5, (uchar *)p, len);
+		md5_update(&ctx.m5, (uchar *)p, len);
 		break;
 	  case CSUM_MD4:
 #ifdef USE_OPENSSL
@@ -597,7 +597,7 @@ int sum_end(char *sum)
 	  }
 #endif
 	  case CSUM_MD5:
-		MD5_Final((uchar *)sum, &ctx.m5);
+		md5_result(&ctx.m5, (uchar *)sum);
 		break;
 	  case CSUM_MD4:
 #ifdef USE_OPENSSL
diff --git a/clientname.c b/clientname.c
index 30e888cd..ea94894b 100644
--- a/clientname.c
+++ b/clientname.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1992-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2002-2020 Wayne Davison
+ * Copyright (C) 2002-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -49,7 +49,7 @@ static char ipaddr_buf[100];
 
 static void client_sockaddr(int fd, struct sockaddr_storage *ss, socklen_t *ss_len);
 static int check_name(const char *ipaddr, const struct sockaddr_storage *ss, char *name_buf, size_t name_buf_size);
-static int valid_ipaddr(const char *s);
+static int valid_ipaddr(const char *s, int allow_scope);
 
 /* Return the IP addr of the client as a string. */
 char *client_addr(int fd)
@@ -73,7 +73,7 @@ char *client_addr(int fd)
 			if ((p = strchr(ipaddr_buf, ' ')) != NULL)
 				*p = '\0';
 		}
-		if (valid_ipaddr(ipaddr_buf))
+		if (valid_ipaddr(ipaddr_buf, True))
 			return ipaddr_buf;
 	}
 
@@ -213,12 +213,14 @@ int read_proxy_protocol_header(int fd)
 				if (size != sizeof hdr.v2.addr.ip4)
 					return 0;
 				inet_ntop(AF_INET, hdr.v2.addr.ip4.src_addr, ipaddr_buf, sizeof ipaddr_buf);
-				return valid_ipaddr(ipaddr_buf);
+				return valid_ipaddr(ipaddr_buf, False);
+#ifdef INET6
 			case PROXY_FAM_TCPv6:
 				if (size != sizeof hdr.v2.addr.ip6)
 					return 0;
 				inet_ntop(AF_INET6, hdr.v2.addr.ip6.src_addr, ipaddr_buf, sizeof ipaddr_buf);
-				return valid_ipaddr(ipaddr_buf);
+				return valid_ipaddr(ipaddr_buf, False);
+#endif
 			default:
 				break;
 			}
@@ -274,7 +276,7 @@ int read_proxy_protocol_header(int fd)
 		if ((sp = strchr(p, ' ')) == NULL)
 			return 0;
 		*sp = '\0';
-		if (!valid_ipaddr(p))
+		if (!valid_ipaddr(p, False))
 			return 0;
 		strlcpy(ipaddr_buf, p, sizeof ipaddr_buf); /* It will always fit when valid. */
 
@@ -282,7 +284,7 @@ int read_proxy_protocol_header(int fd)
 		if ((sp = strchr(p, ' ')) == NULL)
 			return 0;
 		*sp = '\0';
-		if (!valid_ipaddr(p))
+		if (!valid_ipaddr(p, False))
 			return 0;
 		/* Ignore destination address. */
 
@@ -464,7 +466,7 @@ static int check_name(const char *ipaddr, const struct sockaddr_storage *ss, cha
 }
 
 /* Returns 1 for a valid IPv4 or IPv6 addr, or 0 for a bad one. */
-static int valid_ipaddr(const char *s)
+static int valid_ipaddr(const char *s, int allow_scope)
 {
 	int i;
 
@@ -482,6 +484,11 @@ static int valid_ipaddr(const char *s)
 		for (count = 0; count < 8; count++) {
 			if (!*s)
 				return saw_double_colon;
+			if (allow_scope && *s == '%') {
+				if (saw_double_colon)
+					break;
+				return 0;
+			}
 
 			if (strchr(s, ':') == NULL && strchr(s, '.') != NULL) {
 				if ((!saw_double_colon && count != 6) || (saw_double_colon && count > 6))
@@ -507,8 +514,11 @@ static int valid_ipaddr(const char *s)
 			}
 		}
 
-		if (!ipv4_at_end)
-			return !*s;
+		if (!ipv4_at_end) {
+			if (allow_scope && *s == '%')
+				for (s++; isAlNum(s); s++) { }
+			return !*s && s[-1] != '%';
+		}
 	}
 
 	/* IPv4 */
diff --git a/clientserver.c b/clientserver.c
index 48c15a60..66311d3e 100644
--- a/clientserver.c
+++ b/clientserver.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1998-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 2001-2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2002-2020 Wayne Davison
+ * Copyright (C) 2002-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -47,6 +47,7 @@ extern int protocol_version;
 extern int io_timeout;
 extern int no_detach;
 extern int write_batch;
+extern int old_style_args;
 extern int default_af_hint;
 extern int logfile_format_has_i;
 extern int logfile_format_has_o_or_i;
@@ -288,20 +289,45 @@ int start_inband_exchange(int f_in, int f_out, const char *user, int argc, char
 
 	sargs[sargc++] = ".";
 
+	if (!old_style_args)
+		snprintf(line, sizeof line, " %.*s/", modlen, modname);
+
 	while (argc > 0) {
 		if (sargc >= MAX_ARGS - 1) {
 		  arg_overflow:
 			rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
 			exit_cleanup(RERR_SYNTAX);
 		}
-		if (strncmp(*argv, modname, modlen) == 0
-		 && argv[0][modlen] == '\0')
+		if (strncmp(*argv, modname, modlen) == 0 && argv[0][modlen] == '\0')
 			sargs[sargc++] = modname; /* we send "modname/" */
-		else if (**argv == '-') {
-			if (asprintf(sargs + sargc++, "./%s", *argv) < 0)
-				out_of_memory("start_inband_exchange");
-		} else
-			sargs[sargc++] = *argv;
+		else {
+			char *arg = *argv;
+			int extra_chars = *arg == '-' ? 2 : 0; /* a leading dash needs a "./" prefix. */
+			/* If --old-args was not specified, make sure that the arg won't split at a mod name! */
+			if (!old_style_args && (p = strstr(arg, line)) != NULL) {
+				do {
+					extra_chars += 2;
+				} while ((p = strstr(p+1, line)) != NULL);
+			}
+			if (extra_chars) {
+				char *f = arg;
+				char *t = arg = new_array(char, strlen(arg) + extra_chars + 1);
+				if (*f == '-') {
+					*t++ = '.';
+					*t++ = '/';
+				}
+				while (*f) {
+					if (*f == ' ' && strncmp(f, line, modlen+2) == 0) {
+						*t++ = '[';
+						*t++ = *f++;
+						*t++ = ']';
+					} else
+						*t++ = *f++;
+				}
+				*t = '\0';
+			}
+			sargs[sargc++] = arg;
+		}
 		argv++;
 		argc--;
 	}
@@ -380,7 +406,7 @@ int start_inband_exchange(int f_in, int f_out, const char *user, int argc, char
 	return 0;
 }
 
-#ifdef HAVE_PUTENV
+#if defined HAVE_SETENV || defined HAVE_PUTENV
 static int read_arg_from_pipe(int fd, char *buf, int limit)
 {
 	char *bp = buf, *eob = buf + limit - 1;
@@ -405,23 +431,57 @@ static int read_arg_from_pipe(int fd, char *buf, int limit)
 
 static void set_env_str(const char *var, const char *str)
 {
+#ifdef HAVE_SETENV
+	if (setenv(var, str, 1) < 0)
+		out_of_memory("set_env_str");
+#else
 #ifdef HAVE_PUTENV
 	char *mem;
 	if (asprintf(&mem, "%s=%s", var, str) < 0)
 		out_of_memory("set_env_str");
 	putenv(mem);
+#else
+	(void)var;
+	(void)str;
+#endif
 #endif
 }
 
+#if defined HAVE_SETENV || defined HAVE_PUTENV
+
+static void set_envN_str(const char *var, int num, const char *str)
+{
+#ifdef HAVE_SETENV
+	char buf[128];
+	(void)snprintf(buf, sizeof buf, "%s%d", var, num);
+	if (setenv(buf, str, 1) < 0)
+		out_of_memory("set_env_str");
+#else
 #ifdef HAVE_PUTENV
+	char *mem;
+	if (asprintf(&mem, "%s%d=%s", var, num, str) < 0)
+		out_of_memory("set_envN_str");
+	putenv(mem);
+#endif
+#endif
+}
+
 void set_env_num(const char *var, long num)
 {
+#ifdef HAVE_SETENV
+	char val[64];
+	(void)snprintf(val, sizeof val, "%ld", num);
+	if (setenv(var, val, 1) < 0)
+		out_of_memory("set_env_str");
+#else
+#ifdef HAVE_PUTENV
 	char *mem;
 	if (asprintf(&mem, "%s=%ld", var, num) < 0)
 		out_of_memory("set_env_num");
 	putenv(mem);
-}
 #endif
+#endif
+}
 
 /* Used for "early exec", "pre-xfer exec", and the "name converter" script. */
 static pid_t start_pre_exec(const char *cmd, int *arg_fd_ptr, int *error_fd_ptr)
@@ -451,15 +511,13 @@ static pid_t start_pre_exec(const char *cmd, int *arg_fd_ptr, int *error_fd_ptr)
 		set_env_str("RSYNC_REQUEST", buf);
 
 		for (j = 0; ; j++) {
-			char *p;
 			len = read_arg_from_pipe(arg_fd, buf, BIGPATHBUFLEN);
 			if (len <= 0) {
 				if (!len)
 					break;
 				_exit(1);
 			}
-			if (asprintf(&p, "RSYNC_ARG%d=%s", j, buf) >= 0)
-				putenv(p);
+			set_envN_str("RSYNC_ARG", j, buf);
 		}
 
 		dup2(arg_fd, STDIN_FILENO);
@@ -490,6 +548,8 @@ static pid_t start_pre_exec(const char *cmd, int *arg_fd_ptr, int *error_fd_ptr)
 	return pid;
 }
 
+#endif
+
 static void write_pre_exec_args(int write_fd, char *request, char **early_argv, char **argv, int exec_type)
 {
 	int j = 0;
@@ -809,7 +869,7 @@ static int rsync_module(int f_in, int f_out, int i, const char *addr, const char
 
 	log_init(1);
 
-#ifdef HAVE_PUTENV
+#if defined HAVE_SETENV || defined HAVE_PUTENV
 	if ((*lp_early_exec(module_id) || *lp_prexfer_exec(module_id)
 	  || *lp_postxfer_exec(module_id) || *lp_name_converter(module_id))
 	 && !getenv("RSYNC_NO_XFER_EXEC")) {
diff --git a/cmdormsg b/cmd-or-msg
similarity index 100%
rename from cmdormsg
rename to cmd-or-msg
diff --git a/compat.c b/compat.c
index bbabd117..b8967969 100644
--- a/compat.c
+++ b/compat.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) Andrew Tridgell 1996
  * Copyright (C) Paul Mackerras 1996
- * Copyright (C) 2004-2020 Wayne Davison
+ * Copyright (C) 2004-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -21,6 +21,7 @@
 
 #include "rsync.h"
 #include "itypes.h"
+#include "ifuncs.h"
 
 extern int am_server;
 extern int am_sender;
@@ -51,6 +52,8 @@ extern int need_messages_from_generator;
 extern int delete_mode, delete_before, delete_during, delete_after;
 extern int do_compression;
 extern int do_compression_level;
+extern int saw_stderr_opt;
+extern int msgs2stderr;
 extern char *shell_cmd;
 extern char *partial_dir;
 extern char *files_from;
@@ -153,7 +156,13 @@ static void check_sub_protocol(void)
 
 void set_allow_inc_recurse(void)
 {
-	client_info = shell_cmd ? shell_cmd : "";
+	if (!local_server)
+		client_info = shell_cmd ? shell_cmd : "";
+	else if (am_server) {
+		char buf[64];
+		maybe_add_e_option(buf, sizeof buf);
+		client_info = *buf ? strdup(buf+1) : ""; /* The +1 skips the leading "e". */
+	}
 
 	if (!recurse || use_qsort)
 		allow_inc_recurse = 0;
@@ -161,8 +170,7 @@ void set_allow_inc_recurse(void)
 	 && (delete_before || delete_after
 	  || delay_updates || prune_empty_dirs))
 		allow_inc_recurse = 0;
-	else if (am_server && !local_server
-	 && (strchr(client_info, 'i') == NULL))
+	else if (am_server && strchr(client_info, 'i') == NULL)
 		allow_inc_recurse = 0;
 }
 
@@ -558,7 +566,7 @@ void setup_protocol(int f_out,int f_in)
 		atimes_ndx = (file_extra_cnt += EXTRA64_CNT);
 	if (preserve_crtimes)
 		crtimes_ndx = (file_extra_cnt += EXTRA64_CNT);
-	if (am_sender) /* This is most likely in the in64 union as well. */
+	if (am_sender) /* This is most likely in the file_extras64 union as well. */
 		pathname_ndx = (file_extra_cnt += PTR_EXTRA_CNT);
 	else
 		depth_ndx = ++file_extra_cnt;
@@ -596,7 +604,7 @@ void setup_protocol(int f_out,int f_in)
 	if (remote_protocol < MIN_PROTOCOL_VERSION
 	 || remote_protocol > MAX_PROTOCOL_VERSION) {
 		rprintf(FERROR,"protocol version mismatch -- is your shell clean?\n");
-		rprintf(FERROR,"(see the rsync man page for an explanation)\n");
+		rprintf(FERROR,"(see the rsync manpage for an explanation)\n");
 		exit_cleanup(RERR_PROTOCOL);
 	}
 	if (remote_protocol < OLD_PROTOCOL_VERSION) {
@@ -616,6 +624,9 @@ void setup_protocol(int f_out,int f_in)
 	if (read_batch)
 		check_batch_flags();
 
+	if (!saw_stderr_opt && protocol_version <= 28 && am_server)
+		msgs2stderr = 0; /* The client side may not have stderr setup for us. */
+
 #ifndef SUPPORT_PREALLOCATION
 	if (preallocate_files && !am_sender) {
 		rprintf(FERROR, "preallocation is not supported on this %s\n",
@@ -691,17 +702,17 @@ void setup_protocol(int f_out,int f_in)
 #ifdef ICONV_OPTION
 			compat_flags |= CF_SYMLINK_ICONV;
 #endif
-			if (local_server || strchr(client_info, 'f') != NULL)
+			if (strchr(client_info, 'f') != NULL)
 				compat_flags |= CF_SAFE_FLIST;
-			if (local_server || strchr(client_info, 'x') != NULL)
+			if (strchr(client_info, 'x') != NULL)
 				compat_flags |= CF_AVOID_XATTR_OPTIM;
-			if (local_server || strchr(client_info, 'C') != NULL)
+			if (strchr(client_info, 'C') != NULL)
 				compat_flags |= CF_CHKSUM_SEED_FIX;
-			if (local_server || strchr(client_info, 'I') != NULL)
+			if (strchr(client_info, 'I') != NULL)
 				compat_flags |= CF_INPLACE_PARTIAL_DIR;
-			if (local_server || strchr(client_info, 'u') != NULL)
+			if (strchr(client_info, 'u') != NULL)
 				compat_flags |= CF_ID0_NAMES;
-			if (local_server || strchr(client_info, 'v') != NULL) {
+			if (strchr(client_info, 'v') != NULL) {
 				do_negotiated_strings = 1;
 				compat_flags |= CF_VARINT_FLIST_FLAGS;
 			}
@@ -737,7 +748,7 @@ void setup_protocol(int f_out,int f_in)
 #endif
 #ifdef ICONV_OPTION
 		sender_symlink_iconv = iconv_opt && (am_server
-		    ? local_server || strchr(client_info, 's') != NULL
+		    ? strchr(client_info, 's') != NULL
 		    : !!(compat_flags & CF_SYMLINK_ICONV));
 #endif
 		if (inc_recurse && !allow_inc_recurse) {
diff --git a/configure.ac b/configure.ac
index 64d2e6d6..24e383a9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,6 +2,21 @@ dnl Process this file with autoconf to produce a configure script.
 
 AC_INIT([rsync],[ ],[https://rsync.samba.org/bug-tracking.html])
 
+AC_C_BIGENDIAN
+AC_HEADER_DIRENT
+AC_HEADER_TIME
+AC_HEADER_SYS_WAIT
+AC_CHECK_HEADERS(sys/fcntl.h sys/select.h fcntl.h sys/time.h sys/unistd.h \
+    unistd.h utime.h compat.h sys/param.h ctype.h sys/wait.h sys/stat.h \
+    sys/ioctl.h sys/filio.h string.h stdlib.h sys/socket.h sys/mode.h grp.h \
+    sys/un.h sys/attr.h arpa/inet.h arpa/nameser.h locale.h sys/types.h \
+    netdb.h malloc.h float.h limits.h iconv.h libcharset.h langinfo.h mcheck.h \
+    sys/acl.h acl/libacl.h attr/xattr.h sys/xattr.h sys/extattr.h dl.h \
+    popt.h popt/popt.h linux/falloc.h netinet/in_systm.h netgroup.h \
+    zlib.h xxhash.h openssl/md4.h openssl/md5.h zstd.h lz4.h sys/file.h)
+AC_CHECK_HEADERS([netinet/ip.h], [], [], [[#include <netinet/in.h>]])
+AC_HEADER_MAJOR_FIXED
+
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_SRCDIR([byteorder.h])
 AC_CONFIG_HEADER(config.h)
@@ -26,7 +41,7 @@ AC_CONFIG_LIBOBJ_DIR([lib])
 
 AC_MSG_CHECKING([whether to include debugging symbols])
 AC_ARG_ENABLE(debug,
-	AS_HELP_STRING([--disable-debug],[disable debugging symbols and features]))
+	AS_HELP_STRING([--disable-debug],[disable to omit debugging symbols and features]))
 
 if test x"$enable_debug" = x"no"; then
     AC_MSG_RESULT(no)
@@ -63,12 +78,12 @@ nl='
 '
 
 AC_ARG_ENABLE(profile,
-	AS_HELP_STRING([--enable-profile],[turn on CPU profiling]))
+	AS_HELP_STRING([--enable-profile],[enable to turn on CPU profiling]))
 if test x"$enable_profile" = x"yes"; then
 	CFLAGS="$CFLAGS -pg"
 fi
 
-AC_MSG_CHECKING([if md2man can create man pages])
+AC_MSG_CHECKING([if md2man can create manpages])
 if test x"$ac_cv_path_PYTHON3" = x; then
     AC_MSG_RESULT(no - python3 not found)
     md2man_works=no
@@ -86,7 +101,7 @@ fi
 
 AC_MSG_CHECKING([if we require man-page building])
 AC_ARG_ENABLE([md2man],
-	AS_HELP_STRING([--disable-md2man],[disable md2man for man page creation]))
+	AS_HELP_STRING([--disable-md2man],[disable to omit manpage creation]))
 if test x"$enable_md2man" != x"no"; then
     if test -f "$srcdir/rsync.1"; then
 	AC_MSG_RESULT(optional)
@@ -94,7 +109,7 @@ if test x"$enable_md2man" != x"no"; then
 	AC_MSG_RESULT(required)
 	if test x"$md2man_works" = x"no"; then
 	    err_msg="$err_msg$nl- You need python3 and either the cmarkgfm OR commonmark python3 lib in order"
-	    err_msg="$err_msg$nl  to build man pages based on the git source (man pages are included in the"
+	    err_msg="$err_msg$nl  to build manpages based on the git source (manpages are included in the"
 	    err_msg="$err_msg$nl  official release tar files)."
 	    no_lib="$no_lib md2man"
 	fi
@@ -102,12 +117,11 @@ if test x"$enable_md2man" != x"no"; then
     MAKE_MAN=man
 else
     AC_MSG_RESULT(no)
-    MAKE_MAN=''
 fi
 
 # Specifically, this turns on panic_action handling.
 AC_ARG_ENABLE(maintainer-mode,
-	AS_HELP_STRING([--enable-maintainer-mode],[turn on extra debug features]))
+	AS_HELP_STRING([--enable-maintainer-mode],[enable to turn on extra debug features]))
 if test x"$enable_maintainer_mode" = x"yes"; then
 	CFLAGS="$CFLAGS -DMAINTAINER_MODE"
 fi
@@ -121,6 +135,17 @@ if test x"$GCC" = x"yes"; then
 	CFLAGS="$CFLAGS -Wall -W"
 fi
 
+AC_ARG_WITH(rrsync,
+        AS_HELP_STRING([--with-rrsync],[also install the rrsync script and its manpage]))
+if test x"$with_rrsync" != x"yes"; then
+    with_rrsync=no
+else
+    MAKE_RRSYNC='rrsync'
+    MAKE_RRSYNC_1='rrsync.1'
+    GEN_RRSYNC='rrsync.1 rrsync.1.html'
+fi
+AC_SUBST(with_rrsync)
+
 AC_ARG_WITH(included-popt,
         AS_HELP_STRING([--with-included-popt],[use bundled popt library, not from system]))
 
@@ -180,6 +205,11 @@ AC_DEFINE_UNQUOTED(RSYNC_RSH, "$RSYNC_RSH", [default -e command])
 AC_PATH_PROG(SHELL_PATH, sh, /bin/sh, [/usr/xpg4/bin$PATH_SEPARATOR$PATH])
 AC_PATH_PROG(FAKEROOT_PATH, fakeroot, /usr/bin/fakeroot, [/usr/xpg4/bin$PATH_SEPARATOR$PATH])
 
+AC_ARG_WITH(nobody-user,
+    AS_HELP_STRING([--with-nobody-user=USER],[set the default unprivileged user (default nobody)]),
+    [ NOBODY_USER="$with_nobody_user" ],
+    [ NOBODY_USER="nobody" ])
+
 AC_ARG_WITH(nobody-group,
     AS_HELP_STRING([--with-nobody-group=GROUP],[set the default unprivileged group (default nobody or nogroup)]),
     [ NOBODY_GROUP="$with_nobody_group" ])
@@ -196,24 +226,22 @@ if test x"$with_nobody_group" = x; then
     AC_MSG_RESULT($NOBODY_GROUP)
 fi
 
-AC_DEFINE_UNQUOTED(NOBODY_USER, "nobody", [unprivileged user--e.g. nobody])
+AC_DEFINE_UNQUOTED(NOBODY_USER, "$NOBODY_USER", [unprivileged user--e.g. nobody])
 AC_DEFINE_UNQUOTED(NOBODY_GROUP, "$NOBODY_GROUP", [unprivileged group for unprivileged user])
 
-# SIMD optimizations
-SIMD=
+# rolling-checksum SIMD optimizations
+ROLL_SIMD=
 
-AC_MSG_CHECKING([whether to enable SIMD optimizations])
-AC_ARG_ENABLE(simd,
-    AS_HELP_STRING([--disable-simd],[disable SIMD optimizations (requires c++)]))
+AC_MSG_CHECKING([whether to enable rolling-checksum SIMD optimizations])
+AC_ARG_ENABLE(roll-simd,
+    AS_HELP_STRING([--enable-roll-simd],[enable/disable to control rolling-checksum SIMD optimizations (requires c++)]))
 
 # Clag is crashing with -g -O2, so we'll get rid of -g for now.
 CXXFLAGS=`echo "$CXXFLAGS" | sed 's/-g //'`
-
-if test x"$enable_simd" != x"no"; then
-    # For x86-64 SIMD, g++ >=5 or clang++ >=7 is required
-    if test x"$build_cpu" = x"x86_64"; then
-	AC_LANG(C++)
-	AC_RUN_IFELSE([AC_LANG_PROGRAM([[#include <stdio.h>
+m4_define(SIMD_X86_64_TEST, [[#include <stdio.h>
+#if HAVE_STDLIB_H
+#include <stdlib.h>
+#endif
 #include <immintrin.h>
 __attribute__ ((target("default"))) int test_ssse3(int x) { return x; }
 __attribute__ ((target("default"))) int test_sse2(int x) { return x; }
@@ -233,27 +261,45 @@ __attribute__ ((target("ssse3"))) void more_testing(char* buf, int len)
 	in8_2 = _mm_lddqu_si128((__m128i_u*)&buf[i + 16]);
     }
 }
-]], [[if (test_ssse3(42) != 42 || test_sse2(42) != 42 || test_avx2(42) != 42) exit(1);]])],[CXX_OK=yes],[CXX_OK=no])
+]])
+
+if test x"$enable_roll_simd" = x""; then
+    case "$host_os" in
+	*linux*) ;;
+	*) enable_roll_simd=no ;;
+    esac
+fi
+
+if test x"$enable_roll_simd" != x"no"; then
+    # For x86-64 SIMD, g++ >=5 or clang++ >=7 is required
+    if test x"$host_cpu" = x"x86_64" || test x"$host_cpu" = x"amd64"; then
+	AC_LANG(C++)
+	if test x"$host" = x"$build"; then
+	    AC_RUN_IFELSE([AC_LANG_PROGRAM([SIMD_X86_64_TEST],[[if (test_ssse3(42) != 42 || test_sse2(42) != 42 || test_avx2(42) != 42) exit(1);]])],
+		[CXX_OK=yes],[CXX_OK=no])
+	else
+	    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([SIMD_X86_64_TEST])],[CXX_OK=yes],[CXX_OK=no])
+	fi
 	AC_LANG(C)
 	if test x"$CXX_OK" = x"yes"; then
 	    # AC_MSG_RESULT() is called below.
-	    SIMD="x86_64"
-	elif test x"$enable_simd" = x"yes"; then
+	    ROLL_SIMD="$host_cpu"
+	elif test x"$enable_roll_simd" = x"yes"; then
 	    AC_MSG_RESULT(error)
-	    AC_MSG_ERROR(The SIMD compilation test failed.
-Omit --enable-simd to continue without it.)
+	    AC_MSG_ERROR(The rolling-checksum SIMD compilation test failed.
+Omit --enable-roll-simd to continue without it.)
 	fi
-    elif test x"$enable_simd" = x"yes"; then
+    elif test x"$enable_roll_simd" = x"yes"; then
         AC_MSG_RESULT(unavailable)
-        AC_MSG_ERROR(The SIMD optimizations are currently x86_64 only.
-Omit --enable-simd to continue without it.)
+        AC_MSG_ERROR(The rolling-checksum SIMD optimizations are currently x86_64|amd64 only.
+Omit --enable-roll-simd to continue without it.)
     fi
 fi
 
-if test x"$SIMD" != x""; then
-    AC_MSG_RESULT([yes ($SIMD)])
-    AC_DEFINE(HAVE_SIMD, 1, [Define to 1 to enable SIMD optimizations])
-    SIMD='$(SIMD_'"$SIMD)"
+if test x"$ROLL_SIMD" != x""; then
+    AC_MSG_RESULT([yes ($ROLL_SIMD)])
+    AC_DEFINE(USE_ROLL_SIMD, 1, [Define to 1 to enable rolling-checksum SIMD optimizations])
+    ROLL_SIMD='$(ROLL_SIMD_'"$ROLL_SIMD)"
     # We only use c++ for its target attribute dispatching, disable unneeded bulky features
     CXXFLAGS="$CXXFLAGS -fno-exceptions -fno-rtti"
     # Apple often has "g++" as a symlink for clang. Try to find out the truth.
@@ -265,7 +311,7 @@ else
     AC_MSG_RESULT(no)
 fi
 
-AC_SUBST(SIMD)
+AC_SUBST(ROLL_SIMD)
 
 AC_MSG_CHECKING([if assembler accepts noexecstack])
 OLD_CFLAGS="$CFLAGS"
@@ -276,43 +322,19 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ ]], [[return 0;]])],
 CFLAGS="$OLD_CFLAGS"
 AC_SUBST(NOEXECSTACK)
 
-ASM=
-
-AC_MSG_CHECKING([whether to enable ASM optimizations])
-AC_ARG_ENABLE(asm,
-    AS_HELP_STRING([--disable-asm],[disable ASM optimizations]))
-
-if test x"$enable_asm" != x"no"; then
-    if test x"$build_cpu" = x"x86_64"; then
-	ASM="$build_cpu"
-    elif test x"$enable_asm" = x"yes"; then
-        AC_MSG_RESULT(unavailable)
-        AC_MSG_ERROR(The ASM optimizations are currently x86_64 only.
-Omit --enable-asm to continue without it.)
-    fi
-fi
-
-if test x"$ASM" != x""; then
-    AC_MSG_RESULT([yes ($ASM)])
-    AC_DEFINE(HAVE_ASM, 1, [Define to 1 to enable ASM optimizations])
-    ASM='$(ASM_'"$ASM)"
-else
-    AC_MSG_RESULT(no)
-fi
-
-AC_SUBST(ASM)
-
 # arrgh. libc in some old debian version screwed up the largefile
 # stuff, getting byte range locking wrong
 AC_CACHE_CHECK([for broken largefile support],rsync_cv_HAVE_BROKEN_LARGEFILE,[
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #define _FILE_OFFSET_BITS 64
-#include <stdio.h>
-#include <fcntl.h>
-#include <sys/types.h>
+$ac_includes_default
+#ifdef HAVE_FCNTL_H
+# include <fcntl.h>
+#elif defined HAVE_SYS_FCNTL_H
+# include <sys/fcntl.h>
+#endif
+#ifdef HAVE_SYS_WAIT_H
 #include <sys/wait.h>
-#if HAVE_UNISTD_H
-#include <unistd.h>
 #endif
 
 int main(void)
@@ -345,132 +367,39 @@ if test x"$rsync_cv_HAVE_BROKEN_LARGEFILE" != x"yes"; then
    AC_SYS_LARGEFILE
 fi
 
-ipv6type=unknown
-ipv6lib=none
-ipv6trylibc=yes
-
+AC_MSG_CHECKING([whether to enable ipv6])
 AC_ARG_ENABLE(ipv6,
-	AS_HELP_STRING([--disable-ipv6],[turn off IPv6 support]))
-if test x"$enable_ipv6" != x"no"; then
-	AC_MSG_CHECKING([ipv6 stack type])
-	for i in inria kame linux-glibc linux-inet6 solaris toshiba v6d zeta cygwin TANDEM; do
-		case $i in
-		inria)
-			# http://www.kame.net/
-			AC_EGREP_CPP(yes, [
-#include <netinet/in.h>
-#ifdef IPV6_INRIA_VERSION
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])
-				])
-			;;
-		kame)
-			# http://www.kame.net/
-			AC_EGREP_CPP(yes, [
-#include <netinet/in.h>
-#ifdef __KAME__
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		linux-glibc)
-			# http://www.v6.linux.or.jp/
-			AC_EGREP_CPP(yes, [
-#include <features.h>
-#if defined(__GLIBC__) && __GLIBC__ >= 2 && __GLIBC_MINOR__ >= 1
-yes
-#endif],
-				[ipv6type=$i;
-AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		linux-inet6)
-			# http://www.v6.linux.or.jp/
-			if test -d /usr/inet6 -o -f /usr/inet6/lib/libinet6.a; then
-				ipv6type=$i
-				ipv6lib=inet6
-				ipv6libdir=/usr/inet6/lib
-				ipv6trylibc=yes;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])
-				CFLAGS="-I/usr/inet6/include $CFLAGS"
-			fi
-			;;
-		solaris)
-			# http://www.sun.com
-			AC_EGREP_CPP(yes, [
-#include <netinet/ip6.h>
-#ifdef __sun
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		toshiba)
-			AC_EGREP_CPP(yes, [
-#include <sys/param.h>
-#ifdef _TOSHIBA_INET6
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=inet6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		v6d)
-			AC_EGREP_CPP(yes, [
-#include </usr/local/v6/include/sys/v6config.h>
-#ifdef __V6D__
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=v6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		zeta)
-			AC_EGREP_CPP(yes, [
-#include <sys/param.h>
-#ifdef _ZETA_MINAMI_INET6
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=inet6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		cygwin)
-			AC_EGREP_CPP(yes, [
-#include <netinet/in.h>
-#ifdef _CYGWIN_IN6_H
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		TANDEM)
-			AC_EGREP_CPP(yes, [
-#include <netinet/ip6.h>
-#ifdef __TANDEM
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		esac
-		if test "$ipv6type" != "unknown"; then
-			break
-		fi
-	done
-	AC_MSG_RESULT($ipv6type)
+AS_HELP_STRING([--disable-ipv6],[disable to omit ipv6 support]),
+[ case "$enableval" in
+  no)
+	AC_MSG_RESULT(no)
+	;;
+  *)	AC_MSG_RESULT(yes)
+	AC_DEFINE(INET6, 1, [true if you have IPv6])
+	;;
+  esac ],
 
-	AC_SEARCH_LIBS(getaddrinfo, inet6)
-fi
+  AC_TRY_RUN([ /* AF_INET6 availability check */
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+main()
+{
+   if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
+     exit(1);
+   else
+     exit(0);
+}
+],
+  AC_MSG_RESULT(yes)
+  AC_DEFINE(INET6, 1, [true if you have IPv6]),
+  AC_MSG_RESULT(no),
+  AC_MSG_RESULT(no)
+))
 
 dnl Do you want to disable use of locale functions
 AC_ARG_ENABLE([locale],
-	AS_HELP_STRING([--disable-locale],[disable locale features]))
+	AS_HELP_STRING([--disable-locale],[disable to omit locale features]))
 AH_TEMPLATE([CONFIG_LOCALE],
 [Undefine if you do not want locale features.  By default this is defined.])
 if test x"$enable_locale" != x"no"; then
@@ -486,30 +415,17 @@ case $host_os in
 	       * ) AC_MSG_RESULT(no);;
 esac
 
-AC_C_BIGENDIAN
-AC_HEADER_DIRENT
-AC_HEADER_TIME
-AC_HEADER_SYS_WAIT
-AC_CHECK_HEADERS(sys/fcntl.h sys/select.h fcntl.h sys/time.h sys/unistd.h \
-    unistd.h utime.h grp.h compat.h sys/param.h ctype.h sys/wait.h \
-    sys/ioctl.h sys/filio.h string.h stdlib.h sys/socket.h sys/mode.h \
-    sys/un.h sys/attr.h mcheck.h arpa/inet.h arpa/nameser.h locale.h \
-    netdb.h malloc.h float.h limits.h iconv.h libcharset.h langinfo.h \
-    sys/acl.h acl/libacl.h attr/xattr.h sys/xattr.h sys/extattr.h dl.h \
-    popt.h popt/popt.h linux/falloc.h netinet/in_systm.h netinet/ip.h \
-    zlib.h xxhash.h openssl/md4.h openssl/md5.h zstd.h lz4.h sys/file.h)
-AC_HEADER_MAJOR_FIXED
-
 AC_MSG_CHECKING([whether to enable use of openssl crypto library])
 AC_ARG_ENABLE([openssl],
-	AS_HELP_STRING([--disable-openssl],[disable openssl crypto library]))
+	AS_HELP_STRING([--disable-openssl],[disable to omit openssl crypto library]))
 AH_TEMPLATE([USE_OPENSSL],
 [Undefine if you do not want to use openssl crypto library.  By default this is defined.])
 if test x"$enable_openssl" != x"no"; then
     if test x"$ac_cv_header_openssl_md4_h" = x"yes" && test x"$ac_cv_header_openssl_md5_h" = x"yes"; then
       AC_MSG_RESULT(yes)
       AC_SEARCH_LIBS(MD5_Init, crypto,
-          [AC_DEFINE(USE_OPENSSL)],
+          [AC_DEFINE(USE_OPENSSL)
+	   enable_openssl=yes],
           [err_msg="$err_msg$nl- Failed to find MD5_Init function in openssl crypto lib.";
 	   no_lib="$no_lib openssl"])
     else
@@ -517,13 +433,70 @@ if test x"$enable_openssl" != x"no"; then
 	err_msg="$err_msg$nl- Failed to find openssl/md4.h and openssl/md5.h for openssl crypto lib support."
 	no_lib="$no_lib openssl"
     fi
+    if test x"$enable_md5_asm" != x"yes"; then
+	enable_md5_asm=no
+    fi
+else
+    AC_MSG_RESULT(no)
+fi
+
+MD5_ASM=
+
+AC_MSG_CHECKING([whether to enable MD5 ASM optimizations])
+AC_ARG_ENABLE(md5-asm,
+    AS_HELP_STRING([--enable-md5-asm],[enable/disable to control MD5 ASM optimizations]))
+
+if test x"$enable_md5_asm" = x""; then
+    case "$host_os" in
+	*linux*) ;;
+	*) enable_md5_asm=no ;;
+    esac
+fi
+
+if test x"$enable_md5_asm" != x"no"; then
+    if test x"$host_cpu" = x"x86_64" || test x"$host_cpu" = x"amd64"; then
+	MD5_ASM="$host_cpu"
+    elif test x"$enable_md5_asm" = x"yes"; then
+        AC_MSG_RESULT(unavailable)
+        AC_MSG_ERROR(The ASM optimizations are currently x86_64|amd64 only.
+Omit --enable-md5-asm to continue without it.)
+    fi
+fi
+
+if test x"$MD5_ASM" != x""; then
+    AC_MSG_RESULT([yes ($MD5_ASM)])
+    AC_DEFINE(USE_MD5_ASM, 1, [Define to 1 to enable MD5 ASM optimizations])
+    MD5_ASM='$(MD5_ASM_'"$MD5_ASM)"
+else
+    AC_MSG_RESULT(no)
+fi
+
+AC_SUBST(MD5_ASM)
+
+ROLL_ASM=
+
+AC_MSG_CHECKING([whether to enable rolling-checksum ASM optimizations])
+AC_ARG_ENABLE(roll-asm,
+    AS_HELP_STRING([--enable-roll-asm],[enable/disable to control rolling-checksum ASM optimizations (requires --enable-roll-simd)]))
+
+if test x"$ROLL_SIMD" = x""; then
+    enable_roll_asm=no
+fi
+
+if test x"$enable_roll_asm" = x"yes"; then
+    ROLL_ASM="$host_cpu"
+    AC_MSG_RESULT([yes ($ROLL_ASM)])
+    AC_DEFINE(USE_ROLL_ASM, 1, [Define to 1 to enable rolling-checksum ASM optimizations (requires --enable-roll-simd)])
+    ROLL_ASM='$(ROLL_ASM_'"$ROLL_ASM)"
 else
     AC_MSG_RESULT(no)
 fi
 
+AC_SUBST(ROLL_ASM)
+
 AC_MSG_CHECKING([whether to enable xxhash checksum support])
 AC_ARG_ENABLE([xxhash],
-	AS_HELP_STRING([--disable-xxhash],[disable xxhash checksums]))
+	AS_HELP_STRING([--disable-xxhash],[disable to omit xxhash checksums]))
 AH_TEMPLATE([SUPPORT_XXHASH],
 [Undefine if you do not want xxhash checksums.  By default this is defined.])
 if test x"$enable_xxhash" != x"no"; then
@@ -544,7 +517,7 @@ fi
 
 AC_MSG_CHECKING([whether to enable zstd compression])
 AC_ARG_ENABLE([zstd],
-        AC_HELP_STRING([--disable-zstd], [disable zstd compression]))
+        AC_HELP_STRING([--disable-zstd], [disable to omit zstd compression]))
 AH_TEMPLATE([SUPPORT_ZSTD],
 [Undefine if you do not want zstd compression.  By default this is defined.])
 if test x"$enable_zstd" != x"no"; then
@@ -565,7 +538,7 @@ fi
 
 AC_MSG_CHECKING([whether to enable LZ4 compression])
 AC_ARG_ENABLE([lz4],
-        AC_HELP_STRING([--disable-lz4], [disable LZ4 compression]))
+        AC_HELP_STRING([--disable-lz4], [disable to omit LZ4 compression]))
 AH_TEMPLATE([SUPPORT_LZ4],
 [Undefine if you do not want LZ4 compression.  By default this is defined.])
 if test x"$enable_lz4" != x"no"; then
@@ -590,7 +563,7 @@ if test x"$no_lib" != x; then
     echo "$err_msg"
     echo ""
     echo "See the INSTALL file for hints on how to install the missing libraries and/or"
-    echo "how to generate (or fetch) man pages:"
+    echo "how to generate (or fetch) manpages:"
     echo "    https://github.com/WayneD/rsync/blob/master/INSTALL.md"
     echo ""
     echo "To disable one or more features, the relevant configure options are:"
@@ -603,7 +576,9 @@ fi
 
 AC_CACHE_CHECK([if makedev takes 3 args],rsync_cv_MAKEDEV_TAKES_3_ARGS,[
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
 #ifdef MAJOR_IN_MKDEV
 #include <sys/mkdev.h>
 # if !defined makedev && (defined mkdev || defined _WIN32 || defined __WIN32__)
@@ -719,7 +694,9 @@ AC_SEARCH_LIBS(libiconv_open, iconv)
 AC_MSG_CHECKING([for iconv declaration])
 AC_CACHE_VAL(am_cv_proto_iconv, [
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#if HAVE_STDLIB_H
 #include <stdlib.h>
+#endif
 #include <iconv.h>
 extern
 #ifdef __cplusplus
@@ -743,31 +720,47 @@ dnl AC_MSG_NOTICE([Looking in libraries: $LIBS])
 AC_REPLACE_FUNCS([inet_ntop inet_pton])
 
 AC_HAVE_TYPE([struct addrinfo], [#include <netdb.h>])
-AC_HAVE_TYPE([struct sockaddr_storage], [#include <sys/types.h>
-#include <sys/socket.h>])
+AC_HAVE_TYPE([struct sockaddr_storage], [
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif])
 
 # Irix 6.5 has getaddrinfo but not the corresponding defines, so use
 #   builtin getaddrinfo if one of the defines don't exist
 AC_CACHE_CHECK([whether defines needed by getaddrinfo exist],
                rsync_cv_HAVE_GETADDR_DEFINES,[
 			AC_EGREP_CPP(yes, [
-			#include <sys/types.h>
-			#include <sys/socket.h>
-			#include <netdb.h>
-			#ifdef AI_PASSIVE
-			yes
-			#endif],
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef AI_PASSIVE
+yes
+#endif],
 			rsync_cv_HAVE_GETADDR_DEFINES=yes,
 			rsync_cv_HAVE_GETADDR_DEFINES=no)])
-AS_IF([test x"$rsync_cv_HAVE_GETADDR_DEFINES" = x"yes" -a x"$ac_cv_type_struct_addrinfo" = x"yes"],[
+AS_IF([test x"$rsync_cv_HAVE_GETADDR_DEFINES" = x"yes" && test x"$ac_cv_type_struct_addrinfo" = x"yes"],[
 	# Tru64 UNIX has getaddrinfo() but has it renamed in libc as
 	# something else so we must include <netdb.h> to get the
 	# redefinition.
 	AC_CHECK_FUNCS(getaddrinfo, ,
 		[AC_MSG_CHECKING([for getaddrinfo by including <netdb.h>])
-		AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
-		#include <sys/socket.h>
-		#include <netdb.h>]], [[getaddrinfo(NULL, NULL, NULL, NULL);]])],[AC_MSG_RESULT([yes])
+		AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif
+#include <netdb.h>]], [[getaddrinfo(NULL, NULL, NULL, NULL);]])],[AC_MSG_RESULT([yes])
 			AC_DEFINE(HAVE_GETADDRINFO, 1,
 				[Define to 1 if you have the "getaddrinfo" function and required types.])],[AC_MSG_RESULT([no])
 			AC_LIBOBJ([getaddrinfo])])])
@@ -777,16 +770,24 @@ AC_CHECK_MEMBER([struct sockaddr.sa_len],
 		[ AC_DEFINE(HAVE_SOCKADDR_LEN, 1, [Do we have sockaddr.sa_len?]) ],
 		[],
 		[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
 ])
 
 AC_CHECK_MEMBER([struct sockaddr_in.sin_len],
 		[ AC_DEFINE(HAVE_SOCKADDR_IN_LEN, 1, [Do we have sockaddr_in.sin_len?]) ],
 		[],
 		[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 ])
 
@@ -794,8 +795,12 @@ AC_CHECK_MEMBER([struct sockaddr_un.sun_len],
 		[ AC_DEFINE(HAVE_SOCKADDR_UN_LEN, 1, [Do we have sockaddr_un.sun_len?]) ],
 		[],
 		[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 ])
 
@@ -803,8 +808,12 @@ AC_CHECK_MEMBER([struct sockaddr_in6.sin6_scope_id],
 		[ AC_DEFINE(HAVE_SOCKADDR_IN6_SCOPE_ID, 1, [Do we have sockaddr_in6.sin6_scope_id?]) ],
 		[],
 		[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 ])
 
@@ -848,11 +857,12 @@ AC_CHECK_FUNCS(waitpid wait4 getcwd chown chmod lchmod mknod mkfifo \
     fchmod fstat ftruncate strchr readlink link utime utimes lutimes strftime \
     chflags getattrlist mktime innetgr linkat \
     memmove lchown vsnprintf snprintf vasprintf asprintf setsid strpbrk \
-    strlcat strlcpy strtol mallinfo getgroups setgroups geteuid getegid \
+    strlcat strlcpy strtol mallinfo mallinfo2 getgroups setgroups geteuid getegid \
     setlocale setmode open64 lseek64 mkstemp64 mtrace va_copy __va_copy \
     seteuid strerror putenv iconv_open locale_charset nl_langinfo getxattr \
     extattr_get_link sigaction sigprocmask setattrlist getgrouplist \
-    initgroups utimensat posix_fallocate attropen setvbuf nanosleep usleep)
+    initgroups utimensat posix_fallocate attropen setvbuf nanosleep usleep \
+    setenv unsetenv)
 
 dnl cygwin iconv.h defines iconv_open as libiconv_open
 if test x"$ac_cv_func_iconv_open" != x"yes"; then
@@ -863,7 +873,9 @@ dnl Preallocation stuff (also fallocate, posix_fallocate function tests above):
 
 AC_CACHE_CHECK([for useable fallocate],rsync_cv_have_fallocate,[
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <fcntl.h>
-#include <sys/types.h>]], [[fallocate(0, 0, 0, 0);]])],[rsync_cv_have_fallocate=yes],[rsync_cv_have_fallocate=no])])
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif]], [[fallocate(0, 0, 0, 0);]])],[rsync_cv_have_fallocate=yes],[rsync_cv_have_fallocate=no])])
 if test x"$rsync_cv_have_fallocate" = x"yes"; then
     AC_DEFINE(HAVE_FALLOCATE, 1, [Define to 1 if you have the fallocate function and it compiles and links without error])
 fi
@@ -900,8 +912,12 @@ AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
 
 AC_CACHE_CHECK([for SYS_fallocate],rsync_cv_have_sys_fallocate,[
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <sys/syscall.h>
+#ifdef HAVE_UNISTD_H
 #include <unistd.h>
-#include <sys/types.h>]], [[syscall(SYS_fallocate, 0, 0, (loff_t)0, (loff_t)0);]])],[rsync_cv_have_sys_fallocate=yes],[rsync_cv_have_sys_fallocate=no])])
+#endif
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif]], [[syscall(SYS_fallocate, 0, 0, (loff_t)0, (loff_t)0);]])],[rsync_cv_have_sys_fallocate=yes],[rsync_cv_have_sys_fallocate=no])])
 if test x"$rsync_cv_have_sys_fallocate" = x"yes"; then
     AC_DEFINE(HAVE_SYS_FALLOCATE, 1, [Define to 1 if you have the SYS_fallocate syscall number])
 fi
@@ -928,7 +944,7 @@ if test $ac_cv_func_getpgrp = yes; then
 fi
 
 AC_ARG_ENABLE(iconv-open,
-    AS_HELP_STRING([--disable-iconv-open],[disable all use of iconv_open() function]),
+    AS_HELP_STRING([--disable-iconv-open],[disable to avoid all use of iconv_open()]),
     [], [enable_iconv_open=$ac_cv_func_iconv_open])
 
 if test x"$enable_iconv_open" != x"no"; then
@@ -936,7 +952,7 @@ if test x"$enable_iconv_open" != x"no"; then
 fi
 
 AC_ARG_ENABLE(iconv,
-    AS_HELP_STRING([--disable-iconv],[disable rsync's --iconv option]),
+    AS_HELP_STRING([--disable-iconv],[disable to omit the --iconv option]),
     [], [enable_iconv=$enable_iconv_open])
 AH_TEMPLATE([ICONV_OPTION],
 [Define if you want the --iconv option.  Specifying a value will set the
@@ -1020,8 +1036,12 @@ fi
 
 AC_CACHE_CHECK([for working socketpair],rsync_cv_HAVE_SOCKETPAIR,[
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
 
 int main(void) {
        int fd[2];
@@ -1046,6 +1066,21 @@ elif test x"$ac_cv_header_popt_h" != x"yes"; then
     with_included_popt=yes
 fi
 
+if test x"$GCC" = x"yes"; then
+    if test x"$with_included_popt" != x"yes"; then
+	# Turn pedantic warnings into errors to ensure an array-init overflow is an error.
+	CFLAGS="$CFLAGS -pedantic-errors"
+    else
+	# Our internal popt code cannot be compiled with pedantic warnings as errors, so try to
+	# turn off pedantic warnings (which will not lose the error for array-init overflow).
+	# Older gcc versions don't understand -Wno-pedantic, so check if --help=warnings lists
+	# -Wpedantic and use that as a flag.
+	case `$CC --help=warnings 2>/dev/null | grep Wpedantic` in
+	    *-Wpedantic*) CFLAGS="$CFLAGS -pedantic-errors -Wno-pedantic" ;;
+	esac
+    fi
+fi
+
 AC_MSG_CHECKING([whether to use included libpopt])
 if test x"$with_included_popt" = x"yes"; then
     AC_MSG_RESULT($srcdir/popt)
@@ -1088,7 +1123,10 @@ if test x"$rsync_cv_SIGNED_CHAR_OK" = x"yes"; then
 fi
 
 AC_CACHE_CHECK([for broken readdir],rsync_cv_HAVE_BROKEN_READDIR,[
-AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <sys/types.h>
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
 #include <dirent.h>
 int main(void) { struct dirent *di; DIR *d = opendir("."); di = readdir(d);
 if (di && di->d_name[-2] == '.' && di->d_name[-1] == 0 &&
@@ -1098,7 +1136,10 @@ if test x"$rsync_cv_HAVE_BROKEN_READDIR" = x"yes"; then
 fi
 
 AC_CACHE_CHECK([for utimbuf],rsync_cv_HAVE_STRUCT_UTIMBUF,[
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
 #include <utime.h>]], [[struct utimbuf tbuf;  tbuf.actime = 0; tbuf.modtime = 1; return utime("foo.c",&tbuf);]])],[rsync_cv_HAVE_STRUCT_UTIMBUF=yes],[rsync_cv_HAVE_STRUCT_UTIMBUF=no])])
 if test x"$rsync_cv_HAVE_STRUCT_UTIMBUF" = x"yes"; then
     AC_DEFINE(HAVE_STRUCT_UTIMBUF, 1, [Define to 1 if you have the "struct utimbuf" type])
@@ -1106,17 +1147,23 @@ fi
 
 AC_CACHE_CHECK([if gettimeofday takes tz argument],rsync_cv_HAVE_GETTIMEOFDAY_TZ,[
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <sys/time.h>
-#include <unistd.h>]], [[struct timeval tv; return gettimeofday(&tv, NULL);]])],[rsync_cv_HAVE_GETTIMEOFDAY_TZ=yes],[rsync_cv_HAVE_GETTIMEOFDAY_TZ=no])])
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif]], [[struct timeval tv; return gettimeofday(&tv, NULL);]])],[rsync_cv_HAVE_GETTIMEOFDAY_TZ=yes],[rsync_cv_HAVE_GETTIMEOFDAY_TZ=no])])
 if test x"$rsync_cv_HAVE_GETTIMEOFDAY_TZ" != x"no"; then
     AC_DEFINE(HAVE_GETTIMEOFDAY_TZ, 1, [Define to 1 if gettimeofday() takes a time-zone arg])
 fi
 
 AC_CACHE_CHECK([for C99 vsnprintf],rsync_cv_HAVE_C99_VSNPRINTF,[
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
 #include <stdarg.h>
 #include <stdio.h>
+#if HAVE_STDLIB_H
 #include <stdlib.h>
+#endif
 #include <string.h>
 void foo(const char *format, ...) {
        va_list ap;
@@ -1139,9 +1186,13 @@ fi
 
 AC_CACHE_CHECK([for secure mkstemp],rsync_cv_HAVE_SECURE_MKSTEMP,[
 AC_RUN_IFELSE([AC_LANG_SOURCE([[#include <stdlib.h>
+#ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
+#endif
 #include <sys/stat.h>
+#ifdef HAVE_UNISTD_H
 #include <unistd.h>
+#endif
 int main(void) {
   struct stat st;
   char tpl[20]="/tmp/test.XXXXXX";
@@ -1230,6 +1281,9 @@ AC_SUBST(OBJ_RESTORE)
 AC_SUBST(CC_SHOBJ_FLAG)
 AC_SUBST(BUILD_POPT)
 AC_SUBST(BUILD_ZLIB)
+AC_SUBST(MAKE_RRSYNC)
+AC_SUBST(MAKE_RRSYNC_1)
+AC_SUBST(GEN_RRSYNC)
 AC_SUBST(MAKE_MAN)
 
 AC_CHECK_FUNCS(_acl __acl _facl __facl)
@@ -1238,7 +1292,7 @@ AC_CHECK_FUNCS(_acl __acl _facl __facl)
 
 AC_MSG_CHECKING([whether to support ACLs])
 AC_ARG_ENABLE(acl-support,
-	AS_HELP_STRING([--disable-acl-support],[disable ACL support]))
+	AS_HELP_STRING([--disable-acl-support],[disable to omit ACL support]))
 
 if test x"$enable_acl_support" = x"no"; then
     AC_MSG_RESULT(no)
@@ -1284,16 +1338,26 @@ else
 	AC_MSG_RESULT(running tests:)
 	AC_CHECK_LIB(acl,acl_get_file)
 	AC_CACHE_CHECK([for ACL support],samba_cv_HAVE_POSIX_ACLS,[
-	    AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
-#include <sys/acl.h>]], [[ acl_t acl; int entry_id; acl_entry_t *entry_p; return acl_get_entry( acl, entry_id, entry_p);]])],[samba_cv_HAVE_POSIX_ACLS=yes],[samba_cv_HAVE_POSIX_ACLS=no])])
+	    AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_ACL_H
+#include <sys/acl.h>
+#endif]], [[ acl_t acl; int entry_id; acl_entry_t *entry_p; return acl_get_entry( acl, entry_id, entry_p);]])],[samba_cv_HAVE_POSIX_ACLS=yes],[samba_cv_HAVE_POSIX_ACLS=no])])
 	AC_MSG_CHECKING(ACL test results)
 	if test x"$samba_cv_HAVE_POSIX_ACLS" = x"yes"; then
 	    AC_MSG_RESULT(Using posix ACLs)
 	    AC_DEFINE(HAVE_POSIX_ACLS, 1, [true if you have posix ACLs])
 	    AC_DEFINE(SUPPORT_ACLS, 1)
 	    AC_CACHE_CHECK([for acl_get_perm_np],samba_cv_HAVE_ACL_GET_PERM_NP,[
-		AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
-#include <sys/acl.h>]], [[ acl_permset_t permset_d; acl_perm_t perm; return acl_get_perm_np( permset_d, perm);]])],[samba_cv_HAVE_ACL_GET_PERM_NP=yes],[samba_cv_HAVE_ACL_GET_PERM_NP=no])])
+		AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_SYS_ACL_H
+#include <sys/acl.h>
+#endif]], [[ acl_permset_t permset_d; acl_perm_t perm; return acl_get_perm_np( permset_d, perm);]])],[samba_cv_HAVE_ACL_GET_PERM_NP=yes],[samba_cv_HAVE_ACL_GET_PERM_NP=no])])
 	    if test x"$samba_cv_HAVE_ACL_GET_PERM_NP" = x"yes"; then
 		AC_DEFINE(HAVE_ACL_GET_PERM_NP, 1, [true if you have acl_get_perm_np])
 	    fi
@@ -1312,7 +1376,7 @@ fi
 # check for extended attribute support
 AC_MSG_CHECKING(whether to support extended attributes)
 AC_ARG_ENABLE(xattr-support,
-    AS_HELP_STRING([--disable-xattr-support],[disable extended attributes]),
+    AS_HELP_STRING([--disable-xattr-support],[disable to omit extended attributes]),
     [], [case "$ac_cv_func_getxattr$ac_cv_func_extattr_get_link$ac_cv_func_attropen" in
 	*yes*) enable_xattr_support=maybe ;;
 	*) enable_xattr_support=no ;;
@@ -1358,7 +1422,7 @@ else
     esac
 fi
 
-if test x"$enable_acl_support" = x"no" -o x"$enable_xattr_support" = x"no" -o x"$enable_iconv" = x"no"; then
+if test x"$enable_acl_support" = x"no" || test x"$enable_xattr_support" = x"no" || test x"$enable_iconv" = x"no"; then
     AC_MSG_CHECKING([whether $CC supports -Wno-unused-parameter])
     OLD_CFLAGS="$CFLAGS"
     CFLAGS="$CFLAGS -Wno-unused-parameter"
diff --git a/exclude.c b/exclude.c
index e0957443..39073a0c 100644
--- a/exclude.c
+++ b/exclude.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2002 Martin Pool
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -152,13 +152,17 @@ static void add_rule(filter_rule_list *listp, const char *pat, unsigned int pat_
 {
 	const char *cp;
 	unsigned int pre_len, suf_len, slash_cnt = 0;
+	char *mention_rule_suffix;
 
-	if (DEBUG_GTE(FILTER, 2)) {
-		rprintf(FINFO, "[%s] add_rule(%s%.*s%s)%s\n",
+	if (DEBUG_GTE(FILTER, 1) && pat_len && (pat[pat_len-1] == ' ' || pat[pat_len-1] == '\t'))
+		mention_rule_suffix = " -- CAUTION: trailing whitespace!";
+	else
+		mention_rule_suffix = DEBUG_GTE(FILTER, 2) ? "" : NULL;
+	if (mention_rule_suffix) {
+		rprintf(FINFO, "[%s] add_rule(%s%.*s%s)%s%s\n",
 			who_am_i(), get_rule_prefix(rule, pat, 0, NULL),
-			(int)pat_len, pat,
-			(rule->rflags & FILTRULE_DIRECTORY) ? "/" : "",
-			listp->debug_type);
+			(int)pat_len, pat, (rule->rflags & FILTRULE_DIRECTORY) ? "/" : "",
+			listp->debug_type, mention_rule_suffix);
 	}
 
 	/* These flags also indicate that we're reading a list that
diff --git a/flist.c b/flist.c
index 5a1e4245..1ba306bc 100644
--- a/flist.c
+++ b/flist.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2002-2020 Wayne Davison
+ * Copyright (C) 2002-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -43,6 +43,7 @@ extern int use_qsort;
 extern int xfer_dirs;
 extern int filesfrom_fd;
 extern int one_file_system;
+extern int copy_devices;
 extern int copy_dirlinks;
 extern int preserve_uid;
 extern int preserve_gid;
@@ -295,6 +296,8 @@ static void flist_expand(struct file_list *flist, int extra)
 		flist->malloced = FLIST_START;
 	else if (flist->malloced >= FLIST_LINEAR)
 		flist->malloced += FLIST_LINEAR;
+	else if (flist->malloced < FLIST_START_LARGE/16)
+		flist->malloced *= 4;
 	else
 		flist->malloced *= 2;
 
@@ -305,7 +308,7 @@ static void flist_expand(struct file_list *flist, int extra)
 
 	new_ptr = realloc_array(flist->files, struct file_struct *, flist->malloced);
 
-	if (DEBUG_GTE(FLIST, 1) && flist->malloced != FLIST_START) {
+	if (DEBUG_GTE(FLIST, 1) && flist->files) {
 		rprintf(FCLIENT, "[%s] expand file_list pointer array to %s bytes, did%s move\n",
 		    who_am_i(),
 		    big_num(sizeof flist->files[0] * flist->malloced),
@@ -698,6 +701,7 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 	int alloc_len, basename_len, linkname_len;
 	int extra_len = file_extra_cnt * EXTRA_LEN;
 	int first_hlink_ndx = -1;
+	char real_ISREG_entry;
 	int64 file_length;
 #ifdef CAN_SET_NSEC
 	uint32 modtime_nsec;
@@ -812,6 +816,7 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 				linkname_len = strlen(F_SYMLINK(first)) + 1;
 			else
 				linkname_len = 0;
+			real_ISREG_entry = S_ISREG(mode) ? 1 : 0;
 			goto create_object;
 		}
 	}
@@ -939,10 +944,20 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 #endif
 		linkname_len = 0;
 
+	if (copy_devices && IS_DEVICE(mode)) {
+		/* This is impossible in the official release, but some pre-release patches
+		 * didn't convert the device into a file before sending, so we'll do it here
+		 * (even though the length is typically 0 and any checksum data is zeros). */
+		mode = S_IFREG | (mode & ACCESSPERMS);
+		modtime = time(NULL); /* The mtime on the device is not up-to-date, so set it to "now". */
+		real_ISREG_entry = 0;
+	} else
+		real_ISREG_entry = S_ISREG(mode) ? 1 : 0;
+
 #ifdef SUPPORT_HARD_LINKS
   create_object:
 	if (preserve_hard_links) {
-		if (protocol_version < 28 && S_ISREG(mode))
+		if (protocol_version < 28 && real_ISREG_entry)
 			xflags |= XMIT_HLINKED;
 		if (xflags & XMIT_HLINKED)
 			extra_len += (inc_recurse+1) * EXTRA_LEN;
@@ -1158,8 +1173,8 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 	}
 #endif
 
-	if (always_checksum && (S_ISREG(mode) || protocol_version < 28)) {
-		if (S_ISREG(mode))
+	if (always_checksum && (real_ISREG_entry || protocol_version < 28)) {
+		if (real_ISREG_entry)
 			bp = F_SUM(file);
 		else {
 			/* Prior to 28, we get a useless set of nulls. */
@@ -1358,6 +1373,18 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
 	linkname_len = 0;
 #endif
 
+	if (copy_devices && am_sender && IS_DEVICE(st.st_mode)) {
+		if (st.st_size == 0) {
+			int fd = do_open(fname, O_RDONLY, 0);
+			if (fd >= 0) {
+				st.st_size = get_device_size(fd, fname);
+				close(fd);
+			}
+		}
+		st.st_mode = S_IFREG | (st.st_mode & ACCESSPERMS);
+		st.st_mtime = time(NULL); /* The mtime on the device is not up-to-date, so set it to "now". */
+	}
+
 #ifdef ST_MTIME_NSEC
 	if (st.ST_MTIME_NSEC && protocol_version >= 31)
 		extra_len += EXTRA_LEN;
@@ -1438,7 +1465,7 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
 		F_ATIME(file) = st.st_atime;
 #ifdef SUPPORT_CRTIMES
 	if (crtimes_ndx)
-		F_CRTIME(file) = get_create_time(fname);
+		F_CRTIME(file) = get_create_time(fname, &st);
 #endif
 
 	if (basename != thisname)
@@ -2186,8 +2213,10 @@ struct file_list *send_file_list(int f, int argc, char *argv[])
 #endif
 
 	flist = cur_flist = flist_new(0, "send_file_list");
+	flist_expand(flist, FLIST_START_LARGE);
 	if (inc_recurse) {
 		dir_flist = flist_new(FLIST_TEMP, "send_file_list");
+		flist_expand(dir_flist, FLIST_START_LARGE);
 		flags |= FLAG_DIVERT_DIRS;
 	} else
 		dir_flist = cur_flist;
@@ -2541,10 +2570,13 @@ struct file_list *recv_file_list(int f, int dir_ndx)
 #endif
 
 	flist = flist_new(0, "recv_file_list");
+	flist_expand(flist, FLIST_START_LARGE);
 
 	if (inc_recurse) {
-		if (flist->ndx_start == 1)
+		if (flist->ndx_start == 1) {
 			dir_flist = flist_new(FLIST_TEMP, "recv_file_list");
+			flist_expand(dir_flist, FLIST_START_LARGE);
+		}
 		dstart = dir_flist->used;
 	} else {
 		dir_flist = flist;
diff --git a/generator.c b/generator.c
index f1780838..278e2a6f 100644
--- a/generator.c
+++ b/generator.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2000 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,16 +35,18 @@ extern int inc_recurse;
 extern int relative_paths;
 extern int implied_dirs;
 extern int keep_dirlinks;
+extern int write_devices;
 extern int preserve_acls;
 extern int preserve_xattrs;
 extern int preserve_links;
 extern int preserve_devices;
-extern int write_devices;
 extern int preserve_specials;
 extern int preserve_hard_links;
 extern int preserve_executability;
 extern int preserve_perms;
-extern int preserve_times;
+extern int preserve_mtimes;
+extern int omit_dir_times;
+extern int omit_link_times;
 extern int delete_mode;
 extern int delete_before;
 extern int delete_during;
@@ -112,10 +114,6 @@ static int need_retouch_dir_times;
 static int need_retouch_dir_perms;
 static const char *solo_file = NULL;
 
-enum nonregtype {
-	TYPE_DIR, TYPE_SPECIAL, TYPE_DEVICE, TYPE_SYMLINK
-};
-
 /* Forward declarations. */
 #ifdef SUPPORT_HARD_LINKS
 static void handle_skipped_hlink(struct file_struct *file, int itemizing,
@@ -186,7 +184,8 @@ static int remember_delete(struct file_struct *file, const char *fname, int flag
 static int read_delay_line(char *buf, int *flags_p)
 {
 	static int read_pos = 0;
-	int j, len, mode;
+	unsigned int mode;
+	int j, len;
 	char *bp, *past_space;
 
 	while (1) {
@@ -270,7 +269,7 @@ static void do_delayed_deletions(char *delbuf)
  * MAXPATHLEN buffer with the name of the directory in it (the functions we
  * call will append names onto the end, but the old dir value will be restored
  * on exit). */
-static void delete_in_dir(char *fbuf, struct file_struct *file, dev_t *fs_dev)
+static void delete_in_dir(char *fbuf, struct file_struct *file, dev_t fs_dev)
 {
 	static int already_warned = 0;
 	static struct hashtable *dev_tbl;
@@ -305,12 +304,12 @@ static void delete_in_dir(char *fbuf, struct file_struct *file, dev_t *fs_dev)
 		if (!dev_tbl)
 			dev_tbl = hashtable_create(16, HT_KEY64);
 		if (file->flags & FLAG_TOP_DIR) {
-			hashtable_find(dev_tbl, *fs_dev+1, "");
-			filesystem_dev = *fs_dev;
-		} else if (filesystem_dev != *fs_dev) {
-			if (!hashtable_find(dev_tbl, *fs_dev+1, NULL))
+			hashtable_find(dev_tbl, fs_dev+1, "");
+			filesystem_dev = fs_dev;
+		} else if (filesystem_dev != fs_dev) {
+			if (!hashtable_find(dev_tbl, fs_dev+1, NULL))
 				return;
-			filesystem_dev = *fs_dev; /* it's a prior top-dir dev */
+			filesystem_dev = fs_dev; /* it's a prior top-dir dev */
 		}
 	}
 
@@ -379,9 +378,9 @@ static void do_delete_pass(void)
 		 || !S_ISDIR(st.st_mode))
 			continue;
 
-		delete_in_dir(fbuf, file, &st.st_dev);
+		delete_in_dir(fbuf, file, st.st_dev);
 	}
-	delete_in_dir(NULL, NULL, &dev_zero);
+	delete_in_dir(NULL, NULL, dev_zero);
 
 	if (INFO_GTE(FLIST, 2) && !am_server)
 		rprintf(FINFO, "                    \r");
@@ -402,7 +401,7 @@ static inline int any_time_differs(stat_x *sxp, struct file_struct *file, UNUSED
 #ifdef SUPPORT_CRTIMES
 	if (!differs && crtimes_ndx) {
 		if (sxp->crtime == 0)
-			sxp->crtime = get_create_time(fname);
+			sxp->crtime = get_create_time(fname, &sxp->st);
 		differs = !same_time(sxp->crtime, 0, F_CRTIME(file), 0);
 	}
 #endif
@@ -463,7 +462,7 @@ int unchanged_attrs(const char *fname, struct file_struct *file, stat_x *sxp)
 {
 	if (S_ISLNK(file->mode)) {
 #ifdef CAN_SET_SYMLINK_TIMES
-		if (preserve_times & PRESERVE_LINK_TIMES && any_time_differs(sxp, file, fname))
+		if (preserve_mtimes && !omit_link_times && any_time_differs(sxp, file, fname))
 			return 0;
 #endif
 #ifdef CAN_CHMOD_SYMLINK
@@ -483,7 +482,7 @@ int unchanged_attrs(const char *fname, struct file_struct *file, stat_x *sxp)
 			return 0;
 #endif
 	} else {
-		if (preserve_times && any_time_differs(sxp, file, fname))
+		if (preserve_mtimes && any_time_differs(sxp, file, fname))
 			return 0;
 		if (perms_differ(file, sxp))
 			return 0;
@@ -507,9 +506,9 @@ void itemize(const char *fnamecmp, struct file_struct *file, int ndx, int statre
 	     const char *xname)
 {
 	if (statret >= 0) { /* A from-dest-dir statret can == 1! */
-		int keep_time = !preserve_times ? 0
-		    : S_ISDIR(file->mode) ? preserve_times & PRESERVE_DIR_TIMES
-		    : S_ISLNK(file->mode) ? preserve_times & PRESERVE_LINK_TIMES
+		int keep_time = !preserve_mtimes ? 0
+		    : S_ISDIR(file->mode) ? !omit_dir_times
+		    : S_ISLNK(file->mode) ? !omit_link_times
 		    : 1;
 
 		if (S_ISREG(file->mode) && F_LENGTH(file) != sxp->st.st_size)
@@ -528,12 +527,12 @@ void itemize(const char *fnamecmp, struct file_struct *file, int ndx, int statre
 #ifdef SUPPORT_CRTIMES
 		if (crtimes_ndx) {
 			if (sxp->crtime == 0)
-				sxp->crtime = get_create_time(fnamecmp);
+				sxp->crtime = get_create_time(fnamecmp, &sxp->st);
 			if (!same_time(sxp->crtime, 0, F_CRTIME(file), 0))
 				iflags |= ITEM_REPORT_CRTIME;
 		}
 #endif
-#if !defined HAVE_LCHMOD && !defined HAVE_SETATTRLIST
+#ifndef CAN_CHMOD_SYMLINK
 		if (S_ISLNK(file->mode)) {
 			;
 		} else
@@ -599,31 +598,78 @@ void itemize(const char *fnamecmp, struct file_struct *file, int ndx, int statre
 	}
 }
 
+static enum filetype get_file_type(mode_t mode)
+{
+	if (S_ISREG(mode))
+		return FT_REG;
+	if (S_ISLNK(mode))
+		return FT_SYMLINK;
+	if (S_ISDIR(mode))
+		return FT_DIR;
+	if (IS_SPECIAL(mode))
+		return FT_SPECIAL;
+	if (IS_DEVICE(mode))
+		return FT_DEVICE;
+	return FT_UNSUPPORTED;
+}
 
 /* Perform our quick-check heuristic for determining if a file is unchanged. */
-int unchanged_file(char *fn, struct file_struct *file, STRUCT_STAT *st)
+int quick_check_ok(enum filetype ftype, const char *fn, struct file_struct *file, STRUCT_STAT *st)
 {
-	if (st->st_size != F_LENGTH(file))
-		return 0;
+	switch (ftype) {
+	  case FT_REG:
+		if (st->st_size != F_LENGTH(file))
+			return 0;
 
-	/* if always checksum is set then we use the checksum instead
-	   of the file time to determine whether to sync */
-	if (always_checksum > 0 && S_ISREG(st->st_mode)) {
-		char sum[MAX_DIGEST_LEN];
-		file_checksum(fn, st, sum);
-		return memcmp(sum, F_SUM(file), flist_csum_len) == 0;
-	}
+		/* If always_checksum is set then we use the checksum instead
+		 * of the file mtime to determine whether to sync. */
+		if (always_checksum > 0) {
+			char sum[MAX_DIGEST_LEN];
+			file_checksum(fn, st, sum);
+			return memcmp(sum, F_SUM(file), flist_csum_len) == 0;
+		}
 
-	if (size_only > 0)
-		return 1;
+		if (size_only > 0)
+			return 1;
 
-	if (ignore_times)
-		return 0;
+		if (ignore_times)
+			return 0;
 
-	return !mtime_differs(st, file);
+		if (mtime_differs(st, file))
+			return 0;
+		break;
+	  case FT_DIR:
+		break;
+	  case FT_SYMLINK: {
+#ifdef SUPPORT_LINKS
+		char lnk[MAXPATHLEN];
+		int len = do_readlink(fn, lnk, MAXPATHLEN-1);
+		if (len <= 0)
+			return 0;
+		lnk[len] = '\0';
+		if (strcmp(lnk, F_SYMLINK(file)) != 0)
+			return 0;
+		break;
+#else
+		return -1;
+#endif
+	  }
+	  case FT_SPECIAL:
+		if (!BITS_EQUAL(file->mode, st->st_mode, _S_IFMT))
+			return 0;
+		break;
+	  case FT_DEVICE: {
+		uint32 *devp = F_RDEV_P(file);
+		if (st->st_rdev != MAKEDEV(DEV_MAJOR(devp), DEV_MINOR(devp)))
+			return 0;
+		break;
+	  }
+	  case FT_UNSUPPORTED:
+		return -1;
+	}
+	return 1;
 }
 
-
 /*
  * set (initialize) the size entries in the per-file sum_struct
  * calculating dynamic block and checksum sizes.
@@ -907,7 +953,7 @@ static int try_dests_reg(struct file_struct *file, char *fname, int ndx,
 			best_match = j;
 			match_level = 1;
 		}
-		if (!unchanged_file(cmpbuf, file, &sxp->st))
+		if (!quick_check_ok(FT_REG, cmpbuf, file, &sxp->st))
 			continue;
 		if (match_level == 1) {
 			best_match = j;
@@ -1006,29 +1052,14 @@ static int try_dests_non(struct file_struct *file, char *fname, int ndx,
 {
 	int best_match = -1;
 	int match_level = 0;
-	enum nonregtype type;
-	uint32 *devp;
-#ifdef SUPPORT_LINKS
-	char lnk[MAXPATHLEN];
-	int len;
-#endif
+	enum filetype ftype = get_file_type(file->mode);
 	int j = 0;
 
 #ifndef SUPPORT_LINKS
-	if (S_ISLNK(file->mode))
+	if (ftype == FT_SYMLINK)
 		return -1;
 #endif
-	if (S_ISDIR(file->mode)) {
-		type = TYPE_DIR;
-	} else if (IS_SPECIAL(file->mode))
-		type = TYPE_SPECIAL;
-	else if (IS_DEVICE(file->mode))
-		type = TYPE_DEVICE;
-#ifdef SUPPORT_LINKS
-	else if (S_ISLNK(file->mode))
-		type = TYPE_SYMLINK;
-#endif
-	else {
+	if (ftype == FT_REG || ftype == FT_UNSUPPORTED) {
 		rprintf(FERROR,
 			"internal: try_dests_non() called with invalid mode (%o)\n",
 			(int)file->mode);
@@ -1039,53 +1070,14 @@ static int try_dests_non(struct file_struct *file, char *fname, int ndx,
 		pathjoin(cmpbuf, MAXPATHLEN, basis_dir[j], fname);
 		if (link_stat(cmpbuf, &sxp->st, 0) < 0)
 			continue;
-		switch (type) {
-		case TYPE_DIR:
-			if (!S_ISDIR(sxp->st.st_mode))
-				continue;
-			break;
-		case TYPE_SPECIAL:
-			if (!IS_SPECIAL(sxp->st.st_mode))
-				continue;
-			break;
-		case TYPE_DEVICE:
-			if (!IS_DEVICE(sxp->st.st_mode))
-				continue;
-			break;
-		case TYPE_SYMLINK:
-#ifdef SUPPORT_LINKS
-			if (!S_ISLNK(sxp->st.st_mode))
-				continue;
-			break;
-#else
-			return -1;
-#endif
-		}
+		if (ftype != get_file_type(sxp->st.st_mode))
+			continue;
 		if (match_level < 1) {
 			match_level = 1;
 			best_match = j;
 		}
-		switch (type) {
-		case TYPE_DIR:
-		case TYPE_SPECIAL:
-			break;
-		case TYPE_DEVICE:
-			devp = F_RDEV_P(file);
-			if (sxp->st.st_rdev != MAKEDEV(DEV_MAJOR(devp), DEV_MINOR(devp)))
-				continue;
-			break;
-		case TYPE_SYMLINK:
-#ifdef SUPPORT_LINKS
-			if ((len = do_readlink(cmpbuf, lnk, MAXPATHLEN-1)) <= 0)
-				continue;
-			lnk[len] = '\0';
-			if (strcmp(lnk, F_SYMLINK(file)) != 0)
-				continue;
-			break;
-#else
-			return -1;
-#endif
-		}
+		if (!quick_check_ok(ftype, cmpbuf, file, &sxp->st))
+			continue;
 		if (match_level < 2) {
 			match_level = 2;
 			best_match = j;
@@ -1130,14 +1122,14 @@ static int try_dests_non(struct file_struct *file, char *fname, int ndx,
 			match_level = 2;
 		if (itemizing && stdout_format_has_i
 		 && (INFO_GTE(NAME, 2) || stdout_format_has_i > 1)) {
-			int chg = alt_dest_type == COMPARE_DEST && type != TYPE_DIR ? 0
+			int chg = alt_dest_type == COMPARE_DEST && ftype != FT_DIR ? 0
 			    : ITEM_LOCAL_CHANGE + (match_level == 3 ? ITEM_XNAME_FOLLOWS : 0);
 			char *lp = match_level == 3 ? "" : NULL;
 			itemize(cmpbuf, file, ndx, 0, sxp, chg + ITEM_MATCHED, 0, lp);
 		}
 		if (INFO_GTE(NAME, 2) && maybe_ATTRS_REPORT) {
 			rprintf(FCLIENT, "%s%s is uptodate\n",
-				fname, type == TYPE_DIR ? "/" : "");
+				fname, ftype == FT_DIR ? "/" : "");
 		}
 		return -2;
 	}
@@ -1231,7 +1223,8 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 	char fnamecmpbuf[MAXPATHLEN];
 	uchar fnamecmp_type;
 	int del_opts = delete_mode || force_delete ? DEL_RECURSE : 0;
-	int is_dir = !S_ISDIR(file->mode) ? 0
+	enum filetype stype, ftype = get_file_type(file->mode);
+	int is_dir = ftype != FT_DIR ? 0
 		   : inc_recurse && ndx != cur_flist->ndx_start - 1 ? -1
 		   : 1;
 
@@ -1278,7 +1271,6 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 			return;
 		}
 	}
-	sx.crtime = 0;
 
 	if (dry_run > 1 || (dry_missing_dir && is_below(file, dry_missing_dir))) {
 		int i;
@@ -1380,10 +1372,27 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 	 && !am_root && sx.st.st_uid == our_uid)
 		del_opts |= DEL_NO_UID_WRITE;
 
+	if (statret == 0)
+		stype = get_file_type(sx.st.st_mode);
+	else
+		stype = FT_UNSUPPORTED;
+
 	if (ignore_existing > 0 && statret == 0
-	 && (!is_dir || !S_ISDIR(sx.st.st_mode))) {
-		if (INFO_GTE(SKIP, 1) && is_dir >= 0)
-			rprintf(FINFO, "%s exists\n", fname);
+	 && (!is_dir || stype != FT_DIR)) {
+		if (INFO_GTE(SKIP, 1) && is_dir >= 0) {
+			const char *suf = "";
+			if (INFO_GTE(SKIP, 2)) {
+				if (ftype != stype)
+					suf = " (type change)";
+				else if (!quick_check_ok(ftype, fname, file, &sx.st))
+					suf = always_checksum ? " (sum change)" : " (file change)";
+				else if (!unchanged_attrs(fname, file, &sx))
+					suf = " (attr change)";
+				else
+					suf = " (uptodate)";
+			}
+			rprintf(FINFO, "%s exists%s\n", fname, suf);
+		}
 #ifdef SUPPORT_HARD_LINKS
 		if (F_IS_HLINKED(file))
 			handle_skipped_hlink(file, itemizing, code, f_out);
@@ -1404,7 +1413,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		} else
 			added_perms = 0;
 		if (is_dir < 0) {
-			if (!(preserve_times & PRESERVE_DIR_TIMES))
+			if (!preserve_mtimes || omit_dir_times)
 				goto cleanup;
 			/* In inc_recurse mode we want to make sure any missing
 			 * directories get created while we're still processing
@@ -1412,7 +1421,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 			 * dir's mtime right away).  We will handle the dir in
 			 * full later (right before we handle its contents). */
 			if (statret == 0
-			 && (S_ISDIR(sx.st.st_mode)
+			 && (stype == FT_DIR
 			  || delete_item(fname, sx.st.st_mode, del_opts | DEL_FOR_DIR) != 0))
 				goto cleanup; /* Any errors get reported later. */
 			if (do_mkdir(fname, (file->mode|added_perms) & 0700) == 0)
@@ -1424,7 +1433,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		 * file of that name and it is *not* a directory, then
 		 * we need to delete it.  If it doesn't exist, then
 		 * (perhaps recursively) create it. */
-		if (statret == 0 && !S_ISDIR(sx.st.st_mode)) {
+		if (statret == 0 && stype != FT_DIR) {
 			if (delete_item(fname, sx.st.st_mode, del_opts | DEL_FOR_DIR) != 0)
 				goto skipping_dir_contents;
 			statret = -1;
@@ -1508,7 +1517,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		else if (delete_during && f_out != -1 && !phase
 		    && !(file->flags & FLAG_MISSING_DIR)) {
 			if (file->flags & FLAG_CONTENT_DIR)
-				delete_in_dir(fname, file, &real_sx.st.st_dev);
+				delete_in_dir(fname, file, real_sx.st.st_dev);
 			else
 				change_local_filter_dir(fname, strlen(fname), F_DEPTH(file));
 		}
@@ -1519,7 +1528,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 	/* If we're not preserving permissions, change the file-list's
 	 * mode based on the local permissions and some heuristics. */
 	if (!preserve_perms) {
-		int exists = statret == 0 && !S_ISDIR(sx.st.st_mode);
+		int exists = statret == 0 && stype != FT_DIR;
 		file->mode = dest_mode(file->mode, sx.st.st_mode, dflt_perms, exists);
 	}
 
@@ -1529,7 +1538,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		goto cleanup;
 #endif
 
-	if (preserve_links && S_ISLNK(file->mode)) {
+	if (preserve_links && ftype == FT_SYMLINK) {
 #ifdef SUPPORT_LINKS
 		const char *sl = F_SYMLINK(file);
 		if (safe_symlinks && unsafe_symlink(sl, fname)) {
@@ -1546,12 +1555,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 			goto cleanup;
 		}
 		if (statret == 0) {
-			char lnk[MAXPATHLEN];
-			int len;
-
-			if (S_ISLNK(sx.st.st_mode)
-			 && (len = do_readlink(fname, lnk, MAXPATHLEN-1)) > 0
-			 && strncmp(lnk, sl, len) == 0 && sl[len] == '\0') {
+			if (stype == FT_SYMLINK && quick_check_ok(stype, fname, file, &sx.st)) {
 				/* The link is pointing to the right place. */
 				set_file_attrs(fname, file, &sx, NULL, maybe_ATTRS_REPORT);
 				if (itemizing)
@@ -1584,7 +1588,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		if (atomic_create(file, fname, sl, NULL, MAKEDEV(0, 0), &sx, statret == 0 ? DEL_FOR_SYMLINK : 0)) {
 			set_file_attrs(fname, file, NULL, NULL, 0);
 			if (itemizing) {
-				if (statret == 0 && !S_ISLNK(sx.st.st_mode))
+				if (statret == 0 && stype != FT_SYMLINK)
 					statret = -1;
 				itemize(fnamecmp, file, ndx, statret, &sx,
 					ITEM_LOCAL_CHANGE|ITEM_REPORT_CHANGE, 0, NULL);
@@ -1605,28 +1609,22 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		goto cleanup;
 	}
 
-	if ((am_root && preserve_devices && IS_DEVICE(file->mode))
-	 || (preserve_specials && IS_SPECIAL(file->mode))) {
+	if ((am_root && preserve_devices && ftype == FT_DEVICE)
+	 || (preserve_specials && ftype == FT_SPECIAL)) {
 		dev_t rdev;
-		int del_for_flag = 0;
-		if (IS_DEVICE(file->mode)) {
+		int del_for_flag;
+		if (ftype == FT_DEVICE) {
 			uint32 *devp = F_RDEV_P(file);
 			rdev = MAKEDEV(DEV_MAJOR(devp), DEV_MINOR(devp));
-		} else
+			del_for_flag = DEL_FOR_DEVICE;
+		} else {
 			rdev = 0;
+			del_for_flag = DEL_FOR_SPECIAL;
+		}
 		if (statret == 0) {
-			if (IS_DEVICE(file->mode)) {
-				if (!IS_DEVICE(sx.st.st_mode))
-					statret = -1;
-				del_for_flag = DEL_FOR_DEVICE;
-			} else {
-				if (!IS_SPECIAL(sx.st.st_mode))
-					statret = -1;
-				del_for_flag = DEL_FOR_SPECIAL;
-			}
-			if (statret == 0
-			 && BITS_EQUAL(sx.st.st_mode, file->mode, _S_IFMT)
-			 && (IS_SPECIAL(sx.st.st_mode) || sx.st.st_rdev == rdev)) {
+			if (ftype != stype)
+				statret = -1;
+			else if (quick_check_ok(ftype, fname, file, &sx.st)) {
 				/* The device or special file is identical. */
 				set_file_attrs(fname, file, &sx, NULL, maybe_ATTRS_REPORT);
 				if (itemizing)
@@ -1679,10 +1677,12 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		goto cleanup;
 	}
 
-	if (!S_ISREG(file->mode)) {
-		if (solo_file)
-			fname = f_name(file, NULL);
-		rprintf(FINFO, "skipping non-regular file \"%s\"\n", fname);
+	if (ftype != FT_REG) {
+		if (INFO_GTE(NONREG, 1)) {
+			if (solo_file)
+				fname = f_name(file, NULL);
+			rprintf(FINFO, "skipping non-regular file \"%s\"\n", fname);
+		}
 		goto cleanup;
 	}
 
@@ -1703,7 +1703,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		goto cleanup;
 	}
 
-	if (update_only > 0 && statret == 0 && file->modtime - sx.st.st_mtime <= modify_window) {
+	if (update_only > 0 && statret == 0 && file->modtime - sx.st.st_mtime < modify_window) {
 		if (INFO_GTE(SKIP, 1))
 			rprintf(FINFO, "%s is newer\n", fname);
 #ifdef SUPPORT_HARD_LINKS
@@ -1715,7 +1715,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 
 	fnamecmp_type = FNAMECMP_FNAME;
 
-	if (statret == 0 && !(S_ISREG(sx.st.st_mode) || (write_devices && IS_DEVICE(sx.st.st_mode)))) {
+	if (statret == 0 && !(stype == FT_REG || (write_devices && stype == FT_DEVICE))) {
 		if (delete_item(fname, sx.st.st_mode, del_opts | DEL_FOR_FILE) != 0)
 			goto cleanup;
 		statret = -1;
@@ -1749,7 +1749,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		partialptr = NULL;
 
 	if (statret != 0 && fuzzy_basis) {
-		if (need_fuzzy_dirlist && S_ISREG(file->mode)) {
+		if (need_fuzzy_dirlist) {
 			const char *dn = file->dirname ? file->dirname : ".";
 			int i;
 			strlcpy(fnamecmpbuf, dn, sizeof fnamecmpbuf);
@@ -1793,11 +1793,17 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		goto cleanup;
 	}
 
+	if (write_devices && IS_DEVICE(sx.st.st_mode) && sx.st.st_size == 0) {
+		/* This early open into fd skips the regular open below. */
+		if ((fd = do_open(fnamecmp, O_RDONLY, 0)) >= 0)
+			real_sx.st.st_size = sx.st.st_size = get_device_size(fd, fnamecmp);
+	}
+
 	if (fnamecmp_type <= FNAMECMP_BASIS_DIR_HIGH)
 		;
 	else if (fnamecmp_type >= FNAMECMP_FUZZY)
 		;
-	else if (unchanged_file(fnamecmp, file, &sx.st)) {
+	else if (quick_check_ok(FT_REG, fnamecmp, file, &sx.st)) {
 		if (partialptr) {
 			do_unlink(partialptr);
 			handle_partial_dir(partialptr, PDIR_DELETE);
@@ -1858,7 +1864,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 	}
 
 	/* open the file */
-	if ((fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
+	if (fd < 0 && (fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
 		rsyserr(FERROR, errno, "failed to open %s, continuing",
 			full_fname(fnamecmp));
 	  pretend_missing:
@@ -1875,11 +1881,9 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 
 	if (inplace && make_backups > 0 && fnamecmp_type == FNAMECMP_FNAME) {
 		if (!(backupptr = get_backup_name(fname))) {
-			close(fd);
 			goto cleanup;
 		}
 		if (!(back_file = make_file(fname, NULL, NULL, 0, NO_FILTERS))) {
-			close(fd);
 			goto pretend_missing;
 		}
 		if (robust_unlink(backupptr) && errno != ENOENT) {
@@ -1887,14 +1891,12 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 				full_fname(backupptr));
 			unmake_file(back_file);
 			back_file = NULL;
-			close(fd);
 			goto cleanup;
 		}
 		if ((f_copy = do_open(backupptr, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, 0600)) < 0) {
 			rsyserr(FERROR_XFER, errno, "open %s", full_fname(backupptr));
 			unmake_file(back_file);
 			back_file = NULL;
-			close(fd);
 			goto cleanup;
 		}
 		fnamecmp_type = FNAMECMP_BACKUP;
@@ -1945,7 +1947,6 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		write_sum_head(f_out, NULL);
 	else if (sx.st.st_size <= 0) {
 		write_sum_head(f_out, NULL);
-		close(fd);
 	} else {
 		if (generate_and_send_sums(fd, sx.st.st_size, f_out, f_copy) < 0) {
 			rprintf(FWARNING,
@@ -1953,10 +1954,11 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 				fnamecmp);
 			write_sum_head(f_out, NULL);
 		}
-		close(fd);
 	}
 
   cleanup:
+	if (fd >= 0)
+		close(fd);
 	if (back_file) {
 		int save_preserve_xattrs = preserve_xattrs;
 		if (f_copy >= 0)
@@ -2242,7 +2244,7 @@ void generate_files(int f_out, const char *local_name)
 	}
 	solo_file = local_name;
 	dir_tweaking = !(list_only || solo_file || dry_run);
-	need_retouch_dir_times = preserve_times & PRESERVE_DIR_TIMES;
+	need_retouch_dir_times = preserve_mtimes && !omit_dir_times;
 	loopchk_limit = allowed_lull ? allowed_lull * 5 : 200;
 	symlink_timeset_failed_flags = ITEM_REPORT_TIME
 	    | (protocol_version >= 30 || !am_server ? ITEM_REPORT_TIMEFAIL : 0);
@@ -2295,7 +2297,7 @@ void generate_files(int f_out, const char *local_name)
 						dirdev = MAKEDEV(DEV_MAJOR(devp), DEV_MINOR(devp));
 					} else
 						dirdev = MAKEDEV(0, 0);
-					delete_in_dir(fbuf, fp, &dirdev);
+					delete_in_dir(fbuf, fp, dirdev);
 				} else
 					change_local_filter_dir(fbuf, strlen(fbuf), F_DEPTH(fp));
 			}
@@ -2342,7 +2344,7 @@ void generate_files(int f_out, const char *local_name)
 	} while ((cur_flist = cur_flist->next) != NULL);
 
 	if (delete_during)
-		delete_in_dir(NULL, NULL, &dev_zero);
+		delete_in_dir(NULL, NULL, dev_zero);
 	phase++;
 	if (DEBUG_GTE(GENR, 1))
 		rprintf(FINFO, "generate_files phase=%d\n", phase);
diff --git a/hlink.c b/hlink.c
index adec89b0..66810a3e 100644
--- a/hlink.c
+++ b/hlink.c
@@ -406,7 +406,7 @@ int hard_link_check(struct file_struct *file, int ndx, char *fname,
 				}
 				break;
 			}
-			if (!unchanged_file(cmpbuf, file, &alt_sx.st))
+			if (!quick_check_ok(FT_REG, cmpbuf, file, &alt_sx.st))
 				continue;
 			statret = 1;
 			if (unchanged_attrs(cmpbuf, file, &alt_sx))
diff --git a/ifuncs.h b/ifuncs.h
index 4037639b..956fc22e 100644
--- a/ifuncs.h
+++ b/ifuncs.h
@@ -1,6 +1,6 @@
 /* Inline functions for rsync.
  *
- * Copyright (C) 2007-2020 Wayne Davison
+ * Copyright (C) 2007-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -75,6 +75,7 @@ d_name(struct dirent *di)
 static inline void
 init_stat_x(stat_x *sx_p)
 {
+	sx_p->crtime = 0;
 #ifdef SUPPORT_ACLS
 	sx_p->acc_acl = sx_p->def_acl = NULL;
 #endif
diff --git a/install-sh b/install-sh
index 956817d4..8c409fbb 100755
--- a/install-sh
+++ b/install-sh
@@ -115,7 +115,7 @@ else
 # might cause directories to be created, which would be especially bad 
 # if $src (and thus $dsttmp) contains '*'.
 
-	if [ -f $src -o -d $src ]
+	if [ -f $src ] || [ -d $src ]
 	then
 		true
 	else
diff --git a/io.c b/io.c
index b50a066c..cf94cee7 100644
--- a/io.c
+++ b/io.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2001 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -264,15 +264,18 @@ static size_t safe_read(int fd, char *buf, size_t len)
 			rprintf(FINFO, "select exception on fd %d\n", fd); */
 
 		if (FD_ISSET(fd, &r_fds)) {
-			int n = read(fd, buf + got, len - got);
-			if (DEBUG_GTE(IO, 2))
-				rprintf(FINFO, "[%s] safe_read(%d)=%ld\n", who_am_i(), fd, (long)n);
+			ssize_t n = read(fd, buf + got, len - got);
+			if (DEBUG_GTE(IO, 2)) {
+				rprintf(FINFO, "[%s] safe_read(%d)=%" SIZE_T_FMT_MOD "d\n",
+					who_am_i(), fd, (SIZE_T_FMT_CAST)n);
+			}
 			if (n == 0)
 				break;
 			if (n < 0) {
 				if (errno == EINTR)
 					continue;
-				rsyserr(FERROR, errno, "safe_read failed to read %ld bytes", (long)len);
+				rsyserr(FERROR, errno, "safe_read failed to read %" SIZE_T_FMT_MOD "d bytes",
+					(SIZE_T_FMT_CAST)len);
 				exit_cleanup(RERR_STREAMIO);
 			}
 			if ((got += (size_t)n) == len)
@@ -304,7 +307,7 @@ static const char *what_fd_is(int fd)
  * is not used on the socket except very early in the transfer. */
 static void safe_write(int fd, const char *buf, size_t len)
 {
-	int n;
+	ssize_t n;
 
 	assert(fd != iobuf.out_fd);
 
@@ -315,8 +318,8 @@ static void safe_write(int fd, const char *buf, size_t len)
 		if (errno != EINTR && errno != EWOULDBLOCK && errno != EAGAIN) {
 		  write_failed:
 			rsyserr(FERROR, errno,
-				"safe_write failed to write %ld bytes to %s",
-				(long)len, what_fd_is(fd));
+				"safe_write failed to write %" SIZE_T_FMT_MOD "d bytes to %s",
+				(SIZE_T_FMT_CAST)len, what_fd_is(fd));
 			exit_cleanup(RERR_STREAMIO);
 		}
 	} else {
@@ -362,7 +365,7 @@ static void safe_write(int fd, const char *buf, size_t len)
  * a chunk of data and put it into the output buffer. */
 static void forward_filesfrom_data(void)
 {
-	int len;
+	ssize_t len;
 
 	len = read(ff_forward_fd, ff_xb.buf + ff_xb.len, ff_xb.size - ff_xb.len);
 	if (len <= 0) {
@@ -377,8 +380,10 @@ static void forward_filesfrom_data(void)
 		return;
 	}
 
-	if (DEBUG_GTE(IO, 2))
-		rprintf(FINFO, "[%s] files-from read=%ld\n", who_am_i(), (long)len);
+	if (DEBUG_GTE(IO, 2)) {
+		rprintf(FINFO, "[%s] files-from read=%" SIZE_T_FMT_MOD "d\n",
+			who_am_i(), (SIZE_T_FMT_CAST)len);
+	}
 
 #ifdef ICONV_OPTION
 	len += ff_xb.len;
@@ -562,52 +567,59 @@ static char *perform_io(size_t needed, int flags)
 	case PIO_NEED_INPUT:
 		/* We never resize the circular input buffer. */
 		if (iobuf.in.size < needed) {
-			rprintf(FERROR, "need to read %ld bytes, iobuf.in.buf is only %ld bytes.\n",
-				(long)needed, (long)iobuf.in.size);
+			rprintf(FERROR, "need to read %" SIZE_T_FMT_MOD "d bytes,"
+					" iobuf.in.buf is only %" SIZE_T_FMT_MOD "d bytes.\n",
+				(SIZE_T_FMT_CAST)needed, (SIZE_T_FMT_CAST)iobuf.in.size);
 			exit_cleanup(RERR_PROTOCOL);
 		}
 
 		if (msgs2stderr == 1 && DEBUG_GTE(IO, 3)) {
-			rprintf(FINFO, "[%s] perform_io(%ld, %sinput)\n",
-				who_am_i(), (long)needed, flags & PIO_CONSUME_INPUT ? "consume&" : "");
+			rprintf(FINFO, "[%s] perform_io(%" SIZE_T_FMT_MOD "d, %sinput)\n",
+				who_am_i(), (SIZE_T_FMT_CAST)needed, flags & PIO_CONSUME_INPUT ? "consume&" : "");
 		}
 		break;
 
 	case PIO_NEED_OUTROOM:
 		/* We never resize the circular output buffer. */
 		if (iobuf.out.size - iobuf.out_empty_len < needed) {
-			fprintf(stderr, "need to write %ld bytes, iobuf.out.buf is only %ld bytes.\n",
-				(long)needed, (long)(iobuf.out.size - iobuf.out_empty_len));
+			fprintf(stderr, "need to write %" SIZE_T_FMT_MOD "d bytes,"
+					" iobuf.out.buf is only %" SIZE_T_FMT_MOD "d bytes.\n",
+				(SIZE_T_FMT_CAST)needed, (SIZE_T_FMT_CAST)(iobuf.out.size - iobuf.out_empty_len));
 			exit_cleanup(RERR_PROTOCOL);
 		}
 
 		if (msgs2stderr == 1 && DEBUG_GTE(IO, 3)) {
-			rprintf(FINFO, "[%s] perform_io(%ld, outroom) needs to flush %ld\n",
-				who_am_i(), (long)needed,
+			rprintf(FINFO, "[%s] perform_io(%" SIZE_T_FMT_MOD "d,"
+				       " outroom) needs to flush %" SIZE_T_FMT_MOD "d\n",
+				who_am_i(), (SIZE_T_FMT_CAST)needed,
 				iobuf.out.len + needed > iobuf.out.size
-				? (long)(iobuf.out.len + needed - iobuf.out.size) : 0L);
+				? (SIZE_T_FMT_CAST)(iobuf.out.len + needed - iobuf.out.size) : (SIZE_T_FMT_CAST)0);
 		}
 		break;
 
 	case PIO_NEED_MSGROOM:
 		/* We never resize the circular message buffer. */
 		if (iobuf.msg.size < needed) {
-			fprintf(stderr, "need to write %ld bytes, iobuf.msg.buf is only %ld bytes.\n",
-				(long)needed, (long)iobuf.msg.size);
+			fprintf(stderr, "need to write %" SIZE_T_FMT_MOD "d bytes,"
+					" iobuf.msg.buf is only %" SIZE_T_FMT_MOD "d bytes.\n",
+				(SIZE_T_FMT_CAST)needed, (SIZE_T_FMT_CAST)iobuf.msg.size);
 			exit_cleanup(RERR_PROTOCOL);
 		}
 
 		if (msgs2stderr == 1 && DEBUG_GTE(IO, 3)) {
-			rprintf(FINFO, "[%s] perform_io(%ld, msgroom) needs to flush %ld\n",
-				who_am_i(), (long)needed,
+			rprintf(FINFO, "[%s] perform_io(%" SIZE_T_FMT_MOD "d,"
+				       " msgroom) needs to flush %" SIZE_T_FMT_MOD "d\n",
+				who_am_i(), (SIZE_T_FMT_CAST)needed,
 				iobuf.msg.len + needed > iobuf.msg.size
-				? (long)(iobuf.msg.len + needed - iobuf.msg.size) : 0L);
+				? (SIZE_T_FMT_CAST)(iobuf.msg.len + needed - iobuf.msg.size) : (SIZE_T_FMT_CAST)0);
 		}
 		break;
 
 	case 0:
-		if (msgs2stderr == 1 && DEBUG_GTE(IO, 3))
-			rprintf(FINFO, "[%s] perform_io(%ld, %d)\n", who_am_i(), (long)needed, flags);
+		if (msgs2stderr == 1 && DEBUG_GTE(IO, 3)) {
+			rprintf(FINFO, "[%s] perform_io(%" SIZE_T_FMT_MOD "d, %d)\n",
+				who_am_i(), (SIZE_T_FMT_CAST)needed, flags);
+		}
 		break;
 
 	default:
@@ -665,8 +677,8 @@ static char *perform_io(size_t needed, int flags)
 					      ((MPLEX_BASE + (int)MSG_DATA)<<24) + iobuf.out.len - 4);
 
 					if (msgs2stderr == 1 && DEBUG_GTE(IO, 1)) {
-						rprintf(FINFO, "[%s] send_msg(%d, %ld)\n",
-							who_am_i(), (int)MSG_DATA, (long)iobuf.out.len - 4);
+						rprintf(FINFO, "[%s] send_msg(%d, %" SIZE_T_FMT_MOD "d)\n",
+							who_am_i(), (int)MSG_DATA, (SIZE_T_FMT_CAST)iobuf.out.len - 4);
 					}
 
 					/* reserve room for the next MSG_DATA header */
@@ -757,7 +769,7 @@ static char *perform_io(size_t needed, int flags)
 
 		if (iobuf.in_fd >= 0 && FD_ISSET(iobuf.in_fd, &r_fds)) {
 			size_t len, pos = iobuf.in.pos + iobuf.in.len;
-			int n;
+			ssize_t n;
 			if (pos >= iobuf.in.size) {
 				pos -= iobuf.in.size;
 				len = iobuf.in.size - iobuf.in.len;
@@ -784,15 +796,13 @@ static char *perform_io(size_t needed, int flags)
 					exit_cleanup(RERR_SOCKETIO);
 				}
 			}
-			if (msgs2stderr == 1 && DEBUG_GTE(IO, 2))
-				rprintf(FINFO, "[%s] recv=%ld\n", who_am_i(), (long)n);
+			if (msgs2stderr == 1 && DEBUG_GTE(IO, 2)) {
+				rprintf(FINFO, "[%s] recv=%" SIZE_T_FMT_MOD "d\n",
+					who_am_i(), (SIZE_T_FMT_CAST)n);
+			}
 
-			if (io_timeout || stop_at_utime) {
+			if (io_timeout) {
 				last_io_in = time(NULL);
-				if (stop_at_utime && last_io_in >= stop_at_utime) {
-					rprintf(FERROR, "stopping at requested limit\n");
-					exit_cleanup(RERR_TIMEOUT);
-				}
 				if (io_timeout && flags & PIO_NEED_INPUT)
 					maybe_send_keepalive(last_io_in, 0);
 			}
@@ -801,9 +811,14 @@ static char *perform_io(size_t needed, int flags)
 			iobuf.in.len += n;
 		}
 
+		if (stop_at_utime && time(NULL) >= stop_at_utime) {
+			rprintf(FERROR, "stopping at requested limit\n");
+			exit_cleanup(RERR_TIMEOUT);
+		}
+
 		if (out && FD_ISSET(iobuf.out_fd, &w_fds)) {
 			size_t len = iobuf.raw_flushing_ends_before ? iobuf.raw_flushing_ends_before - out->pos : out->len;
-			int n;
+			ssize_t n;
 
 			if (bwlimit_writemax && len > bwlimit_writemax)
 				len = bwlimit_writemax;
@@ -824,8 +839,8 @@ static char *perform_io(size_t needed, int flags)
 				}
 			}
 			if (msgs2stderr == 1 && DEBUG_GTE(IO, 2)) {
-				rprintf(FINFO, "[%s] %s sent=%ld\n",
-					who_am_i(), out == &iobuf.out ? "out" : "msg", (long)n);
+				rprintf(FINFO, "[%s] %s sent=%" SIZE_T_FMT_MOD "d\n",
+					who_am_i(), out == &iobuf.out ? "out" : "msg", (SIZE_T_FMT_CAST)n);
 			}
 
 			if (io_timeout)
@@ -945,8 +960,10 @@ int send_msg(enum msgcode code, const char *buf, size_t len, int convert)
 	if (!OUT_MULTIPLEXED)
 		return 0;
 
-	if (want_debug)
-		rprintf(FINFO, "[%s] send_msg(%d, %ld)\n", who_am_i(), (int)code, (long)len);
+	if (want_debug) {
+		rprintf(FINFO, "[%s] send_msg(%d, %" SIZE_T_FMT_MOD "d)\n",
+			who_am_i(), (int)code, (SIZE_T_FMT_CAST)len);
+	}
 
 	/* When checking for enough free space for this message, we need to
 	 * make sure that there is space for the 4-byte header, plus we'll
@@ -962,9 +979,9 @@ int send_msg(enum msgcode code, const char *buf, size_t len, int convert)
 #endif
 		needed = len + 4 + 3;
 	if (iobuf.msg.len + needed > iobuf.msg.size) {
-		if (!am_receiver)
+		if (am_sender)
 			perform_io(needed, PIO_NEED_MSGROOM);
-		else { /* We allow the receiver to increase their iobuf.msg size to avoid a deadlock. */
+		else { /* We sometimes allow the iobuf.msg size to increase to avoid a deadlock. */
 			size_t old_size = iobuf.msg.size;
 			restore_iobuf_size(&iobuf.msg);
 			realloc_xbuf(&iobuf.msg, iobuf.msg.size * 2);
@@ -1021,8 +1038,10 @@ int send_msg(enum msgcode code, const char *buf, size_t len, int convert)
 
 	SIVAL(hdr, 0, ((MPLEX_BASE + (int)code)<<24) + len);
 
-	if (want_debug && convert > 0)
-		rprintf(FINFO, "[%s] converted msg len=%ld\n", who_am_i(), (long)len);
+	if (want_debug && convert > 0) {
+		rprintf(FINFO, "[%s] converted msg len=%" SIZE_T_FMT_MOD "d\n",
+			who_am_i(), (SIZE_T_FMT_CAST)len);
+	}
 
 	return 1;
 }
@@ -1436,8 +1455,10 @@ static void read_a_msg(void)
 	msg_bytes = tag & 0xFFFFFF;
 	tag = (tag >> 24) - MPLEX_BASE;
 
-	if (msgs2stderr == 1 && DEBUG_GTE(IO, 1))
-		rprintf(FINFO, "[%s] got msg=%d, len=%ld\n", who_am_i(), (int)tag, (long)msg_bytes);
+	if (msgs2stderr == 1 && DEBUG_GTE(IO, 1)) {
+		rprintf(FINFO, "[%s] got msg=%d, len=%" SIZE_T_FMT_MOD "d\n",
+			who_am_i(), (int)tag, (SIZE_T_FMT_CAST)msg_bytes);
+	}
 
 	switch (tag) {
 	case MSG_DATA:
@@ -1613,8 +1634,10 @@ static void read_a_msg(void)
 		else
 			goto invalid_msg;
 		iobuf.in_multiplexed = 1;
-		if (DEBUG_GTE(EXIT, 3))
-			rprintf(FINFO, "[%s] got MSG_ERROR_EXIT with %ld bytes\n", who_am_i(), (long)msg_bytes);
+		if (DEBUG_GTE(EXIT, 3)) {
+			rprintf(FINFO, "[%s] got MSG_ERROR_EXIT with %" SIZE_T_FMT_MOD "d bytes\n",
+					who_am_i(), (SIZE_T_FMT_CAST)msg_bytes);
+		}
 		if (msg_bytes == 0) {
 			if (!am_sender && !am_generator) {
 				if (DEBUG_GTE(EXIT, 3)) {
@@ -1820,6 +1843,7 @@ int64 read_longint(int f)
 #endif
 }
 
+/* Debugging note: this will be named read_buf_() when using an external zlib. */
 void read_buf(int f, char *buf, size_t len)
 {
 	if (f != iobuf.in_fd) {
diff --git a/itypes.h b/itypes.h
index db997bba..0a7111f1 100644
--- a/itypes.h
+++ b/itypes.h
@@ -1,6 +1,6 @@
 /* Inline functions for rsync.
  *
- * Copyright (C) 2007-2020 Wayne Davison
+ * Copyright (C) 2007-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -40,6 +40,12 @@ isSpace(const char *ptr)
 	return isspace(*(unsigned char *)ptr);
 }
 
+static inline int
+isAlNum(const char *ptr)
+{
+	return isalnum(*(unsigned char *)ptr);
+}
+
 static inline int
 isLower(const char *ptr)
 {
diff --git a/latest-year.h b/latest-year.h
index ddbf2b5e..37e8efbb 100644
--- a/latest-year.h
+++ b/latest-year.h
@@ -1 +1 @@
-#define LATEST_YEAR "2020"
+#define LATEST_YEAR "2022"
diff --git a/lib/md5-asm-x86_64.S b/lib/md5-asm-x86_64.S
index 383f193a..3737058f 100644
--- a/lib/md5-asm-x86_64.S
+++ b/lib/md5-asm-x86_64.S
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "md-defines.h"
 
-#if !defined USE_OPENSSL && CSUM_CHUNK == 64
+#ifdef USE_MD5_ASM /* { */
 
 #ifdef __APPLE__
 #define md5_process_asm _md5_process_asm
@@ -698,4 +698,4 @@ md5_process_asm:
 	pop	%rbp
 	ret
 
-#endif /* !USE_OPENSSL ... */
+#endif /* } USE_MD5_ASM */
diff --git a/lib/md5.c b/lib/md5.c
index 41f158b8..2366339e 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -2,7 +2,7 @@
  * RFC 1321 compliant MD5 implementation
  *
  * Copyright (C) 2001-2003 Christophe Devine
- * Copyright (C) 2007-2020 Wayne Davison
+ * Copyright (C) 2007-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -20,7 +20,7 @@
 
 #include "rsync.h"
 
-#ifndef USE_OPENSSL
+#if !defined USE_OPENSSL || USE_MD5_ASM /* { */
 void md5_begin(md_context *ctx)
 {
 	ctx->A = 0x67452301;
@@ -148,7 +148,10 @@ static void md5_process(md_context *ctx, const uchar data[CSUM_CHUNK])
 	ctx->D += D;
 }
 
-#if defined HAVE_ASM && CSUM_CHUNK == 64
+#ifdef USE_MD5_ASM
+#if CSUM_CHUNK != 64
+#error The MD5 ASM code does not support CSUM_CHUNK != 64
+#endif
 extern void md5_process_asm(md_context *ctx, const void *data, size_t num);
 #endif
 
@@ -176,20 +179,20 @@ void md5_update(md_context *ctx, const uchar *input, uint32 length)
 		left = 0;
 	}
 
-#if defined HAVE_ASM && CSUM_CHUNK == 64
+#ifdef USE_MD5_ASM /* { */
 	if (length >= CSUM_CHUNK) {
 		uint32 chunks = length / CSUM_CHUNK;
 		md5_process_asm(ctx, input, chunks);
 		length -= chunks * CSUM_CHUNK;
 		input += chunks * CSUM_CHUNK;
 	}
-#else
+#else /* } { */
 	while (length >= CSUM_CHUNK) {
 		md5_process(ctx, input);
 		length -= CSUM_CHUNK;
 		input  += CSUM_CHUNK;
 	}
-#endif
+#endif /* } */
 
 	if (length)
 		memcpy(ctx->buffer + left, input, length);
@@ -221,9 +224,9 @@ void md5_result(md_context *ctx, uchar digest[MD5_DIGEST_LEN])
 	SIVALu(digest, 8, ctx->C);
 	SIVALu(digest, 12, ctx->D);
 }
-#endif
+#endif /* } */
 
-#ifdef TEST_MD5
+#ifdef TEST_MD5 /* { */
 
 void get_md5(uchar *out, const uchar *input, int n)
 {
@@ -317,4 +320,4 @@ int main(int argc, char *argv[])
 	return 0;
 }
 
-#endif
+#endif /* } */
diff --git a/lib/mdigest.h b/lib/mdigest.h
index db174017..f1d6d934 100644
--- a/lib/mdigest.h
+++ b/lib/mdigest.h
@@ -17,12 +17,13 @@ void mdfour_begin(md_context *md);
 void mdfour_update(md_context *md, const uchar *in, uint32 length);
 void mdfour_result(md_context *md, uchar digest[MD4_DIGEST_LEN]);
 
-#ifndef USE_OPENSSL
-#define MD5_CTX md_context
-#define MD5_Init md5_begin
-#define MD5_Update md5_update
-#define MD5_Final(digest, cptr) md5_result(cptr, digest)
-
+#if defined USE_OPENSSL && !defined USE_MD5_ASM
+#define md5_context MD5_CTX
+#define md5_begin MD5_Init
+#define md5_update MD5_Update
+#define md5_result(cptr, digest) MD5_Final(digest, cptr)
+#else
+#define md5_context md_context
 void md5_begin(md_context *ctx);
 void md5_update(md_context *ctx, const uchar *input, uint32 length);
 void md5_result(md_context *ctx, uchar digest[MD5_DIGEST_LEN]);
diff --git a/lib/pool_alloc.c b/lib/pool_alloc.c
index f6c6faf6..a1a7245f 100644
--- a/lib/pool_alloc.c
+++ b/lib/pool_alloc.c
@@ -9,8 +9,7 @@ struct alloc_pool
 	size_t			size;		/* extent size		*/
 	size_t			quantum;	/* allocation quantum	*/
 	struct pool_extent	*extents;	/* top extent is "live" */
-	void			(*bomb)();	/* function to call if
-						 * malloc fails		*/
+	void			(*bomb)();	/* called if malloc fails */
 	int			flags;
 
 	/* statistical data */
@@ -49,7 +48,7 @@ pool_create(size_t size, size_t quantum, void (*bomb)(const char*, const char*,
 {
 	struct alloc_pool *pool;
 
-	if ((MINALIGN & (MINALIGN - 1)) != 0) {
+	if ((MINALIGN & (MINALIGN - 1)) != (0)) {
 		if (bomb)
 			(*bomb)("Compiler error: MINALIGN is not a power of 2", __FILE__, __LINE__);
 		return NULL;
diff --git a/lib/snprintf.c b/lib/snprintf.c
index 52fdd11f..15c0529d 100644
--- a/lib/snprintf.c
+++ b/lib/snprintf.c
@@ -20,7 +20,7 @@
  * for string length.  This covers a nasty loophole.
  *
  * The other functions are there to prevent NULL pointers from
- * causing nast effects.
+ * causing nasty effects.
  *
  * More Recently:
  *  Brandon Long <blong@fiction.net> 9/15/96 for mutt 0.43
diff --git a/lib/sysacls.c b/lib/sysacls.c
index c23864fe..a9c3f1bd 100644
--- a/lib/sysacls.c
+++ b/lib/sysacls.c
@@ -1739,7 +1739,6 @@ int sys_acl_free_acl(SMB_ACL_T acl_d)
 int sys_acl_get_entry(SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p)
 {
 	struct acl_entry_link *link;
-	struct new_acl_entry *entry;
 	int keep_going;
 
 	if (entry_id == SMB_ACL_FIRST_ENTRY)
@@ -1765,10 +1764,15 @@ int sys_acl_get_entry(SMB_ACL_T theacl, int entry_id, SMB_ACL_ENTRY_T *entry_p)
 	for (keep_going = 0; keep_going < theacl->count; keep_going++)
 		link = link->nextp;
 
-	entry = *entry_p =  link->entryp;
+	*entry_p =  link->entryp;
 
-	DEBUG(10, ("*entry_p is %d\n", entry_p));
-	DEBUG(10, ("*entry_p->ace_access is %d\n", entry->ace_access));
+#if 0
+	{
+		struct new_acl_entry *entry = *entry_p;
+		DEBUG(10, ("*entry_p is %lx\n", (long)entry));
+		DEBUG(10, ("*entry_p->ace_access is %d\n", entry->ace_access));
+	}
+#endif
 
 	/* Increment count */
 	theacl->count++;
@@ -2297,7 +2301,7 @@ int sys_acl_create_entry(SMB_ACL_T *pacl, SMB_ACL_ENTRY_T *pentry)
 {
 	struct acl_entry_link *theacl;
 	struct acl_entry_link *acl_entryp;
-	struct acl_entry_link *temp_entry;
+	struct acl_entry_link *temp_entry = NULL;
 	int counting;
 
 	DEBUG(10, ("Entering the sys_acl_create_entry\n"));
diff --git a/lib/sysxattrs.c b/lib/sysxattrs.c
index 583b93e9..ca08d131 100644
--- a/lib/sysxattrs.c
+++ b/lib/sysxattrs.c
@@ -2,7 +2,7 @@
  * Extended attribute support for rsync.
  *
  * Copyright (C) 2004 Red Hat, Inc.
- * Copyright (C) 2003-2019 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  * Written by Jay Fenlason.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -67,7 +67,7 @@ ssize_t sys_lgetxattr(const char *path, const char *name, void *value, size_t si
 		u_int32_t offset = len;
 		size_t data_retrieved = len;
 		while (data_retrieved < size) {
-			len = getxattr(path, name, value + offset, size - data_retrieved, offset, XATTR_NOFOLLOW);
+			len = getxattr(path, name, (char*)value + offset, size - data_retrieved, offset, XATTR_NOFOLLOW);
 			if (len <= 0)
 				break;
 			data_retrieved += len;
@@ -167,7 +167,7 @@ static ssize_t read_xattr(int attrfd, void *buf, size_t buflen)
 	} else {
 		size_t bufpos;
 		for (bufpos = 0; bufpos < sb.st_size; ) {
-			ssize_t cnt = read(attrfd, buf + bufpos, sb.st_size - bufpos);
+			ssize_t cnt = read(attrfd, (char*)buf + bufpos, sb.st_size - bufpos);
 			if (cnt <= 0) {
 				if (cnt < 0 && errno == EINTR)
 					continue;
@@ -218,7 +218,7 @@ int sys_lsetxattr(const char *path, const char *name, const void *value, size_t
 		return -1;
 
 	for (bufpos = 0; bufpos < size; ) {
-		ssize_t cnt = write(attrfd, value+bufpos, size);
+		ssize_t cnt = write(attrfd, (char*)value + bufpos, size);
 		if (cnt <= 0) {
 			if (cnt < 0 && errno == EINTR)
 				continue;
@@ -274,7 +274,8 @@ ssize_t sys_llistxattr(const char *path, char *list, size_t size)
 		 && (dp->d_name[10] == 'o' || dp->d_name[10] == 'w'))
 			continue;
 
-		if ((ret += len+1) > size) {
+		ret += len + 1;
+		if ((size_t)ret > size) {
 			if (size == 0)
 				continue;
 			ret = -1;
diff --git a/loadparm.c b/loadparm.c
index 952a0b74..3906bc0f 100644
--- a/loadparm.c
+++ b/loadparm.c
@@ -437,7 +437,7 @@ static BOOL do_parameter(char *parmname, char *parmvalue)
 		break;
 
 	case P_OCTAL:
-		sscanf(parmvalue, "%o", (int *)parm_ptr);
+		sscanf(parmvalue, "%o", (unsigned int *)parm_ptr);
 		break;
 
 	case P_PATH:
diff --git a/log.c b/log.c
index 062a930e..44344e2a 100644
--- a/log.c
+++ b/log.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1998-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 2000-2001 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,7 +34,7 @@ extern int module_id;
 extern int allow_8bit_chars;
 extern int protocol_version;
 extern int always_checksum;
-extern int preserve_times;
+extern int preserve_mtimes;
 extern int msgs2stderr;
 extern int xfersum_type;
 extern int checksum_type;
@@ -706,7 +706,7 @@ static void log_formatted(enum logcode code, const char *format, const char *op,
 				c[1] = 'L';
 				c[3] = '.';
 				c[4] = !(iflags & ITEM_REPORT_TIME) ? '.'
-				     : !preserve_times || !receiver_symlink_times
+				     : !preserve_mtimes || !receiver_symlink_times
 				    || (iflags & ITEM_REPORT_TIMEFAIL) ? 'T' : 't';
 			} else {
 				c[1] = S_ISDIR(file->mode) ? 'd'
@@ -714,7 +714,7 @@ static void log_formatted(enum logcode code, const char *format, const char *op,
 				     : IS_DEVICE(file->mode) ? 'D' : 'f';
 				c[3] = !(iflags & ITEM_REPORT_SIZE) ? '.' : 's';
 				c[4] = !(iflags & ITEM_REPORT_TIME) ? '.'
-				     : !preserve_times ? 'T' : 't';
+				     : !preserve_mtimes ? 'T' : 't';
 			}
 			c[2] = !(iflags & ITEM_REPORT_CHANGE) ? '.' : 'c';
 			c[5] = !(iflags & ITEM_REPORT_PERMS) ? '.' : 'p';
@@ -838,14 +838,24 @@ void maybe_log_item(struct file_struct *file, int iflags, int itemizing, const c
 
 void log_delete(const char *fname, int mode)
 {
-	static struct {
-		union file_extras ex[4]; /* just in case... */
-		struct file_struct file;
-	} x; /* Zero-initialized due to static declaration. */
+	static struct file_struct *file = NULL;
 	int len = strlen(fname);
 	const char *fmt;
 
-	x.file.mode = mode;
+	if (!file) {
+		int extra_len = (file_extra_cnt + 2) * EXTRA_LEN;
+		char *bp;
+#if EXTRA_ROUNDING > 0
+		if (extra_len & (EXTRA_ROUNDING * EXTRA_LEN))
+			extra_len = (extra_len | (EXTRA_ROUNDING * EXTRA_LEN)) + EXTRA_LEN;
+#endif
+
+		bp = new_array0(char, FILE_STRUCT_LEN + extra_len + 1);
+		bp += extra_len;
+		file = (struct file_struct *)bp;
+	}
+
+	file->mode = mode;
 
 	if (am_server && protocol_version >= 29 && len < MAXPATHLEN) {
 		if (S_ISDIR(mode))
@@ -855,14 +865,14 @@ void log_delete(const char *fname, int mode)
 		;
 	else {
 		fmt = stdout_format_has_o_or_i ? stdout_format : "deleting %n";
-		log_formatted(FCLIENT, fmt, "del.", &x.file, fname, ITEM_DELETED, NULL);
+		log_formatted(FCLIENT, fmt, "del.", file, fname, ITEM_DELETED, NULL);
 	}
 
 	if (!logfile_name || dry_run || !logfile_format)
 		return;
 
 	fmt = logfile_format_has_o_or_i ? logfile_format : "deleting %n";
-	log_formatted(FLOG, fmt, "del.", &x.file, fname, ITEM_DELETED, NULL);
+	log_formatted(FLOG, fmt, "del.", file, fname, ITEM_DELETED, NULL);
 }
 
 /*
diff --git a/main.c b/main.c
index 46b97b58..58920a2d 100644
--- a/main.c
+++ b/main.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -48,6 +48,7 @@ extern int called_from_signal_handler;
 extern int need_messages_from_generator;
 extern int kluge_around_eof;
 extern int got_xfer_error;
+extern int old_style_args;
 extern int msgs2stderr;
 extern int module_id;
 extern int read_only;
@@ -87,6 +88,7 @@ extern BOOL shutting_down;
 extern int backup_dir_len;
 extern int basis_dir_cnt;
 extern int default_af_hint;
+extern int stdout_format_has_i;
 extern struct stats stats;
 extern char *stdout_format;
 extern char *logfile_format;
@@ -466,38 +468,33 @@ static void output_summary(void)
  **/
 static void show_malloc_stats(void)
 {
-#ifdef HAVE_MALLINFO
-	struct mallinfo mi;
-
-	mi = mallinfo();
+#ifdef MEM_ALLOC_INFO
+	struct MEM_ALLOC_INFO mi = MEM_ALLOC_INFO(); /* mallinfo or mallinfo2 */
 
 	rprintf(FCLIENT, "\n");
 	rprintf(FINFO, RSYNC_NAME "[%d] (%s%s%s) heap statistics:\n",
 		(int)getpid(), am_server ? "server " : "",
 		am_daemon ? "daemon " : "", who_am_i());
-	rprintf(FINFO, "  arena:     %10ld   (bytes from sbrk)\n",
-		(long)mi.arena);
-	rprintf(FINFO, "  ordblks:   %10ld   (chunks not in use)\n",
-		(long)mi.ordblks);
-	rprintf(FINFO, "  smblks:    %10ld\n",
-		(long)mi.smblks);
-	rprintf(FINFO, "  hblks:     %10ld   (chunks from mmap)\n",
-		(long)mi.hblks);
-	rprintf(FINFO, "  hblkhd:    %10ld   (bytes from mmap)\n",
-		(long)mi.hblkhd);
-	rprintf(FINFO, "  allmem:    %10ld   (bytes from sbrk + mmap)\n",
-		(long)mi.arena + mi.hblkhd);
-	rprintf(FINFO, "  usmblks:   %10ld\n",
-		(long)mi.usmblks);
-	rprintf(FINFO, "  fsmblks:   %10ld\n",
-		(long)mi.fsmblks);
-	rprintf(FINFO, "  uordblks:  %10ld   (bytes used)\n",
-		(long)mi.uordblks);
-	rprintf(FINFO, "  fordblks:  %10ld   (bytes free)\n",
-		(long)mi.fordblks);
-	rprintf(FINFO, "  keepcost:  %10ld   (bytes in releasable chunk)\n",
-		(long)mi.keepcost);
-#endif /* HAVE_MALLINFO */
+
+#define PRINT_ALLOC_NUM(title, descr, num) \
+	rprintf(FINFO, "  %-11s%10" SIZE_T_FMT_MOD "d   (" descr ")\n", \
+		title ":", (SIZE_T_FMT_CAST)(num));
+
+	PRINT_ALLOC_NUM("arena", "bytes from sbrk", mi.arena);
+	PRINT_ALLOC_NUM("ordblks", "chunks not in use", mi.ordblks);
+	PRINT_ALLOC_NUM("smblks", "free fastbin blocks", mi.smblks);
+	PRINT_ALLOC_NUM("hblks", "chunks from mmap", mi.hblks);
+	PRINT_ALLOC_NUM("hblkhd", "bytes from mmap", mi.hblkhd);
+	PRINT_ALLOC_NUM("allmem", "bytes from sbrk + mmap", mi.arena + mi.hblkhd);
+	PRINT_ALLOC_NUM("usmblks", "always 0", mi.usmblks);
+	PRINT_ALLOC_NUM("fsmblks", "bytes in freed fastbin blocks", mi.fsmblks);
+	PRINT_ALLOC_NUM("uordblks", "bytes used", mi.uordblks);
+	PRINT_ALLOC_NUM("fordblks", "bytes free", mi.fordblks);
+	PRINT_ALLOC_NUM("keepcost", "bytes in releasable chunk", mi.keepcost);
+
+#undef PRINT_ALLOC_NUM
+
+#endif /* MEM_ALLOC_INFO */
 }
 
 
@@ -611,11 +608,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char **remote_argv, in
 				rprintf(FERROR, "internal: args[] overflowed in do_cmd()\n");
 				exit_cleanup(RERR_SYNTAX);
 			}
-			if (**remote_argv == '-') {
-				if (asprintf(args + argc++, "./%s", *remote_argv++) < 0)
-					out_of_memory("do_cmd");
-			} else
-				args[argc++] = *remote_argv++;
+			args[argc++] = safe_arg(NULL, *remote_argv++);
 			remote_argc--;
 		}
 	}
@@ -721,18 +714,21 @@ static char *get_local_name(struct file_list *flist, char *dest_path)
 	trailing_slash = cp && !cp[1];
 
 	if (mkpath_dest_arg && statret < 0 && (cp || file_total > 1)) {
+		int save_errno = errno;
 		int ret = make_path(dest_path, file_total > 1 && !trailing_slash ? 0 : MKP_DROP_NAME);
 		if (ret < 0)
 			goto mkdir_error;
-		if (INFO_GTE(NAME, 1)) {
+		if (ret && (INFO_GTE(NAME, 1) || stdout_format_has_i)) {
 			if (file_total == 1 || trailing_slash)
 				*cp = '\0';
 			rprintf(FINFO, "created %d director%s for %s\n", ret, ret == 1 ? "y" : "ies", dest_path);
 			if (file_total == 1 || trailing_slash)
 				*cp = '/';
 		}
-		if (file_total > 1 || trailing_slash)
+		if (ret)
 			statret = do_stat(dest_path, &st);
+		else
+			errno = save_errno;
 	}
 
 	if (statret == 0) {
@@ -788,7 +784,7 @@ static char *get_local_name(struct file_list *flist, char *dest_path)
 		 && strcmp(flist->files[flist->low]->basename, ".") == 0)
 			flist->files[0]->flags |= FLAG_DIR_CREATED;
 
-		if (INFO_GTE(NAME, 1))
+		if (INFO_GTE(NAME, 1) || stdout_format_has_i)
 			rprintf(FINFO, "created directory %s\n", dest_path);
 
 		if (dry_run) {
@@ -1475,6 +1471,10 @@ static int start_client(int argc, char *argv[])
 		rsync_port = 0;
 	}
 
+	/* A local transfer doesn't unbackslash anything, so leave the args alone. */
+	if (local_server)
+		old_style_args = 2;
+
 	if (!rsync_port && remote_argc && !**remote_argv) /* Turn an empty arg into a dot dir. */
 		*remote_argv = ".";
 
@@ -1564,6 +1564,8 @@ static int start_client(int argc, char *argv[])
 #ifdef HAVE_PUTENV
 	if (daemon_connection)
 		set_env_num("RSYNC_PORT", env_port);
+#else
+	(void)env_port;
 #endif
 
 	pid = do_cmd(shell_cmd, shell_machine, shell_user, remote_argv, remote_argc, &f_in, &f_out);
@@ -1636,7 +1638,6 @@ void remember_children(UNUSED(int val))
 #endif
 }
 
-
 /**
  * This routine catches signals and tries to send them to gdb.
  *
@@ -1660,7 +1661,6 @@ const char *get_panic_action(void)
 	return "xterm -display :0 -T Panic -n Panic -e gdb /proc/%d/exe %d";
 }
 
-
 /**
  * Handle a fatal signal by launching a debugger, controlled by $RSYNC_PANIC_ACTION.
  *
@@ -1684,6 +1684,22 @@ static void rsync_panic_handler(UNUSED(int whatsig))
 }
 #endif
 
+static void unset_env_var(const char *var)
+{
+#ifdef HAVE_UNSETENV
+	unsetenv(var);
+#else
+#ifdef HAVE_PUTENV
+	char *mem;
+	if (asprintf(&mem, "%s=", var) < 0)
+		out_of_memory("unset_env_var");
+	putenv(mem);
+#else
+	(void)var;
+#endif
+#endif
+}
+
 
 int main(int argc,char *argv[])
 {
@@ -1721,6 +1737,8 @@ int main(int argc,char *argv[])
 	our_gid = MY_GID();
 	am_root = our_uid == ROOT_UID;
 
+	unset_env_var("DISPLAY");
+
 	memset(&stats, 0, sizeof(stats));
 
 	/* Even a non-daemon runs needs the default config values to be set, e.g.
@@ -1739,6 +1757,7 @@ int main(int argc,char *argv[])
 
 #if defined CONFIG_LOCALE && defined HAVE_SETLOCALE
 	setlocale(LC_CTYPE, "");
+	setlocale(LC_NUMERIC, "");
 #endif
 
 	if (!parse_arguments(&argc, (const char ***) &argv)) {
diff --git a/maybe-make-man b/maybe-make-man
index b7f0a9f1..0dc17305 100755
--- a/maybe-make-man
+++ b/maybe-make-man
@@ -1,22 +1,17 @@
 #!/bin/sh
 
-if [ x"$2" = x ]; then
-    echo "Usage: $0 SRC_DIR NAME.NUM.md" 1>&2
+if [ $# != 1 ]; then
+    echo "Usage: $0 NAME.NUM.md" 1>&2
     exit 1
 fi
 
-srcdir="$1"
-inname="$2"
+inname="$1"
+srcdir=`dirname "$0"`
 flagfile="$srcdir/.md2man-works"
 
-if [ ! -d "$srcdir" ]; then
-    echo "The specified SRC_DIR is not a directory: $srcdir" 1>&2
-    exit 1
-fi
-
 if [ ! -f "$flagfile" ]; then
     # We test our smallest manpage just to see if the python setup works.
-    if "$srcdir/md2man" --test "$srcdir/rsync-ssl.1.md" >/dev/null 2>&1; then
+    if "$srcdir/md-convert" --test "$srcdir/rsync-ssl.1.md" >/dev/null 2>&1; then
 	touch $flagfile
     else
 	outname=`echo "$inname" | sed 's/\.md$//'`
@@ -37,4 +32,4 @@ if [ ! -f "$flagfile" ]; then
     fi
 fi
 
-"$srcdir/md2man" "$srcdir/$inname"
+"$srcdir/md-convert" "$srcdir/$inname"
diff --git a/md-convert b/md-convert
new file mode 100755
index 00000000..41a1930a
--- /dev/null
+++ b/md-convert
@@ -0,0 +1,630 @@
+#!/usr/bin/env python3
+
+# This script transforms markdown files into html and (optionally) nroff. The
+# output files are written into the current directory named for the input file
+# without the .md suffix and either the .html suffix or no suffix.
+#
+# If the input .md file has a section number at the end of the name (e.g.,
+# rsync.1.md) a nroff file is also output (PROJ.NUM.md -> PROJ.NUM).
+#
+# The markdown input format has one extra extension: if a numbered list starts
+# at 0, it is turned into a description list. The dl's dt tag is taken from the
+# contents of the first tag inside the li, which is usually a p, code, or
+# strong tag.
+#
+# The cmarkgfm or commonmark lib is used to transforms the input file into
+# html.  Then, the html.parser is used as a state machine that lets us tweak
+# the html and (optionally) output nroff data based on the html tags.
+#
+# If the string @USE_GFM_PARSER@ exists in the file, the string is removed and
+# a github-flavored-markup parser is used to parse the file.
+#
+# The man-page .md files also get the vars @VERSION@, @BINDIR@, and @LIBDIR@
+# substituted.  Some of these values depend on the Makefile $(prefix) (see the
+# generated Makefile).  If the maintainer wants to build files for /usr/local
+# while creating release-ready man-page files for /usr, use the environment to
+# set RSYNC_OVERRIDE_PREFIX=/usr.
+
+# Copyright (C) 2020 - 2021 Wayne Davison
+#
+# This program is freely redistributable.
+
+import os, sys, re, argparse, subprocess, time
+from html.parser import HTMLParser
+
+VALID_PAGES = 'README INSTALL COPYING rsync.1 rrsync.1 rsync-ssl.1 rsyncd.conf.5'.split()
+
+CONSUMES_TXT = set('h1 h2 h3 p li pre'.split())
+
+HTML_START = """\
+<html><head>
+<title>%TITLE%</title>
+<meta charset="UTF-8"/>
+<link href="https://fonts.googleapis.com/css2?family=Roboto&family=Roboto+Mono&display=swap" rel="stylesheet">
+<style>
+body {
+  max-width: 50em;
+  margin: auto;
+}
+body, b, strong, u {
+  font-family: 'Roboto', sans-serif;
+}
+a.tgt { font-face: symbol; font-weight: 400; font-size: 70%; visibility: hidden; text-decoration: none; color: #ddd; padding: 0 4px; border: 0; }
+a.tgt:after { content: '🔗'; }
+a.tgt:hover { color: #444; background-color: #eaeaea; }
+h1:hover > a.tgt, h2:hover > a.tgt, h3:hover > a.tgt, dt:hover > a.tgt { visibility: visible; }
+code {
+  font-family: 'Roboto Mono', monospace;
+  font-weight: bold;
+  white-space: pre;
+}
+pre code {
+  display: block;
+  font-weight: normal;
+}
+blockquote pre code {
+  background: #f1f1f1;
+}
+dd p:first-of-type {
+  margin-block-start: 0em;
+}
+</style>
+</head><body>
+"""
+
+TABLE_STYLE = """\
+table {
+  border-color: grey;
+  border-spacing: 0;
+}
+tr {
+  border-top: 1px solid grey;
+}
+tr:nth-child(2n) {
+  background-color: #f6f8fa;
+}
+th, td {
+  border: 1px solid #dfe2e5;
+  text-align: center;
+  padding-left: 1em;
+  padding-right: 1em;
+}
+"""
+
+MAN_HTML_END = """\
+<div style="float: right"><p><i>%s</i></p></div>
+"""
+
+HTML_END = """\
+</body></html>
+"""
+
+MAN_START = r"""
+.TH "%s" "%s" "%s" "%s" "User Commands"
+.\" prefix=%s
+""".lstrip()
+
+MAN_END = """\
+"""
+
+NORM_FONT = ('\1', r"\fP")
+BOLD_FONT = ('\2', r"\fB")
+UNDR_FONT = ('\3', r"\fI")
+NBR_DASH = ('\4', r"\-")
+NBR_SPACE = ('\xa0', r"\ ")
+
+FILENAME_RE = re.compile(r'^(?P<fn>(?P<srcdir>.+/)?(?P<name>(?P<prog>[^/]+?)(\.(?P<sect>\d+))?)\.md)$')
+ASSIGNMENT_RE = re.compile(r'^(\w+)=(.+)')
+QUOTED_RE = re.compile(r'"(.+?)"')
+VAR_REF_RE = re.compile(r'\$\{(\w+)\}')
+VERSION_RE = re.compile(r' (\d[.\d]+)[, ]')
+BIN_CHARS_RE = re.compile(r'[\1-\7]+')
+SPACE_DOUBLE_DASH_RE = re.compile(r'\s--(\s)')
+NON_SPACE_SINGLE_DASH_RE = re.compile(r'(^|\W)-')
+WHITESPACE_RE = re.compile(r'\s')
+CODE_BLOCK_RE = re.compile(r'[%s]([^=%s]+)[=%s]' % (BOLD_FONT[0], NORM_FONT[0], NORM_FONT[0]))
+NBR_DASH_RE = re.compile(r'[%s]' % NBR_DASH[0])
+INVALID_TARGET_CHARS_RE = re.compile(r'[^-A-Za-z0-9._]')
+INVALID_START_CHAR_RE = re.compile(r'^([^A-Za-z0-9])')
+MANIFY_LINESTART_RE = re.compile(r"^(['.])", flags=re.M)
+
+md_parser = None
+env_subs = { }
+
+warning_count = 0
+
+def main():
+    for mdfn in args.mdfiles:
+        parse_md_file(mdfn)
+
+    if args.test:
+        print("The test was successful.")
+
+
+def parse_md_file(mdfn):
+    fi = FILENAME_RE.match(mdfn)
+    if not fi:
+        die('Failed to parse a md input file name:', mdfn)
+    fi = argparse.Namespace(**fi.groupdict())
+    fi.want_manpage = not not fi.sect
+    if fi.want_manpage:
+        fi.title = fi.prog + '(' + fi.sect + ') manpage'
+    else:
+        fi.title = fi.prog + ' for rsync'
+
+    if fi.want_manpage:
+        if not env_subs:
+            find_man_substitutions()
+        prog_ver = 'rsync ' + env_subs['VERSION']
+        if fi.prog != 'rsync':
+            prog_ver = fi.prog + ' from ' + prog_ver
+        fi.man_headings = (fi.prog, fi.sect, env_subs['date'], prog_ver, env_subs['prefix'])
+
+    with open(mdfn, 'r', encoding='utf-8') as fh:
+        txt = fh.read()
+
+    use_gfm_parser = '@USE_GFM_PARSER@' in txt
+    if use_gfm_parser:
+        txt = txt.replace('@USE_GFM_PARSER@', '')
+
+    if fi.want_manpage:
+        txt = (txt.replace('@VERSION@', env_subs['VERSION'])
+                  .replace('@BINDIR@', env_subs['bindir'])
+                  .replace('@LIBDIR@', env_subs['libdir']))
+
+    if use_gfm_parser:
+        if not gfm_parser:
+            die('Input file requires cmarkgfm parser:', mdfn)
+        fi.html_in = gfm_parser(txt)
+    else:
+        fi.html_in = md_parser(txt)
+    txt = None
+
+    TransformHtml(fi)
+
+    if args.test:
+        return
+
+    output_list = [ (fi.name + '.html', fi.html_out) ]
+    if fi.want_manpage:
+        output_list += [ (fi.name, fi.man_out) ]
+    for fn, txt in output_list:
+        if args.dest and args.dest != '.':
+            fn = os.path.join(args.dest, fn)
+        if os.path.lexists(fn):
+            os.unlink(fn)
+        print("Wrote:", fn)
+        with open(fn, 'w', encoding='utf-8') as fh:
+            fh.write(txt)
+
+
+def find_man_substitutions():
+    srcdir = os.path.dirname(sys.argv[0]) + '/'
+    mtime = 0
+
+    git_dir = srcdir + '.git'
+    if os.path.lexists(git_dir):
+        mtime = int(subprocess.check_output(['git', '--git-dir', git_dir, 'log', '-1', '--format=%at']))
+
+    # Allow "prefix" to be overridden via the environment:
+    env_subs['prefix'] = os.environ.get('RSYNC_OVERRIDE_PREFIX', None)
+
+    if args.test:
+        env_subs['VERSION'] = '1.0.0'
+        env_subs['bindir'] = '/usr/bin'
+        env_subs['libdir'] = '/usr/lib/rsync'
+    else:
+        for fn in (srcdir + 'version.h', 'Makefile'):
+            try:
+                st = os.lstat(fn)
+            except OSError:
+                die('Failed to find', srcdir + fn)
+            if not mtime:
+                mtime = st.st_mtime
+
+        with open(srcdir + 'version.h', 'r', encoding='utf-8') as fh:
+            txt = fh.read()
+        m = QUOTED_RE.search(txt)
+        env_subs['VERSION'] = m.group(1)
+
+        with open('Makefile', 'r', encoding='utf-8') as fh:
+            for line in fh:
+                m = ASSIGNMENT_RE.match(line)
+                if not m:
+                    continue
+                var, val = (m.group(1), m.group(2))
+                if var == 'prefix' and env_subs[var] is not None:
+                    continue
+                while VAR_REF_RE.search(val):
+                    val = VAR_REF_RE.sub(lambda m: env_subs[m.group(1)], val)
+                env_subs[var] = val
+                if var == 'srcdir':
+                    break
+
+    env_subs['date'] = time.strftime('%d %b %Y', time.localtime(mtime))
+
+
+def html_via_commonmark(txt):
+    return commonmark.HtmlRenderer().render(commonmark.Parser().parse(txt))
+
+
+class TransformHtml(HTMLParser):
+    def __init__(self, fi):
+        HTMLParser.__init__(self, convert_charrefs=True)
+
+        self.fn = fi.fn
+
+        st = self.state = argparse.Namespace(
+                list_state = [ ],
+                p_macro = ".P\n",
+                at_first_tag_in_li = False,
+                at_first_tag_in_dd = False,
+                dt_from = None,
+                in_pre = False,
+                in_code = False,
+                html_out = [ HTML_START.replace('%TITLE%', fi.title) ],
+                man_out = [ ],
+                txt = '',
+                want_manpage = fi.want_manpage,
+                created_hashtags = set(),
+                derived_hashtags = set(),
+                referenced_hashtags = set(),
+                bad_hashtags = set(),
+                latest_targets = [ ],
+                opt_prefix = 'opt',
+                a_txt_start = None,
+                target_suf = '',
+                )
+
+        if st.want_manpage:
+            st.man_out.append(MAN_START % fi.man_headings)
+
+        if '</table>' in fi.html_in:
+            st.html_out[0] = st.html_out[0].replace('</style>', TABLE_STYLE + '</style>')
+
+        self.feed(fi.html_in)
+        fi.html_in = None
+
+        if st.want_manpage:
+            st.html_out.append(MAN_HTML_END % env_subs['date'])
+        st.html_out.append(HTML_END)
+        st.man_out.append(MAN_END)
+
+        fi.html_out = ''.join(st.html_out)
+        st.html_out = None
+
+        fi.man_out = ''.join(st.man_out)
+        st.man_out = None
+
+        for tgt, txt in st.derived_hashtags:
+            derived = txt2target(txt, tgt)
+            if derived not in st.created_hashtags:
+                txt = BIN_CHARS_RE.sub('', txt.replace(NBR_DASH[0], '-').replace(NBR_SPACE[0], ' '))
+                warn('Unknown derived hashtag link in', self.fn, 'based on:', (tgt, txt))
+
+        for bad in st.bad_hashtags:
+            if bad in st.created_hashtags:
+                warn('Missing "#" in hashtag link in', self.fn + ':', bad)
+            else:
+                warn('Unknown non-hashtag link in', self.fn + ':', bad)
+
+        for bad in st.referenced_hashtags - st.created_hashtags:
+            warn('Unknown hashtag link in', self.fn + ':', '#' + bad)
+
+    def handle_starttag(self, tag, attrs_list):
+        st = self.state
+        if args.debug:
+            self.output_debug('START', (tag, attrs_list))
+        if st.at_first_tag_in_li:
+            if st.list_state[-1] == 'dl':
+                st.dt_from = tag
+                if tag == 'p':
+                    tag = 'dt'
+                else:
+                    st.html_out.append('<dt>')
+            elif tag == 'p':
+                st.at_first_tag_in_dd = True # Kluge to suppress a .P at the start of an li.
+            st.at_first_tag_in_li = False
+        if tag == 'p':
+            if not st.at_first_tag_in_dd:
+                st.man_out.append(st.p_macro)
+        elif tag == 'li':
+            st.at_first_tag_in_li = True
+            lstate = st.list_state[-1]
+            if lstate == 'dl':
+                return
+            if lstate == 'o':
+                st.man_out.append(".IP o\n")
+            else:
+                st.man_out.append(".IP " + str(lstate) + ".\n")
+                st.list_state[-1] += 1
+        elif tag == 'blockquote':
+            st.man_out.append(".RS 4\n")
+        elif tag == 'pre':
+            st.in_pre = True
+            st.man_out.append(st.p_macro + ".nf\n")
+        elif tag == 'code' and not st.in_pre:
+            st.in_code = True
+            st.txt += BOLD_FONT[0]
+        elif tag == 'strong' or tag == 'b':
+            st.txt += BOLD_FONT[0]
+        elif tag == 'em' or  tag == 'i':
+            if st.want_manpage:
+                tag = 'u' # Change it into underline to be more like the manpage
+                st.txt += UNDR_FONT[0]
+        elif tag == 'ol':
+            start = 1
+            for var, val in attrs_list:
+                if var == 'start':
+                    start = int(val) # We only support integers.
+                    break
+            if st.list_state:
+                st.man_out.append(".RS\n")
+            if start == 0:
+                tag = 'dl'
+                attrs_list = [ ]
+                st.list_state.append('dl')
+            else:
+                st.list_state.append(start)
+            st.man_out.append(st.p_macro)
+            st.p_macro = ".IP\n"
+        elif tag == 'ul':
+            st.man_out.append(st.p_macro)
+            if st.list_state:
+                st.man_out.append(".RS\n")
+                st.p_macro = ".IP\n"
+            st.list_state.append('o')
+        elif tag == 'hr':
+            st.man_out.append(".l\n")
+            st.html_out.append("<hr />")
+            return
+        elif tag == 'a':
+            st.a_href = None
+            for var, val in attrs_list:
+                if var == 'href':
+                    if val.startswith(('https://', 'http://', 'mailto:', 'ftp:')):
+                        pass # nothing to check
+                    elif '#' in val:
+                        pg, tgt = val.split('#', 2)
+                        if pg and pg not in VALID_PAGES or '#' in tgt:
+                            st.bad_hashtags.add(val)
+                        elif tgt in ('', 'opt', 'dopt'):
+                            st.a_href = val
+                        elif pg == '':
+                            st.referenced_hashtags.add(tgt)
+                            if tgt in st.latest_targets:
+                                warn('Found link to the current section in', self.fn + ':', val)
+                    elif val not in VALID_PAGES:
+                        st.bad_hashtags.add(val)
+            st.a_txt_start = len(st.txt)
+        st.html_out.append('<' + tag + ''.join(' ' + var + '="' + htmlify(val) + '"' for var, val in attrs_list) + '>')
+        st.at_first_tag_in_dd = False
+
+
+    def handle_endtag(self, tag):
+        st = self.state
+        if args.debug:
+            self.output_debug('END', (tag,))
+        if tag in CONSUMES_TXT or st.dt_from == tag:
+            txt = st.txt.strip()
+            st.txt = ''
+        else:
+            txt = None
+        add_to_txt = None
+        if tag == 'h1':
+            tgt = txt
+            target_suf = ''
+            if tgt.startswith('NEWS for '):
+                m = VERSION_RE.search(tgt)
+                if m:
+                    tgt = m.group(1)
+                    st.target_suf = '-' + tgt
+            self.add_targets(tag, tgt)
+        elif tag == 'h2':
+            st.man_out.append(st.p_macro + '.SH "' + manify(txt) + '"\n')
+            self.add_targets(tag, txt, st.target_suf)
+            st.opt_prefix = 'dopt' if txt == 'DAEMON OPTIONS' else 'opt'
+        elif tag == 'h3':
+            st.man_out.append(st.p_macro + '.SS "' + manify(txt) + '"\n')
+            self.add_targets(tag, txt, st.target_suf)
+        elif tag == 'p':
+            if st.dt_from == 'p':
+                tag = 'dt'
+                st.man_out.append('.IP "' + manify(txt) + '"\n')
+                if txt.startswith(BOLD_FONT[0]):
+                    self.add_targets(tag, txt)
+                st.dt_from = None
+            elif txt != '':
+                st.man_out.append(manify(txt) + "\n")
+        elif tag == 'li':
+            if st.list_state[-1] == 'dl':
+                if st.at_first_tag_in_li:
+                    die("Invalid 0. -> td translation")
+                tag = 'dd'
+            if txt != '':
+                st.man_out.append(manify(txt) + "\n")
+            st.at_first_tag_in_li = False
+        elif tag == 'blockquote':
+            st.man_out.append(".RE\n")
+        elif tag == 'pre':
+            st.in_pre = False
+            st.man_out.append(manify(txt) + "\n.fi\n")
+        elif (tag == 'code' and not st.in_pre):
+            st.in_code = False
+            add_to_txt = NORM_FONT[0]
+        elif tag == 'strong' or tag == 'b':
+            add_to_txt = NORM_FONT[0]
+        elif tag == 'em' or  tag == 'i':
+            if st.want_manpage:
+                tag = 'u' # Change it into underline to be more like the manpage
+                add_to_txt = NORM_FONT[0]
+        elif tag == 'ol' or tag == 'ul':
+            if st.list_state.pop() == 'dl':
+                tag = 'dl'
+            if st.list_state:
+                st.man_out.append(".RE\n")
+            else:
+                st.p_macro = ".P\n"
+            st.at_first_tag_in_dd = False
+        elif tag == 'hr':
+            return
+        elif tag == 'a':
+            if st.a_href:
+                atxt = st.txt[st.a_txt_start:]
+                find = 'href="' + st.a_href + '"'
+                for j in range(len(st.html_out)-1, 0, -1):
+                    if find in st.html_out[j]:
+                        pg, tgt = st.a_href.split('#', 2)
+                        derived = txt2target(atxt, tgt)
+                        if pg == '':
+                            if derived in st.latest_targets:
+                                warn('Found link to the current section in', self.fn + ':', st.a_href)
+                            st.derived_hashtags.add((tgt, atxt))
+                        st.html_out[j] = st.html_out[j].replace(find, 'href="' + pg + '#' + derived + '"')
+                        break
+                else:
+                    die('INTERNAL ERROR: failed to find href in html data:', find)
+        st.html_out.append('</' + tag + '>')
+        if add_to_txt:
+            if txt is None:
+                st.txt += add_to_txt
+            else:
+                txt += add_to_txt
+        if st.dt_from == tag:
+            st.man_out.append('.IP "' + manify(txt) + '"\n')
+            st.html_out.append('</dt><dd>')
+            st.at_first_tag_in_dd = True
+            st.dt_from = None
+        elif tag == 'dt':
+            st.html_out.append('<dd>')
+            st.at_first_tag_in_dd = True
+
+
+    def handle_data(self, txt):
+        st = self.state
+        if '](' in txt:
+            warn('Malformed link in', self.fn + ':', txt)
+        if args.debug:
+            self.output_debug('DATA', (txt,))
+        if st.in_pre:
+            html = htmlify(txt)
+        else:
+            txt = SPACE_DOUBLE_DASH_RE.sub(NBR_SPACE[0] + r'--\1', txt).replace('--', NBR_DASH[0]*2)
+            txt = NON_SPACE_SINGLE_DASH_RE.sub(r'\1' + NBR_DASH[0], txt)
+            html = htmlify(txt)
+            if st.in_code:
+                txt = WHITESPACE_RE.sub(NBR_SPACE[0], txt)
+                html = html.replace(NBR_DASH[0], '-').replace(NBR_SPACE[0], ' ') # <code> is non-breaking in CSS
+        st.html_out.append(html.replace(NBR_SPACE[0], '&nbsp;').replace(NBR_DASH[0], '-&#8288;'))
+        st.txt += txt
+
+
+    def add_targets(self, tag, txt, suf=None):
+        st = self.state
+        tag = '<' + tag + '>'
+        targets = CODE_BLOCK_RE.findall(txt)
+        if not targets:
+            targets = [ txt ]
+        tag_pos = 0
+        for txt in targets:
+            txt = txt2target(txt, st.opt_prefix)
+            if not txt:
+                continue
+            if suf:
+                txt += suf
+            if txt in st.created_hashtags:
+                for j in range(2, 1000):
+                    chk = txt + '-' + str(j)
+                    if chk not in st.created_hashtags:
+                        print('Made link target unique:', chk)
+                        txt = chk
+                        break
+            if tag_pos == 0:
+                tag_pos -= 1
+                while st.html_out[tag_pos] != tag:
+                    tag_pos -= 1
+                st.html_out[tag_pos] = tag[:-1] + ' id="' + txt + '">'
+                st.html_out.append('<a href="#' + txt + '" class="tgt"></a>')
+                tag_pos -= 1 # take into account the append
+            else:
+                st.html_out[tag_pos] = '<span id="' + txt + '"></span>' + st.html_out[tag_pos]
+            st.created_hashtags.add(txt)
+        st.latest_targets = targets
+
+
+    def output_debug(self, event, extra):
+        import pprint
+        st = self.state
+        if args.debug < 2:
+            st = argparse.Namespace(**vars(st))
+            if len(st.html_out) > 2:
+                st.html_out = ['...'] + st.html_out[-2:]
+            if len(st.man_out) > 2:
+                st.man_out = ['...'] + st.man_out[-2:]
+        print(event, extra)
+        pprint.PrettyPrinter(indent=2).pprint(vars(st))
+
+
+def txt2target(txt, opt_prefix):
+    txt = txt.strip().rstrip(':')
+    m = CODE_BLOCK_RE.search(txt)
+    if m:
+        txt = m.group(1)
+    txt = NBR_DASH_RE.sub('-', txt)
+    txt = BIN_CHARS_RE.sub('', txt)
+    txt = INVALID_TARGET_CHARS_RE.sub('_', txt)
+    if opt_prefix and txt.startswith('-'):
+        txt = opt_prefix + txt
+    else:
+        txt = INVALID_START_CHAR_RE.sub(r't\1', txt)
+    return txt
+
+
+def manify(txt):
+    return MANIFY_LINESTART_RE.sub(r'\&\1', txt.replace('\\', '\\\\')
+            .replace(NBR_SPACE[0], NBR_SPACE[1])
+            .replace(NBR_DASH[0], NBR_DASH[1])
+            .replace(NORM_FONT[0], NORM_FONT[1])
+            .replace(BOLD_FONT[0], BOLD_FONT[1])
+            .replace(UNDR_FONT[0], UNDR_FONT[1]))
+
+
+def htmlify(txt):
+    return txt.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;')
+
+
+def warn(*msg):
+    print(*msg, file=sys.stderr)
+    global warning_count
+    warning_count += 1
+
+
+def die(*msg):
+    warn(*msg)
+    sys.exit(1)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description="Output html and (optionally) nroff for markdown pages.", add_help=False)
+    parser.add_argument('--test', action='store_true', help="Just test the parsing without outputting any files.")
+    parser.add_argument('--dest', metavar='DIR', help="Put files into DIR instead of the current directory.")
+    parser.add_argument('--debug', '-D', action='count', default=0, help='Output copious info on the html parsing. Repeat for even more.')
+    parser.add_argument("--help", "-h", action="help", help="Output this help message and exit.")
+    parser.add_argument("mdfiles", nargs='+', help="The source .md files to convert.")
+    args = parser.parse_args()
+
+    try:
+        import cmarkgfm
+        md_parser = cmarkgfm.markdown_to_html
+        gfm_parser = cmarkgfm.github_flavored_markdown_to_html
+    except:
+        try:
+            import commonmark
+            md_parser = html_via_commonmark
+        except:
+            die("Failed to find cmarkgfm or commonmark for python3.")
+        gfm_parser = None
+
+    main()
+    if warning_count:
+        sys.exit(1)
diff --git a/md2man b/md2man
deleted file mode 100755
index 7f783c56..00000000
--- a/md2man
+++ /dev/null
@@ -1,383 +0,0 @@
-#!/usr/bin/env python3
-
-# This script takes a manpage written in markdown and turns it into an html web
-# page and a nroff man page.  The input file must have the name of the program
-# and the section in this format: NAME.NUM.md.  The output files are written
-# into the current directory named NAME.NUM.html and NAME.NUM.  The input
-# format has one extra extension: if a numbered list starts at 0, it is turned
-# into a description list. The dl's dt tag is taken from the contents of the
-# first tag inside the li, which is usually a p, code, or strong tag.  The
-# cmarkgfm or commonmark lib is used to transforms the input file into html.
-# The html.parser is used as a state machine that both tweaks the html and
-# outputs the nroff data based on the html tags.
-#
-# Copyright (C) 2020 Wayne Davison
-#
-# This program is freely redistributable.
-
-import sys, os, re, argparse, subprocess, time
-from html.parser import HTMLParser
-
-CONSUMES_TXT = set('h1 h2 p li pre'.split())
-
-HTML_START = """\
-<html><head>
-<title>%s</title>
-<link href="https://fonts.googleapis.com/css2?family=Roboto&family=Roboto+Mono&display=swap" rel="stylesheet">
-<style>
-body {
-  max-width: 50em;
-  margin: auto;
-}
-body, b, strong, u {
-  font-family: 'Roboto', sans-serif;
-}
-code {
-  font-family: 'Roboto Mono', monospace;
-  font-weight: bold;
-  white-space: pre;
-}
-pre code {
-  display: block;
-  font-weight: normal;
-}
-blockquote pre code {
-  background: #f1f1f1;
-}
-dd p:first-of-type {
-  margin-block-start: 0em;
-}
-</style>
-</head><body>
-"""
-
-HTML_END = """\
-<div style="float: right"><p><i>%s</i></p></div>
-</body></html>
-"""
-
-MAN_START = r"""
-.TH "%s" "%s" "%s" "%s" "User Commands"
-""".lstrip()
-
-MAN_END = """\
-"""
-
-NORM_FONT = ('\1', r"\fP")
-BOLD_FONT = ('\2', r"\fB")
-UNDR_FONT = ('\3', r"\fI")
-NBR_DASH = ('\4', r"\-")
-NBR_SPACE = ('\xa0', r"\ ")
-
-md_parser = None
-
-def main():
-    fi = re.match(r'^(?P<fn>(?P<srcdir>.+/)?(?P<name>(?P<prog>[^/]+)\.(?P<sect>\d+))\.md)$', args.mdfile)
-    if not fi:
-        die('Failed to parse NAME.NUM.md out of input file:', args.mdfile)
-    fi = argparse.Namespace(**fi.groupdict())
-
-    if not fi.srcdir:
-        fi.srcdir = './'
-
-    fi.title = fi.prog + '(' + fi.sect + ') man page'
-    fi.mtime = 0
-
-    git_dir = fi.srcdir + '.git'
-    if os.path.lexists(git_dir):
-        fi.mtime = int(subprocess.check_output(['git', '--git-dir', git_dir, 'log', '-1', '--format=%at']))
-
-    env_subs = { 'prefix': os.environ.get('RSYNC_OVERRIDE_PREFIX', None) }
-
-    if args.test:
-        env_subs['VERSION'] = '1.0.0'
-        env_subs['libdir'] = '/usr'
-    else:
-        for fn in (fi.srcdir + 'version.h', 'Makefile'):
-            try:
-                st = os.lstat(fn)
-            except:
-                die('Failed to find', fi.srcdir + fn)
-            if not fi.mtime:
-                fi.mtime = st.st_mtime
-
-        with open(fi.srcdir + 'version.h', 'r', encoding='utf-8') as fh:
-            txt = fh.read()
-        m = re.search(r'"(.+?)"', txt)
-        env_subs['VERSION'] = m.group(1)
-
-        with open('Makefile', 'r', encoding='utf-8') as fh:
-            for line in fh:
-                m = re.match(r'^(\w+)=(.+)', line)
-                if not m:
-                    continue
-                var, val = (m.group(1), m.group(2))
-                if var == 'prefix' and env_subs[var] is not None:
-                    continue
-                while re.search(r'\$\{', val):
-                    val = re.sub(r'\$\{(\w+)\}', lambda m: env_subs[m.group(1)], val)
-                env_subs[var] = val
-                if var == 'srcdir':
-                    break
-
-    with open(fi.fn, 'r', encoding='utf-8') as fh:
-        txt = fh.read()
-
-    txt = re.sub(r'@VERSION@', env_subs['VERSION'], txt)
-    txt = re.sub(r'@LIBDIR@', env_subs['libdir'], txt)
-
-    fi.html_in = md_parser(txt)
-    txt = None
-
-    fi.date = time.strftime('%d %b %Y', time.localtime(fi.mtime))
-    fi.man_headings = (fi.prog, fi.sect, fi.date, fi.prog + ' ' + env_subs['VERSION'])
-
-    HtmlToManPage(fi)
-
-    if args.test:
-        print("The test was successful.")
-        return
-
-    for fn, txt in ((fi.name + '.html', fi.html_out), (fi.name, fi.man_out)):
-        print("Wrote:", fn)
-        with open(fn, 'w', encoding='utf-8') as fh:
-            fh.write(txt)
-
-
-def html_via_commonmark(txt):
-    return commonmark.HtmlRenderer().render(commonmark.Parser().parse(txt))
-
-
-class HtmlToManPage(HTMLParser):
-    def __init__(self, fi):
-        HTMLParser.__init__(self, convert_charrefs=True)
-
-        st = self.state = argparse.Namespace(
-                list_state = [ ],
-                p_macro = ".P\n",
-                at_first_tag_in_li = False,
-                at_first_tag_in_dd = False,
-                dt_from = None,
-                in_pre = False,
-                in_code = False,
-                html_out = [ HTML_START % fi.title ],
-                man_out = [ MAN_START % fi.man_headings ],
-                txt = '',
-                )
-
-        self.feed(fi.html_in)
-        fi.html_in = None
-
-        st.html_out.append(HTML_END % fi.date)
-        st.man_out.append(MAN_END)
-
-        fi.html_out = ''.join(st.html_out)
-        st.html_out = None
-
-        fi.man_out = ''.join(st.man_out)
-        st.man_out = None
-
-
-    def handle_starttag(self, tag, attrs_list):
-        st = self.state
-        if args.debug:
-            self.output_debug('START', (tag, attrs_list))
-        if st.at_first_tag_in_li:
-            if st.list_state[-1] == 'dl':
-                st.dt_from = tag
-                if tag == 'p':
-                    tag = 'dt'
-                else:
-                    st.html_out.append('<dt>')
-            elif tag == 'p':
-                st.at_first_tag_in_dd = True # Kluge to suppress a .P at the start of an li.
-            st.at_first_tag_in_li = False
-        if tag == 'p':
-            if not st.at_first_tag_in_dd:
-                st.man_out.append(st.p_macro)
-        elif tag == 'li':
-            st.at_first_tag_in_li = True
-            lstate = st.list_state[-1]
-            if lstate == 'dl':
-                return
-            if lstate == 'o':
-                st.man_out.append(".IP o\n")
-            else:
-                st.man_out.append(".IP " + str(lstate) + ".\n")
-                st.list_state[-1] += 1
-        elif tag == 'blockquote':
-            st.man_out.append(".RS 4\n")
-        elif tag == 'pre':
-            st.in_pre = True
-            st.man_out.append(st.p_macro + ".nf\n")
-        elif tag == 'code' and not st.in_pre:
-            st.in_code = True
-            st.txt += BOLD_FONT[0]
-        elif tag == 'strong' or tag == 'b':
-            st.txt += BOLD_FONT[0]
-        elif tag == 'em' or  tag == 'i':
-            tag = 'u' # Change it into underline to be more like the man page
-            st.txt += UNDR_FONT[0]
-        elif tag == 'ol':
-            start = 1
-            for var, val in attrs_list:
-                if var == 'start':
-                    start = int(val) # We only support integers.
-                    break
-            if st.list_state:
-                st.man_out.append(".RS\n")
-            if start == 0:
-                tag = 'dl'
-                attrs_list = [ ]
-                st.list_state.append('dl')
-            else:
-                st.list_state.append(start)
-            st.man_out.append(st.p_macro)
-            st.p_macro = ".IP\n"
-        elif tag == 'ul':
-            st.man_out.append(st.p_macro)
-            if st.list_state:
-                st.man_out.append(".RS\n")
-                st.p_macro = ".IP\n"
-            st.list_state.append('o')
-        st.html_out.append('<' + tag + ''.join(' ' + var + '="' + htmlify(val) + '"' for var, val in attrs_list) + '>')
-        st.at_first_tag_in_dd = False
-
-
-    def handle_endtag(self, tag):
-        st = self.state
-        if args.debug:
-            self.output_debug('END', (tag,))
-        if tag in CONSUMES_TXT or st.dt_from == tag:
-            txt = st.txt.strip()
-            st.txt = ''
-        else:
-            txt = None
-        add_to_txt = None
-        if tag == 'h1':
-            st.man_out.append(st.p_macro + '.SH "' + manify(txt) + '"\n')
-        elif tag == 'h2':
-            st.man_out.append(st.p_macro + '.SS "' + manify(txt) + '"\n')
-        elif tag == 'p':
-            if st.dt_from == 'p':
-                tag = 'dt'
-                st.man_out.append('.IP "' + manify(txt) + '"\n')
-                st.dt_from = None
-            elif txt != '':
-                st.man_out.append(manify(txt) + "\n")
-        elif tag == 'li':
-            if st.list_state[-1] == 'dl':
-                if st.at_first_tag_in_li:
-                    die("Invalid 0. -> td translation")
-                tag = 'dd'
-            if txt != '':
-                st.man_out.append(manify(txt) + "\n")
-            st.at_first_tag_in_li = False
-        elif tag == 'blockquote':
-            st.man_out.append(".RE\n")
-        elif tag == 'pre':
-            st.in_pre = False
-            st.man_out.append(manify(txt) + "\n.fi\n")
-        elif (tag == 'code' and not st.in_pre):
-            st.in_code = False
-            add_to_txt = NORM_FONT[0]
-        elif tag == 'strong' or tag == 'b':
-            add_to_txt = NORM_FONT[0]
-        elif tag == 'em' or  tag == 'i':
-            tag = 'u' # Change it into underline to be more like the man page
-            add_to_txt = NORM_FONT[0]
-        elif tag == 'ol' or tag == 'ul':
-            if st.list_state.pop() == 'dl':
-                tag = 'dl'
-            if st.list_state:
-                st.man_out.append(".RE\n")
-            else:
-                st.p_macro = ".P\n"
-            st.at_first_tag_in_dd = False
-        st.html_out.append('</' + tag + '>')
-        if add_to_txt:
-            if txt is None:
-                st.txt += add_to_txt
-            else:
-                txt += add_to_txt
-        if st.dt_from == tag:
-            st.man_out.append('.IP "' + manify(txt) + '"\n')
-            st.html_out.append('</dt><dd>')
-            st.at_first_tag_in_dd = True
-            st.dt_from = None
-        elif tag == 'dt':
-            st.html_out.append('<dd>')
-            st.at_first_tag_in_dd = True
-
-
-    def handle_data(self, txt):
-        st = self.state
-        if args.debug:
-            self.output_debug('DATA', (txt,))
-        if st.in_pre:
-            html = htmlify(txt)
-        else:
-            txt = re.sub(r'\s--(\s)', NBR_SPACE[0] + r'--\1', txt).replace('--', NBR_DASH[0]*2)
-            txt = re.sub(r'(^|\W)-', r'\1' + NBR_DASH[0], txt)
-            html = htmlify(txt)
-            if st.in_code:
-                txt = re.sub(r'\s', NBR_SPACE[0], txt)
-                html = html.replace(NBR_DASH[0], '-').replace(NBR_SPACE[0], ' ') # <code> is non-breaking in CSS
-        st.html_out.append(html.replace(NBR_SPACE[0], '&nbsp;').replace(NBR_DASH[0], '-&#8288;'))
-        st.txt += txt
-
-
-    def output_debug(self, event, extra):
-        import pprint
-        st = self.state
-        if args.debug < 2:
-            st = argparse.Namespace(**vars(st))
-            if len(st.html_out) > 2:
-                st.html_out = ['...'] + st.html_out[-2:]
-            if len(st.man_out) > 2:
-                st.man_out = ['...'] + st.man_out[-2:]
-        print(event, extra)
-        pprint.PrettyPrinter(indent=2).pprint(vars(st))
-
-
-def manify(txt):
-    return re.sub(r"^(['.])", r'\&\1', txt.replace('\\', '\\\\')
-            .replace(NBR_SPACE[0], NBR_SPACE[1])
-            .replace(NBR_DASH[0], NBR_DASH[1])
-            .replace(NORM_FONT[0], NORM_FONT[1])
-            .replace(BOLD_FONT[0], BOLD_FONT[1])
-            .replace(UNDR_FONT[0], UNDR_FONT[1]), flags=re.M)
-
-
-def htmlify(txt):
-    return txt.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;').replace('"', '&quot;')
-
-
-def warn(*msg):
-    print(*msg, file=sys.stderr)
-
-
-def die(*msg):
-    warn(*msg)
-    sys.exit(1)
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description='Transform a NAME.NUM.md markdown file into a NAME.NUM.html web page & a NAME.NUM man page.', add_help=False)
-    parser.add_argument('--test', action='store_true', help='Test if we can parse the input w/o updating any files.')
-    parser.add_argument('--debug', '-D', action='count', default=0, help='Output copious info on the html parsing. Repeat for even more.')
-    parser.add_argument("--help", "-h", action="help", help="Output this help message and exit.")
-    parser.add_argument('mdfile', help="The NAME.NUM.md file to parse.")
-    args = parser.parse_args()
-
-    try:
-        import cmarkgfm
-        md_parser = cmarkgfm.markdown_to_html
-    except:
-        try:
-            import commonmark
-            md_parser = html_via_commonmark
-        except:
-            die("Failed to find cmarkgfm or commonmark for python3.")
-
-    main()
diff --git a/md2man b/md2man
new file mode 120000
index 00000000..5d1a8fcd
--- /dev/null
+++ b/md2man
@@ -0,0 +1 @@
+md-convert
\ No newline at end of file
diff --git a/mkgitver b/mkgitver
index c0dd1b5f..49aa150b 100755
--- a/mkgitver
+++ b/mkgitver
@@ -3,9 +3,18 @@
 srcdir=`dirname $0`
 gitver=`git describe --abbrev=8 2>/dev/null`
 
-if test x"$gitver" != x; then
-    gitver=\""$gitver"\"
-else
-    gitver=RSYNC_VERSION
+if [ ! -f git-version.h ]; then
+    touch git-version.h
 fi
-echo "#define RSYNC_GITVER $gitver" >git-version.h
+
+case "$gitver" in
+    *.*)
+	echo "#define RSYNC_GITVER \"$gitver\"" >git-version.h.new
+	if ! diff git-version.h.new git-version.h >/dev/null; then
+	    echo "Updating git-version.h"
+	    mv git-version.h.new git-version.h
+	else
+	    rm git-version.h.new
+	fi
+	;;
+esac
diff --git a/options.c b/options.c
index a9f0dc9e..93bdb237 100644
--- a/options.c
+++ b/options.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1998-2001 Andrew Tridgell <tridge@samba.org>
  * Copyright (C) 2000, 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2002-2020 Wayne Davison
+ * Copyright (C) 2002-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -47,6 +47,7 @@ int append_mode = 0;
 int keep_dirlinks = 0;
 int copy_dirlinks = 0;
 int copy_links = 0;
+int copy_devices = 0;
 int write_devices = 0;
 int preserve_links = 0;
 int preserve_hard_links = 0;
@@ -58,14 +59,17 @@ int preserve_devices = 0;
 int preserve_specials = 0;
 int preserve_uid = 0;
 int preserve_gid = 0;
-int preserve_times = 0;
+int preserve_mtimes = 0;
 int preserve_atimes = 0;
 int preserve_crtimes = 0;
+int omit_dir_times = 0;
+int omit_link_times = 0;
 int update_only = 0;
 int open_noatime = 0;
 int cvs_exclude = 0;
 int dry_run = 0;
 int do_xfers = 1;
+int do_fsync = 0;
 int ignore_times = 0;
 int delete_mode = 0;
 int delete_during = 0;
@@ -88,6 +92,7 @@ int implied_dirs = 1;
 int missing_args = 0; /* 0 = FERROR_XFER, 1 = ignore, 2 = delete */
 int numeric_ids = 0;
 int msgs2stderr = 2; /* Default: send errors to stderr for local & remote-shell transfers */
+int saw_stderr_opt = 0;
 int allow_8bit_chars = 0;
 int force_delete = 0;
 int io_timeout = 0;
@@ -98,6 +103,7 @@ int filesfrom_fd = -1;
 char *filesfrom_host = NULL;
 int eol_nulls = 0;
 int protect_args = -1;
+int old_style_args = -1;
 int human_readable = 1;
 int recurse = 0;
 int mkpath_dest_arg = 0;
@@ -227,7 +233,7 @@ static const char *debug_verbosity[] = {
 #define MAX_VERBOSITY ((int)(sizeof debug_verbosity / sizeof debug_verbosity[0]) - 1)
 
 static const char *info_verbosity[1+MAX_VERBOSITY] = {
-	/*0*/ NULL,
+	/*0*/ "NONREG",
 	/*1*/ "COPY,DEL,FLIST,MISC,NAME,STATS,SYMSAFE",
 	/*2*/ "BACKUP,MISC2,MOUNT,NAME2,REMOVE,SKIP",
 };
@@ -265,9 +271,10 @@ static struct output_struct info_words[COUNT_INFO+1] = {
 	INFO_WORD(MISC, W_SND|W_REC, "Mention miscellaneous information (levels 1-2)"),
 	INFO_WORD(MOUNT, W_SND|W_REC, "Mention mounts that were found or skipped"),
 	INFO_WORD(NAME, W_SND|W_REC, "Mention 1) updated file/dir names, 2) unchanged names"),
+	INFO_WORD(NONREG, W_REC, "Mention skipped non-regular files (default 1, 0 disables)"),
 	INFO_WORD(PROGRESS, W_CLI, "Mention 1) per-file progress or 2) total transfer progress"),
 	INFO_WORD(REMOVE, W_SND, "Mention files removed on the sending side"),
-	INFO_WORD(SKIP, W_REC, "Mention files that are skipped due to options used"),
+	INFO_WORD(SKIP, W_REC, "Mention files skipped due to transfer overrides (levels 1-2)"),
 	INFO_WORD(STATS, W_CLI|W_SRV, "Mention statistics at end of run (levels 1-3)"),
 	INFO_WORD(SYMSAFE, W_SND|W_REC, "Mention symlinks that are unsafe"),
 	{ NULL, "--info", 0, 0, 0, 0 }
@@ -307,8 +314,6 @@ static int verbose = 0;
 static int do_stats = 0;
 static int do_progress = 0;
 static int daemon_opt;   /* sets am_daemon after option error-reporting */
-static int omit_dir_times = 0;
-static int omit_link_times = 0;
 static int F_option_cnt = 0;
 static int modify_window_set;
 static int itemize_changes = 0;
@@ -487,9 +492,9 @@ static void output_item_help(struct output_struct *words)
 
 	rprintf(FINFO, fmt, "HELP", "Output this help message");
 	rprintf(FINFO, "\n");
-	rprintf(FINFO, "Options added for each increase in verbose level:\n");
+	rprintf(FINFO, "Options added at each level of verbosity:\n");
 
-	for (j = 1; j <= MAX_VERBOSITY; j++) {
+	for (j = 0; j <= MAX_VERBOSITY; j++) {
 		parse_output_words(words, levels, verbosity[j], HELP_PRIORITY);
 		opt = make_output_option(words, levels, W_CLI|W_SRV|W_SND|W_REC);
 		if (opt) {
@@ -508,7 +513,7 @@ static void set_output_verbosity(int level, uchar priority)
 	if (level > MAX_VERBOSITY)
 		level = MAX_VERBOSITY;
 
-	for (j = 1; j <= level; j++) {
+	for (j = 0; j <= level; j++) {
 		parse_output_words(info_words, info_levels, info_verbosity[j], priority);
 		parse_output_words(debug_words, debug_levels, debug_verbosity[j], priority);
 	}
@@ -527,7 +532,7 @@ void limit_output_verbosity(int level)
 	memset(debug_limits, 0, sizeof debug_limits);
 
 	/* Compute the level limits in the above arrays. */
-	for (j = 1; j <= level; j++) {
+	for (j = 0; j <= level; j++) {
 		parse_output_words(info_words, info_limits, info_verbosity[j], LIMIT_PRIORITY);
 		parse_output_words(debug_words, debug_limits, debug_verbosity[j], LIMIT_PRIORITY);
 	}
@@ -574,7 +579,7 @@ enum {OPT_SERVER = 1000, OPT_DAEMON, OPT_SENDER, OPT_EXCLUDE, OPT_EXCLUDE_FROM,
       OPT_READ_BATCH, OPT_WRITE_BATCH, OPT_ONLY_WRITE_BATCH, OPT_MAX_SIZE,
       OPT_NO_D, OPT_APPEND, OPT_NO_ICONV, OPT_INFO, OPT_DEBUG, OPT_BLOCK_SIZE,
       OPT_USERMAP, OPT_GROUPMAP, OPT_CHOWN, OPT_BWLIMIT, OPT_STDERR,
-      OPT_OLD_COMPRESS, OPT_NEW_COMPRESS, OPT_NO_COMPRESS,
+      OPT_OLD_COMPRESS, OPT_NEW_COMPRESS, OPT_NO_COMPRESS, OPT_OLD_ARGS,
       OPT_STOP_AFTER, OPT_STOP_AT,
       OPT_REFUSED_BASE = 9000};
 
@@ -621,9 +626,9 @@ static struct poptOption long_options[] = {
   {"xattrs",          'X', POPT_ARG_NONE,   0, 'X', 0, 0 },
   {"no-xattrs",        0,  POPT_ARG_VAL,    &preserve_xattrs, 0, 0, 0 },
   {"no-X",             0,  POPT_ARG_VAL,    &preserve_xattrs, 0, 0, 0 },
-  {"times",           't', POPT_ARG_VAL,    &preserve_times, 1, 0, 0 },
-  {"no-times",         0,  POPT_ARG_VAL,    &preserve_times, 0, 0, 0 },
-  {"no-t",             0,  POPT_ARG_VAL,    &preserve_times, 0, 0, 0 },
+  {"times",           't', POPT_ARG_VAL,    &preserve_mtimes, 1, 0, 0 },
+  {"no-times",         0,  POPT_ARG_VAL,    &preserve_mtimes, 0, 0, 0 },
+  {"no-t",             0,  POPT_ARG_VAL,    &preserve_mtimes, 0, 0, 0 },
   {"atimes",          'U', POPT_ARG_NONE,   0, 'U', 0, 0 },
   {"no-atimes",        0,  POPT_ARG_VAL,    &preserve_atimes, 0, 0, 0 },
   {"no-U",             0,  POPT_ARG_VAL,    &preserve_atimes, 0, 0, 0 },
@@ -652,6 +657,7 @@ static struct poptOption long_options[] = {
   {"no-D",             0,  POPT_ARG_NONE,   0, OPT_NO_D, 0, 0 },
   {"devices",          0,  POPT_ARG_VAL,    &preserve_devices, 1, 0, 0 },
   {"no-devices",       0,  POPT_ARG_VAL,    &preserve_devices, 0, 0, 0 },
+  {"copy-devices",     0,  POPT_ARG_NONE,   &copy_devices, 0, 0, 0 },
   {"write-devices",    0,  POPT_ARG_VAL,    &write_devices, 1, 0, 0 },
   {"no-write-devices", 0,  POPT_ARG_VAL,    &write_devices, 0, 0, 0 },
   {"specials",         0,  POPT_ARG_VAL,    &preserve_specials, 1, 0, 0 },
@@ -777,6 +783,8 @@ static struct poptOption long_options[] = {
   {"files-from",       0,  POPT_ARG_STRING, &files_from, 0, 0, 0 },
   {"from0",           '0', POPT_ARG_VAL,    &eol_nulls, 1, 0, 0},
   {"no-from0",         0,  POPT_ARG_VAL,    &eol_nulls, 0, 0, 0},
+  {"old-args",         0,  POPT_ARG_NONE,   0, OPT_OLD_ARGS, 0, 0},
+  {"no-old-args",      0,  POPT_ARG_VAL,    &old_style_args, 0, 0, 0},
   {"protect-args",    's', POPT_ARG_VAL,    &protect_args, 1, 0, 0},
   {"no-protect-args",  0,  POPT_ARG_VAL,    &protect_args, 0, 0, 0},
   {"no-s",             0,  POPT_ARG_VAL,    &protect_args, 0, 0, 0},
@@ -789,6 +797,7 @@ static struct poptOption long_options[] = {
   {"no-timeout",       0,  POPT_ARG_VAL,    &io_timeout, 0, 0, 0 },
   {"contimeout",       0,  POPT_ARG_INT,    &connect_timeout, 0, 0, 0 },
   {"no-contimeout",    0,  POPT_ARG_VAL,    &connect_timeout, 0, 0, 0 },
+  {"fsync",            0,  POPT_ARG_NONE,   &do_fsync, 0, 0, 0 },
   {"stop-after",       0,  POPT_ARG_STRING, 0, OPT_STOP_AFTER, 0, 0 },
   {"time-limit",       0,  POPT_ARG_STRING, 0, OPT_STOP_AFTER, 0, 0 }, /* earlier stop-after name */
   {"stop-at",          0,  POPT_ARG_STRING, 0, OPT_STOP_AT, 0, 0 },
@@ -942,6 +951,7 @@ static void set_refuse_options(void)
 		 || strcmp("iconv", longName) == 0
 		 || strcmp("no-iconv", longName) == 0
 		 || strcmp("checksum-seed", longName) == 0
+		 || strcmp("copy-devices", longName) == 0 /* disable wild-match (it gets refused below) */
 		 || strcmp("write-devices", longName) == 0 /* disable wild-match (it gets refused below) */
 		 || strcmp("log-format", longName) == 0 /* aka out-format (NOT log-file-format) */
 		 || strcmp("sender", longName) == 0
@@ -953,6 +963,7 @@ static void set_refuse_options(void)
 	assert(list_end != NULL);
 
 	if (am_daemon) { /* Refused by default, but can be accepted via a negated exact match. */
+		parse_one_refuse_match(0, "copy-devices", list_end);
 		parse_one_refuse_match(0, "write-devices", list_end);
 	}
 
@@ -1516,7 +1527,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 			preserve_links = 1;
 #endif
 			preserve_perms = 1;
-			preserve_times = 1;
+			preserve_mtimes = 1;
 			preserve_gid = 1;
 			preserve_uid = 1;
 			preserve_devices = 1;
@@ -1601,6 +1612,13 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 			compress_choice = NULL;
 			break;
 
+		case OPT_OLD_ARGS:
+			if (old_style_args <= 0)
+				old_style_args = 1;
+			else
+				old_style_args++;
+			break;
+
 		case 'M':
 			arg = poptGetOptArg(pc);
 			if (*arg != '-') {
@@ -1745,6 +1763,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 			}
 			usermap = (char *)poptGetOptArg(pc);
 			usermap_via_chown = False;
+			preserve_uid = 1;
 			break;
 
 		case OPT_GROUPMAP:
@@ -1760,6 +1779,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 			}
 			groupmap = (char *)poptGetOptArg(pc);
 			groupmap_via_chown = False;
+			preserve_gid = 1;
 			break;
 
 		case OPT_CHOWN: {
@@ -1783,6 +1803,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 				if (asprintf(&usermap, "*:%.*s", len, chown) < 0)
 					out_of_memory("parse_arguments");
 				usermap_via_chown = True;
+				preserve_uid = 1;
 			}
 			if (arg && *arg) {
 				if (groupmap) {
@@ -1798,6 +1819,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 				if (asprintf(&groupmap, "*:%s", arg) < 0)
 					out_of_memory("parse_arguments");
 				groupmap_via_chown = True;
+				preserve_gid = 1;
 			}
 			break;
 		}
@@ -1875,6 +1897,7 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 					"--stderr mode \"%s\" is not one of errors, all, or client\n", arg);
 				return 0;
 			}
+			saw_stderr_opt = 1;
 			break;
 		}
 
@@ -1893,6 +1916,9 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 		}
 	}
 
+	if (msgs2stderr != 2)
+		saw_stderr_opt = 1;
+
 	if (version_opt_cnt) {
 		print_rsync_version(FINFO);
 		exit_cleanup(0);
@@ -1910,6 +1936,21 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 		max_alloc = size;
 	}
 
+	if (old_style_args < 0) {
+		if (!am_server && protect_args <= 0 && (arg = getenv("RSYNC_OLD_ARGS")) != NULL && *arg) {
+			protect_args = 0;
+			old_style_args = atoi(arg);
+		} else
+			old_style_args = 0;
+	} else if (old_style_args) {
+		if (protect_args > 0) {
+			snprintf(err_buf, sizeof err_buf,
+				 "--protect-args conflicts with --old-args.\n");
+			return 0;
+		}
+		protect_args = 0;
+	}
+
 	if (protect_args < 0) {
 		if (am_server)
 			protect_args = 0;
@@ -2255,20 +2296,8 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 		parse_filter_str(&filter_list, backup_dir_buf, rule_template(0), 0);
 	}
 
-	if (preserve_times) {
-		preserve_times = PRESERVE_FILE_TIMES;
-		if (!omit_dir_times)
-			preserve_times |= PRESERVE_DIR_TIMES;
-#ifdef CAN_SET_SYMLINK_TIMES
-		if (!omit_link_times)
-			preserve_times |= PRESERVE_LINK_TIMES;
-#endif
-	}
-
-	if (make_backups && !backup_dir) {
-		omit_dir_times = 0; /* Implied, so avoid -O to sender. */
-		preserve_times &= ~PRESERVE_DIR_TIMES;
-	}
+	if (make_backups && !backup_dir)
+		omit_dir_times = -1; /* Implied, so avoid -O to sender. */
 
 	if (stdout_format) {
 		if (am_server && log_format_has(stdout_format, 'I'))
@@ -2447,6 +2476,61 @@ int parse_arguments(int *argc_p, const char ***argv_p)
 }
 
 
+static char SPLIT_ARG_WHEN_OLD[1];
+
+/**
+ * Do backslash quoting of any weird chars in "arg", append the resulting
+ * string to the end of the "opt" (which gets a "=" appended if it is not
+ * an empty or NULL string), and return the (perhaps malloced) result.
+ * If opt is NULL, arg is considered a filename arg that allows wildcards.
+ * If it is "" or any other value, it is considered an option.
+ **/
+char *safe_arg(const char *opt, const char *arg)
+{
+#define SHELL_CHARS "!#$&;|<>(){}\"' \t\\"
+#define WILD_CHARS  "*?[]" /* We don't allow remote brace expansion */
+	BOOL is_filename_arg = !opt;
+	char *escapes = is_filename_arg ? SHELL_CHARS : WILD_CHARS SHELL_CHARS;
+	BOOL escape_leading_dash = is_filename_arg && *arg == '-';
+	int len1 = opt && *opt ? strlen(opt) + 1 : 0;
+	int len2 = strlen(arg);
+	int extras = escape_leading_dash ? 2 : 0;
+	char *ret;
+	if (!protect_args && old_style_args < 2 && (!old_style_args || (!is_filename_arg && opt != SPLIT_ARG_WHEN_OLD))) {
+		const char *f;
+		for (f = arg; *f; f++) {
+			if (strchr(escapes, *f))
+				extras++;
+		}
+	}
+	if (!len1 && !extras)
+		return (char*)arg;
+	ret = new_array(char, len1 + len2 + extras + 1);
+	if (len1) {
+		memcpy(ret, opt, len1-1);
+		ret[len1-1] = '=';
+	}
+	if (escape_leading_dash) {
+		ret[len1++] = '.';
+		ret[len1++] = '/';
+		extras -= 2;
+	}
+	if (!extras)
+		memcpy(ret + len1, arg, len2);
+	else {
+		const char *f = arg;
+		char *t = ret + len1;
+		while (*f) {
+			if (strchr(escapes, *f))
+				*t++ = '\\';
+			*t++ = *f++;
+		}
+	}
+	ret[len1+len2+extras] = '\0';
+	return ret;
+}
+
+
 /**
  * Construct a filtered list of options to pass through from the
  * client to the server.
@@ -2496,7 +2580,7 @@ void server_options(char **args, int *argc_p)
 			argstr[x++] = 'K';
 		if (prune_empty_dirs)
 			argstr[x++] = 'm';
-		if (omit_dir_times)
+		if (omit_dir_times > 0)
 			argstr[x++] = 'O';
 		if (omit_link_times)
 			argstr[x++] = 'J';
@@ -2529,7 +2613,7 @@ void server_options(char **args, int *argc_p)
 		argstr[x++] = 'g';
 	if (preserve_devices) /* ignore preserve_specials here */
 		argstr[x++] = 'D';
-	if (preserve_times)
+	if (preserve_mtimes)
 		argstr[x++] = 't';
 	if (preserve_atimes) {
 		argstr[x++] = 'U';
@@ -2577,47 +2661,8 @@ void server_options(char **args, int *argc_p)
 
 	set_allow_inc_recurse();
 
-	/* We don't really know the actual protocol_version at this point,
-	 * but checking the pre-negotiated value allows the user to use a
-	 * --protocol=29 override to avoid the use of this -eFLAGS opt. */
-	if (protocol_version >= 30) {
-		/* Use "eFlags" alias so that cull_options doesn't think that these are no-arg option letters. */
-#define eFlags argstr
-		/* We make use of the -e option to let the server know about
-		 * any pre-release protocol version && some behavior flags. */
-		eFlags[x++] = 'e';
-#if SUBPROTOCOL_VERSION != 0
-		if (protocol_version == PROTOCOL_VERSION) {
-			x += snprintf(argstr+x, sizeof argstr - x,
-				      "%d.%d",
-				      PROTOCOL_VERSION, SUBPROTOCOL_VERSION);
-		} else
-#endif
-			eFlags[x++] = '.';
-		if (allow_inc_recurse)
-			eFlags[x++] = 'i';
-#ifdef CAN_SET_SYMLINK_TIMES
-		eFlags[x++] = 'L'; /* symlink time-setting support */
-#endif
-#ifdef ICONV_OPTION
-		eFlags[x++] = 's'; /* symlink iconv translation support */
-#endif
-		eFlags[x++] = 'f'; /* flist I/O-error safety support */
-		eFlags[x++] = 'x'; /* xattr hardlink optimization not desired */
-		eFlags[x++] = 'C'; /* support checksum seed order fix */
-		eFlags[x++] = 'I'; /* support inplace_partial behavior */
-		eFlags[x++] = 'v'; /* use varint for flist & compat flags; negotiate checksum */
-		eFlags[x++] = 'u'; /* include name of uid 0 & gid 0 in the id map */
-		/* NOTE: Avoid using 'V' -- it was the high bit of a write_byte() that became write_varint(). */
-#undef eFlags
-	}
-
-	if (x >= (int)sizeof argstr) { /* Not possible... */
-		rprintf(FERROR, "argstr overflow in server_options().\n");
-		exit_cleanup(RERR_MALLOC);
-	}
-
-	argstr[x] = '\0';
+	/* This '\0'-terminates argstr and makes sure it didn't overflow. */
+	x += maybe_add_e_option(argstr + x, (int)sizeof argstr - x);
 
 	if (x > 1)
 		args[ac++] = argstr;
@@ -2629,9 +2674,7 @@ void server_options(char **args, int *argc_p)
 			set++;
 		else
 			set = iconv_opt;
-		if (asprintf(&arg, "--iconv=%s", set) < 0)
-			goto oom;
-		args[ac++] = arg;
+		args[ac++] = safe_arg("--iconv", set);
 	}
 #endif
 
@@ -2697,33 +2740,24 @@ void server_options(char **args, int *argc_p)
 	}
 
 	if (backup_dir) {
+		/* This split idiom allows for ~/path expansion via the shell. */
 		args[ac++] = "--backup-dir";
-		args[ac++] = backup_dir;
+		args[ac++] = safe_arg("", backup_dir);
 	}
 
 	/* Only send --suffix if it specifies a non-default value. */
-	if (strcmp(backup_suffix, backup_dir ? "" : BACKUP_SUFFIX) != 0) {
-		/* We use the following syntax to avoid weirdness with '~'. */
-		if (asprintf(&arg, "--suffix=%s", backup_suffix) < 0)
-			goto oom;
-		args[ac++] = arg;
-	}
+	if (strcmp(backup_suffix, backup_dir ? "" : BACKUP_SUFFIX) != 0)
+		args[ac++] = safe_arg("--suffix", backup_suffix);
 
-	if (checksum_choice) {
-		if (asprintf(&arg, "--checksum-choice=%s", checksum_choice) < 0)
-			goto oom;
-		args[ac++] = arg;
-	}
+	if (checksum_choice)
+		args[ac++] = safe_arg("--checksum-choice", checksum_choice);
 
 	if (do_compression == CPRES_ZLIBX)
 		args[ac++] = "--new-compress";
 	else if (compress_choice && do_compression == CPRES_ZLIB)
 		args[ac++] = "--old-compress";
-	else if (compress_choice) {
-		if (asprintf(&arg, "--compress-choice=%s", compress_choice) < 0)
-			goto oom;
-		args[ac++] = arg;
-	}
+	else if (compress_choice)
+		args[ac++] = safe_arg("--compress-choice", compress_choice);
 
 	if (am_sender) {
 		if (max_delete > 0) {
@@ -2732,14 +2766,10 @@ void server_options(char **args, int *argc_p)
 			args[ac++] = arg;
 		} else if (max_delete == 0)
 			args[ac++] = "--max-delete=-1";
-		if (min_size >= 0) {
-			args[ac++] = "--min-size";
-			args[ac++] = min_size_arg;
-		}
-		if (max_size >= 0) {
-			args[ac++] = "--max-size";
-			args[ac++] = max_size_arg;
-		}
+		if (min_size >= 0)
+			args[ac++] = safe_arg("--min-size", min_size_arg);
+		if (max_size >= 0)
+			args[ac++] = safe_arg("--max-size", max_size_arg);
 		if (delete_before)
 			args[ac++] = "--delete-before";
 		else if (delete_during == 2)
@@ -2763,17 +2793,12 @@ void server_options(char **args, int *argc_p)
 		if (do_stats)
 			args[ac++] = "--stats";
 	} else {
-		if (skip_compress) {
-			if (asprintf(&arg, "--skip-compress=%s", skip_compress) < 0)
-				goto oom;
-			args[ac++] = arg;
-		}
+		if (skip_compress)
+			args[ac++] = safe_arg("--skip-compress", skip_compress);
 	}
 
-	if (max_alloc_arg && max_alloc != DEFAULT_MAX_ALLOC) {
-		args[ac++] = "--max-alloc";
-		args[ac++] = max_alloc_arg;
-	}
+	if (max_alloc_arg && max_alloc != DEFAULT_MAX_ALLOC)
+		args[ac++] = safe_arg("--max-alloc", max_alloc_arg);
 
 	/* --delete-missing-args needs the cooperation of both sides, but
 	 * the sender can handle --ignore-missing-args by itself. */
@@ -2798,7 +2823,7 @@ void server_options(char **args, int *argc_p)
 	if (partial_dir && am_sender) {
 		if (partial_dir != tmp_partialdir) {
 			args[ac++] = "--partial-dir";
-			args[ac++] = partial_dir;
+			args[ac++] = safe_arg("", partial_dir);
 		}
 		if (delay_updates)
 			args[ac++] = "--delay-updates";
@@ -2821,17 +2846,11 @@ void server_options(char **args, int *argc_p)
 		args[ac++] = "--use-qsort";
 
 	if (am_sender) {
-		if (usermap) {
-			if (asprintf(&arg, "--usermap=%s", usermap) < 0)
-				goto oom;
-			args[ac++] = arg;
-		}
+		if (usermap)
+			args[ac++] = safe_arg("--usermap", usermap);
 
-		if (groupmap) {
-			if (asprintf(&arg, "--groupmap=%s", groupmap) < 0)
-				goto oom;
-			args[ac++] = arg;
-		}
+		if (groupmap)
+			args[ac++] = safe_arg("--groupmap", groupmap);
 
 		if (ignore_existing)
 			args[ac++] = "--ignore-existing";
@@ -2842,9 +2861,12 @@ void server_options(char **args, int *argc_p)
 
 		if (tmpdir) {
 			args[ac++] = "--temp-dir";
-			args[ac++] = tmpdir;
+			args[ac++] = safe_arg("", tmpdir);
 		}
 
+		if (do_fsync)
+			args[ac++] = "--fsync";
+
 		if (basis_dir[0]) {
 			/* the server only needs this option if it is not the sender,
 			 *   and it may be an older version that doesn't know this
@@ -2852,7 +2874,7 @@ void server_options(char **args, int *argc_p)
 			 */
 			for (i = 0; i < basis_dir_cnt; i++) {
 				args[ac++] = alt_dest_opt(0);
-				args[ac++] = basis_dir[i];
+				args[ac++] = safe_arg("", basis_dir[i]);
 			}
 		}
 	}
@@ -2867,13 +2889,17 @@ void server_options(char **args, int *argc_p)
 		if (append_mode > 1)
 			args[ac++] = "--append";
 		args[ac++] = "--append";
-	} else if (inplace)
+	} else if (inplace) {
 		args[ac++] = "--inplace";
+		/* Work around a bug in older rsync versions (on the remote side) for --inplace --sparse */
+		if (sparse_files && !whole_file && am_sender)
+			args[ac++] = "--no-W";
+	}
 
 	if (files_from && (!am_sender || filesfrom_host)) {
 		if (filesfrom_host) {
 			args[ac++] = "--files-from";
-			args[ac++] = files_from;
+			args[ac++] = safe_arg("", files_from);
 			if (eol_nulls)
 				args[ac++] = "--from0";
 		} else {
@@ -2895,6 +2921,9 @@ void server_options(char **args, int *argc_p)
 	else if (remove_source_files)
 		args[ac++] = "--remove-sent-files";
 
+	if (copy_devices && !am_sender)
+		args[ac++] = "--copy-devices";
+
 	if (preallocate_files && am_sender)
 		args[ac++] = "--preallocate";
 
@@ -2916,7 +2945,7 @@ void server_options(char **args, int *argc_p)
 			exit_cleanup(RERR_SYNTAX);
 		}
 		for (j = 1; j <= remote_option_cnt; j++)
-			args[ac++] = (char*)remote_options[j];
+			args[ac++] = safe_arg(SPLIT_ARG_WHEN_OLD, remote_options[j]);
 	}
 
 	*argc_p = ac;
@@ -2926,6 +2955,52 @@ void server_options(char **args, int *argc_p)
 	out_of_memory("server_options");
 }
 
+int maybe_add_e_option(char *buf, int buf_len)
+{
+	int x = 0;
+
+	/* We don't really know the actual protocol_version at this point,
+	 * but checking the pre-negotiated value allows the user to use a
+	 * --protocol=29 override to avoid the use of this -eFLAGS opt. */
+	if (protocol_version >= 30 && buf_len > 0) {
+		/* We make use of the -e option to let the server know about
+		 * any pre-release protocol version && some behavior flags. */
+		buf[x++] = 'e';
+
+#if SUBPROTOCOL_VERSION != 0
+		if (protocol_version == PROTOCOL_VERSION)
+			x += snprintf(buf + x, buf_len - x, "%d.%d", PROTOCOL_VERSION, SUBPROTOCOL_VERSION);
+		else
+#endif
+			buf[x++] = '.';
+		if (allow_inc_recurse)
+			buf[x++] = 'i';
+#ifdef CAN_SET_SYMLINK_TIMES
+		buf[x++] = 'L'; /* symlink time-setting support */
+#endif
+#ifdef ICONV_OPTION
+		buf[x++] = 's'; /* symlink iconv translation support */
+#endif
+		buf[x++] = 'f'; /* flist I/O-error safety support */
+		buf[x++] = 'x'; /* xattr hardlink optimization not desired */
+		buf[x++] = 'C'; /* support checksum seed order fix */
+		buf[x++] = 'I'; /* support inplace_partial behavior */
+		buf[x++] = 'v'; /* use varint for flist & compat flags; negotiate checksum */
+		buf[x++] = 'u'; /* include name of uid 0 & gid 0 in the id map */
+
+		/* NOTE: Avoid using 'V' -- it was represented with the high bit of a write_byte() that became a write_varint(). */
+	}
+
+	if (x >= buf_len) { /* Not possible... */
+		rprintf(FERROR, "overflow in add_e_flags().\n");
+		exit_cleanup(RERR_MALLOC);
+	}
+
+	buf[x] = '\0';
+
+	return x;
+}
+
 /* If str points to a valid hostspec, return allocated memory containing the
  * [USER@]HOST part of the string, and set the path_start_ptr to the part of
  * the string after the host part.  Otherwise, return NULL.  If port_ptr is
diff --git a/packaging/auto-Makefile b/packaging/auto-Makefile
index 29d2d688..7f2e2585 100644
--- a/packaging/auto-Makefile
+++ b/packaging/auto-Makefile
@@ -1,6 +1,6 @@
 TARGETS := all install install-ssl-daemon install-all install-strip conf gen gensend reconfigure restatus \
 	proto man clean cleantests distclean test check check29 check30 installcheck splint \
-	doxygen doxygen-upload finddead
+	doxygen doxygen-upload finddead rrsync
 
 .PHONY: $(TARGETS) auto-prep
 
diff --git a/packaging/cull-options b/packaging/cull-options
new file mode 100755
index 00000000..955c21f1
--- /dev/null
+++ b/packaging/cull-options
@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+# This script outputs either perl or python code that parses all possible options
+# that the code in options.c might send to the server.  The resulting code is then
+# included in the rrsync script.
+
+import re, argparse
+
+short_no_arg = { }
+short_with_num = { '@': 1 }
+long_opts = { # These include some extra long-args that BackupPC uses:
+        'block-size': 1,
+        'daemon': -1,
+        'debug': 1,
+        'fake-super': 0,
+        'fuzzy': 0,
+        'group': 0,
+        'hard-links': 0,
+        'ignore-times': 0,
+        'info': 1,
+        'links': 0,
+        'log-file': 3,
+        'munge-links': 0,
+        'no-munge-links': -1,
+        'one-file-system': 0,
+        'owner': 0,
+        'perms': 0,
+        'recursive': 0,
+        'stderr': 1,
+        'times': 0,
+        'write-devices': -1,
+        }
+
+def main():
+    last_long_opt = None
+
+    with open('../options.c') as fh:
+        for line in fh:
+            m = re.search(r"argstr\[x\+\+\] = '([^.ie])'", line)
+            if m:
+                short_no_arg[m.group(1)] = 1
+                last_long_opt = None
+                continue
+
+            m = re.search(r'asprintf$[^,]+, "-([a-zA-Z0-9])\%l?[ud]"', line)
+            if m:
+                short_with_num[m.group(1)] = 1
+                last_long_opt = None
+                continue
+
+            m = re.search(r'args\[ac\+\+\] = "--([^"=]+)"', line)
+            if m:
+                last_long_opt = m.group(1)
+                if last_long_opt not in long_opts:
+                    long_opts[last_long_opt] = 0
+                else:
+                    last_long_opt = None
+                continue
+
+            if last_long_opt:
+                m = re.search(r'args\[ac\+\+\] = safe_arg\("", ([^[("\s]+)$;', line)
+                if m:
+                    long_opts[last_long_opt] = 2
+                    last_long_opt = None
+                    continue
+                if 'args[ac++] = ' in line:
+                    last_long_opt = None
+
+            m = re.search(r'return "--([^"]+-dest)";', line)
+            if m:
+                long_opts[m.group(1)] = 2
+                last_long_opt = None
+                continue
+
+            m = re.search(r'asprintf\([^,]+, "--([^"=]+)=', line)
+            if not m:
+                m = re.search(r'args\[ac\+\+\] = "--([^"=]+)=', line)
+                if not m:
+                    m = re.search(r'args\[ac\+\+\] = safe_arg\("--([^"=]+)"', line)
+                    if not m:
+                        m = re.search(r'fmt = .*: "--([^"=]+)=', line)
+            if m:
+                long_opts[m.group(1)] = 1
+                last_long_opt = None
+
+    long_opts['files-from'] = 3
+
+    txt = """\
+### START of options data produced by the cull-options script. ###
+
+# To disable a short-named option, add its letter to this string:
+"""
+
+    txt += str_assign('short_disabled', 's') + "\n"
+    txt += '# These are also disabled when the restricted dir is not "/":\n'
+    txt += str_assign('short_disabled_subdir', 'KLk') + "\n"
+    txt += '# These are all possible short options that we will accept (when not disabled above):\n'
+    txt += str_assign('short_no_arg', ''.join(sorted(short_no_arg)), 'DO NOT REMOVE ANY')
+    txt += str_assign('short_with_num', ''.join(sorted(short_with_num)), 'DO NOT REMOVE ANY')
+   
+    txt += """
+# To disable a long-named option, change its value to a -1.  The values mean:
+# 0 = the option has no arg; 1 = the arg doesn't need any checking; 2 = only
+# check the arg when receiving; and 3 = always check the arg.
+"""
+
+    print(txt, end='')
+
+    if args.python:
+        print("long_opts = {")
+        sep = ':'
+    else:
+        print("our %long_opt = (")
+        sep = ' =>'
+
+    for opt in sorted(long_opts):
+        if opt.startswith(('min-', 'max-')):
+            val = 1
+        else:
+            val = long_opts[opt]
+        print(' ', repr(opt) + sep, str(val) + ',')
+
+    if args.python:
+        print("}")
+    else:
+        print(");")
+    print("\n### END of options data produced by the cull-options script. ###")
+
+
+def str_assign(name, val, comment=None):
+    comment = ' # ' + comment if comment else ''
+    if args.python:
+        return name + ' = ' + repr(val) + comment + "\n"
+    return 'our $' + name + ' = ' + repr(val) + ';' + comment + "\n"
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description="Output culled rsync options for rrsync.", add_help=False)
+    out_group = parser.add_mutually_exclusive_group()
+    out_group.add_argument('--perl', action='store_true', help="Output perl code.")
+    out_group.add_argument('--python', action='store_true', help="Output python code (the default).")
+    parser.add_argument('--help', '-h', action='help', help="Output this help message and exit.")
+    args = parser.parse_args()
+    if not args.perl:
+        args.python = True
+    main()
+
+# vim: sw=4 et
diff --git a/packaging/cull_options b/packaging/cull_options
deleted file mode 100755
index 7588002b..00000000
--- a/packaging/cull_options
+++ /dev/null
@@ -1,85 +0,0 @@
-#!/usr/bin/env perl
-# This script outputs some perl code that parses all possible options
-# that the code in options.c might send to the server.  This perl code
-# is included in the rrsync script.
-use strict;
-
-our %short_no_arg;
-our %short_with_num = ( '@' => 1 );
-our %long_opt = ( # These include some extra long-args that BackupPC uses:
-    'block-size' => 1,
-    'daemon' => -1,
-    'debug' => 1,
-    'fake-super' => 0,
-    'fuzzy' => 0,
-    'group' => 0,
-    'hard-links' => 0,
-    'ignore-times' => 0,
-    'info' => 1,
-    'links' => 0,
-    'log-file' => 3,
-    'one-file-system' => 0,
-    'owner' => 0,
-    'perms' => 0,
-    'recursive' => 0,
-    'times' => 0,
-    'write-devices' => -1,
-);
-our $last_long_opt;
-
-open(IN, '../options.c') or die "Unable to open ../options.c: $!\n";
-
-while (<IN>) {
-    if (/\Qargstr[x++]\E = '([^.ie])'/) {
-	$short_no_arg{$1} = 1;
-	undef $last_long_opt;
-    } elsif (/\Qasprintf(\E[^,]+, "-([a-zA-Z0-9])\%l?[ud]"/) {
-	$short_with_num{$1} = 1;
-	undef $last_long_opt;
-    } elsif (/\Qargs[ac++]\E = "--([^"=]+)"/) {
-	$last_long_opt = $1;
-	$long_opt{$1} = 0 unless exists $long_opt{$1};
-    } elsif (defined($last_long_opt)
-	&& /\Qargs[ac++]\E = ([^["\s]+);/) {
-	$long_opt{$last_long_opt} = 2;
-	undef $last_long_opt;
-    } elsif (/return "--([^"]+-dest)";/) {
-	$long_opt{$1} = 2;
-	undef $last_long_opt;
-    } elsif (/\Qasprintf(\E[^,]+, "--([^"=]+)=/ || /\Qargs[ac++]\E = "--([^"=]+)=/ || /fmt = .*: "--([^"=]+)=/) {
-	$long_opt{$1} = 1;
-	undef $last_long_opt;
-    }
-}
-close IN;
-
-my $short_no_arg = join('', sort keys %short_no_arg);
-my $short_with_num = join('', sort keys %short_with_num);
-
-print <<EOT;
-
-# These options are the only options that rsync might send to the server,
-# and only in the option format that the stock rsync produces.
-
-# To disable a short-named option, add its letter to this string:
-our \$short_disabled = 's';
-
-our \$short_no_arg = '$short_no_arg'; # DO NOT REMOVE ANY
-our \$short_with_num = '$short_with_num'; # DO NOT REMOVE ANY
-
-# To disable a long-named option, change its value to a -1.  The values mean:
-# 0 = the option has no arg; 1 = the arg doesn't need any checking; 2 = only
-# check the arg when receiving; and 3 = always check the arg.
-our \%long_opt = (
-EOT
-
-foreach my $opt (sort keys %long_opt) {
-    my $val = $long_opt{$opt};
-    $val = 1 if $opt =~ /^(max-|min-)/;
-    $val = 3 if $opt eq 'files-from';
-    $val = q"$only eq 'r' ? -1 : " . $val if $opt =~ /^(remove-|log-file)/;
-    $val = q"$only eq 'w' ? -1 : " . $val if $opt eq 'sender';
-    print "  '$opt' => $val,\n";
-}
-
-print ");\n\n";
diff --git a/packaging/lsb/rsync.spec b/packaging/lsb/rsync.spec
index 04163c72..6c8f3f5c 100644
--- a/packaging/lsb/rsync.spec
+++ b/packaging/lsb/rsync.spec
@@ -1,9 +1,9 @@
 Summary: A fast, versatile, remote (and local) file-copying tool
 Name: rsync
-Version: 3.2.3
-%define fullversion %{version}
-Release: 1
-%define srcdir src
+Version: 3.2.4
+%define fullversion %{version}pre4
+Release: 0.1.pre4
+%define srcdir src-previews
 Group: Applications/Internet
 License: GPL
 Source0: https://rsync.samba.org/ftp/rsync/%{srcdir}/rsync-%{fullversion}.tar.gz
@@ -79,8 +79,8 @@ rm -rf $RPM_BUILD_ROOT
 %dir /etc/rsync-ssl/certs
 
 %changelog
-* Thu Aug 06 2020 Wayne Davison <wayne@opencoder.net>
-Released 3.2.3.
+* Sun Mar 27 2022 Wayne Davison <wayne@opencoder.net>
+Released 3.2.4pre4.
 
 * Fri Mar 21 2008 Wayne Davison <wayne@opencoder.net>
 Added installation of /etc/xinetd.d/rsync file and some commented-out
diff --git a/packaging/md2html b/packaging/md2html
deleted file mode 100755
index 21e42c66..00000000
--- a/packaging/md2html
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright (C) 2020 Wayne Davison
-#
-# This program is freely redistributable.
-
-import os, re, argparse
-
-HTML_START = """\
-<html><head>
-<title>%s</title>
-<link href="https://fonts.googleapis.com/css2?family=Roboto&family=Roboto+Mono&display=swap" rel="stylesheet">
-<style>
-body {
-  max-width: 50em;
-  margin: auto;
-}
-body, b, strong, u {
-  font-family: 'Roboto', sans-serif;
-}
-code {
-  font-family: 'Roboto Mono', monospace;
-  font-weight: bold;
-}
-pre code {
-  display: block;
-  font-weight: normal;
-}
-blockquote pre code {
-  background: #f1f1f1;
-}
-dd p:first-of-type {
-  margin-block-start: 0em;
-}
-table {
-  border-color: grey;
-  border-spacing: 0;
-}
-tr {
-  border-top: 1px solid grey;
-}
-tr:nth-child(2n) {
-  background-color: #f6f8fa;
-}
-th, td {
-  border: 1px solid #dfe2e5;
-  text-align: center;
-  padding-left: 1em;
-  padding-right: 1em;
-}
-</style>
-</head><body>
-"""
-
-HTML_END = """\
-</body></html>
-"""
-
-md_parser = None
-
-def main():
-    for mdfn in args.mdfiles:
-        if not mdfn.endswith('.md'):
-            print('Ignoring non-md input file:', mdfn)
-            continue
-        title = re.sub(r'.*/', '', mdfn).replace('.md', '')
-        htfn = mdfn.replace('.md', '.html')
-
-        print("Parsing", mdfn, '->', htfn)
-
-        with open(mdfn, 'r', encoding='utf-8') as fh:
-            txt = fh.read()
-
-        txt = re.sub(r'\s--\s', '\xa0-- ', txt)
-
-        html = md_parser(txt)
-
-        html = re.sub(r'(?<!<pre>)(<code>)([\s\S]*?)(</code>)', lambda m: m[1] + re.sub(r'\s', '\xa0', m[2]) + m[3], html)
-        html = html.replace('--', '&#8209;&#8209;').replace("\xa0-", '&nbsp;&#8209;').replace("\xa0", '&nbsp;')
-        html = re.sub(r'(\W)-', r'\1&#8209;', html)
-
-        if os.path.lexists(htfn):
-            os.unlink(htfn)
-
-        with open(htfn, 'w', encoding='utf-8') as fh:
-            fh.write(HTML_START % title)
-            fh.write(html)
-            fh.write(HTML_END)
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description='Output html for md pages.', add_help=False)
-    parser.add_argument("--help", "-h", action="help", help="Output this help message and exit.")
-    parser.add_argument("mdfiles", nargs='+', help="The .md files to turn into .html files.")
-    args = parser.parse_args()
-
-    try:
-        import cmarkgfm
-        # Our NEWS.md file has a gfm table in it.
-        md_parser = cmarkgfm.github_flavored_markdown_to_html
-    except:
-        die("Failed to find cmarkgfm for python3.")
-
-    main()
diff --git a/packaging/patch-update b/packaging/patch-update
index b3fb527b..fd56a9d8 100755
--- a/packaging/patch-update
+++ b/packaging/patch-update
@@ -33,7 +33,7 @@ def main():
 
     master_commit = latest_git_hash(args.base_branch)
 
-    if cmd_txt_chk(['packaging/prep-auto-dir']) == '':
+    if cmd_txt_chk(['packaging/prep-auto-dir']).out == '':
         die('You must setup an auto-build-save dir to use this script.')
 
     if args.gen:
diff --git a/packaging/pkglib.py b/packaging/pkglib.py
index b201bf77..52f3d892 100644
--- a/packaging/pkglib.py
+++ b/packaging/pkglib.py
@@ -1,4 +1,4 @@
-import os, sys, re, subprocess
+import os, sys, re, subprocess, argparse
 
 # This python3 library provides a few helpful routines that are
 # used by the latest packaging scripts.
@@ -23,27 +23,32 @@ def set_default_encoding(enc):
 
 
 # Set shell=True if the cmd is a string; sets a default encoding unless raw=True was specified.
-def _tweak_opts(cmd, opts, **maybe_set):
-    # This sets any maybe_set value that isn't already set AND creates a copy of opts for us.
-    opts = {**maybe_set, **opts}
+def _tweak_opts(cmd, opts, **maybe_set_args):
+    def _maybe_set(o, **msa): # Only set a value if the user didn't already set it.
+        for var, val in msa.items():
+            if var not in o:
+                o[var] = val
+
+    opts = opts.copy()
+    _maybe_set(opts, **maybe_set_args)
 
     if type(cmd) == str:
-        opts = {'shell': True, **opts}
+        _maybe_set(opts, shell=True)
 
     want_raw = opts.pop('raw', False)
     if default_encoding and not want_raw:
-        opts = {'encoding': default_encoding, **opts}
+        _maybe_set(opts, encoding=default_encoding)
 
     capture = opts.pop('capture', None)
     if capture:
         if capture == 'stdout':
-            opts = {'stdout': subprocess.PIPE, **opts}
+            _maybe_set(opts, stdout=subprocess.PIPE)
         elif capture == 'stderr':
-            opts = {'stderr': subprocess.PIPE, **opts}
+            _maybe_set(opts, stderr=subprocess.PIPE)
         elif capture == 'output':
-            opts = {'stdout': subprocess.PIPE, 'stderr': subprocess.PIPE, **opts}
+            _maybe_set(opts, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
         elif capture == 'combined':
-            opts = {'stdout': subprocess.PIPE, 'stderr': subprocess.STDOUT, **opts}
+            _maybe_set(opts, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
 
     discard = opts.pop('discard', None)
     if discard:
@@ -66,30 +71,26 @@ def cmd_chk(cmd, **opts):
     return subprocess.run(cmd, **_tweak_opts(cmd, opts, check=True))
 
 
-# Capture stdout in a string and return the (output, return_code) tuple.
-# Use capture='combined' opt to get both stdout and stderr together.
-def cmd_txt_status(cmd, **opts):
+# Capture stdout in a string and return an object with out, err, and rc (return code).
+# It defaults to capture='stdout' (so err is empty) but can be overridden using
+# capture='combined' or capture='output' (the latter populates the err value).
+def cmd_txt(cmd, **opts):
     input = opts.pop('input', None)
     if input is not None:
         opts['stdin'] = subprocess.PIPE
     proc = subprocess.Popen(cmd, **_tweak_opts(cmd, opts, capture='stdout'))
-    out = proc.communicate(input=input)[0]
-    return (out, proc.returncode)
-
-
-# Like cmd_txt_status() but just return the output.
-def cmd_txt(cmd, **opts):
-    return cmd_txt_status(cmd, **opts)[0]
+    out, err = proc.communicate(input=input)
+    return argparse.Namespace(out=out, err=err, rc=proc.returncode)
 
 
-# Capture stdout in a string and return the output if the command has a 0 return code.
-# Otherwise it throws an exception that indicates the return code and the output.
+# Just like calling cmd_txt() except that it raises an error if the command has a non-0 return code.
+# The raised error includes the cmd, the return code, and the captured output.
 def cmd_txt_chk(cmd, **opts):
-    out, rc = cmd_txt_status(cmd, **opts)
-    if rc != 0:
-        cmd_err = f'Command "{cmd}" returned non-zero exit status "{rc}" and output:\n{out}'
+    ct = cmd_txt(cmd, **opts)
+    if ct.rc != 0:
+        cmd_err = f'Command "{cmd}" returned non-0 exit status "{ct.rc}" and output:\n{ct.out}{ct.err}'
         raise Exception(cmd_err)
-    return out
+    return ct
 
 
 # Starts a piped-output command of stdout (by default) and leaves it up to you to read
@@ -102,7 +103,7 @@ def cmd_pipe(cmd, **opts):
 # arg fatal_unless_clean can be used to make that non-fatal.  Returns a
 # tuple of the current branch, the is_clean flag, and the status text.
 def check_git_status(fatal_unless_clean=True, subdir='.'):
-    status_txt = cmd_txt_chk(f"cd '{subdir}' && git status")
+    status_txt = cmd_txt_chk(f"cd '{subdir}' && git status").out
     is_clean = re.search(r'\nnothing to commit.+working (directory|tree) clean', status_txt) != None
 
     if not is_clean and fatal_unless_clean:
@@ -149,7 +150,7 @@ def check_git_state(master_branch, fatal_unless_clean=True, check_extra_dir=None
 
 # Return the git hash of the most recent commit.
 def latest_git_hash(branch):
-    out = cmd_txt_chk(['git', 'log', '-1', '--no-color', branch])
+    out = cmd_txt_chk(['git', 'log', '-1', '--no-color', branch]).out
     m = re.search(r'^commit (\S+)', out, flags=re.M)
     if not m:
         die(f"Unable to determine commit hash for master branch: {branch}")
@@ -175,20 +176,20 @@ def mandate_gensend_hook():
         print('Creating hook file:', hook)
         cmd_chk(['./rsync', '-a', 'packaging/pre-push', hook])
     else:
-        out, rc = cmd_txt_status(['fgrep', 'make gensend', hook], discard='output')
-        if rc:
+        ct = cmd_txt(['fgrep', 'make gensend', hook], discard='output')
+        if ct.rc:
             die('Please add a "make gensend" into your', hook, 'script.')
 
 
-# Snag the GENFILES values out of the Makefile.in file and return them as a list.
+# Snag the GENFILES values out of the Makefile file and return them as a list.
 def get_gen_files(want_dir_plus_list=False):
     cont_re = re.compile(r'\\\n')
 
     gen_files = [ ]
 
-    auto_dir = os.path.join('auto-build-save', cmd_txt('git rev-parse --abbrev-ref HEAD').strip().replace('/', '%'))
+    auto_dir = os.path.join('auto-build-save', cmd_txt('git rev-parse --abbrev-ref HEAD').out.strip().replace('/', '%'))
 
-    with open('Makefile.in', 'r', encoding='utf-8') as fh:
+    with open(auto_dir + '/Makefile', 'r', encoding='utf-8') as fh:
         for line in fh:
             if not gen_files:
                 chk = re.sub(r'^GENFILES=', '', line)
diff --git a/packaging/pre-push b/packaging/pre-push
index 04b0d20b..8a713695 100755
--- a/packaging/pre-push
+++ b/packaging/pre-push
@@ -1,3 +1,16 @@
-#!/bin/sh
+#!/bin/bash -e
+
 cat >/dev/null # Just discard stdin data
-make gensend
+
+if [[ -f /proc/$PPID/cmdline ]]; then
+    while read -d $'\0' arg ; do
+	if [[ "$arg" == '--tags' ]] ; then
+	    exit 0
+	fi
+    done </proc/$PPID/cmdline
+fi
+
+branch=`git rev-parse --abbrev-ref HEAD`
+if [[ "$branch" = master && "$*" == *github* ]]; then
+    make gensend
+fi
diff --git a/packaging/prep-auto-dir b/packaging/prep-auto-dir
index 1e5a2965..b67f390a 100755
--- a/packaging/prep-auto-dir
+++ b/packaging/prep-auto-dir
@@ -13,7 +13,7 @@
 # run "make distclean" before creating the auto-build-save dir.
 
 auto_top='auto-build-save'
-if test -d $auto_top -a -d .git; then
+if test -d $auto_top && test -d .git; then
     desired_branch=`git rev-parse --abbrev-ref HEAD | tr / %`
     if test "$desired_branch" = HEAD; then
 	echo "ERROR: switch to the right build dir manually when in detached HEAD mode." 1>&2
diff --git a/packaging/release-rsync b/packaging/release-rsync
index a8d63ec1..d484628c 100755
--- a/packaging/release-rsync
+++ b/packaging/release-rsync
@@ -18,6 +18,9 @@ dest = os.environ['HOME'] + '/samba-rsync-ftp'
 ORIGINAL_PATH = os.environ['PATH']
 
 def main():
+    if not os.path.isfile('packaging/release-rsync'):
+        die('You must run this script from the top of your rsync checkout.')
+
     now = datetime.now()
     cl_today = now.strftime('* %a %b %d %Y')
     year = now.strftime('%Y')
@@ -30,7 +33,7 @@ def main():
 
     signal.signal(signal.SIGINT, signal_handler)
 
-    if cmd_txt_chk(['packaging/prep-auto-dir']) == '':
+    if cmd_txt_chk(['packaging/prep-auto-dir']).out == '':
         die('You must setup an auto-build-save dir to use this script.');
 
     auto_dir, gen_files = get_gen_files(True)
@@ -44,6 +47,17 @@ def main():
 {dash_line}
 """)
 
+    with open('build/rsync.1') as fh:
+        for line in fh:
+            if line.startswith(r'.\" prefix='):
+                doc_prefix = line.split('=')[1].strip()
+                if doc_prefix != '/usr':
+                    warn(f"*** The documentation was built with prefix {doc_prefix} instead of /usr ***")
+                    die("*** Read the md2man script for a way to override this. ***")
+                break
+            if line.startswith('.P'):
+                die("Failed to find the prefix comment at the start of the rsync.1 manpage.")
+
     if not os.path.isdir(dest):
         die(dest, "dest does not exist")
     if not os.path.isdir('.git'):
@@ -84,7 +98,7 @@ def main():
     if os.path.lexists(rsync_ver):
         die(f'"{rsync_ver}" must not exist in the current directory.')
 
-    out = cmd_txt_chk(['git', 'tag', '-l', v_ver])
+    out = cmd_txt_chk(['git', 'tag', '-l', v_ver]).out
     if out != '':
         print(f"Tag {v_ver} already exists.")
         ans = input("\nDelete tag or quit? [Q/del] ")
@@ -192,10 +206,10 @@ About to:
             txt = replace_or_die(x_re, repl, txt, f"Unable to find SUBPROTOCOL_VERSION define in {fn}")
         elif fn == 'NEWS.md':
             efv = re.escape(finalversion)
-            x_re = re.compile(r'^<.+>\s+# NEWS for rsync %s $UNRELEASED$\s+## Changes in this version:\n' % efv
+            x_re = re.compile(r'^# NEWS for rsync %s $UNRELEASED$\s+## Changes in this version:\n' % efv
                     + r'(\n### PROTOCOL NUMBER:\s+- The protocol number was changed to \d+\.\n)?')
             rel_day = 'UNRELEASED' if pre else today
-            repl = (f'<a name="{finalversion}"></a>\n\n# NEWS for rsync {finalversion} ({rel_day})\n\n'
+            repl = (f'# NEWS for rsync {finalversion} ({rel_day})\n\n'
                 + '## Changes in this version:\n')
             if proto_changed:
                 repl += f'\n### PROTOCOL NUMBER:\n\n - The protocol number was changed to {protocol_version}.\n'
@@ -216,7 +230,7 @@ About to:
     cmd_chk(['packaging/year-tweak'])
 
     print(dash_line)
-    cmd_run("git diff --color | less -p '^diff .*'")
+    cmd_run("git diff")
 
     srctar_name = f"{rsync_ver}.tar.gz"
     pattar_name = f"rsync-patches-{version}.tar.gz"
@@ -282,13 +296,13 @@ About to:
     # TODO: is there a better way to ensure that our passphrase is in the agent?
     cmd_run("touch TeMp; gpg --sign TeMp; rm TeMp*")
 
-    out = cmd_txt(f"git tag -s -m 'Version {version}.' {v_ver}", capture='combined')
+    out = cmd_txt(f"git tag -s -m 'Version {version}.' {v_ver}", capture='combined').out
     print(out, end='')
     if 'bad passphrase' in out or 'failed' in out:
         die('Aborting')
 
     if os.path.isdir('patches/.git'):
-        out = cmd_txt(f"cd patches && git tag -s -m 'Version {version}.' {v_ver}", capture='combined')
+        out = cmd_txt(f"cd patches && git tag -s -m 'Version {version}.' {v_ver}", capture='combined').out
         print(out, end='')
         if 'bad passphrase' in out or 'failed' in out:
             die('Aborting')
@@ -327,7 +341,7 @@ About to:
     md_files = 'README.md NEWS.md INSTALL.md'.split()
     html_files = [ fn for fn in gen_pathnames if fn.endswith('.html') ]
     cmd_chk(['rsync', '-a', *md_files, *html_files, dest])
-    cmd_chk(["packaging/md2html"] + [ dest +'/'+ fn for fn in md_files ])
+    cmd_chk(["./md-convert", "--dest", dest, *md_files])
 
     cmd_chk(f"git log --name-status | gzip -9 >{dest}/ChangeLog.gz")
 
diff --git a/packaging/smart-make b/packaging/smart-make
index 6f634d64..3826432e 100755
--- a/packaging/smart-make
+++ b/packaging/smart-make
@@ -4,8 +4,6 @@ set -e
 
 export LANG=C
 
-make=`which gmake 2>/dev/null` || make=`which make 2>/dev/null`
-
 branch=`packaging/prep-auto-dir`
 if test x"$branch" = x; then
     srcdir=.
@@ -40,8 +38,8 @@ fi
 
 ./config.status
 
-$make all
+make all
 
 if test x"$1" = x"check"; then
-    $make check
+    make check
 fi
diff --git a/packaging/systemd/rsync.service b/packaging/systemd/rsync.service
index 8a0b5820..8a867ca6 100644
--- a/packaging/systemd/rsync.service
+++ b/packaging/systemd/rsync.service
@@ -7,6 +7,7 @@ Documentation=man:rsync(1) man:rsyncd.conf(5)
 [Service]
 ExecStart=/usr/bin/rsync --daemon --no-detach
 RestartSec=1
+Restart=on-failure
 
 # Citing README.md:
 #
diff --git a/packaging/var-checker b/packaging/var-checker
index fe7491df..f17c69a2 100755
--- a/packaging/var-checker
+++ b/packaging/var-checker
@@ -4,7 +4,7 @@
 # for vars that are defined but not used, and for inconsistent array
 # sizes.  Run it from inside the main rsync directory.
 
-import re, argparse, glob
+import os, sys, re, argparse, glob
 
 VARS_RE = re.compile(r'^(?!(?:extern|enum)\s)([a-zA-Z]\S*\s+.*);', re.M)
 EXTERNS_RE = re.compile(r'^extern\s+(.*);', re.M)
@@ -15,8 +15,15 @@ def main():
     add_syscall_c = set('t_stub.c t_unsafe.c tls.c trimslash.c'.split())
     add_util_c = set('t_stub.c t_unsafe.c'.split())
 
+    if not os.path.exists('syscall.c'):
+        if os.path.exists('var-checker'):
+            os.chdir('..')
+        else:
+            print("Couldn't find the source dir.")
+            sys.exit(1)
+
     syscall_c = slurp_file('syscall.c', True)
-    util_c = slurp_file('util.c', True)
+    util_c = slurp_file('util1.c', True)
 
     for fn in sorted(glob.glob('*.c')):
         txt = slurp_file(fn)
diff --git a/prepare-source b/prepare-source
index f5b7b46c..a4e78e61 100755
--- a/prepare-source
+++ b/prepare-source
@@ -6,7 +6,7 @@
 #
 #   build     build the config files [the default w/no arg]
 #   fetch     fetch the latest dev autoconfig files
-#   fetchgen  fetch all the latest dev generated files (including man pages)
+#   fetchgen  fetch all the latest dev generated files (including manpages)
 #   fetchSRC  fetch the latest dev source files [NON-GENERATED FILES]
 #
 # The script stops after the first successful action.
@@ -32,7 +32,7 @@ if test "$dir" != '.'; then
 	fi
     done
     for fn in configure.sh config.h.in aclocal.m4; do
-	test ! -f $fn -a -f "$dir/$fn" && cp -p "$dir/$fn" $fn
+	test ! -f $fn && test -f "$dir/$fn" && cp -p "$dir/$fn" $fn
     done
 fi
 
diff --git a/progress.c b/progress.c
index 8da52862..87207fbf 100644
--- a/progress.c
+++ b/progress.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2000 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -115,13 +115,13 @@ static void rprint_progress(OFF_T ofs, OFF_T size, struct timeval *now, int is_l
 		units = "kB/s";
 	}
 
-	if (remain < 0)
+	if (remain < 0 || remain > 9999.0 * 3600.0)
 		strlcpy(rembuf, "  ??:??:??", sizeof rembuf);
 	else {
-		snprintf(rembuf, sizeof rembuf, "%4d:%02d:%02d",
-			 (int) (remain / 3600.0),
-			 (int) (remain / 60.0) % 60,
-			 (int) remain % 60);
+		snprintf(rembuf, sizeof rembuf, "%4u:%02u:%02u",
+			 (unsigned int) (remain / 3600.0),
+			 (unsigned int) (remain / 60.0) % 60,
+			 (unsigned int) remain % 60);
 	}
 
 	output_needs_newline = 0;
diff --git a/receiver.c b/receiver.c
index 9df603fe..b3a69da0 100644
--- a/receiver.c
+++ b/receiver.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996-2000 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,6 +41,7 @@ extern int preserve_hard_links;
 extern int preserve_perms;
 extern int write_devices;
 extern int preserve_xattrs;
+extern int do_fsync;
 extern int basis_dir_cnt;
 extern int make_backups;
 extern int cleanup_got_literal;
@@ -394,6 +395,11 @@ static int receive_data(int f_in, char *fname_r, int fd_r, OFF_T size_r,
 
 	sum_len = sum_end(file_sum1);
 
+	if (do_fsync && fd != -1 && fsync(fd) != 0) {
+		rsyserr(FERROR, errno, "fsync failed on %s", full_fname(fname));
+		exit_cleanup(RERR_FILEIO);
+	}
+
 	if (mapbuf)
 		unmap_file(mapbuf);
 
@@ -539,6 +545,9 @@ int recv_files(int f_in, int f_out, char *local_name)
 	if (delay_updates)
 		delayed_bits = bitbag_create(cur_flist->used + 1);
 
+	if (whole_file < 0)
+		whole_file = 0;
+
 	progress_init();
 
 	while (1) {
@@ -799,14 +808,16 @@ int recv_files(int f_in, int f_out, char *local_name)
 			continue;
 		}
 
-		if (fd1 != -1 && !(S_ISREG(st.st_mode) || (write_devices && IS_DEVICE(st.st_mode)))) {
+		if (write_devices && IS_DEVICE(st.st_mode)) {
+			if (fd1 != -1 && st.st_size == 0)
+				st.st_size = get_device_size(fd1, fname);
+			/* Mark the file entry as a device so that we don't try to truncate it later on. */
+			file->mode = S_IFBLK | (file->mode & ACCESSPERMS);
+		} else if (fd1 != -1 && !(S_ISREG(st.st_mode))) {
 			close(fd1);
 			fd1 = -1;
 		}
 
-		if (fd1 != -1 && IS_DEVICE(st.st_mode) && st.st_size == 0)
-			st.st_size = get_device_size(fd1, fname);
-
 		/* If we're not preserving permissions, change the file-list's
 		 * mode based on the local permissions and some heuristics. */
 		if (!preserve_perms) {
@@ -826,6 +837,12 @@ int recv_files(int f_in, int f_out, char *local_name)
 		if (inplace || one_inplace)  {
 			fnametmp = one_inplace ? partialptr : fname;
 			fd2 = do_open(fnametmp, O_WRONLY|O_CREAT, 0600);
+#ifdef linux
+			if (fd2 == -1 && errno == EACCES) {
+				/* Maybe the error was due to protected_regular setting? */
+				fd2 = do_open(fname, O_WRONLY, 0600);
+			}
+#endif
 			if (fd2 == -1) {
 				rsyserr(FERROR_XFER, errno, "open %s failed",
 					full_fname(fnametmp));
@@ -878,7 +895,7 @@ int recv_files(int f_in, int f_out, char *local_name)
 					do_unlink(partialptr);
 				handle_partial_dir(partialptr, PDIR_DELETE);
 			}
-		} else if (keep_partial && partialptr && !one_inplace) {
+		} else if (keep_partial && partialptr && (!one_inplace || delay_updates)) {
 			if (!handle_partial_dir(partialptr, PDIR_CREATE)) {
 				rprintf(FERROR,
 					"Unable to create partial-dir for %s -- discarding %s.\n",
@@ -912,7 +929,7 @@ int recv_files(int f_in, int f_out, char *local_name)
 			break;
 		case 0: {
 			enum logcode msgtype = redoing ? FERROR_XFER : FWARNING;
-			if (msgtype == FERROR_XFER || INFO_GTE(NAME, 1)) {
+			if (msgtype == FERROR_XFER || INFO_GTE(NAME, 1) || stdout_format_has_i) {
 				char *errstr, *redostr, *keptstr;
 				if (!(keep_partial && partialptr) && !inplace)
 					keptstr = "discarded";
diff --git a/rsync-ssl b/rsync-ssl
index 8101975a..56ee7dfe 100755
--- a/rsync-ssl
+++ b/rsync-ssl
@@ -73,8 +73,16 @@ function rsync_ssl_helper {
 	certopt=""
 	gnutls_cert_opt=""
     else
-	certopt="cert$optsep$RSYNC_SSL_CERT"
-	gnutls_cert_opt="--x509keyfile=$RSYNC_SSL_CERT"
+	certopt="-cert$optsep$RSYNC_SSL_CERT"
+	gnutls_cert_opt="--x509certfile=$RSYNC_SSL_CERT"
+    fi
+
+    if [[ -z "$RSYNC_SSL_KEY" ]]; then
+	keyopt=""
+	gnutls_key_opt=""
+    else
+	keyopt="-key$optsep$RSYNC_SSL_KEY"
+	gnutls_key_opt="--x509keyfile=$RSYNC_SSL_KEY"
     fi
 
     if [[ -z ${RSYNC_SSL_CA_CERT+x} ]]; then
@@ -129,9 +137,9 @@ function rsync_ssl_helper {
     fi
 
     if [[ $RSYNC_SSL_TYPE == openssl ]]; then
-	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -connect $hostname:$port
+	exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt $keyopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port
     elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
-	exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_opts $hostname:$port
+	exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_key_opt $gnutls_opts $hostname:$port
     else
 	# devzero@web.de came up with this no-tmpfile calling syntax:
 	exec $RSYNC_SSL_STUNNEL -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&-
diff --git a/rsync-ssl.1.md b/rsync-ssl.1.md
index 3a014862..f3f93718 100644
--- a/rsync-ssl.1.md
+++ b/rsync-ssl.1.md
@@ -1,14 +1,17 @@
-# NAME
+## NAME
 
 rsync-ssl - a helper script for connecting to an ssl rsync daemon
 
-# SYNOPSIS
+## SYNOPSIS
 
 ```
 rsync-ssl [--type=SSL_TYPE] RSYNC_ARGS
 ```
 
-# DESCRIPTION
+The online version of this manpage (that includes cross-linking of topics)
+is available at <https://download.samba.org/pub/rsync/rsync-ssl.1>.
+
+## DESCRIPTION
 
 The rsync-ssl script helps you to run an rsync copy to/from an rsync daemon
 that requires ssl connections.
@@ -20,7 +23,7 @@ environment.  You can specify an overriding port via `--port` or by including
 it in the normal spot in the URL format, though both of those require your
 rsync version to be at least 3.2.0.
 
-# OPTIONS
+## OPTIONS
 
 If the **first** arg is a `--type=SSL_TYPE` option, the script will only use
 that particular program to open an ssl connection instead of trying to find an
@@ -32,33 +35,56 @@ required for this particular option.
 All the other options are passed through to the rsync command, so consult the
 **rsync**(1) manpage for more information on how it works.
 
-# ENVIRONMENT VARIABLES
+## ENVIRONMENT VARIABLES
 
 The ssl helper scripts are affected by the following environment variables:
 
-0.  `RSYNC_SSL_TYPE` Specifies the program type that should be used to open the
-    ssl connection.  It must be one of `openssl` or `stunnel`.  The
-    `--type=SSL_TYPE` option overrides this, when specified.
-0.  `RSYNC_SSL_PORT` If specified, the value is the port number that is used as
-    the default when the user does not specify a port in their rsync command.
-    When not specified, the default port number is 874.  (Note that older rsync
-    versions (prior to 3.2.0) did not communicate an overriding port number
-    value to the helper script.)
-0.  `RSYNC_SSL_CERT` If specified, the value is a filename that contains a
+0.  `RSYNC_SSL_TYPE`
+
+    Specifies the program type that should be used to open the ssl connection.
+    It must be one of `openssl` or `stunnel`.  The `--type=SSL_TYPE` option
+    overrides this, when specified.
+
+0.  `RSYNC_SSL_PORT`
+
+    If specified, the value is the port number that is used as the default when
+    the user does not specify a port in their rsync command.  When not
+    specified, the default port number is 874.  (Note that older rsync versions
+    (prior to 3.2.0) did not communicate an overriding port number value to the
+    helper script.)
+
+0.  `RSYNC_SSL_CERT`
+
+    If specified, the value is a filename that contains a certificate to use
+    for the connection.
+
+0.  `RSYNC_SSL_KEY`
+
+    If specified, the value is a filename that contains a key for the provided
     certificate to use for the connection.
-0.  `RSYNC_SSL_CA_CERT` If specified, the value is a filename that contains a
-    certificate authority certificate that is used to validate the connection.
-0.  `RSYNC_SSL_OPENSSL` Specifies the openssl executable to run when the
-    connection type is set to openssl.  If unspecified, the $PATH is searched
-    for "openssl".
-0.  `RSYNC_SSL_GNUTLS` Specifies the gnutls-cli executable to run when the
-    connection type is set to gnutls.  If unspecified, the $PATH is searched
-    for "gnutls-cli".
-0.  `RSYNC_SSL_STUNNEL` Specifies the stunnel executable to run when the
-    connection type is set to stunnel.  If unspecified, the $PATH is searched
-    first for "stunnel4" and then for "stunnel".
-
-# EXAMPLES
+
+0.  `RSYNC_SSL_CA_CERT`
+
+    If specified, the value is a filename that contains a certificate authority
+    certificate that is used to validate the connection.
+
+0.  `RSYNC_SSL_OPENSSL`
+
+    Specifies the openssl executable to run when the connection type is set to
+    openssl.  If unspecified, the $PATH is searched for "openssl".
+
+0.  `RSYNC_SSL_GNUTLS`
+
+    Specifies the gnutls-cli executable to run when the connection type is set
+    to gnutls.  If unspecified, the $PATH is searched for "gnutls-cli".
+
+0.  `RSYNC_SSL_STUNNEL`
+
+    Specifies the stunnel executable to run when the connection type is set to
+    stunnel.  If unspecified, the $PATH is searched first for "stunnel4" and
+    then for "stunnel".
+
+## EXAMPLES
 
 >     rsync-ssl -aiv example.com::mod/ dest
 
@@ -68,11 +94,11 @@ The ssl helper scripts are affected by the following environment variables:
 
 >     rsync-ssl -aiv rsync://example.com:9874/mod/ dest
 
-# SEE ALSO
+## SEE ALSO
 
-**rsync**(1), **rsyncd.conf**(5)
+[**rsync**(1)](rsync.1), [**rsyncd.conf**(5)](rsyncd.conf.5)
 
-# CAVEATS
+## CAVEATS
 
 Note that using an stunnel connection requires at least version 4 of stunnel,
 which should be the case on modern systems.  Also, it does not verify a
@@ -85,23 +111,23 @@ release the gnutls-cli command was dropping output, making it unusable.  If
 that bug has been fixed in your version, feel free to put gnutls into an
 exported RSYNC_SSL_TYPE environment variable to make its use the default.
 
-# BUGS
+## BUGS
 
 Please report bugs! See the web site at <https://rsync.samba.org/>.
 
-# VERSION
+## VERSION
 
-This man page is current for version @VERSION@ of rsync.
+This manpage is current for version @VERSION@ of rsync.
 
-# CREDITS
+## CREDITS
 
-rsync is distributed under the GNU General Public License.  See the file
-COPYING for details.
+Rsync is distributed under the GNU General Public License.  See the file
+[COPYING](COPYING) for details.
 
 A web site is available at <https://rsync.samba.org/>.  The site includes an
 FAQ-O-Matic which may cover questions unanswered by this manual page.
 
-# AUTHOR
+## AUTHOR
 
 This manpage was written by Wayne Davison.
 
diff --git a/rsync.1.md b/rsync.1.md
index b1ef84e1..313025df 100644
--- a/rsync.1.md
+++ b/rsync.1.md
@@ -1,8 +1,8 @@
-# NAME
+## NAME
 
 rsync - a fast, versatile, remote (and local) file-copying tool
 
-# SYNOPSIS
+## SYNOPSIS
 
 ```
 Local:
@@ -26,7 +26,10 @@ Access via rsync daemon:
 Usages with just one SRC arg and no DEST arg will list the source files instead
 of copying.
 
-# DESCRIPTION
+The online version of this manpage (that includes cross-linking of topics)
+is available at <https://download.samba.org/pub/rsync/rsync.1>.
+
+## DESCRIPTION
 
 Rsync is a fast and extraordinarily versatile file copying tool.  It can copy
 locally, to/from another host over any remote shell, or to/from a remote rsync
@@ -54,7 +57,7 @@ Some of the additional features of rsync are:
 - pipelining of file transfers to minimize latency costs
 - support for anonymous or authenticated rsync daemons (ideal for mirroring)
 
-# GENERAL
+## GENERAL
 
 Rsync copies files either to or from a remote host, or locally on the current
 host (it does not support copying files between two remote hosts).
@@ -65,21 +68,21 @@ rsync daemon directly via TCP.  The remote-shell transport is used whenever the
 source or destination path contains a single colon (:) separator after a host
 specification.  Contacting an rsync daemon directly happens when the source or
 destination path contains a double colon (::) separator after a host
-specification, OR when an rsync:// URL is specified (see also the "USING
-RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL CONNECTION" section for an exception
-to this latter rule).
+specification, OR when an rsync:// URL is specified (see also the [USING
+RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL CONNECTION](#) section for an
+exception to this latter rule).
 
 As a special case, if a single source arg is specified without a destination,
 the files are listed in an output format similar to "`ls -l`".
 
 As expected, if neither the source or destination path specify a remote host,
-the copy occurs locally (see also the `--list-only` option).
+the copy occurs locally (see also the [`--list-only`](#opt) option).
 
 Rsync refers to the local side as the client and the remote side as the server.
 Don't confuse server with an rsync daemon.  A daemon is always a server, but a
 server can be either a daemon or a remote-shell spawned process.
 
-# SETUP
+## SETUP
 
 See the file README.md for installation instructions.
 
@@ -89,12 +92,12 @@ protocol).  For remote transfers, a modern rsync uses ssh for its
 communications, but it may have been configured to use a different remote shell
 by default, such as rsh or remsh.
 
-You can also specify any remote shell you like, either by using the `-e`
-command line option, or by setting the RSYNC_RSH environment variable.
+You can also specify any remote shell you like, either by using the [`-e`](#opt)
+command line option, or by setting the [`RSYNC_RSH`](#) environment variable.
 
 Note that rsync must be installed on both the source and destination machines.
 
-# USAGE
+## USAGE
 
 You use rsync in the same way you use rcp.  You must specify a source and a
 destination, one of which may be remote.
@@ -151,38 +154,38 @@ rsync daemon by leaving off the module name:
 
 See the following section for more details.
 
-# ADVANCED USAGE
+## ADVANCED USAGE
 
 The syntax for requesting multiple files from a remote host is done by
 specifying additional remote-host args in the same style as the first, or with
 the hostname omitted.  For instance, all these work:
 
->     rsync -av host:file1 :file2 host:file{3,4} /dest/
->     rsync -av host::modname/file{1,2} host::modname/file3 /dest/
->     rsync -av host::modname/file1 ::modname/file{3,4}
+>     rsync -aiv host:file1 :file2 host:file{3,4} /dest/
+>     rsync -aiv host::modname/file{1,2} host::modname/extra /dest/
+>     rsync -aiv host::modname/first ::modname/extra{1,2} /dest/
 
-Older versions of rsync required using quoted spaces in the SRC, like these
-examples:
+In a modern rsync, you only need to quote or backslash-escape things like
+spaces from the local shell but not also from the remote shell:
 
->     rsync -av host:'dir1/file1 dir2/file2' /dest
->     rsync host::'modname/dir1/file1 modname/dir2/file2' /dest
+>     rsync -aiv host:'a simple file.pdf' /dest/
 
-This word-splitting still works (by default) in the latest rsync, but is not as
-easy to use as the first method.
+Really old versions of rsync only allowed specifying one remote-source arg, so
+it required the remote side to split the args at a space.  You can still get
+this old-style arg splitting by using the [`--old-args`](#opt) option:
 
-If you need to transfer a filename that contains whitespace, you can either
-specify the `--protect-args` (`-s`) option, or you'll need to escape the
-whitespace in a way that the remote shell will understand.  For instance:
+>     rsync -ai --old-args host:'dir1/file1 dir2/file2' /dest
+>     rsync -ai --old-args host::'modname/dir1/file1 modname/dir2/file2' /dest
 
->     rsync -av host:'file\ name\ with\ spaces' /dest
+See that option's section for an [environment variable](#RSYNC_OLD_ARGS) that
+can be exported to help old scripts.
 
-# CONNECTING TO AN RSYNC DAEMON
+## CONNECTING TO AN RSYNC DAEMON
 
 It is also possible to use rsync without a remote shell as the transport.  In
 this case you will directly connect to a remote rsync daemon, typically using
 TCP port 873. (This obviously requires the daemon to be running on the remote
-system, so refer to the STARTING AN RSYNC DAEMON TO ACCEPT CONNECTIONS section
-below for information on that.)
+system, so refer to the [STARTING AN RSYNC DAEMON TO ACCEPT CONNECTIONS](#)
+section below for information on that.)
 
 Using rsync in this way is the same as using it with a remote shell except
 that:
@@ -195,9 +198,9 @@ that:
   paths on the daemon will be shown.
 - if you specify no local destination then a listing of the specified files on
   the remote daemon is provided.
-- you must not specify the `--rsh` (`-e`) option (since that overrides the
-  daemon connection to use ssh -- see USING RSYNC-DAEMON FEATURES VIA A
-  REMOTE-SHELL CONNECTION below).
+- you must not specify the [`--rsh`](#opt) (`-e`) option (since that overrides
+  the daemon connection to use ssh -- see [USING RSYNC-DAEMON FEATURES VIA A
+  REMOTE-SHELL CONNECTION](#) below).
 
 An example that copies all the files in a remote module named "src":
 
@@ -205,22 +208,23 @@ An example that copies all the files in a remote module named "src":
 
 Some modules on the remote daemon may require authentication.  If so, you will
 receive a password prompt when you connect.  You can avoid the password prompt
-by setting the environment variable RSYNC_PASSWORD to the password you want to
-use or using the `--password-file` option.  This may be useful when scripting
-rsync.
+by setting the environment variable [`RSYNC_PASSWORD`](#) to the password you
+want to use or using the [`--password-file`](#opt) option.  This may be useful
+when scripting rsync.
 
 WARNING: On some systems environment variables are visible to all users.  On
-those systems using `--password-file` is recommended.
+those systems using [`--password-file`](#opt) is recommended.
 
 You may establish the connection via a web proxy by setting the environment
-variable RSYNC_PROXY to a hostname:port pair pointing to your web proxy.  Note
-that your web proxy's configuration must support proxy connections to port 873.
+variable [`RSYNC_PROXY`](#) to a hostname:port pair pointing to your web proxy.
+Note that your web proxy's configuration must support proxy connections to port
+873.
 
 You may also establish a daemon connection using a program as a proxy by
-setting the environment variable RSYNC_CONNECT_PROG to the commands you wish to
-run in place of making a direct socket connection.  The string may contain the
-escape "%H" to represent the hostname specified in the rsync command (so use
-"%%" if you need a single "%" in your string).  For example:
+setting the environment variable [`RSYNC_CONNECT_PROG`](#) to the commands you
+wish to run in place of making a direct socket connection.  The string may
+contain the escape "%H" to represent the hostname specified in the rsync
+command (so use "%%" if you need a single "%" in your string).  For example:
 
 >     export RSYNC_CONNECT_PROG='ssh proxyhost nc %H 873'
 >     rsync -av targethost1::module/src/ /dest/
@@ -229,11 +233,11 @@ escape "%H" to represent the hostname specified in the rsync command (so use
 The command specified above uses ssh to run nc (netcat) on a proxyhost, which
 forwards all data to port 873 (the rsync daemon) on the targethost (%H).
 
-Note also that if the RSYNC_SHELL environment variable is set, that program
-will be used to run the RSYNC_CONNECT_PROG command instead of using the default
-shell of the **system()** call.
+Note also that if the [`RSYNC_SHELL`](#) environment variable is set, that
+program will be used to run the `RSYNC_CONNECT_PROG` command instead of using
+the default shell of the **system()** call.
 
-# USING RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL CONNECTION
+## USING RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL CONNECTION
 
 It is sometimes useful to use various features of an rsync daemon (such as
 named modules) without actually allowing any new socket connections into a
@@ -250,7 +254,7 @@ on that remote host to only allow connections from "localhost".)
 From the user's perspective, a daemon transfer via a remote-shell connection
 uses nearly the same command-line syntax as a normal rsync-daemon transfer,
 with the only exception being that you must explicitly set the remote shell
-program on the command-line with the `--rsh=COMMAND` option. (Setting the
+program on the command-line with the [`--rsh=COMMAND`](#opt) option. (Setting the
 RSYNC_RSH in the environment will not turn on this functionality.) For example:
 
 >     rsync -av --rsh=ssh host::module /dest
@@ -259,27 +263,27 @@ If you need to specify a different remote-shell user, keep in mind that the
 user@ prefix in front of the host is specifying the rsync-user value (for a
 module that requires user-based authentication).  This means that you must give
 the '-l user' option to ssh when specifying the remote-shell, as in this
-example that uses the short version of the `--rsh` option:
+example that uses the short version of the [`--rsh`](#opt) option:
 
 >     rsync -av -e "ssh -l ssh-user" rsync-user@host::module /dest
 
 The "ssh-user" will be used at the ssh level; the "rsync-user" will be used to
 log-in to the "module".
 
-# STARTING AN RSYNC DAEMON TO ACCEPT CONNECTIONS
+## STARTING AN RSYNC DAEMON TO ACCEPT CONNECTIONS
 
 In order to connect to an rsync daemon, the remote system needs to have a
 daemon already running (or it needs to have configured something like inetd to
 spawn an rsync daemon for incoming connections on a particular port).  For full
 information on how to start a daemon that will handling incoming socket
-connections, see the **rsyncd.conf**(5) man page -- that is the config file for
-the daemon, and it contains the full details for how to run the daemon
-(including stand-alone and inetd configurations).
+connections, see the [**rsyncd.conf**(5)](rsyncd.conf.5) manpage -- that is
+the config file for the daemon, and it contains the full details for how to run
+the daemon (including stand-alone and inetd configurations).
 
 If you're using one of the remote-shell transports for the transfer, there is
 no need to manually start an rsync daemon.
 
-# SORTED TRANSFER ORDER
+## SORTED TRANSFER ORDER
 
 Rsync always sorts the specified filenames into its internal transfer list.
 This handles the merging together of the contents of identically named
@@ -289,10 +293,10 @@ on the command-line.
 
 If you need a particular file to be transferred prior to another, either
 separate the files into different rsync calls, or consider using
-`--delay-updates` (which doesn't affect the sorted transfer order, but does
-make the final file-updating phase happen much more rapidly).
+[`--delay-updates`](#opt) (which doesn't affect the sorted transfer order, but
+does make the final file-updating phase happen much more rapidly).
 
-# EXAMPLES
+## EXAMPLES
 
 Here are some examples of how I use rsync.
 
@@ -322,10 +326,10 @@ I mirror a directory between my "old" and "new" ftp sites with the command:
 
 This is launched from cron every few hours.
 
-# OPTION SUMMARY
+## OPTION SUMMARY
 
-Here is a short summary of the options available in rsync.  Please refer to the
-detailed description below for a complete description.
+Here is a short summary of the options available in rsync.  Each option also
+has its own detailed description later in this manpage.
 
 [comment]: # (help-rsync.h)
 [comment]: # (Keep these short enough that they'll be under 80 chars when indented by 7 chars.)
@@ -338,7 +342,7 @@ detailed description below for a complete description.
 --quiet, -q              suppress non-error messages
 --no-motd                suppress daemon-mode MOTD
 --checksum, -c           skip based on checksum, not mod-time & size
---archive, -a            archive mode; equals -rlptgoD (no -H,-A,-X)
+--archive, -a            archive mode is -rlptgoD (no -A,-X,-U,-N,-H)
 --no-OPTION              turn off an implied OPTION (e.g. --no-D)
 --recursive, -r          recurse into directories
 --relative, -R           use relative path names
@@ -351,6 +355,7 @@ detailed description below for a complete description.
 --append                 append data onto shorter files
 --append-verify          --append w/old data in file checksum
 --dirs, -d               transfer directories without recursing
+--old-dirs, --old-d      works like --dirs when talking to old rsync
 --mkpath                 create the destination's path component
 --links, -l              copy symlinks as symlinks
 --copy-links, -L         transform symlink into referent file/dir
@@ -368,6 +373,8 @@ detailed description below for a complete description.
 --owner, -o              preserve owner (super-user only)
 --group, -g              preserve group
 --devices                preserve device files (super-user only)
+--copy-devices           copy device contents as a regular file
+--write-devices          write to devices as files (implies --inplace)
 --specials               preserve special files
 -D                       same as --devices --specials
 --times, -t              preserve modification times
@@ -380,7 +387,6 @@ detailed description below for a complete description.
 --fake-super             store/recover privileged attrs using xattrs
 --sparse, -S             turn sequences of nulls into sparse blocks
 --preallocate            allocate dest files before writing them
---write-devices          write to devices as files (implies --inplace)
 --dry-run, -n            perform a trial run with no changes made
 --whole-file, -W         copy files whole (w/o delta-xfer algorithm)
 --checksum-choice=STR    choose the checksum algorithm (aka --cc)
@@ -438,6 +444,7 @@ detailed description below for a complete description.
 --include-from=FILE      read include patterns from FILE
 --files-from=FILE        read list of source-file names from FILE
 --from0, -0              all *-from/filter files are delimited by 0s
+--old-args               disable the modern arg-protection idiom
 --protect-args, -s       no space-splitting; wildcard chars only
 --copy-as=USER[:GROUP]   specify user & optional group for the copy
 --address=ADDRESS        bind address for outgoing socket to daemon
@@ -461,6 +468,7 @@ detailed description below for a complete description.
 --bwlimit=RATE           limit socket I/O bandwidth
 --stop-after=MINS        Stop rsync after MINS minutes have elapsed
 --stop-at=y-m-dTh:m      Stop rsync at the specified point in time
+--fsync                  fsync every written file
 --write-batch=FILE       write a batched update to FILE
 --only-write-batch=FILE  like --write-batch but w/o updating dest
 --read-batch=FILE        read a batched update from FILE
@@ -495,7 +503,7 @@ accepted:
 --help, -h               show this help (when used with --daemon)
 ```
 
-# OPTIONS
+## OPTIONS
 
 Rsync accepts both long (double-dash + word) and short (single-dash + letter)
 options.  The full list of the available options are described below.  If an
@@ -511,11 +519,11 @@ your home directory (remove the '=' for that).
 
 [comment]: # (An OL starting at 0 is converted into a DL by the parser.)
 
-0.  `--help`, `-h` `(*)`
+0.  `--help`
 
     Print a short help page describing the options available in rsync and exit.
-    (*) The `-h` short option will only invoke `--help` when used without other
-    options since it normally means `--human-readable`.
+    You can also use `-h` for `--help` when it is used without any other
+    options (since it normally means [`--human-readable`](#opt)).
 
 0.  `--version`, `-V`
 
@@ -534,12 +542,24 @@ your home directory (remove the '=' for that).
     being skipped and slightly more information at the end.  More than two `-v`
     options should only be used if you are debugging rsync.
 
+    The end-of-run summary tells you the number of bytes sent to the remote
+    rsync (which is the receiving side on a local copy), the number of bytes
+    received from the remote host, and the average bytes per second of the
+    transferred data computed over the entire length of the rsync run. The
+    second line shows the total size (in bytes), which is the sum of all the
+    file sizes that rsync considered transferring.  It also shows a "speedup"
+    value, which is a ratio of the total file size divided by the sum of the
+    sent and received bytes (which is really just a feel-good bigger-is-better
+    number).  Note that these byte values can be made more (or less)
+    human-readable by using the [`--human-readable`](#opt) (or
+    `--no-human-readable`) options.
+
     In a modern rsync, the `-v` option is equivalent to the setting of groups
-    of `--info` and `--debug` options.  You can choose to use these newer
-    options in addition to, or in place of using `--verbose`, as any
-    fine-grained settings override the implied settings of `-v`.  Both `--info`
-    and `--debug` have a way to ask for help that tells you exactly what flags
-    are set for each increase in verbosity.
+    of [`--info`](#opt) and [`--debug`](#opt) options.  You can choose to use
+    these newer options in addition to, or in place of using `--verbose`, as
+    any fine-grained settings override the implied settings of `-v`.  Both
+    [`--info`](#opt) and [`--debug`](#opt) have a way to ask for help that
+    tells you exactly what flags are set for each increase in verbosity.
 
     However, do keep in mind that a daemon's "`max verbosity`" setting will limit
     how high of a level the various individual flags can be set on the daemon
@@ -560,9 +580,9 @@ your home directory (remove the '=' for that).
     >     rsync -a --info=progress2 src/ dest/
     >     rsync -avv --info=stats2,misc1,flist0 src/ dest/
 
-    Note that `--info=name`'s output is affected by the `--out-format` and
-    `--itemize-changes` (`-i`) options.  See those options for more information
-    on what is output and when.
+    Note that `--info=name`'s output is affected by the [`--out-format`](#opt)
+    and [`--itemize-changes`](#opt) (`-i`) options.  See those options for more
+    information on what is output and when.
 
     This option was added to 3.1.0, so an older rsync on the server side might
     reject your attempts at fine-grained control (if one or more flags needed
@@ -582,8 +602,8 @@ your home directory (remove the '=' for that).
     >     rsync -avvv --debug=none src/ dest/
     >     rsync -avA --del --debug=del2,acl src/ dest/
 
-    Note that some debug messages will only be output when `--stderr=all` is
-    specified, especially those pertaining to I/O and buffer debugging.
+    Note that some debug messages will only be output when the [`--stderr=all`](#opt)
+    option is specified, especially those pertaining to I/O and buffer debugging.
 
     Beginning in 3.2.0, this option is no longer auto-forwarded to the server
     side in order to allow you to specify different debug values for each side
@@ -613,8 +633,8 @@ your home directory (remove the '=' for that).
       divide up the info and error messages by file handle.  For those doing
       debugging or using several levels of verbosity, this option can help to
       avoid clogging up the transfer stream (which should prevent any chance of
-      a deadlock bug hanging things up).  It also enables the outputting of some
-      I/O related debug messages.
+      a deadlock bug hanging things up).  It also allows [`--debug`](#opt) to
+      enable some extra I/O related messages.
 
     - `client` - causes all rsync messages to be sent to the client side
       via the protocol stream.  One client process outputs all messages, with
@@ -651,6 +671,10 @@ your home directory (remove the '=' for that).
     the same modification timestamp.  This option turns off this "quick check"
     behavior, causing all files to be updated.
 
+    This option can be confusing compared to [`--ignore-existing`](#opt) and
+    [`--ignore-non-existing`](#opt) in that that they cause rsync to transfer
+    fewer files, while this option causes rsync to transfer more files.
+
 0.  `--size-only`
 
     This modifies rsync's "quick check" algorithm for finding files that need
@@ -705,62 +729,92 @@ your home directory (remove the '=' for that).
     before-the-transfer "Does this file need to be updated?" check.
 
     The checksum used is auto-negotiated between the client and the server, but
-    can be overridden using either the `--checksum-choice` (`--cc`) option or an
-    environment variable that is discussed in that option's section.
+    can be overridden using either the [`--checksum-choice`](#opt) (`--cc`)
+    option or an environment variable that is discussed in that option's
+    section.
 
 0.  `--archive`, `-a`
 
     This is equivalent to `-rlptgoD`.  It is a quick way of saying you want
-    recursion and want to preserve almost everything (with `-H` being a notable
-    omission).  The only exception to the above equivalence is when
-    `--files-from` is specified, in which case `-r` is not implied.
+    recursion and want to preserve almost everything.  Be aware that it does
+    **not** include preserving ACLs (`-A`), xattrs (`-X`), atimes (`-U`),
+    crtimes (`-N`), nor the finding and preserving of hardlinks (`-H`).
 
-    Note that `-a` **does not preserve hardlinks**, because finding
-    multiply-linked files is expensive.  You must separately specify `-H`.
+    The only exception to the above equivalence is when [`--files-from`](#opt)
+    is specified, in which case [`-r`](#opt) is not implied.
 
 0.  `--no-OPTION`
 
     You may turn off one or more implied options by prefixing the option name
-    with "no-".  Not all options may be prefixed with a "no-": only options that
-    are implied by other options (e.g. `--no-D`, `--no-perms`) or have
-    different defaults in various circumstances (e.g. `--no-whole-file`,
-    `--no-blocking-io`, `--no-dirs`).  You may specify either the short or the
-    long option name after the "no-" prefix (e.g. `--no-R` is the same as
-    `--no-relative`).
-
-    For example: if you want to use `-a` (`--archive`) but don't want `-o`
-    (`--owner`), instead of converting `-a` into `-rlptgD`, you could specify
-    `-a --no-o` (or `-a --no-owner`).
-
-    The order of the options is important: if you specify `--no-r -a`, the
-    `-r` option would end up being turned on, the opposite of `-a --no-r`.
-    Note also that the side-effects of the `--files-from` option are NOT
+    with "no-".  Not all positive options have a negated opposite, but a lot
+    do, including those that can be used to disable an implied option (e.g.
+    `--no-D`, `--no-perms`) or have different defaults in various circumstances
+    (e.g. [`--no-whole-file`](#opt), `--no-blocking-io`, `--no-dirs`).  Every
+    valid negated option accepts both the short and the long option name after
+    the "no-" prefix (e.g. `--no-R` is the same as `--no-relative`).
+
+    As an example, if you want to use [`--archive`](#opt) (`-a`) but don't want
+    [`--owner`](#opt) (`-o`), instead of converting `-a` into `-rlptgD`, you
+    can specify `-a --no-o` (aka `--archive --no-owner`).
+
+    The order of the options is important: if you specify `--no-r -a`, the `-r`
+    option would end up being turned on, the opposite of `-a --no-r`.  Note
+    also that the side-effects of the [`--files-from`](#opt) option are NOT
     positional, as it affects the default state of several options and slightly
-    changes the meaning of `-a` (see the `--files-from` option for more
-    details).
+    changes the meaning of [`-a`](#opt) (see the [`--files-from`](#opt) option
+    for more details).
 
 0.  `--recursive`, `-r`
 
-    This tells rsync to copy directories recursively.  See also `--dirs` (`-d`).
+    This tells rsync to copy directories recursively.  See also
+    [`--dirs`](#opt) (`-d`) for an option that allows the scanning of a single
+    directory.
+
+    See the [`--inc-recursive`](#opt) option for a discussion of the
+    incremental recursion for creating the list of files to transfer.
 
-    Beginning with rsync 3.0.0, the recursive algorithm used is now an
-    incremental scan that uses much less memory than before and begins the
-    transfer after the scanning of the first few directories have been
-    completed.  This incremental scan only affects our recursion algorithm, and
-    does not change a non-recursive transfer.  It is also only possible when
-    both ends of the transfer are at least version 3.0.0.
+0. `--inc-recursive`, `--i-r`
 
-    Some options require rsync to know the full file list, so these options
-    disable the incremental recursion mode.  These include: `--delete-before`,
-    `--delete-after`, `--prune-empty-dirs`, and `--delay-updates`.  Because of
-    this, the default delete mode when you specify `--delete` is now
-    `--delete-during` when both ends of the connection are at least 3.0.0 (use
-    `--del` or `--delete-during` to request this improved deletion mode
-    explicitly).  See also the `--delete-delay` option that is a better choice
-    than using `--delete-after`.
+    This option explicitly enables on incremental recursion when scanning for
+    files, which is enabled by default when using the [`--recursive`](#opt)
+    option and both sides of the transfer are running rsync 3.0.0 or newer.
 
-    Incremental recursion can be disabled using the `--no-inc-recursive` option
-    or its shorter `--no-i-r` alias.
+    Incremental recursion uses much less memory than non-incremental, while
+    also beginning the transfer more quickly (since it doesn't need to scan the
+    entire transfer hierarchy before it starts transferring files).  If no
+    recursion is enabled in the source files, this option has no effect.
+
+    Some options require rsync to know the full file list, so these options
+    disable the incremental recursion mode.  These include:
+    - [`--delete-before`](#opt) (the old default of [`--delete`](#opt))
+    - [`--delete-after`](#opt)
+    - [`--prune-empty-dirs`](#opt)
+    - [`--delay-updates`](#opt)
+
+    In order to make [`--delete`](#opt) compatible with incremental recursion,
+    rsync 3.0.0 made [`--delete-during`](#opt) the default delete mode (which
+    was first first added in 2.6.4).
+
+    One side-effect of incremental recursion is that any missing
+    sub-directories inside a recursively-scanned directory are (by default)
+    created prior to recursing into the sub-dirs.  This earlier creation point
+    (compared to a non-incremental recursion) allows rsync to then set the
+    modify time of the finished directory right away (without having to delay
+    that until a bunch of recursive copying has finished).  However, these
+    early directories don't yet have their completed mode, mtime, or ownership
+    set -- they have more restrictive rights until the subdirectory's copying
+    actually begins.  This early-creation idiom can be avoiding by using the
+    [`--omit-dir-times`](#opt) option.
+
+    Incremental recursion can be disabled using the
+    [`--no-inc-recursive`](#opt) (`--no-i-r`) option.
+
+0. `--no-inc-recursive`, `--no-i-r`
+
+    Disables the new incremental recursion algorithm of the
+    [`--recursive`](#opt) option.  This makes rsync scan the full file list
+    before it begins to transfer files.  See [`--inc-recursive`](#opt) for more
+    info.
 
 0.  `--relative`, `-R`
 
@@ -789,7 +843,7 @@ your home directory (remove the '=' for that).
     in its path.  If you want to duplicate a server-side symlink, include both
     the symlink via its path, and referent directory via its real path.  If
     you're dealing with an older rsync on the sending side, you may need to use
-    the `--no-implied-dirs` option.
+    the [`--no-implied-dirs`](#opt) option.
 
     It is also possible to limit the amount of path information that is sent as
     implied directories for each path you specify.  With a modern rsync on the
@@ -815,7 +869,7 @@ your home directory (remove the '=' for that).
 
 0.  `--no-implied-dirs`
 
-    This option affects the default behavior of the `--relative` option.  When
+    This option affects the default behavior of the [`--relative`](#opt) option.  When
     it is specified, the attributes of the implied directories from the source
     names are not included in the transfer.  This means that the corresponding
     path elements on the destination system are left unchanged if they exist,
@@ -825,13 +879,13 @@ your home directory (remove the '=' for that).
 
     For instance, if a command-line arg or a files-from entry told rsync to
     transfer the file "path/foo/file", the directories "path" and "path/foo"
-    are implied when `--relative` is used.  If "path/foo" is a symlink to "bar"
+    are implied when [`--relative`](#opt) is used.  If "path/foo" is a symlink to "bar"
     on the destination system, the receiving rsync would ordinarily delete
     "path/foo", recreate it as a directory, and receive the file into the new
     directory.  With `--no-implied-dirs`, the receiving rsync updates
     "path/foo/file" using the existing path elements, which means that the file
     ends up being created in "path/bar".  Another way to accomplish this link
-    preservation is to use the `--keep-dirlinks` option (which will also affect
+    preservation is to use the [`--keep-dirlinks`](#opt) option (which will also affect
     symlinks to directories in the rest of the transfer).
 
     When pulling files from an rsync older than 3.0.0, you may need to use this
@@ -842,27 +896,31 @@ your home directory (remove the '=' for that).
 
     With this option, preexisting destination files are renamed as each file is
     transferred or deleted.  You can control where the backup file goes and
-    what (if any) suffix gets appended using the `--backup-dir` and `--suffix`
-    options.
-
-    Note that if you don't specify `--backup-dir`, (1) the `--omit-dir-times`
-    option will be forced on, and (2) if `--delete` is also in effect (without
-    `--delete-excluded`), rsync will add a "protect" filter-rule for the backup
-    suffix to the end of all your existing excludes (e.g. `-f "P *~"`).  This
-    will prevent previously backed-up files from being deleted.  Note that if
-    you are supplying your own filter rules, you may need to manually insert
-    your own exclude/protect rule somewhere higher up in the list so that it
-    has a high enough priority to be effective (e.g., if your rules specify a
-    trailing inclusion/exclusion of `*`, the auto-added rule would never be
-    reached).
+    what (if any) suffix gets appended using the [`--backup-dir`](#opt) and
+    [`--suffix`](#opt) options.
+
+    If you don't specify [`--backup-dir`](#opt):
+
+    1. the [`--omit-dir-times`](#opt) option will be forced on
+    2. the use of [`--delete`](#opt) (without [`--delete-excluded`](#opt)),
+       causes rsync to add a "protect" [filter-rule](#FILTER_RULES) for the
+       backup suffix to the end of all your existing filters that looks like
+       this: `-f "P *~"`.  This rule prevents previously backed-up files from
+       being deleted.
+
+    Note that if you are supplying your own filter rules, you may need to
+    manually insert your own exclude/protect rule somewhere higher up in the
+    list so that it has a high enough priority to be effective (e.g. if your
+    rules specify a trailing inclusion/exclusion of `*`, the auto-added rule
+    would never be reached).
 
 0.  `--backup-dir=DIR`
 
-    This implies the `--backup` option, and tells rsync to store all
+    This implies the [`--backup`](#opt) option, and tells rsync to store all
     backups in the specified directory on the receiving side.  This can be used
     for incremental backups.  You can additionally specify a backup suffix
-    using the `--suffix` option (otherwise the files backed up in the specified
-    directory will keep their original filenames).
+    using the [`--suffix`](#opt) option (otherwise the files backed up in the
+    specified directory will keep their original filenames).
 
     Note that if you specify a relative path, the backup directory will be
     relative to the destination directory, so you probably want to specify
@@ -873,8 +931,8 @@ your home directory (remove the '=' for that).
 0.  `--suffix=SUFFIX`
 
     This option allows you to override the default backup suffix used with the
-    `--backup` (`-b`) option.  The default suffix is a `~` if no `--backup-dir`
-    was specified, otherwise it is an empty string.
+    [`--backup`](#opt) (`-b`) option.  The default suffix is a `~` if no
+    [`--backup-dir`](#opt) was specified, otherwise it is an empty string.
 
 0.  `--update`, `-u`
 
@@ -894,6 +952,13 @@ your home directory (remove the '=' for that).
     data that goes into the file-lists, and thus it doesn't affect deletions.
     It just limits the files that the receiver requests to be transferred.
 
+    A caution for those that choose to combine [`--inplace`](#opt) with
+    `--update`: an interrupted transfer will leave behind a partial file on the
+    receiving side that has a very recent modified time, so re-running the
+    transfer will probably **not** continue the interrupted file.  As such, it
+    is usually best to avoid combining this with[ `--inplace`](#opt) unless you
+    have implemented manual steps to handle any interrupted in-progress files.
+
 0.  `--inplace`
 
     This option changes how rsync transfers a file when its data needs to be
@@ -919,7 +984,7 @@ your home directory (remove the '=' for that).
       for the open of the file for writing to be successful.
     - The efficiency of rsync's delta-transfer algorithm may be reduced if some
       data in the destination file is overwritten before it can be copied to a
-      position later in the file.  This does not apply if you use `--backup`,
+      position later in the file.  This does not apply if you use [`--backup`](#opt),
       since rsync is smart enough to use the backup file as the basis file for
       the transfer.
 
@@ -931,10 +996,10 @@ your home directory (remove the '=' for that).
     bound.  It can also help keep a copy-on-write filesystem snapshot from
     diverging the entire contents of a file that only has minor changes.
 
-    The option implies `--partial` (since an interrupted transfer does not
-    delete the file), but conflicts with `--partial-dir` and `--delay-updates`.
-    Prior to rsync 2.6.4 `--inplace` was also incompatible with
-    `--compare-dest` and `--link-dest`.
+    The option implies [`--partial`](#opt) (since an interrupted transfer does
+    not delete the file), but conflicts with [`--partial-dir`](#opt) and
+    [`--delay-updates`](#opt).  Prior to rsync 2.6.4 `--inplace` was also
+    incompatible with [`--compare-dest`](#opt) and [`--link-dest`](#opt).
 
 0.  `--append`
 
@@ -949,7 +1014,9 @@ your home directory (remove the '=' for that).
     existing content in the file (it only verifies the content that it is
     appending).  Rsync skips any files that exist on the receiving side that
     are not shorter than the associated file on the sending side (which means
-    that new files are trasnferred).
+    that new files are transferred).  It also skips any files whose size on the
+    sending side gets shorter during the send negotiations (rsync warns about a
+    "diminished" file when this happens).
 
     This does not interfere with the updating of a file's non-content
     attributes (e.g.  permissions, ownership, etc.) when the file does not need
@@ -958,13 +1025,13 @@ your home directory (remove the '=' for that).
 
 0.  `--append-verify`
 
-    This special copy mode works like `--append` except that all the data in
-    the file is included in the checksum verification (making it much less
+    This special copy mode works like [`--append`](#opt) except that all the
+    data in the file is included in the checksum verification (making it less
     efficient but also potentially safer).  This option **can be dangerous** if
     you aren't 100% sure that all the files in the transfer are shared, growing
-    files.  See the `--append` option for more details.
+    files.  See the [`--append`](#opt) option for more details.
 
-    Note: prior to rsync 3.0.0, the `--append` option worked like
+    Note: prior to rsync 3.0.0, the [`--append`](#opt) option worked like
     `--append-verify`, so if you are interacting with an older rsync (or the
     transfer is using a protocol prior to 30), specifying either append option
     will initiate an `--append-verify` transfer.
@@ -972,20 +1039,21 @@ your home directory (remove the '=' for that).
 0.  `--dirs`, `-d`
 
     Tell the sending side to include any directories that are encountered.
-    Unlike `--recursive`, a directory's contents are not copied unless the
-    directory name specified is "." or ends with a trailing slash (e.g. ".",
-    "dir/.", "dir/", etc.).  Without this option or the `--recursive` option,
-    rsync will skip all directories it encounters (and output a message to that
-    effect for each one).  If you specify both `--dirs` and `--recursive`,
-    `--recursive` takes precedence.
-
-    The `--dirs` option is implied by the `--files-from` option or the
-    `--list-only` option (including an implied `--list-only` usage) if
-    `--recursive` wasn't specified (so that directories are seen in the
-    listing).  Specify `--no-dirs` (or `--no-d`) if you want to turn this off.
-
-    There is also a backward-compatibility helper option, `--old-dirs` (or
-    `--old-d`) that tells rsync to use a hack of `-r --exclude='/*/*'` to get
+    Unlike [`--recursive`](#opt), a directory's contents are not copied unless
+    the directory name specified is "." or ends with a trailing slash (e.g.
+    ".", "dir/.", "dir/", etc.).  Without this option or the
+    [`--recursive`](#opt) option, rsync will skip all directories it encounters
+    (and output a message to that effect for each one).  If you specify both
+    `--dirs` and [`--recursive`](#opt), `--recursive` takes precedence.
+
+    The `--dirs` option is implied by the [`--files-from`](#opt) option or the
+    [`--list-only`](#opt) option (including an implied [`--list-only`](#opt)
+    usage) if [`--recursive`](#opt) wasn't specified (so that directories are
+    seen in the listing).  Specify `--no-dirs` (or `--no-d`) if you want to
+    turn this off.
+
+    There is also a backward-compatibility helper option, `--old-dirs`
+    (`--old-d`) that tells rsync to use a hack of `-r --exclude='/*/*'` to get
     an older rsync to list a single directory without recursing.
 
 0.  `--mkpath`
@@ -1010,26 +1078,44 @@ your home directory (remove the '=' for that).
 
 0.  `--links`, `-l`
 
-    When symlinks are encountered, recreate the symlink on the destination.
+    Add symlinks to the transferred files instead of noisily ignoring them with
+    a "non-regular file" warning for each symlink encountered.  You can
+    alternately silence the warning by specifying [`--info=nonreg0`](#opt).
+
+    The default handling of symlinks is to recreate each symlink's unchanged
+    value on the receiving side.
+
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
 
 0.  `--copy-links`, `-L`
 
-    When symlinks are encountered, the item that they point to (the referent)
-    is copied, rather than the symlink.  In older versions of rsync, this
-    option also had the side-effect of telling the receiving side to follow
-    symlinks, such as symlinks to directories.  In a modern rsync such as this
-    one, you'll need to specify `--keep-dirlinks` (`-K`) to get this extra
-    behavior.  The only exception is when sending files to an rsync that is too
-    old to understand `-K` -- in that case, the `-L` option will still have the
-    side-effect of `-K` on that older receiving rsync.
+    The sender transforms each symlink encountered in the transfer into the
+    referent item, following the symlink chain to the file or directory that it
+    references.  If a symlink chain is broken, an error is output and the file
+    is dropped from the transfer.
+
+    This option supersedes any other options that affect symlinks in the
+    transfer, since there are no symlinks left in the transfer.
+
+    This option does not change the handling of existing symlinks on the
+    receiving side, unlike versions of rsync prior to 2.6.3 which had the
+    side-effect of telling the receiving side to also follow symlinks.  A
+    modern rsync won't forward this option to a remote receiver (since only the
+    sender needs to know about it), so this caveat should only affect someone
+    using an rsync client older than 2.6.7 (which is when `-L` stopped being
+    forwarded to the receiver).
+
+    See the [`--keep-dirlinks`](#opt) (`-K`) if you need a symlink to a
+    directory to be treated as a real directory on the receiving side.
+
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
 
 0.  `--copy-unsafe-links`
 
     This tells rsync to copy the referent of symbolic links that point outside
     the copied tree.  Absolute symlinks are also treated like ordinary files,
-    and so are any symlinks in the source path itself when `--relative` is
-    used.  This option has no additional effect if `--copy-links` was also
-    specified.
+    and so are any symlinks in the source path itself when [`--relative`](#opt)
+    is used.
 
     Note that the cut-off point is the top of the transfer, which is the part
     of the path that rsync isn't mentioning in the verbose output.  If you copy
@@ -1040,50 +1126,88 @@ your home directory (remove the '=' for that).
     slash) to "/dest/subdir" that would not allow symlinks to any files outside
     of "subdir".
 
+    Note that safe symlinks are only copied if [`--links`](#opt) was also
+    specified or implied. The `--copy-unsafe-links` option has no extra effect
+    when combined with [`--copy-links`](#opt).
+
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
+
 0.  `--safe-links`
 
-    This tells rsync to ignore any symbolic links which point outside the
-    copied tree.  All absolute symlinks are also ignored. Using this option in
-    conjunction with `--relative` may give unexpected results.
+    This tells the receiving rsync to ignore any symbolic links in the transfer
+    which point outside the copied tree.  All absolute symlinks are also
+    ignored.
 
-0.  `--munge-links`
+    Since this ignoring is happening on the receiving side, it will still be
+    effective even when the sending side has munged symlinks (when it is using
+    [`--munge-links`](#opt)). It also affects deletions, since the file being
+    present in the transfer prevents any matching file on the receiver from
+    being deleted when the symlink is deemed to be unsafe and is skipped.
 
-    This option tells rsync to (1) modify all symlinks on the receiving side in
-    a way that makes them unusable but recoverable (see below), or (2) to
-    unmunge symlinks on the sending side that had been stored in a munged
-    state.  This is useful if you don't quite trust the source of the data to
-    not try to slip in a symlink to a unexpected place.
+    This option must be combined with [`--links`](#opt) (or
+    [`--archive`](#opt)) to have any symlinks in the transfer to conditionally
+    ignore. Its effect is superseded by [`--copy-unsafe-links`](#opt).
 
-    The way rsync disables the use of symlinks is to prefix each one with the
-    string "/rsyncd-munged/".  This prevents the links from being used as long
-    as that directory does not exist.  When this option is enabled, rsync will
-    refuse to run if that path is a directory or a symlink to a directory.
+    Using this option in conjunction with [`--relative`](#opt) may give
+    unexpected results.
 
-    The option only affects the client side of the transfer, so if you need it
-    to affect the server, specify it via `--remote-option`. (Note that in a
-    local transfer, the client side is the sender.)
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
+
+0.  `--munge-links`
 
-    This option has no affect on a daemon, since the daemon configures whether
-    it wants munged symlinks via its "`munge symlinks`" parameter.  See also the
-    "munge-symlinks" perl script in the support directory of the source code.
+    This option affects just one side of the transfer and tells rsync to munge
+    symlink values when it is receiving files or unmunge symlink values when it
+    is sending files.  The munged values make the symlinks unusable on disk but
+    allows the original contents of the symlinks to be recovered.
+
+    The server-side rsync often enables this option without the client's
+    knowledge, such as in an rsync daemon's configuration file or by an option
+    given to the rrsync (restricted rsync) script.  When specified on the
+    client side, specify the option normally if it is the client side that
+    has/needs the munged symlinks, or use `-M--munge-links` to give the option
+    to the server when it has/needs the munged symlinks.  Note that on a local
+    transfer, the client is the sender, so specifying the option directly
+    unmunges symlinks while specifying it as a remote option munges symlinks.
+
+    This option has no affect when sent to a daemon via [`--remote-option`](#opt)
+    because the daemon configures whether it wants munged symlinks via its
+    "`munge symlinks`" parameter.
+
+    The symlink value is munged/unmunged once it is in the transfer, so any
+    option that transforms symlinks into non-symlinks occurs prior to the
+    munging/unmunging **except** for [`--safe-links`](#opt), which is a choice
+    that the receiver makes, so it bases its decision on the munged/unmunged
+    value.  This does mean that if a receiver has munging enabled, that using
+    [`--safe-links`](#opt) will cause all symlinks to be ignored (since they
+    are all absolute).
+
+    The method that rsync uses to munge the symlinks is to prefix each one's
+    value with the string "/rsyncd-munged/".  This prevents the links from
+    being used as long as the directory does not exist.  When this option is
+    enabled, rsync will refuse to run if that path is a directory or a symlink
+    to a directory (though it only checks at startup).  See also the
+    "munge-symlinks" python script in the support directory of the source code
+    for a way to munge/unmunge one or more symlinks in-place.
 
 0.  `--copy-dirlinks`, `-k`
 
     This option causes the sending side to treat a symlink to a directory as
     though it were a real directory.  This is useful if you don't want symlinks
-    to non-directories to be affected, as they would be using `--copy-links`.
+    to non-directories to be affected, as they would be using
+    [`--copy-links`](#opt).
 
     Without this option, if the sending side has replaced a directory with a
     symlink to a directory, the receiving side will delete anything that is in
     the way of the new symlink, including a directory hierarchy (as long as
-    `--force` or `--delete` is in effect).
+    [`--force`](#opt) or [`--delete`](#opt) is in effect).
 
-    See also `--keep-dirlinks` for an analogous option for the receiving side.
+    See also [`--keep-dirlinks`](#opt) for an analogous option for the
+    receiving side.
 
     `--copy-dirlinks` applies to all symlinks to directories in the source.  If
     you want to follow only a few specified symlinks, a trick you can use is to
     pass them as additional source args with a trailing slash, using
-    `--relative` to make the paths match up right.  For example:
+    [`--relative`](#opt) to make the paths match up right.  For example:
 
     >     rsync -r --relative src/./ src/./follow-me/ dest/
 
@@ -1092,6 +1216,8 @@ your home directory (remove the '=' for that).
     directory in the file-list which overrides the symlink found during the
     scan of "src/./".
 
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
+
 0.  `--keep-dirlinks`, `-K`
 
     This option causes the receiving side to treat a symlink to a directory as
@@ -1107,14 +1233,18 @@ your home directory (remove the '=' for that).
     "bar".
 
     One note of caution: if you use `--keep-dirlinks`, you must trust all the
-    symlinks in the copy! If it is possible for an untrusted user to create
-    their own symlink to any directory, the user could then (on a subsequent
+    symlinks in the copy or enable the [`--munge-links`](#opt) option on the
+    receiving side!  If it is possible for an untrusted user to create their
+    own symlink to any real directory, the user could then (on a subsequent
     copy) replace the symlink with a real directory and affect the content of
     whatever directory the symlink references.  For backup copies, you are
     better off using something like a bind mount instead of a symlink to modify
     your receiving hierarchy.
 
-    See also `--copy-dirlinks` for an analogous option for the sending side.
+    See also [`--copy-dirlinks`](#opt) for an analogous option for the sending
+    side.
+
+    See the [SYMBOLIC LINKS](#) section for multi-option info.
 
 0.  `--hard-links`, `-H`
 
@@ -1131,41 +1261,42 @@ your home directory (remove the '=' for that).
       is present in the source file list), the copying algorithm will not break
       them explicitly.  However, if one or more of the paths have content
       differences, the normal file-update process will break those extra links
-      (unless you are using the `--inplace` option).
-    - If you specify a `--link-dest` directory that contains hard links, the
-      linking of the destination files against the `--link-dest` files can
-      cause some paths in the destination to become linked together due to the
-      `--link-dest` associations.
+      (unless you are using the [`--inplace`](#opt) option).
+    - If you specify a [`--link-dest`](#opt) directory that contains hard
+      links, the linking of the destination files against the
+      [`--link-dest`](#opt) files can cause some paths in the destination to
+      become linked together due to the [`--link-dest`](#opt) associations.
 
     Note that rsync can only detect hard links between files that are inside
     the transfer set.  If rsync updates a file that has extra hard-link
     connections to files outside the transfer, that linkage will be broken.  If
-    you are tempted to use the `--inplace` option to avoid this breakage, be
+    you are tempted to use the [`--inplace`](#opt) option to avoid this breakage, be
     very careful that you know how your files are being updated so that you are
     certain that no unintended changes happen due to lingering hard links (and
-    see the `--inplace` option for more caveats).
+    see the [`--inplace`](#opt) option for more caveats).
 
-    If incremental recursion is active (see `--recursive`), rsync may transfer
-    a missing hard-linked file before it finds that another link for that
-    contents exists elsewhere in the hierarchy.  This does not affect the
-    accuracy of the transfer (i.e. which files are hard-linked together), just
-    its efficiency (i.e. copying the data for a new, early copy of a
+    If incremental recursion is active (see [`--inc-recursive`](#opt)), rsync
+    may transfer a missing hard-linked file before it finds that another link
+    for that contents exists elsewhere in the hierarchy.  This does not affect
+    the accuracy of the transfer (i.e. which files are hard-linked together),
+    just its efficiency (i.e. copying the data for a new, early copy of a
     hard-linked file that could have been found later in the transfer in
     another member of the hard-linked set of files).  One way to avoid this
     inefficiency is to disable incremental recursion using the
-    `--no-inc-recursive` option.
+    [`--no-inc-recursive`](#opt) option.
 
 0.  `--perms`, `-p`
 
     This option causes the receiving rsync to set the destination permissions
-    to be the same as the source permissions. (See also the `--chmod` option
-    for a way to modify what rsync considers to be the source permissions.)
+    to be the same as the source permissions. (See also the [`--chmod`](#opt)
+    option for a way to modify what rsync considers to be the source
+    permissions.)
 
     When this option is _off_, permissions are set as follows:
 
     - Existing files (including updated files) retain their existing
-      permissions, though the `--executability` option might change just the
-      execute permission for the file.
+      permissions, though the [`--executability`](#opt) option might change
+      just the execute permission for the file.
     - New files get their "normal" permission bits set to the source file's
       permissions masked with the receiving directory's default permissions
       (either the receiving process's umask, or the permissions specified via
@@ -1173,18 +1304,19 @@ your home directory (remove the '=' for that).
       bits disabled except in the case where a new directory inherits a setgid
       bit from its parent directory.
 
-    Thus, when `--perms` and `--executability` are both disabled, rsync's
+    Thus, when `--perms` and [`--executability`](#opt) are both disabled, rsync's
     behavior is the same as that of other file-copy utilities, such as **cp**(1)
     and **tar**(1).
 
     In summary: to give destination files (both old and new) the source
     permissions, use `--perms`.  To give new files the destination-default
     permissions (while leaving existing files unchanged), make sure that the
-    `--perms` option is off and use `--chmod=ugo=rwX` (which ensures that all
-    non-masked bits get enabled).  If you'd care to make this latter behavior
-    easier to type, you could define a popt alias for it, such as putting this
-    line in the file `~/.popt` (the following defines the `-Z` option, and
-    includes `--no-g` to use the default group of the destination dir):
+    `--perms` option is off and use [`--chmod=ugo=rwX`](#opt) (which ensures
+    that all non-masked bits get enabled).  If you'd care to make this latter
+    behavior easier to type, you could define a popt alias for it, such as
+    putting this line in the file `~/.popt` (the following defines the `-Z`
+    option, and includes `--no-g` to use the default group of the destination
+    dir):
 
     >      rsync alias -Z --no-p --no-g --chmod=ugo=rwX
 
@@ -1208,8 +1340,8 @@ your home directory (remove the '=' for that).
 0.  `--executability`, `-E`
 
     This option causes rsync to preserve the executability (or
-    non-executability) of regular files when `--perms` is not enabled.  A
-    regular file is considered to be executable if at least one 'x' is turned
+    non-executability) of regular files when [`--perms`](#opt) is not enabled.
+    A regular file is considered to be executable if at least one 'x' is turned
     on in its permissions.  When an existing destination file's executability
     differs from that of the corresponding source file, rsync modifies the
     destination file's permissions as follows:
@@ -1218,16 +1350,16 @@ your home directory (remove the '=' for that).
     - To make a file executable, rsync turns on each 'x' permission that has a
       corresponding 'r' permission enabled.
 
-    If `--perms` is enabled, this option is ignored.
+    If [`--perms`](#opt) is enabled, this option is ignored.
 
 0.  `--acls`, `-A`
 
     This option causes rsync to update the destination ACLs to be the same as
-    the source ACLs.  The option also implies `--perms`.
+    the source ACLs.  The option also implies [`--perms`](#opt).
 
     The source and destination systems must have compatible ACL entries for
-    this option to work properly.  See the `--fake-super` option for a way to
-    backup and restore ACLs that are not compatible.
+    this option to work properly.  See the [`--fake-super`](#opt) option for a
+    way to backup and restore ACLs that are not compatible.
 
 0.  `--xattrs`, `-X`
 
@@ -1237,7 +1369,7 @@ your home directory (remove the '=' for that).
     For systems that support extended-attribute namespaces, a copy being done
     by a super-user copies all namespaces except system.\*.  A normal user only
     copies the user.\* namespace.  To be able to backup and restore non-user
-    namespaces as a normal user, see the `--fake-super` option.
+    namespaces as a normal user, see the [`--fake-super`](#opt) option.
 
     The above name filtering can be overridden by using one or more filter
     options with the **x** modifier.  When you specify an xattr-affecting
@@ -1259,8 +1391,8 @@ your home directory (remove the '=' for that).
     >     --filter='-xr *'
 
     Note that the `-X` option does not copy rsync's special xattr values (e.g.
-    those used by `--fake-super`) unless you repeat the option (e.g. `-XX`).
-    This "copy all xattrs" mode cannot be used with `--fake-super`.
+    those used by [`--fake-super`](#opt)) unless you repeat the option (e.g. `-XX`).
+    This "copy all xattrs" mode cannot be used with [`--fake-super`](#opt).
 
 0.  `--chmod=CHMOD`
 
@@ -1268,7 +1400,7 @@ your home directory (remove the '=' for that).
     to the permission of the files in the transfer.  The resulting value is
     treated as though it were the permissions that the sending side supplied
     for the file, which means that this option can seem to have no effect on
-    existing files if `--perms` is not enabled.
+    existing files if [`--perms`](#opt) is not enabled.
 
     In addition to the normal parsing rules specified in the **chmod**(1)
     manpage, you can specify an item that should only apply to a directory by
@@ -1287,20 +1419,20 @@ your home directory (remove the '=' for that).
     It is also legal to specify multiple `--chmod` options, as each additional
     option is just appended to the list of changes to make.
 
-    See the `--perms` and `--executability` options for how the resulting
-    permission value can be applied to the files in the transfer.
+    See the [`--perms`](#opt) and [`--executability`](#opt) options for how the
+    resulting permission value can be applied to the files in the transfer.
 
 0.  `--owner`, `-o`
 
     This option causes rsync to set the owner of the destination file to be the
     same as the source file, but only if the receiving rsync is being run as
-    the super-user (see also the `--super` and `--fake-super` options).  Without
-    this option, the owner of new and/or transferred files are set to the
-    invoking user on the receiving side.
+    the super-user (see also the [`--super`](#opt) and [`--fake-super`](#opt)
+    options).  Without this option, the owner of new and/or transferred files
+    are set to the invoking user on the receiving side.
 
     The preservation of ownership will associate matching names by default, but
     may fall back to using the ID number in some circumstances (see also the
-    `--numeric-ids` option for a full discussion).
+    [`--numeric-ids`](#opt) option for a full discussion).
 
 0.  `--group`, `-g`
 
@@ -1313,60 +1445,79 @@ your home directory (remove the '=' for that).
 
     The preservation of group information will associate matching names by
     default, but may fall back to using the ID number in some circumstances
-    (see also the `--numeric-ids` option for a full discussion).
+    (see also the [`--numeric-ids`](#opt) option for a full discussion).
 
 0.  `--devices`
 
     This option causes rsync to transfer character and block device files to
-    the remote system to recreate these devices.  This option has no effect if
-    the receiving rsync is not run as the super-user (see also the `--super`
-    and `--fake-super` options).
+    the remote system to recreate these devices.  If the receiving rsync is not
+    being run as the super-user, rsync silently skips creating the device files
+    (see also the [`--super`](#opt) and [`--fake-super`](#opt) options).
+
+    By default, rsync generates a "non-regular file" warning for each device
+    file encountered when this option is not set.  You can silence the warning
+    by specifying [`--info=nonreg0`](#opt).
 
 0.  `--specials`
 
-    This option causes rsync to transfer special files such as named sockets
-    and fifos.
+    This option causes rsync to transfer special files, such as named sockets
+    and fifos.  If the receiving rsync is not being run as the super-user,
+    rsync silently skips creating the special files (see also the
+    [`--super`](#opt) and [`--fake-super`](#opt) options).
+
+    By default, rsync generates a "non-regular file" warning for each special
+    file encountered when this option is not set.  You can silence the warning
+    by specifying [`--info=nonreg0`](#opt).
 
 0.  `-D`
 
-    The `-D` option is equivalent to `--devices --specials`.
+    The `-D` option is equivalent to "[`--devices`](#opt)
+    [`--specials`](#opt)".
+
+0.  `--copy-devices`
+
+    This tells rsync to treat a device on the sending side as a regular file,
+    allowing it to be copied to a normal destination file (or another device
+    if `--write-devices` was also specifed).
+
+    This option is refused by default by an rsync daemon.
 
 0.  `--write-devices`
 
     This tells rsync to treat a device on the receiving side as a regular file,
     allowing the writing of file data into a device.
 
-    This option implies the `--inplace` option.
+    This option implies the [`--inplace`](#opt) option.
 
     Be careful using this, as you should know what devices are present on the
-    receiving side of the transfer, especially if running rsync as root.
+    receiving side of the transfer, especially when running rsync as root.
 
-    This option is refused by an rsync daemon.
+    This option is refused by default by an rsync daemon.
 
 0.  `--times`, `-t`
 
     This tells rsync to transfer modification times along with the files and
     update them on the remote system.  Note that if this option is not used,
     the optimization that excludes files that have not been modified cannot be
-    effective; in other words, a missing `-t` or `-a` will cause the next
-    transfer to behave as if it used `-I`, causing all files to be updated
-    (though rsync's delta-transfer algorithm will make the update fairly
-    efficient if the files haven't actually changed, you're much better off
-    using `-t`).
+    effective; in other words, a missing `-t` (or [`-a`](#opt)) will cause the
+    next transfer to behave as if it used [`--ignore-times`](#opt) (`-I`),
+    causing all files to be updated (though rsync's delta-transfer algorithm
+    will make the update fairly efficient if the files haven't actually
+    changed, you're much better off using `-t`).
 
 0.  `--atimes`, `-U`
 
     This tells rsync to set the access (use) times of the destination files to
     the same value as the source files.
 
-    If repeated, it also sets the `--open-noatime` option, which can help you
+    If repeated, it also sets the [`--open-noatime`](#opt) option, which can help you
     to make the sending and receiving systems have the same access times on the
     transferred files without needing to run rsync an extra time after a file
     is transferred.
 
     Note that some older rsync versions (prior to 3.2.0) may have been built
-    with a pre-release `--atimes` patch that does not imply `--open-noatime`
-    when this option is repeated.
+    with a pre-release `--atimes` patch that does not imply
+    [`--open-noatime`](#opt) when this option is repeated.
 
 0.  `--open-noatime`
 
@@ -1384,37 +1535,31 @@ your home directory (remove the '=' for that).
 
 0.  `--omit-dir-times`, `-O`
 
-    This tells rsync to omit directories when it is preserving modification
-    times (see `--times`).  If NFS is sharing the directories on the receiving
+    This tells rsync to omit directories when it is preserving modification,
+    access, and create times.  If NFS is sharing the directories on the receiving
     side, it is a good idea to use `-O`.  This option is inferred if you use
-    `--backup` without `--backup-dir`.
-
-    This option also has the side-effect of avoiding early creation of
-    directories in incremental recursion copies.  The default `--inc-recursive`
-    copying normally does an early-create pass of all the sub-directories in a
-    parent directory in order for it to be able to then set the modify time of
-    the parent directory right away (without having to delay that until a bunch
-    of recursive copying has finished).  This early-create idiom is not
-    necessary if directory modify times are not being preserved, so it is
-    skipped.  Since early-create directories don't have accurate mode, mtime,
-    or ownership, the use of this option can help when someone wants to avoid
-    these partially-finished directories.
+    [`--backup`](#opt) without [`--backup-dir`](#opt).
+
+    This option also has the side-effect of avoiding early creation of missing
+    sub-directories when incremental recursion is enabled, as discussed in the
+    [`--inc-recursive`](#opt) section.
 
 0.  `--omit-link-times`, `-J`
 
-    This tells rsync to omit symlinks when it is preserving modification times
-    (see `--times`).
+    This tells rsync to omit symlinks when it is preserving modification,
+    access, and create times.
 
 0.  `--super`
 
     This tells the receiving side to attempt super-user activities even if the
     receiving rsync wasn't run by the super-user.  These activities include:
-    preserving users via the `--owner` option, preserving all groups (not just
-    the current user's groups) via the `--groups` option, and copying devices
-    via the `--devices` option.  This is useful for systems that allow such
-    activities without being the super-user, and also for ensuring that you
-    will get errors if the receiving side isn't being run as the super-user.
-    To turn off super-user activities, the super-user can use `--no-super`.
+    preserving users via the [`--owner`](#opt) option, preserving all groups
+    (not just the current user's groups) via the [`--group`](#opt) option, and
+    copying devices via the [`--devices`](#opt) option.  This is useful for
+    systems that allow such activities without being the super-user, and also
+    for ensuring that you will get errors if the receiving side isn't being run
+    as the super-user.  To turn off super-user activities, the super-user can
+    use `--no-super`.
 
 0.  `--fake-super`
 
@@ -1427,15 +1572,15 @@ your home directory (remove the '=' for that).
     u-s,g-s,o-t for safety) or that would limit the owner's access (since the
     real super-user can always access/change a file, the files we create can
     always be accessed/changed by the creating user).  This option also handles
-    ACLs (if `--acls` was specified) and non-user extended attributes (if
-    `--xattrs` was specified).
+    ACLs (if [`--acls`](#opt) was specified) and non-user extended attributes
+    (if [`--xattrs`](#opt) was specified).
 
     This is a good way to backup data without using a super-user, and to store
     ACLs from incompatible systems.
 
     The `--fake-super` option only affects the side where the option is used.
     To affect the remote side of a remote-shell connection, use the
-    `--remote-option` (`-M`) option:
+    [`--remote-option`](#opt) (`-M`) option:
 
     >     rsync -av -M--fake-super /src/ host:/dest/
 
@@ -1444,21 +1589,22 @@ your home directory (remove the '=' for that).
     files, specify `-M--fake-super`.  If you wish a local copy to enable this
     option just for the source files, combine `--fake-super` with `-M--super`.
 
-    This option is overridden by both `--super` and `--no-super`.
+    This option is overridden by both [`--super`](#opt) and `--no-super`.
 
-    See also the "`fake super`" setting in the daemon's rsyncd.conf file.
+    See also the [`fake super`](rsyncd.conf.5#fake_super) setting in the
+    daemon's rsyncd.conf file.
 
 0.  `--sparse`, `-S`
 
     Try to handle sparse files efficiently so they take up less space on the
-    destination.  If combined with `--inplace` the file created might not end
-    up with sparse blocks with some combinations of kernel version and/or
-    filesystem type.  If `--whole-file` is in effect (e.g. for a local copy)
-    then it will always work because rsync truncates the file prior to writing
-    out the updated version.
+    destination.  If combined with [`--inplace`](#opt) the file created might
+    not end up with sparse blocks with some combinations of kernel version
+    and/or filesystem type.  If [`--whole-file`](#opt) is in effect (e.g. for a
+    local copy) then it will always work because rsync truncates the file prior
+    to writing out the updated version.
 
     Note that versions of rsync older than 3.1.3 will reject the combination of
-    `--sparse` and `--inplace`.
+    `--sparse` and [`--inplace`](#opt).
 
 0.  `--preallocate`
 
@@ -1473,26 +1619,26 @@ your home directory (remove the '=' for that).
     the destination is not an extent-supporting filesystem (such as ext4, xfs,
     NTFS, etc.), this option may have no positive effect at all.
 
-    If combined with `--sparse`, the file will only have sparse blocks (as
-    opposed to allocated sequences of null bytes) if the kernel version and
+    If combined with [`--sparse`](#opt), the file will only have sparse blocks
+    (as opposed to allocated sequences of null bytes) if the kernel version and
     filesystem type support creating holes in the allocated data.
 
 0.  `--dry-run`, `-n`
 
     This makes rsync perform a trial run that doesn't make any changes (and
     produces mostly the same output as a real run).  It is most commonly used
-    in combination with the `--verbose`, `-v` and/or `--itemize-changes`, `-i`
-    options to see what an rsync command is going to do before one actually
-    runs it.
-
-    The output of `--itemize-changes` is supposed to be exactly the same on a
-    dry run and a subsequent real run (barring intentional trickery and system
-    call failures); if it isn't, that's a bug.  Other output should be mostly
-    unchanged, but may differ in some areas.  Notably, a dry run does not send
-    the actual data for file transfers, so `--progress` has no effect, the
-    "bytes sent", "bytes received", "literal data", and "matched data"
-    statistics are too small, and the "speedup" value is equivalent to a run
-    where no file transfers were needed.
+    in combination with the [`--verbose`](#opt) (`-v`) and/or
+    [`--itemize-changes`](#opt) (`-i`) options to see what an rsync command is
+    going to do before one actually runs it.
+
+    The output of [`--itemize-changes`](#opt) is supposed to be exactly the
+    same on a dry run and a subsequent real run (barring intentional trickery
+    and system call failures); if it isn't, that's a bug.  Other output should
+    be mostly unchanged, but may differ in some areas.  Notably, a dry run does
+    not send the actual data for file transfers, so [`--progress`](#opt) has no
+    effect, the "bytes sent", "bytes received", "literal data", and "matched
+    data" statistics are too small, and the "speedup" value is equivalent to a
+    run where no file transfers were needed.
 
 0.  `--whole-file`, `-W`
 
@@ -1504,11 +1650,20 @@ your home directory (remove the '=' for that).
     source and destination are specified as local paths, but only if no
     batch-writing option is in effect.
 
+0. `--no-whole-file`, `--no-W`
+
+    Disable whole-file updating when it is enabled by default for a local
+    transfer.  This usually slows rsync down, but it can be useful if you are
+    trying to minimize the writes to the destination file (if combined with
+    [`--inplace`](#opt)) or for testing the checksum-based update algorithm.
+
+    See also the [`--whole-file`](#opt) option.
+
 0.  `--checksum-choice=STR`, `--cc=STR`
 
     This option overrides the checksum algorithms.  If one algorithm name is
     specified, it is used for both the transfer checksums and (assuming
-    `--checksum` is specified) the pre-transfer checksums.  If two
+    [`--checksum`](#opt) is specified) the pre-transfer checksums.  If two
     comma-separated names are supplied, the first name affects the transfer
     checksums, and the second name affects the pre-transfer checksums (`-c`).
 
@@ -1525,10 +1680,10 @@ your home directory (remove the '=' for that).
     Run `rsync --version` to see the default checksum list compiled into your
     version (which may differ from the list above).
 
-    If "none" is specified for the first (or only) name, the `--whole-file`
+    If "none" is specified for the first (or only) name, the [`--whole-file`](#opt)
     option is forced on and no checksum verification is performed on the
     transferred data.  If "none" is specified for the second (or only) name,
-    the `--checksum` option cannot be used.
+    the [`--checksum`](#opt) option cannot be used.
 
     The "auto" option is the default, where rsync bases its algorithm choice on
     a negotiation between the client and the server as follows:
@@ -1541,14 +1696,14 @@ your home directory (remove the '=' for that).
     and various flavors of MD4 based on protocol age).
 
     The default order can be customized by setting the environment variable
-    RSYNC_CHECKSUM_LIST to a space-separated list of acceptable checksum names.
-    If the string contains a "`&`" character, it is separated into the "client
-    string & server string", otherwise the same string
-    applies to both.  If the string (or string portion) contains no
-    non-whitespace characters, the default checksum list is used.  This method
-    does not allow you to specify the transfer checksum separately from the
-    pre-transfer checksum, and it discards "auto" and all unknown checksum
-    names.  A list with only invalid names results in a failed negotiation.
+    [`RSYNC_CHECKSUM_LIST`](#) to a space-separated list of acceptable checksum
+    names.  If the string contains a "`&`" character, it is separated into the
+    "client string & server string", otherwise the same string applies to both.
+    If the string (or string portion) contains no non-whitespace characters,
+    the default checksum list is used.  This method does not allow you to
+    specify the transfer checksum separately from the pre-transfer checksum,
+    and it discards "auto" and all unknown checksum names.  A list with only
+    invalid names results in a failed negotiation.
 
     The use of the `--checksum-choice` option overrides this environment list.
 
@@ -1566,17 +1721,17 @@ your home directory (remove the '=' for that).
     encounters (using the attributes of the mounted directory because those of
     the underlying mount-point directory are inaccessible).
 
-    If rsync has been told to collapse symlinks (via `--copy-links` or
-    `--copy-unsafe-links`), a symlink to a directory on another device is
-    treated like a mount-point.  Symlinks to non-directories are unaffected by
-    this option.
+    If rsync has been told to collapse symlinks (via [`--copy-links`](#opt) or
+    [`--copy-unsafe-links`](#opt)), a symlink to a directory on another device
+    is treated like a mount-point.  Symlinks to non-directories are unaffected
+    by this option.
 
-0.  `--existing`, `--ignore-non-existing`
+0.  `--ignore-non-existing`, `--existing`
 
     This tells rsync to skip creating files (including directories) that do not
     exist yet on the destination.  If this option is combined with the
-    `--ignore-existing` option, no files will be updated (which can be useful
-    if all you want to do is delete extraneous files).
+    [`--ignore-existing`](#opt) option, no files will be updated (which can be
+    useful if all you want to do is delete extraneous files).
 
     This option is a transfer rule, not an exclude, so it doesn't affect the
     data that goes into the file-lists, and thus it doesn't affect deletions.
@@ -1586,19 +1741,27 @@ your home directory (remove the '=' for that).
 
     This tells rsync to skip updating files that already exist on the
     destination (this does _not_ ignore existing directories, or nothing would
-    get done).  See also `--existing`.
+    get done).  See also [`--ignore-non-existing`](#opt).
 
     This option is a transfer rule, not an exclude, so it doesn't affect the
     data that goes into the file-lists, and thus it doesn't affect deletions.
     It just limits the files that the receiver requests to be transferred.
 
-    This option can be useful for those doing backups using the `--link-dest`
-    option when they need to continue a backup run that got interrupted.  Since
-    a `--link-dest` run is copied into a new directory hierarchy (when it is
-    used properly), using `--ignore-existing` will ensure that the
-    already-handled files don't get tweaked (which avoids a change in
-    permissions on the hard-linked files).  This does mean that this option is
-    only looking at the existing files in the destination hierarchy itself.
+    This option can be useful for those doing backups using the
+    [`--link-dest`](#opt) option when they need to continue a backup run that
+    got interrupted.  Since a [`--link-dest`](#opt) run is copied into a new
+    directory hierarchy (when it is used properly), using [`--ignore-existing`
+    will ensure that the already-handled files don't get tweaked (which avoids
+    a change in permissions on the hard-linked files).  This does mean that
+    this option is only looking at the existing files in the destination
+    hierarchy itself.
+
+    When [`--info=skip2`](#opt) is used rsync will output "FILENAME exists
+    (INFO)" messages where the INFO indicates one of "type change", "sum
+    change" (requires [`-c`](#opt)), "file change" (based on the quick check),
+    "attr change", or "uptodate".  Using [`--info=skip1`](#opt) (which is also
+    implied by 2 [`-v`](#opt) options) outputs the exists message without the
+    INFO suffix.
 
 0.  `--remove-source-files`
 
@@ -1614,8 +1777,8 @@ your home directory (remove the '=' for that).
     If you can't first write the files into a different directory, you should
     use a naming idiom that lets rsync avoid transferring files that are not
     yet finished (e.g. name the file "foo.new" when it is written, rename it to
-    "foo" when it is done, and then use the option `--exclude='*.new'` for the
-    rsync transfer).
+    "foo" when it is done, and then use the option [`--exclude='*.new'`](#opt)
+    for the rsync transfer).
 
     Starting with 3.1.0, rsync will skip the sender-side removal (and output an
     error) if the file's size or modify time has not stayed unchanged.
@@ -1629,70 +1792,71 @@ your home directory (remove the '=' for that).
     contents (e.g. "`dir/*`") since the wildcard is expanded by the shell and
     rsync thus gets a request to transfer individual files, not the files'
     parent directory.  Files that are excluded from the transfer are also
-    excluded from being deleted unless you use the `--delete-excluded` option
-    or mark the rules as only matching on the sending side (see the
-    include/exclude modifiers in the FILTER RULES section).
+    excluded from being deleted unless you use the [`--delete-excluded`](#opt)
+    option or mark the rules as only matching on the sending side (see the
+    include/exclude modifiers in the [FILTER RULES](#) section).
 
-    Prior to rsync 2.6.7, this option would have no effect unless `--recursive`
-    was enabled.  Beginning with 2.6.7, deletions will also occur when `--dirs`
-    (`-d`) is enabled, but only for directories whose contents are being
-    copied.
+    Prior to rsync 2.6.7, this option would have no effect unless
+    [`--recursive`](#opt) was enabled.  Beginning with 2.6.7, deletions will
+    also occur when [`--dirs`](#opt) (`-d`) is enabled, but only for
+    directories whose contents are being copied.
 
     This option can be dangerous if used incorrectly! It is a very good idea to
-    first try a run using the `--dry-run` option (`-n`) to see what files are
-    going to be deleted.
+    first try a run using the [`--dry-run`](#opt) (`-n`) option to see what
+    files are going to be deleted.
 
     If the sending side detects any I/O errors, then the deletion of any files
     at the destination will be automatically disabled.  This is to prevent
     temporary filesystem failures (such as NFS errors) on the sending side from
     causing a massive deletion of files on the destination.  You can override
-    this with the `--ignore-errors` option.
+    this with the [`--ignore-errors`](#opt) option.
 
     The `--delete` option may be combined with one of the --delete-WHEN options
-    without conflict, as well as `--delete-excluded`.  However, if none of the
-    `--delete-WHEN` options are specified, rsync will choose the
-    `--delete-during` algorithm when talking to rsync 3.0.0 or newer, and the
-    `--delete-before` algorithm when talking to an older rsync.  See also
-    `--delete-delay` and `--delete-after`.
+    without conflict, as well as [`--delete-excluded`](#opt).  However, if none
+    of the `--delete-WHEN` options are specified, rsync will choose the
+    [`--delete-during`](#opt) algorithm when talking to rsync 3.0.0 or newer,
+    or the [`--delete-before`](#opt) algorithm when talking to an older rsync.
+    See also [`--delete-delay`](#opt) and [`--delete-after`](#opt).
 
 0.  `--delete-before`
 
     Request that the file-deletions on the receiving side be done before the
-    transfer starts.  See `--delete` (which is implied) for more details on
-    file-deletion.
+    transfer starts.  See [`--delete`](#opt) (which is implied) for more
+    details on file-deletion.
 
     Deleting before the transfer is helpful if the filesystem is tight for
     space and removing extraneous files would help to make the transfer
     possible.  However, it does introduce a delay before the start of the
     transfer, and this delay might cause the transfer to timeout (if
-    `--timeout` was specified).  It also forces rsync to use the old,
+    [`--timeout`](#opt) was specified).  It also forces rsync to use the old,
     non-incremental recursion algorithm that requires rsync to scan all the
-    files in the transfer into memory at once (see `--recursive`).
+    files in the transfer into memory at once (see [`--recursive`](#opt)).
 
 0.  `--delete-during`, `--del`
 
     Request that the file-deletions on the receiving side be done incrementally
     as the transfer happens.  The per-directory delete scan is done right
     before each directory is checked for updates, so it behaves like a more
-    efficient `--delete-before`, including doing the deletions prior to any
-    per-directory filter files being updated.  This option was first added in
-    rsync version 2.6.4.  See `--delete` (which is implied) for more details on
-    file-deletion.
+    efficient [`--delete-before`](#opt), including doing the deletions prior to
+    any per-directory filter files being updated.  This option was first added
+    in rsync version 2.6.4.  See [`--delete`](#opt) (which is implied) for more
+    details on file-deletion.
 
 0.  `--delete-delay`
 
     Request that the file-deletions on the receiving side be computed during
-    the transfer (like `--delete-during`), and then removed after the transfer
-    completes.  This is useful when combined with `--delay-updates` and/or
-    `--fuzzy`, and is more efficient than using `--delete-after` (but can
-    behave differently, since `--delete-after` computes the deletions in a
-    separate pass after all updates are done).  If the number of removed files
-    overflows an internal buffer, a temporary file will be created on the
-    receiving side to hold the names (it is removed while open, so you
-    shouldn't see it during the transfer).  If the creation of the temporary
-    file fails, rsync will try to fall back to using `--delete-after` (which it
-    cannot do if `--recursive` is doing an incremental scan).  See `--delete`
-    (which is implied) for more details on file-deletion.
+    the transfer (like [`--delete-during`](#opt)), and then removed after the
+    transfer completes.  This is useful when combined with
+    [`--delay-updates`](#opt) and/or [`--fuzzy`](#opt), and is more efficient
+    than using [`--delete-after`](#opt) (but can behave differently, since
+    [`--delete-after`](#opt) computes the deletions in a separate pass after
+    all updates are done).  If the number of removed files overflows an
+    internal buffer, a temporary file will be created on the receiving side to
+    hold the names (it is removed while open, so you shouldn't see it during
+    the transfer).  If the creation of the temporary file fails, rsync will try
+    to fall back to using [`--delete-after`](#opt) (which it cannot do if
+    [`--recursive`](#opt) is doing an incremental scan).  See
+    [`--delete`](#opt) (which is implied) for more details on file-deletion.
 
 0.  `--delete-after`
 
@@ -1702,53 +1866,58 @@ your home directory (remove the '=' for that).
     exclusions to take effect for the delete phase of the current transfer.  It
     also forces rsync to use the old, non-incremental recursion algorithm that
     requires rsync to scan all the files in the transfer into memory at once
-    (see `--recursive`). See `--delete` (which is implied) for more details on
-    file-deletion.
+    (see [`--recursive`](#opt)). See [`--delete`](#opt) (which is implied) for
+    more details on file-deletion.
+
+    See also the [`--delete-delay`](#opt) option that might be a faster choice
+    for those that just want the deletions to occur at the end of the transfer.
 
 0.  `--delete-excluded`
 
     In addition to deleting the files on the receiving side that are not on the
     sending side, this tells rsync to also delete any files on the receiving
-    side that are excluded (see `--exclude`).  See the FILTER RULES section for
-    a way to make individual exclusions behave this way on the receiver, and
-    for a way to protect files from `--delete-excluded`.  See `--delete` (which
-    is implied) for more details on file-deletion.
+    side that are excluded (see [`--exclude`](#opt)).  See the [FILTER
+    RULES](#) section for a way to make individual exclusions behave this way
+    on the receiver, and for a way to protect files from `--delete-excluded`.
+    See [`--delete`](#opt) (which is implied) for more details on
+    file-deletion.
 
 0.  `--ignore-missing-args`
 
     When rsync is first processing the explicitly requested source files (e.g.
-    command-line arguments or `--files-from` entries), it is normally an error
-    if the file cannot be found.  This option suppresses that error, and does
-    not try to transfer the file.  This does not affect subsequent
+    command-line arguments or [`--files-from`](#opt) entries), it is normally
+    an error if the file cannot be found.  This option suppresses that error,
+    and does not try to transfer the file.  This does not affect subsequent
     vanished-file errors if a file was initially found to be present and later
     is no longer there.
 
 0.  `--delete-missing-args`
 
-    This option takes the behavior of (the implied) `--ignore-missing-args`
-    option a step farther: each missing arg will become a deletion request of
-    the corresponding destination file on the receiving side (should it exist).
-    If the destination file is a non-empty directory, it will only be
-    successfully deleted if `--force` or `--delete` are in effect.  Other than
-    that, this option is independent of any other type of delete processing.
+    This option takes the behavior of the (implied)
+    [`--ignore-missing-args`](#opt) option a step farther: each missing arg
+    will become a deletion request of the corresponding destination file on the
+    receiving side (should it exist).  If the destination file is a non-empty
+    directory, it will only be successfully deleted if [`--force`](#opt) or
+    [`--delete`](#opt) are in effect.  Other than that, this option is
+    independent of any other type of delete processing.
 
     The missing source files are represented by special file-list entries which
-    display as a "`*missing`" entry in the `--list-only` output.
+    display as a "`*missing`" entry in the [`--list-only`](#opt) output.
 
 0.  `--ignore-errors`
 
-    Tells `--delete` to go ahead and delete files even when there are I/O
-    errors.
+    Tells [`--delete`](#opt) to go ahead and delete files even when there are
+    I/O errors.
 
 0.  `--force`
 
     This option tells rsync to delete a non-empty directory when it is to be
     replaced by a non-directory.  This is only relevant if deletions are not
-    active (see `--delete` for details).
+    active (see [`--delete`](#opt) for details).
 
     Note for older rsync versions: `--force` used to still be required when
-    using `--delete-after`, and it used to be non-functional unless the
-    `--recursive` option was also enabled.
+    using [`--delete-after`](#opt), and it used to be non-functional unless the
+    [`--recursive`](#opt) option was also enabled.
 
 0.  `--max-delete=NUM`
 
@@ -1796,7 +1965,7 @@ your home directory (remove the '=' for that).
 
     This tells rsync to avoid transferring any file that is smaller than the
     specified SIZE, which can help in not transferring small, junk files.  See
-    the `--max-size` option for a description of SIZE and other information.
+    the [`--max-size`](#opt) option for a description of SIZE and other info.
 
     Note that rsync versions prior to 3.1.0 did not allow `--min-size=0`.
 
@@ -1813,16 +1982,17 @@ your home directory (remove the '=' for that).
     Keep in mind that this is not a limit on the total size of allocated
     memory.  It is a sanity-check value for each individual allocation.
 
-    See the `--max-size` option for a description of how SIZE can be specified.
-    The default suffix if none is given is bytes.
+    See the [`--max-size`](#opt) option for a description of how SIZE can be
+    specified.  The default suffix if none is given is bytes.
 
     Beginning in 3.2.3, a value of 0 specifies no limit.
 
-    You can set a default value using the environment variable RSYNC_MAX_ALLOC
-    using the same SIZE values as supported by this option.  If the remote
-    rsync doesn't understand the `--max-alloc` option, you can override an
-    environmental value by specifying `--max-alloc=1g`, which will make rsync
-    avoid sending the option to the remote side (because "1G" is the default).
+    You can set a default value using the environment variable
+    [`RSYNC_MAX_ALLOC`](#) using the same SIZE values as supported by this
+    option.  If the remote rsync doesn't understand the `--max-alloc` option,
+    you can override an environmental value by specifying `--max-alloc=1g`,
+    which will make rsync avoid sending the option to the remote side (because
+    "1G" is the default).
 
 0.  `--block-size=SIZE`, `-B`
 
@@ -1831,7 +2001,7 @@ your home directory (remove the '=' for that).
     updated.  See the technical report for details.
 
     Beginning in 3.2.3 the SIZE can be specified with a suffix as detailed in
-    the `--max-size` option.  Older versions only accepted a byte count.
+    the [`--max-size`](#opt) option.  Older versions only accepted a byte count.
 
 0.  `--rsh=COMMAND`, `-e`
 
@@ -1844,17 +2014,17 @@ your home directory (remove the '=' for that).
     shell _COMMAND_ will be used to run an rsync daemon on the remote host, and
     all data will be transmitted through that remote shell connection, rather
     than through a direct socket connection to a running rsync daemon on the
-    remote host.  See the section "USING RSYNC-DAEMON FEATURES VIA A
-    REMOTE-SHELL CONNECTION" above.
-
-    Beginning with rsync 3.2.0, the RSYNC_PORT environment variable will be set
-    when a daemon connection is being made via a remote-shell connection.  It
-    is set to 0 if the default daemon port is being assumed, or it is set to
-    the value of the rsync port that was specified via either the `--port`
-    option or a non-empty port value in an rsync:// URL.  This allows the
-    script to discern if a non-default port is being requested, allowing for
-    things such as an SSL or stunnel helper script to connect to a default or
-    alternate port.
+    remote host.  See the [USING RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL
+    CONNECTION](#) section above.
+
+    Beginning with rsync 3.2.0, the [`RSYNC_PORT`](#) environment variable will
+    be set when a daemon connection is being made via a remote-shell
+    connection.  It is set to 0 if the default daemon port is being assumed, or
+    it is set to the value of the rsync port that was specified via either the
+    [`--port`](#opt) option or a non-empty port value in an `rsync://` URL.
+    This allows the script to discern if a non-default port is being requested,
+    allowing for things such as an SSL or stunnel helper script to connect to a
+    default or alternate port.
 
     Command-line arguments are permitted in COMMAND provided that COMMAND is
     presented to rsync as a single argument.  You must use spaces (not tabs or
@@ -1871,10 +2041,11 @@ your home directory (remove the '=' for that).
     (Note that ssh users can alternately customize site-specific connect
     options in their .ssh/config file.)
 
-    You can also choose the remote shell program using the RSYNC_RSH
+    You can also choose the remote shell program using the [`RSYNC_RSH`](#)
     environment variable, which accepts the same range of values as `-e`.
 
-    See also the `--blocking-io` option which is affected by this option.
+    See also the [`--blocking-io`](#opt) option which is affected by this
+    option.
 
 0.  `--rsync-path=PROGRAM`
 
@@ -1886,7 +2057,7 @@ your home directory (remove the '=' for that).
     & standard-out that rsync is using to communicate.
 
     One tricky example is to set a different default directory on the remote
-    machine for use with the `--relative` option.  For instance:
+    machine for use with the [`--relative`](#opt) option.  For instance:
 
     >     rsync -avR --rsync-path="cd /a/b && rsync" host:c/d /e/
 
@@ -1894,8 +2065,8 @@ your home directory (remove the '=' for that).
 
     This option is used for more advanced situations where you want certain
     effects to be limited to one side of the transfer only.  For instance, if
-    you want to pass `--log-file=FILE` and `--fake-super` to the remote system,
-    specify it like this:
+    you want to pass [`--log-file=FILE`](#opt) and [`--fake-super`](#opt) to
+    the remote system, specify it like this:
 
     >     rsync -av -M --log-file=foo -M--fake-super src/ dest/
 
@@ -1909,11 +2080,10 @@ your home directory (remove the '=' for that).
     cause rsync to have a different idea about what data to expect next over
     the socket, and that will make it fail in a cryptic fashion.
 
-    Note that it is best to use a separate `--remote-option` for each option
-    you want to pass.  This makes your usage compatible with the
-    `--protect-args` option.  If that option is off, any spaces in your remote
-    options will be split by the remote shell unless you take steps to protect
-    them.
+    Note that you should use a separate `-M` option for each remote option you
+    want to pass.  On older rsync versions, the presence of any spaces in the
+    remote-option arg could cause it to be split into separate remote args, but
+    this requires the use of [`--old-args`](#opt) in a modern rsync.
 
     When performing a local transfer, the "local" side is the sender and the
     "remote" side is the receiver.
@@ -1931,7 +2101,8 @@ your home directory (remove the '=' for that).
     to CVS to determine if a file should be ignored.
 
     The exclude list is initialized to exclude the following items (these
-    initial items are marked as perishable -- see the FILTER RULES section):
+    initial items are marked as perishable -- see the [FILTER RULES](#)
+    section):
 
     [comment]: # (This list gets used for the default-cvsignore.h file.)
 
@@ -1981,17 +2152,17 @@ your home directory (remove the '=' for that).
     filter/exclude files, these patterns are split on whitespace.  See the
     **cvs**(1) manual for more information.
 
-    If you're combining `-C` with your own `--filter` rules, you should note
-    that these CVS excludes are appended at the end of your own rules,
+    If you're combining `-C` with your own [`--filter`](#opt) rules, you should
+    note that these CVS excludes are appended at the end of your own rules,
     regardless of where the `-C` was placed on the command-line.  This makes
     them a lower priority than any rules you specified explicitly.  If you want
     to control where these CVS excludes get inserted into your filter rules,
     you should omit the `-C` as a command-line option and use a combination of
-    `--filter=:C` and `--filter=-C` (either on your command-line or by putting
-    the ":C" and "-C" rules into a filter file with your other rules).  The
-    first option turns on the per-directory scanning for the .cvsignore file.
-    The second option does a one-time import of the CVS excludes mentioned
-    above.
+    [`--filter=:C`](#opt) and [`--filter=-C`](#opt) (either on your
+    command-line or by putting the ":C" and "-C" rules into a filter file with
+    your other rules).  The first option turns on the per-directory scanning
+    for the .cvsignore file.  The second option does a one-time import of the
+    CVS excludes mentioned above.
 
 0.  `--filter=RULE`, `-f`
 
@@ -2005,12 +2176,12 @@ your home directory (remove the '=' for that).
     argument.  The text below also mentions that you can use an underscore to
     replace the space that separates a rule from its arg.
 
-    See the FILTER RULES section for detailed information on this option.
+    See the [FILTER RULES](#) section for detailed information on this option.
 
 0.  `-F`
 
-    The `-F` option is a shorthand for adding two `--filter` rules to your
-    command.  The first time it is used is a shorthand for this rule:
+    The `-F` option is a shorthand for adding two [`--filter`](#opt) rules to
+    your command.  The first time it is used is a shorthand for this rule:
 
     >     --filter='dir-merge /.rsync-filter'
 
@@ -2023,38 +2194,42 @@ your home directory (remove the '=' for that).
 
     This filters out the .rsync-filter files themselves from the transfer.
 
-    See the FILTER RULES section for detailed information on how these options
-    work.
+    See the [FILTER RULES](#) section for detailed information on how these
+    options work.
 
 0.  `--exclude=PATTERN`
 
-    This option is a simplified form of the `--filter` option that defaults to
-    an exclude rule and does not allow the full rule-parsing syntax of normal
-    filter rules.
+    This option is a simplified form of the [`--filter`](#opt) option that
+    defaults to an exclude rule and does not allow the full rule-parsing syntax
+    of normal filter rules.
 
-    See the FILTER RULES section for detailed information on this option.
+    See the [FILTER RULES](#) section for detailed information on this option.
 
 0.  `--exclude-from=FILE`
 
-    This option is related to the `--exclude` option, but it specifies a FILE
-    that contains exclude patterns (one per line).  Blank lines in the file and
-    lines starting with '`;`' or '`#`' are ignored.  If _FILE_ is '`-`', the
-    list will be read from standard input.
+    This option is related to the [`--exclude`](#opt) option, but it specifies
+    a FILE that contains exclude patterns (one per line).  Blank lines in the
+    file are ignored, as are whole-line comments that start with '`;`' or '`#`'
+    (filename rules that contain those characters are unaffected).
+
+    If _FILE_ is '`-`', the list will be read from standard input.
 
 0.  `--include=PATTERN`
 
-    This option is a simplified form of the `--filter` option that defaults to
-    an include rule and does not allow the full rule-parsing syntax of normal
-    filter rules.
+    This option is a simplified form of the [`--filter`](#opt) option that
+    defaults to an include rule and does not allow the full rule-parsing syntax
+    of normal filter rules.
 
-    See the FILTER RULES section for detailed information on this option.
+    See the [FILTER RULES](#) section for detailed information on this option.
 
 0.  `--include-from=FILE`
 
-    This option is related to the `--include` option, but it specifies a FILE
-    that contains include patterns (one per line).  Blank lines in the file and
-    lines starting with '`;`' or '`#`' are ignored.  If _FILE_ is '`-`', the
-    list will be read from standard input.
+    This option is related to the [`--include`](#opt) option, but it specifies
+    a FILE that contains include patterns (one per line).  Blank lines in the
+    file are ignored, as are whole-line comments that start with '`;`' or '`#`'
+    (filename rules that contain those characters are unaffected).
+
+    If _FILE_ is '`-`', the list will be read from standard input.
 
 0.  `--files-from=FILE`
 
@@ -2063,17 +2238,17 @@ your home directory (remove the '=' for that).
     tweaks the default behavior of rsync to make transferring just the
     specified files and directories easier:
 
-    - The `--relative` (`-R`) option is implied, which preserves the path
-      information that is specified for each item in the file (use
+    - The [`--relative`](#opt) (`-R`) option is implied, which preserves the
+      path information that is specified for each item in the file (use
       `--no-relative` or `--no-R` if you want to turn that off).
-    - The `--dirs` (`-d`) option is implied, which will create directories
-      specified in the list on the destination rather than noisily skipping
-      them (use `--no-dirs` or `--no-d` if you want to turn that off).
-    - The `--archive` (`-a`) option's behavior does not imply `--recursive`
-      (`-r`), so specify it explicitly, if you want it.
+    - The [`--dirs`](#opt) (`-d`) option is implied, which will create
+      directories specified in the list on the destination rather than noisily
+      skipping them (use `--no-dirs` or `--no-d` if you want to turn that off).
+    - The [`--archive`](#opt) (`-a`) option's behavior does not imply
+      [`--recursive`](#opt) (`-r`), so specify it explicitly, if you want it.
     - These side-effects change the default state of rsync, so the position of
       the `--files-from` option on the command-line has no bearing on how other
-      options are parsed (e.g. `-a` works the same before or after
+      options are parsed (e.g. [`-a`](#opt) works the same before or after
       `--files-from`, as does `--no-R` and all other options).
 
     The filenames that are read from the FILE are all relative to the source
@@ -2086,13 +2261,13 @@ your home directory (remove the '=' for that).
     directory will be created as /backup/bin on the remote host.  If it
     contains "bin/" (note the trailing slash), the immediate contents of the
     directory would also be sent (without needing to be explicitly mentioned in
-    the file -- this began in version 2.6.4).  In both cases, if the `-r`
-    option was enabled, that dir's entire hierarchy would also be transferred
-    (keep in mind that `-r` needs to be specified explicitly with
-    `--files-from`, since it is not implied by `-a`).  Also note that the
-    effect of the (enabled by default) `--relative` option is to duplicate only
-    the path info that is read from the file -- it does not force the
-    duplication of the source-spec path (/usr in this case).
+    the file -- this began in version 2.6.4).  In both cases, if the
+    [`-r`](#opt) option was enabled, that dir's entire hierarchy would also be
+    transferred (keep in mind that [`-r`](#opt) needs to be specified
+    explicitly with `--files-from`, since it is not implied by [`-a`](#opt).
+    Also note that the effect of the (enabled by default) [`-r`](#opt) option
+    is to duplicate only the path info that is read from the file -- it does
+    not force the duplication of the source-spec path (/usr in this case).
 
     In addition, the `--files-from` file can be read from the remote host
     instead of the local host if you specify a "host:" in front of the file
@@ -2105,9 +2280,9 @@ your home directory (remove the '=' for that).
     This would copy all the files specified in the /path/file-list file that
     was located on the remote "src" host.
 
-    If the `--iconv` and `--protect-args` options are specified and the
-    `--files-from` filenames are being sent from one host to another, the
-    filenames will be translated from the sending host's charset to the
+    If the [`--iconv`](#opt) and [`--protect-args`](#opt) options are specified
+    and the `--files-from` filenames are being sent from one host to another,
+    the filenames will be translated from the sending host's charset to the
     receiving host's charset.
 
     NOTE: sorting the list of files in the `--files-from` input helps rsync to
@@ -2121,40 +2296,65 @@ your home directory (remove the '=' for that).
 
     This tells rsync that the rules/filenames it reads from a file are
     terminated by a null ('\\0') character, not a NL, CR, or CR+LF.  This
-    affects `--exclude-from`, `--include-from`, `--files-from`, and any merged
-    files specified in a `--filter` rule.  It does not affect `--cvs-exclude`
-    (since all names read from a .cvsignore file are split on whitespace).
+    affects [`--exclude-from`](#opt), [`--include-from`](#opt),
+    [`--files-from`](#opt), and any merged files specified in a
+    [`--filter`](#opt) rule.  It does not affect [`--cvs-exclude`](#opt) (since
+    all names read from a .cvsignore file are split on whitespace).
+
+0. `--old-args`
+
+    This option tells rsync to stop trying to protect the arg values on the
+    remote side from unintended word-splitting or other misinterpretation.
+
+    The default in a modern rsync is for "shell-active" characters (including
+    spaces) to be backslash-escaped in the args that are sent to the remote
+    shell.  The wildcard characters `*`, `?`, `[`, & `]` are not escaped in
+    filename args (allowing them to expand into multiple filenames) while being
+    protected in option args, such as [`--usermap`](#opt).
+
+    If you have a script that wants to use old-style arg splitting in its
+    filenames, specify this option once.  If the remote shell has a problem
+    with any backslash escapes at all, specify this option twice.
+
+    You may also control this setting via the [`RSYNC_OLD_ARGS`](#) environment
+    variable.  If it has the value "1", rsync will default to a single-option
+    setting.  If it has the value "2" (or more), rsync will default to a
+    repeated-option setting.  If it is "0", you'll get the default escaping
+    behavior.  The environment is always overridden by manually specified
+    positive or negative options (the negative is `--no-old-args`).
+
+    This option conflicts with the [`--protect-args`](#opt) option.
 
 0.  `--protect-args`, `-s`
 
     This option sends all filenames and most options to the remote rsync
-    without allowing the remote shell to interpret them.  This means that
-    spaces are not split in names, and any non-wildcard special characters are
-    not translated (such as `~`, `$`, `;`, `&`, etc.).  Wildcards are expanded
-    on the remote host by rsync (instead of the shell doing it).
-
-    If you use this option with `--iconv`, the args related to the remote side
-    will also be translated from the local to the remote character-set.  The
-    translation happens before wild-cards are expanded.  See also the
-    `--files-from` option.
-
-    You may also control this option via the RSYNC_PROTECT_ARGS environment
-    variable.  If this variable has a non-zero value, this option will be
+    without allowing the remote shell to interpret them.  Wildcards are
+    expanded on the remote host by rsync instead of the shell doing it.
+
+    This is similar to the new-style backslash-escaping of args that was added
+    in 3.2.4, but supports some extra features and doesn't rely on backslash
+    escaping in the remote shell.
+
+    If you use this option with [`--iconv`](#opt), the args related to the
+    remote side will also be translated from the local to the remote
+    character-set.  The translation happens before wild-cards are expanded.
+    See also the [`--files-from`](#opt) option.
+
+    You may also control this setting via the [`RSYNC_PROTECT_ARGS`](#)
+    environment variable.  If it has a non-zero value, this setting will be
     enabled by default, otherwise it will be disabled by default.  Either state
     is overridden by a manually specified positive or negative version of this
     option (note that `--no-s` and `--no-protect-args` are the negative
-    versions).  Since this option was first introduced in 3.0.0, you'll need to
-    make sure it's disabled if you ever need to interact with a remote rsync
-    that is older than that.
+    versions).  This environment variable is also superseded by a non-zero
+    [`RSYNC_OLD_ARGS`](#) export.
+
+    You may need to disable this option when interacting with an older rsync
+    (one prior to 3.0.0).
 
-    Rsync can also be configured (at build time) to have this option enabled by
-    default (with is overridden by both the environment and the command-line).
-    Run `rsync --version` to check if this is the case, as it will display
-    "default protect-args" or "optional protect-args" depending on how it was
-    compiled.
+    This option conflicts with the [`--old-args`](#opt) option.
 
-    This option will eventually become a new default setting at some
-    as-yet-undetermined point in the future.
+    Note that this option is incompatible with the use of the restricted rsync
+    script (`rrsync`) since it hides options from the script's inspection.
 
 0.  `--copy-as=USER[:GROUP]`
 
@@ -2172,14 +2372,14 @@ your home directory (remove the '=' for that).
     operation after the remote-shell or daemon connection is established.
 
     The option only affects one side of the transfer unless the transfer is
-    local, in which case it affects both sides.  Use the `--remote-option` to
-    affect the remote side, such as `-M--copy-as=joe`.  For a local transfer,
-    the lsh (or lsh.sh) support file provides a local-shell helper script that
-    can be used to allow a "localhost:" or "lh:" host-spec to be specified
-    without needing to setup any remote shells, allowing you to specify remote
-    options that affect the side of the transfer that is using the host-spec
-    (and using hostname "lh" avoids the overriding of the remote directory to
-    the user's home dir).
+    local, in which case it affects both sides.  Use the
+    [`--remote-option`](#opt) to affect the remote side, such as
+    `-M--copy-as=joe`.  For a local transfer, the lsh (or lsh.sh) support file
+    provides a local-shell helper script that can be used to allow a
+    "localhost:" or "lh:" host-spec to be specified without needing to setup
+    any remote shells, allowing you to specify remote options that affect the
+    side of the transfer that is using the host-spec (and using hostname "lh"
+    avoids the overriding of the remote directory to the user's home dir).
 
     For example, the following rsync writes the local files as user "joe":
 
@@ -2219,17 +2419,17 @@ your home directory (remove the '=' for that).
     new version on the disk at the same time.
 
     If you are using this option for reasons other than a shortage of disk
-    space, you may wish to combine it with the `--delay-updates` option, which
-    will ensure that all copied files get put into subdirectories in the
-    destination hierarchy, awaiting the end of the transfer.  If you don't have
-    enough room to duplicate all the arriving files on the destination
-    partition, another way to tell rsync that you aren't overly concerned about
-    disk space is to use the `--partial-dir` option with a relative path;
-    because this tells rsync that it is OK to stash off a copy of a single file
-    in a subdir in the destination hierarchy, rsync will use the partial-dir as
-    a staging area to bring over the copied file, and then rename it into place
-    from there. (Specifying a `--partial-dir` with an absolute path does not
-    have this side-effect.)
+    space, you may wish to combine it with the [`--delay-updates`](#opt)
+    option, which will ensure that all copied files get put into subdirectories
+    in the destination hierarchy, awaiting the end of the transfer.  If you
+    don't have enough room to duplicate all the arriving files on the
+    destination partition, another way to tell rsync that you aren't overly
+    concerned about disk space is to use the [`--partial-dir`](#opt) option
+    with a relative path; because this tells rsync that it is OK to stash off a
+    copy of a single file in a subdir in the destination hierarchy, rsync will
+    use the partial-dir as a staging area to bring over the copied file, and
+    then rename it into place from there. (Specifying a [`--partial-dir`](#opt)
+    with an absolute path does not have this side-effect.)
 
 0.  `--fuzzy`, `-y`
 
@@ -2240,12 +2440,12 @@ your home directory (remove the '=' for that).
     the fuzzy basis file to try to speed up the transfer.
 
     If the option is repeated, the fuzzy scan will also be done in any matching
-    alternate destination directories that are specified via `--compare-dest`,
-    `--copy-dest`, or `--link-dest`.
+    alternate destination directories that are specified via
+    [`--compare-dest`](#opt), [`--copy-dest`](#opt), or [`--link-dest`](#opt).
 
-    Note that the use of the `--delete` option might get rid of any potential
-    fuzzy-match files, so either use `--delete-after` or specify some filename
-    exclusions if you need to prevent this.
+    Note that the use of the [`--delete`](#opt) option might get rid of any
+    potential fuzzy-match files, so either use [`--delete-after`](#opt) or
+    specify some filename exclusions if you need to prevent this.
 
 0.  `--compare-dest=DIR`
 
@@ -2266,7 +2466,7 @@ your home directory (remove the '=' for that).
     transfer.
 
     If _DIR_ is a relative path, it is relative to the destination directory.
-    See also `--copy-dest` and `--link-dest`.
+    See also [`--copy-dest`](#opt) and [`--link-dest`](#opt).
 
     NOTE: beginning with version 3.1.0, rsync will remove a file from a
     non-empty destination hierarchy if an exact match is found in one of the
@@ -2275,7 +2475,7 @@ your home directory (remove the '=' for that).
 
 0.  `--copy-dest=DIR`
 
-    This option behaves like `--compare-dest`, but rsync will also copy
+    This option behaves like [`--compare-dest`](#opt), but rsync will also copy
     unchanged files found in _DIR_ to the destination directory using a local
     copy.  This is useful for doing transfers to a new destination while
     leaving existing files intact, and then doing a flash-cutover when all
@@ -2287,18 +2487,18 @@ your home directory (remove the '=' for that).
     try to speed up the transfer.
 
     If _DIR_ is a relative path, it is relative to the destination directory.
-    See also `--compare-dest` and `--link-dest`.
+    See also [`--compare-dest`](#opt) and [`--link-dest`](#opt).
 
 0.  `--link-dest=DIR`
 
-    This option behaves like `--copy-dest`, but unchanged files are hard linked
-    from _DIR_ to the destination directory.  The files must be identical in
-    all preserved attributes (e.g. permissions, possibly ownership) in order
-    for the files to be linked together.  An example:
+    This option behaves like [`--copy-dest`](#opt), but unchanged files are
+    hard linked from _DIR_ to the destination directory.  The files must be
+    identical in all preserved attributes (e.g. permissions, possibly
+    ownership) in order for the files to be linked together.  An example:
 
     >     rsync -av --link-dest=$PWD/prior_dir host:src_dir/ new_dir/
 
-    If file's aren't linking, double-check their attributes.  Also check if
+    If files aren't linking, double-check their attributes.  Also check if
     some attributes are getting forced outside of rsync's control, such a mount
     option that squishes root to a single user, or mounts a removable drive
     with generic ownership (such as OS X's "Ignore ownership on this volume"
@@ -2318,18 +2518,19 @@ your home directory (remove the '=' for that).
     alternate-directory exact match would never be found (nor linked into the
     destination) when a destination file already exists.
 
-    Note that if you combine this option with `--ignore-times`, rsync will not
+    Note that if you combine this option with [`--ignore-times`](#opt), rsync will not
     link any files together because it only links identical files together as a
     substitute for transferring the file, never as an additional check after
     the file is updated.
 
     If _DIR_ is a relative path, it is relative to the destination directory.
-    See also `--compare-dest` and `--copy-dest`.
+    See also [`--compare-dest`](#opt) and [`--copy-dest`](#opt).
 
     Note that rsync versions prior to 2.6.1 had a bug that could prevent
-    `--link-dest` from working properly for a non-super-user when `-o` was
-    specified (or implied by `-a`).  You can work-around this bug by avoiding
-    the `-o` option when sending to an old rsync.
+    `--link-dest` from working properly for a non-super-user when
+    [`--owner`](#opt) (`-o`) was specified (or implied).  You can work-around
+    this bug by avoiding the `-o` option (or using `--no-o`) when sending to an
+    old rsync.
 
 0.  `--compress`, `-z`
 
@@ -2338,7 +2539,8 @@ your home directory (remove the '=' for that).
     something that is useful over a slow connection.
 
     Rsync supports multiple compression methods and will choose one for you
-    unless you force the choice using the `--compress-choice` (`--zc`) option.
+    unless you force the choice using the [`--compress-choice`](#opt) (`--zc`)
+    option.
 
     Run `rsync --version` to see the default compress list compiled into your
     version.
@@ -2350,10 +2552,10 @@ your home directory (remove the '=' for that).
     its list is assumed to be "zlib".
 
     The default order can be customized by setting the environment variable
-    RSYNC_COMPRESS_LIST to a space-separated list of acceptable compression
-    names.  If the string contains a "`&`" character, it is separated into the
-    "client string & server string", otherwise the same string applies to both.
-    If the string (or string portion) contains no
+    [`RSYNC_COMPRESS_LIST`](#) to a space-separated list of acceptable
+    compression names.  If the string contains a "`&`" character, it is
+    separated into the "client string & server string", otherwise the same
+    string applies to both.  If the string (or string portion) contains no
     non-whitespace characters, the default compress list is used.  Any unknown
     compression names are discarded from the list, but a list with only invalid
     names results in a failed negotiation.
@@ -2364,15 +2566,12 @@ your home directory (remove the '=' for that).
     ignore this weirdness unless the rsync server complains and tells you to
     specify `-zz`.
 
-    See also the `--skip-compress` option for the default list of file suffixes
-    that will be transferred with no (or minimal) compression.
-
 0.  `--compress-choice=STR`, `--zc=STR`
 
     This option can be used to override the automatic negotiation of the
-    compression algorithm that occurs when `--compress` is used.  The option
-    implies `--compress` unless "none" was specified, which instead implies
-    `--no-compress`.
+    compression algorithm that occurs when [`--compress`](#opt) is used.  The
+    option implies [`--compress`](#opt) unless "none" was specified, which
+    instead implies `--no-compress`.
 
     The compression options that you may be able to use are:
 
@@ -2397,22 +2596,23 @@ your home directory (remove the '=' for that).
 
 0.  `--compress-level=NUM`, `--zl=NUM`
 
-    Explicitly set the compression level to use (see `--compress`, `-z`)
-    instead of letting it default.  The `--compress` option is implied as long
-    as the level chosen is not a "don't compress" level for the compression
-    algorithm that is in effect (e.g. zlib compression treats level 0 as
-    "off").
+    Explicitly set the compression level to use (see [`--compress`](#opt),
+    `-z`) instead of letting it default.  The [`--compress`](#opt) option is
+    implied as long as the level chosen is not a "don't compress" level for the
+    compression algorithm that is in effect (e.g. zlib compression treats level
+    0 as "off").
 
     The level values vary depending on the checksum in effect.  Because rsync
     will negotiate a checksum choice by default (when the remote rsync is new
-    enough), it can be good to combine this option with a `--compress-choice`
-    (`--zc`) option unless you're sure of the choice in effect.  For example:
+    enough), it can be good to combine this option with a
+    [`--compress-choice`](#opt) (`--zc`) option unless you're sure of the
+    choice in effect.  For example:
 
     >     rsync -aiv --zc=zstd --zl=22 host:src/ dest/
 
     For zlib & zlibx compression the valid values are from 1 to 9 with 6 being
-    the default.  Specifying 0 turns compression off, and specifying -1 chooses
-    the default of 6.
+    the default.  Specifying `--zl=0` turns compression off, and specifying
+    `--zl=-1` chooses the default level of 6.
 
     For zstd compression the valid values are from -131072 to 22 with 3 being
     the default. Specifying 0 chooses the default of 3.
@@ -2425,20 +2625,21 @@ your home directory (remove the '=' for that).
     compression level no matter what algorithm was chosen.
 
     If you want to know the compression level that is in effect, specify
-    `--debug=nstr` to see the "negotiated string" results.  This will report
-    something like "`Client compress: zstd (level 3)`" (along with the checksum
-    choice in effect).
+    [`--debug=nstr`](#opt) to see the "negotiated string" results.  This will
+    report something like "`Client compress: zstd (level 3)`" (along with the
+    checksum choice in effect).
 
 0.  `--skip-compress=LIST`
 
+    **NOTE:** no compression method currently supports per-file compression
+    changes, so this option has no effect.
+
     Override the list of file suffixes that will be compressed as little as
     possible.  Rsync sets the compression level on a per-file basis based on
-    the file's suffix.  If the compression algorithm has an "off" level (such
-    as zlib/zlibx) then no compression occurs for those files.  Other
-    algorithms that support changing the streaming level on-the-fly will have
-    the level minimized to reduces the CPU usage as much as possible for a
-    matching file.  At this time, only zlib & zlibx compression support this
-    changing of levels on a per-file basis.
+    the file's suffix.  If the compression algorithm has an "off" level, then
+    no compression occurs for those files.  Other algorithms that support
+    changing the streaming level on-the-fly will have the level minimized to
+    reduces the CPU usage as much as possible for a matching file.
 
     The **LIST** should be one or more file suffixes (without the dot) separated
     by slashes (`/`).  You may specify an empty string to indicate that no files
@@ -2574,10 +2775,10 @@ your home directory (remove the '=' for that).
 
     If a user or group has no name on the source system or it has no match on
     the destination system, then the numeric ID from the source system is used
-    instead.  See also the comments on the "`use chroot`" setting in the
-    rsyncd.conf manpage for information on how the chroot setting affects
-    rsync's ability to look up the names of the users and groups and what you
-    can do about it.
+    instead.  See also the [`use chroot`](rsyncd.conf.5#use_chroot) setting
+    in the rsyncd.conf manpage for some comments on how the chroot setting
+    affects rsync's ability to look up the names of the users and groups and
+    what you can do about it.
 
 0.  `--usermap=STRING`, `--groupmap=STRING`
 
@@ -2610,31 +2811,41 @@ your home directory (remove the '=' for that).
 
     >     --usermap=:nobody --groupmap=*:nobody
 
-    When the `--numeric-ids` option is used, the sender does not send any
+    When the [`--numeric-ids`](#opt) option is used, the sender does not send any
     names, so all the IDs are treated as having an empty name.  This means that
     you will need to specify numeric **FROM** values if you want to map these
     nameless IDs to different values.
 
-    For the `--usermap` option to have any effect, the `-o` (`--owner`) option
-    must be used (or implied), and the receiver will need to be running as a
-    super-user (see also the `--fake-super` option).  For the `--groupmap`
-    option to have any effect, the `-g` (`--groups`) option must be used (or
-    implied), and the receiver will need to have permissions to set that group.
+    For the `--usermap` option to work, the receiver will need to be running as
+    a super-user (see also the [`--super`](#opt) and [`--fake-super`](#opt)
+    options).  For the `--groupmap` option to work, the receiver will need to
+    have permissions to set that group.
 
-    If your shell complains about the wildcards, use `--protect-args` (`-s`).
+    Starting with rsync 3.2.4, the `--usermap` option implies the
+    [`--owner`](#opt) (`-o`) option while the `--groupmap` option implies the
+    [`--group`](#opt) (`-g`) option (since rsync needs to have those options
+    enabled for the mapping options to work).
+
+    An older rsync client may need to use [`--protect-args`](#opt) (`-s`) to
+    avoid a complaint about wildcard characters, but a modern rsync handles
+    this automatically.
 
 0.  `--chown=USER:GROUP`
 
     This option forces all files to be owned by USER with group GROUP.  This is
-    a simpler interface than using `--usermap` and `--groupmap` directly, but
-    it is implemented using those options internally, so you cannot mix them.
-    If either the USER or GROUP is empty, no mapping for the omitted user/group
-    will occur.  If GROUP is empty, the trailing colon may be omitted, but if
-    USER is empty, a leading colon must be supplied.
+    a simpler interface than using [`--usermap`](#opt) & [`--groupmap`](#opt)
+    directly, but it is implemented using those options internally so they
+    cannot be mixed.  If either the USER or GROUP is empty, no mapping for the
+    omitted user/group will occur.  If GROUP is empty, the trailing colon may
+    be omitted, but if USER is empty, a leading colon must be supplied.
 
     If you specify "`--chown=foo:bar`", this is exactly the same as specifying
-    "`--usermap=*:foo --groupmap=*:bar`", only easier.  If your shell complains
-    about the wildcards, use `--protect-args` (`-s`).
+    "`--usermap=*:foo --groupmap=*:bar`", only easier (and with the same
+    implied [`--owner`](#opt) and/or [`--group`](#opt) options).
+
+    An older rsync client may need to use [`--protect-args`](#opt) (`-s`) to
+    avoid a complaint about wildcard characters, but a modern rsync handles
+    this automatically.
 
 0.  `--timeout=SECONDS`
 
@@ -2652,27 +2863,29 @@ your home directory (remove the '=' for that).
 
     By default rsync will bind to the wildcard address when connecting to an
     rsync daemon.  The `--address` option allows you to specify a specific IP
-    address (or hostname) to bind to.  See also this option in the `--daemon`
-    mode section.
+    address (or hostname) to bind to.
+
+    See also [the daemon version of the `--address` option](#dopt--address).
 
 0.  `--port=PORT`
 
     This specifies an alternate TCP port number to use rather than the default
     of 873.  This is only needed if you are using the double-colon (::) syntax
     to connect with an rsync daemon (since the URL syntax has a way to specify
-    the port as a part of the URL).  See also this option in the `--daemon`
-    mode section.
+    the port as a part of the URL).
+
+    See also [the daemon version of the `--port` option](#dopt--port).
 
 0.  `--sockopts=OPTIONS`
 
     This option can provide endless fun for people who like to tune their
     systems to the utmost degree.  You can set all sorts of socket options
-    which may make transfers faster (or slower!).  Read the man page for the
+    which may make transfers faster (or slower!).  Read the manpage for the
     `setsockopt()` system call for details on some of the options you may be
     able to set.  By default no special socket options are set.  This only
     affects direct socket connections to a remote rsync daemon.
 
-    This option also exists in the `--daemon` mode section.
+    See also [the daemon version of the `--sockopts` option](#dopt--sockopts).
 
 0.  `--blocking-io`
 
@@ -2694,10 +2907,10 @@ your home directory (remove the '=' for that).
 
     Requests a simple itemized list of the changes that are being made to each
     file, including attribute changes.  This is exactly the same as specifying
-    `--out-format='%i %n%L'`.  If you repeat the option, unchanged files will
-    also be output, but only if the receiving rsync is at least version 2.6.7
-    (you can use `-vv` with older versions of rsync, but that also turns on the
-    output of other verbose messages).
+    [`--out-format='%i %n%L'`](#opt).  If you repeat the option, unchanged
+    files will also be output, but only if the receiving rsync is at least
+    version 2.6.7 (you can use `-vv` with older versions of rsync, but that
+    also turns on the output of other verbose messages).
 
     The "%i" escape has a cryptic output that is 11 letters long.  The general
     format is like the string `YXcstpoguax`, where **Y** is replaced by the type
@@ -2712,7 +2925,7 @@ your home directory (remove the '=' for that).
     - A `c` means that a local change/creation is occurring for the item (such
       as the creation of a directory or the changing of a symlink, etc.).
     - A `h` means that the item is a hard link to another item (requires
-      `--hard-links`).
+      [`--hard-links`](#opt)).
     - A `.` means that the item is not being updated (though it might have
       attributes that are being modified).
     - A `*` means that the rest of the itemized-output area contains a message
@@ -2734,30 +2947,32 @@ your home directory (remove the '=' for that).
     The attribute that is associated with each letter is as follows:
 
     - A `c` means either that a regular file has a different checksum (requires
-      `--checksum`) or that a symlink, device, or special file has a changed
-      value.  Note that if you are sending files to an rsync prior to 3.0.1,
-      this change flag will be present only for checksum-differing regular
-      files.
+      [`--checksum`](#opt)) or that a symlink, device, or special file has a
+      changed value.  Note that if you are sending files to an rsync prior to
+      3.0.1, this change flag will be present only for checksum-differing
+      regular files.
     - A `s` means the size of a regular file is different and will be updated
       by the file transfer.
     - A `t` means the modification time is different and is being updated to
-      the sender's value (requires `--times`).  An alternate value of `T` means
-      that the modification time will be set to the transfer time, which
-      happens when a file/symlink/device is updated without `--times` and when
-      a symlink is changed and the receiver can't set its time. (Note: when
-      using an rsync 3.0.0 client, you might see the `s` flag combined with `t`
-      instead of the proper `T` flag for this time-setting failure.)
+      the sender's value (requires [`--times`](#opt)).  An alternate value of
+      `T` means that the modification time will be set to the transfer time,
+      which happens when a file/symlink/device is updated without
+      [`--times`](#opt) and when a symlink is changed and the receiver can't
+      set its time. (Note: when using an rsync 3.0.0 client, you might see the
+      `s` flag combined with `t` instead of the proper `T` flag for this
+      time-setting failure.)
     - A `p` means the permissions are different and are being updated to the
-      sender's value (requires `--perms`).
+      sender's value (requires [`--perms`](#opt)).
     - An `o` means the owner is different and is being updated to the sender's
-      value (requires `--owner` and super-user privileges).
+      value (requires [`--owner`](#opt) and super-user privileges).
     - A `g` means the group is different and is being updated to the sender's
-      value (requires `--group` and the authority to set the group).
-    - A `u`|`n`|`b` indicates the following information: `u`  means the access
-      (use) time is different and is being updated to the sender's value
-      (requires `--atimes`); `n` means the create time (newness) is different
-      and is being updated to the sender's value (requires `--crtimes`); `b`
-      means that both the access and create times are being updated.
+      value (requires [`--group`](#opt) and the authority to set the group).
+    - A `u`|`n`|`b` indicates the following information:
+      - `u`  means the access (use) time is different and is being updated to
+	the sender's value (requires [`--atimes`](#opt))
+      - `n` means the create time (newness) is different and is being updated
+	to the sender's value (requires [`--crtimes`](#opt))
+      - `b` means that both the access and create times are being updated
     - The `a` means that the ACL information is being changed.
     - The `x` means that the extended attribute information is being changed.
 
@@ -2771,26 +2986,27 @@ your home directory (remove the '=' for that).
     This allows you to specify exactly what the rsync client outputs to the
     user on a per-update basis.  The format is a text string containing
     embedded single-character escape sequences prefixed with a percent (%)
-    character.  A default format of "%n%L" is assumed if either `--info=name`
-    or `-v` is specified (this tells you just the name of the file and, if the
-    item is a link, where it points).  For a full list of the possible escape
-    characters, see the "`log format`" setting in the rsyncd.conf manpage.
-
-    Specifying the `--out-format` option implies the `--info=name` option,
-    which will mention each file, dir, etc. that gets updated in a significant
-    way (a transferred file, a recreated symlink/device, or a touched
-    directory).  In addition, if the itemize-changes escape (%i) is included in
-    the string (e.g. if the `--itemize-changes` option was used), the logging
-    of names increases to mention any item that is changed in any way (as long
-    as the receiving side is at least 2.6.4).  See the `--itemize-changes`
-    option for a description of the output of "%i".
+    character.  A default format of "%n%L" is assumed if either
+    [`--info=name`](#opt) or [`-v`](#opt) is specified (this tells you just the
+    name of the file and, if the item is a link, where it points).  For a full
+    list of the possible escape characters, see the [`log
+    format`](rsyncd.conf.5#log_format) setting in the rsyncd.conf manpage.
+
+    Specifying the `--out-format` option implies the [`--info=name`](#opt)
+    option, which will mention each file, dir, etc. that gets updated in a
+    significant way (a transferred file, a recreated symlink/device, or a
+    touched directory).  In addition, if the itemize-changes escape (%i) is
+    included in the string (e.g. if the [`--itemize-changes`](#opt) option was
+    used), the logging of names increases to mention any item that is changed
+    in any way (as long as the receiving side is at least 2.6.4).  See the
+    [`--itemize-changes`](#opt) option for a description of the output of "%i".
 
     Rsync will output the out-format string prior to a file's transfer unless
     one of the transfer-statistic escapes is requested, in which case the
     logging is done at the end of the file's transfer.  When this late logging
-    is in effect and `--progress` is also specified, rsync will also output the
-    name of the file being transferred prior to its progress information
-    (followed, of course, by the out-format output).
+    is in effect and [`--progress`](#opt) is also specified, rsync will also
+    output the name of the file being transferred prior to its progress
+    information (followed, of course, by the out-format output).
 
 0.  `--log-file=FILE`
 
@@ -2798,8 +3014,8 @@ your home directory (remove the '=' for that).
     similar to the logging that a daemon does, but can be requested for the
     client side and/or the server side of a non-daemon transfer.  If specified
     as a client option, transfer logging will be enabled with a default format
-    of "%i %n%L".  See the `--log-file-format` option if you wish to override
-    this.
+    of "%i %n%L".  See the [`--log-file-format`](#opt) option if you wish to
+    override this.
 
     Here's a example command that requests the remote side to log what is
     happening:
@@ -2809,24 +3025,30 @@ your home directory (remove the '=' for that).
     This is very useful if you need to debug why a connection is closing
     unexpectedly.
 
+    See also [the daemon version of the `--log-file` option](#dopt--log-file).
+
 0.  `--log-file-format=FORMAT`
 
     This allows you to specify exactly what per-update logging is put into the
-    file specified by the `--log-file` option (which must also be specified for
-    this option to have any effect).  If you specify an empty string, updated
-    files will not be mentioned in the log file.  For a list of the possible
-    escape characters, see the "`log format`" setting in the rsyncd.conf manpage.
+    file specified by the [`--log-file`](#opt) option (which must also be
+    specified for this option to have any effect).  If you specify an empty
+    string, updated files will not be mentioned in the log file.  For a list of
+    the possible escape characters, see the [`log format`](rsyncd.conf.5#log_format)
+    setting in the rsyncd.conf manpage.
+
+    The default FORMAT used if [`--log-file`](#opt) is specified and this
+    option is not is '%i %n%L'.
 
-    The default FORMAT used if `--log-file` is specified and this option is not
-    is '%i %n%L'.
+    See also [the daemon version of the `--log-file-format`
+    option](#dopt--log-file-format).
 
 0.  `--stats`
 
     This tells rsync to print a verbose set of statistics on the file transfer,
     allowing you to tell how effective rsync's delta-transfer algorithm is for
-    your data.  This option is equivalent to `--info=stats2` if combined with 0
-    or 1 `-v` options, or `--info=stats3` if combined with 2 or more `-v`
-    options.
+    your data.  This option is equivalent to [`--info=stats2`](#opt) if
+    combined with 0 or 1 [`-v`](#opt) options, or [`--info=stats3`](#opt) if
+    combined with 2 or more [`-v`](#opt) options.
 
     The current statistics are as follows:
 
@@ -2840,7 +3062,7 @@ your home directory (remove the '=' for that).
       sense) were created (as opposed to updated).  The total count will be
       followed by a list of counts by filetype (if the total is non-zero).
     - `Number of deleted files` is the count of how many "files" (generic
-      sense) were created (as opposed to updated).  The total count will be
+      sense) were deleted.  The total count will be
       followed by a list of counts by filetype (if the total is non-zero).
       Note that this line is only output if deletions are in effect, and only
       if protocol 31 is being used (the default for rsync 3.1.x).
@@ -2887,12 +3109,14 @@ your home directory (remove the '=' for that).
 
 0.  `--human-readable`, `-h`
 
-    Output numbers in a more human-readable format.  There are 3 possible
-    levels: (1) output numbers with a separator between each set of 3 digits
-    (either a comma or a period, depending on if the decimal point is
-    represented by a period or a comma); (2) output numbers in units of 1000
-    (with a character suffix for larger units -- see below); (3) output
-    numbers in units of 1024.
+    Output numbers in a more human-readable format.  There are 3 possible levels:
+
+    1. output numbers with a separator between each set of 3 digits (either a
+       comma or a period, depending on if the decimal point is represented by a
+       period or a comma).
+    2. output numbers in units of 1000 (with a character suffix for larger
+       units -- see below).
+    3. output numbers in units of 1024.
 
     The default is human-readable level 1.  Each `-h` option increases the
     level by one.  You can take the level down to 0 (to output numbers as pure
@@ -2907,7 +3131,7 @@ your home directory (remove the '=' for that).
     support human-readable level 1, and they default to level 0.  Thus,
     specifying one or two `-h` options will behave in a comparable manner in
     old and new versions as long as you didn't specify a `--no-h` option prior
-    to one or more `-h` options.  See the `--list-only` option for one
+    to one or more `-h` options.  See the [`--list-only`](#opt) option for one
     difference.
 
 0.  `--partial`
@@ -2920,56 +3144,64 @@ your home directory (remove the '=' for that).
 
 0.  `--partial-dir=DIR`
 
-    A better way to keep partial files than the `--partial` option is to
-    specify a _DIR_ that will be used to hold the partial data (instead of
-    writing it out to the destination file).  On the next transfer, rsync will
-    use a file found in this dir as data to speed up the resumption of the
+    This option modifies the behavior of the [`--partial`](#opt) option while
+    also implying that it be enabled.  This enhanced partial-file method puts
+    any partially transferred files into the specified _DIR_ instead of writing
+    the partial file out to the destination file.  On the next transfer, rsync
+    will use a file found in this dir as data to speed up the resumption of the
     transfer and then delete it after it has served its purpose.
 
-    Note that if `--whole-file` is specified (or implied), any partial-dir file
-    that is found for a file that is being updated will simply be removed
-    (since rsync is sending files without using rsync's delta-transfer
-    algorithm).
+    Note that if [`--whole-file`](#opt) is specified (or implied), any
+    partial-dir files that are found for a file that is being updated will
+    simply be removed (since rsync is sending files without using rsync's
+    delta-transfer algorithm).
 
-    Rsync will create the _DIR_ if it is missing (just the last dir -- not the
-    whole path).  This makes it easy to use a relative path (such as
+    Rsync will create the _DIR_ if it is missing, but just the last dir -- not
+    the whole path.  This makes it easy to use a relative path (such as
     "`--partial-dir=.rsync-partial`") to have rsync create the
-    partial-directory in the destination file's directory when needed, and then
-    remove it again when the partial file is deleted.  Note that the directory
-    is only removed if it is a relative pathname, as it is expected that an
-    absolute path is to a directory that is reserved for partial-dir work.
+    partial-directory in the destination file's directory when it is needed,
+    and then remove it again when the partial file is deleted.  Note that this
+    directory removal is only done for a relative pathname, as it is expected
+    that an absolute path is to a directory that is reserved for partial-dir
+    work.
 
     If the partial-dir value is not an absolute path, rsync will add an exclude
     rule at the end of all your existing excludes.  This will prevent the
     sending of any partial-dir files that may exist on the sending side, and
     will also prevent the untimely deletion of partial-dir items on the
     receiving side.  An example: the above `--partial-dir` option would add the
-    equivalent of "`-f '-p .rsync-partial/'`" at the end of any other filter
-    rules.
+    equivalent of this "perishable" exclude at the end of any other filter
+    rules: `-f '-p .rsync-partial/'`
 
     If you are supplying your own exclude rules, you may need to add your own
-    exclude/hide/protect rule for the partial-dir because (1) the auto-added
-    rule may be ineffective at the end of your other rules, or (2) you may wish
-    to override rsync's exclude choice.  For instance, if you want to make
-    rsync clean-up any left-over partial-dirs that may be lying around, you
-    should specify `--delete-after` and add a "risk" filter rule, e.g.
-    `-f 'R .rsync-partial/'`. (Avoid using `--delete-before` or
-    `--delete-during` unless you don't need rsync to use any of the left-over
-    partial-dir data during the current run.)
+    exclude/hide/protect rule for the partial-dir because:
+
+    1. the auto-added rule may be ineffective at the end of your other rules, or
+    2. you may wish to override rsync's exclude choice.
+
+    For instance, if you want to make rsync clean-up any left-over partial-dirs
+    that may be lying around, you should specify [`--delete-after`](#opt) and
+    add a "risk" filter rule, e.g.  `-f 'R .rsync-partial/'`. Avoid using
+    [`--delete-before`](#opt) or [`--delete-during`](#opt) unless you don't
+    need rsync to use any of the left-over partial-dir data during the current
+    run.
 
     IMPORTANT: the `--partial-dir` should not be writable by other users or it
-    is a security risk.  E.g. AVOID "/tmp".
-
-    You can also set the partial-dir value the RSYNC_PARTIAL_DIR environment
-    variable.  Setting this in the environment does not force `--partial` to be
-    enabled, but rather it affects where partial files go when `--partial` is
-    specified.  For instance, instead of using `--partial-dir=.rsync-tmp` along
-    with `--progress`, you could set RSYNC_PARTIAL_DIR=.rsync-tmp in your
-    environment and then just use the `-P` option to turn on the use of the
-    .rsync-tmp dir for partial transfers.  The only times that the `--partial`
-    option does not look for this environment value are (1) when `--inplace`
-    was specified (since `--inplace` conflicts with `--partial-dir`), and (2)
-    when `--delay-updates` was specified (see below).
+    is a security risk!  E.g. AVOID "/tmp"!
+
+    You can also set the partial-dir value the [`RSYNC_PARTIAL_DIR`](#)
+    environment variable.  Setting this in the environment does not force
+    [`--partial`](#opt) to be enabled, but rather it affects where partial
+    files go when [`--partial`](#opt) is specified.  For instance, instead of
+    using `--partial-dir=.rsync-tmp` along with [`--progress`](#opt), you could
+    set [`RSYNC_PARTIAL_DIR=.rsync-tmp`](#) in your environment and then use
+    the [`-P`](#opt) option to turn on the use of the .rsync-tmp dir for
+    partial transfers.  The only times that the [`--partial`](#opt) option does
+    not look for this environment value are:
+
+    1. when [`--inplace`](#opt) was specified (since [`--inplace`](#opt)
+       conflicts with `--partial-dir`), and
+    2. when [`--delay-updates`](#opt) was specified (see below).
 
     When a modern rsync resumes the transfer of a file in the partial-dir, that
     partial file is now updated in-place instead of creating yet another
@@ -2978,10 +3210,10 @@ your home directory (remove the '=' for that).
     3.2.0.
 
     For the purposes of the daemon-config's "`refuse options`" setting,
-    `--partial-dir` does _not_ imply `--partial`.  This is so that a refusal of
-    the `--partial` option can be used to disallow the overwriting of
-    destination files with a partial transfer, while still allowing the safer
-    idiom provided by `--partial-dir`.
+    `--partial-dir` does _not_ imply [`--partial`](#opt).  This is so that a
+    refusal of the [`--partial`](#opt) option can be used to disallow the
+    overwriting of destination files with a partial transfer, while still
+    allowing the safer idiom provided by `--partial-dir`.
 
 0.  `--delay-updates`
 
@@ -2990,27 +3222,30 @@ your home directory (remove the '=' for that).
     renamed into place in rapid succession.  This attempts to make the updating
     of the files a little more atomic.  By default the files are placed into a
     directory named `.~tmp~` in each file's destination directory, but if
-    you've specified the `--partial-dir` option, that directory will be used
-    instead.  See the comments in the `--partial-dir` section for a discussion
-    of how this `.~tmp~` dir will be excluded from the transfer, and what you
-    can do if you want rsync to cleanup old `.~tmp~` dirs that might be lying
-    around.  Conflicts with `--inplace` and `--append`.
+    you've specified the [`--partial-dir`](#opt) option, that directory will be
+    used instead.  See the comments in the [`--partial-dir`](#opt) section for
+    a discussion of how this `.~tmp~` dir will be excluded from the transfer,
+    and what you can do if you want rsync to cleanup old `.~tmp~` dirs that
+    might be lying around.  Conflicts with [`--inplace`](#opt) and
+    [`--append`](#opt).
 
-    This option implies `--no-inc-recursive` since it needs the full file list
-    in memory in order to be able to iterate over it at the end.
+    This option implies [`--no-inc-recursive`](#opt) since it needs the full
+    file list in memory in order to be able to iterate over it at the end.
 
     This option uses more memory on the receiving side (one bit per file
     transferred) and also requires enough free disk space on the receiving side
     to hold an additional copy of all the updated files.  Note also that you
-    should not use an absolute path to `--partial-dir` unless (1) there is no
-    chance of any of the files in the transfer having the same name (since all
-    the updated files will be put into a single directory if the path is
-    absolute) and (2) there are no mount points in the hierarchy (since the
-    delayed updates will fail if they can't be renamed into place).
+    should not use an absolute path to [`--partial-dir`](#opt) unless:
 
-    See also the "atomic-rsync" perl script in the "support" subdir for an
-    update algorithm that is even more atomic (it uses `--link-dest` and a
-    parallel hierarchy of files).
+    1. there is no chance of any of the files in the transfer having the same
+       name (since all the updated files will be put into a single directory if
+       the path is absolute), and
+    2. there are no mount points in the hierarchy (since the delayed updates
+       will fail if they can't be renamed into place).
+
+    See also the "atomic-rsync" python script in the "support" subdir for an
+    update algorithm that is even more atomic (it uses [`--link-dest`](#opt)
+    and a parallel hierarchy of files).
 
 0.  `--prune-empty-dirs`, `-m`
 
@@ -3020,9 +3255,9 @@ your home directory (remove the '=' for that).
     directories when the sending rsync is recursively scanning a hierarchy of
     files using include/exclude/filter rules.
 
-    Note that the use of transfer rules, such as the `--min-size` option, does
-    not affect what goes into the file list, and thus does not leave
-    directories empty, even if none of the files in a directory match the
+    Note that the use of transfer rules, such as the [`--min-size`](#opt)
+    option, does not affect what goes into the file list, and thus does not
+    leave directories empty, even if none of the files in a directory match the
     transfer rule.
 
     Because the file-list is actually being pruned, this option also affects
@@ -3053,9 +3288,9 @@ your home directory (remove the '=' for that).
 
     This option tells rsync to print information showing the progress of the
     transfer.  This gives a bored user something to watch.  With a modern rsync
-    this is the same as specifying `--info=flist2,name,progress`, but any
-    user-supplied settings for those info flags takes precedence (e.g.
-    "`--info=flist0 --progress`").
+    this is the same as specifying [`--info=flist2,name,progress`](#opt), but
+    any user-supplied settings for those info flags takes precedence (e.g.
+    [`--info=flist0 --progress`](#opt)).
 
     While rsync is transferring a regular file, it updates a progress line that
     looks like this:
@@ -3098,16 +3333,17 @@ your home directory (remove the '=' for that).
 
 0.  `-P`
 
-    The `-P` option is equivalent to `--partial --progress`.  Its purpose is
-    to make it much easier to specify these two options for a long transfer
-    that may be interrupted.
+    The `-P` option is equivalent to "[`--partial`](#opt)
+    [`--progress`](#opt)".  Its purpose is to make it much easier to specify
+    these two options for a long transfer that may be interrupted.
 
-    There is also a `--info=progress2` option that outputs statistics based on
-    the whole transfer, rather than individual files.  Use this flag without
-    outputting a filename (e.g. avoid `-v` or specify `--info=name0`) if you
-    want to see how the transfer is doing without scrolling the screen with a
-    lot of names. (You don't need to specify the `--progress` option in order
-    to use `--info=progress2`.)
+    There is also a [`--info=progress2`](#opt) option that outputs statistics
+    based on the whole transfer, rather than individual files.  Use this flag
+    without outputting a filename (e.g. avoid `-v` or specify
+    [`--info=name0`](#opt)) if you want to see how the transfer is doing
+    without scrolling the screen with a lot of names. (You don't need to
+    specify the [`--progress`](#opt) option in order to use
+    [`--info=progress2`](#opt).)
 
     Finally, you can get an instant progress report by sending rsync a signal
     of either SIGINFO or SIGVTALRM.  On BSD systems, a SIGINFO is generated by
@@ -3116,8 +3352,8 @@ your home directory (remove the '=' for that).
     output a single progress report which is output when the current file
     transfer finishes (so it may take a little time if a big file is being
     handled when the signal arrives).  A filename is output (if needed)
-    followed by the `--info=progress2` format of progress info.  If you don't
-    know which of the 3 rsync processes is the client process, it's OK to
+    followed by the [`--info=progress2`](#opt) format of progress info.  If you
+    don't know which of the 3 rsync processes is the client process, it's OK to
     signal all of them (since the non-client processes ignore the signal).
 
     CAUTION: sending SIGVTALRM to an older rsync (pre-3.2.0) will kill it.
@@ -3150,40 +3386,44 @@ your home directory (remove the '=' for that).
 
     This option will cause the source files to be listed instead of
     transferred.  This option is inferred if there is a single source arg and
-    no destination specified, so its main uses are: (1) to turn a copy command
-    that includes a destination arg into a file-listing command, or (2) to be
-    able to specify more than one source arg (note: be sure to include the
-    destination).  Caution: keep in mind that a source arg with a wild-card is
-    expanded by the shell into multiple args, so it is never safe to try to
-    list such an arg without using this option. For example:
+    no destination specified, so its main uses are:
+
+    1. to turn a copy command that includes a destination arg into a
+       file-listing command, or
+    2. to be able to specify more than one source arg.  Note: be sure to
+       include the destination.
+
+    CAUTION: keep in mind that a source arg with a wild-card is expanded by the
+    shell into multiple args, so it is never safe to try to list such an arg
+    without using this option. For example:
 
     >     rsync -av --list-only foo* dest/
 
     Starting with rsync 3.1.0, the sizes output by `--list-only` are affected
-    by the `--human-readable` option.  By default they will contain digit
-    separators, but higher levels of readability will output the sizes with
-    unit suffixes.  Note also that the column width for the size output has
-    increased from 11 to 14 characters for all human-readable levels.  Use
+    by the [`--human-readable`](#opt) option.  By default they will contain
+    digit separators, but higher levels of readability will output the sizes
+    with unit suffixes.  Note also that the column width for the size output
+    has increased from 11 to 14 characters for all human-readable levels.  Use
     `--no-h` if you want just digits in the sizes, and the old column width of
     11 characters.
 
     Compatibility note: when requesting a remote listing of files from an rsync
     that is version 2.6.3 or older, you may encounter an error if you ask for a
-    non-recursive listing.  This is because a file listing implies the `--dirs`
-    option w/o `--recursive`, and older rsyncs don't have that option.  To
-    avoid this problem, either specify the `--no-dirs` option (if you don't
-    need to expand a directory's content), or turn on recursion and exclude the
-    content of subdirectories: `-r --exclude='/*/*'`.
+    non-recursive listing.  This is because a file listing implies the
+    [`--dirs`](#opt) option w/o [`--recursive`](#opt), and older rsyncs don't
+    have that option.  To avoid this problem, either specify the `--no-dirs`
+    option (if you don't need to expand a directory's content), or turn on
+    recursion and exclude the content of subdirectories: `-r --exclude='/*/*'`.
 
 0.  `--bwlimit=RATE`
 
     This option allows you to specify the maximum transfer rate for the data
     sent over the socket, specified in units per second.  The RATE value can be
     suffixed with a string to indicate a size multiplier, and may be a
-    fractional value (e.g. "`--bwlimit=1.5m`").  If no suffix is specified, the
+    fractional value (e.g. `--bwlimit=1.5m`).  If no suffix is specified, the
     value will be assumed to be in units of 1024 bytes (as if "K" or "KiB" had
-    been appended).  See the `--max-size` option for a description of all the
-    available suffixes.  A value of 0 specifies no limit.
+    been appended).  See the [`--max-size`](#opt) option for a description of
+    all the available suffixes.  A value of 0 specifies no limit.
 
     For backward-compatibility reasons, the rate limit will be rounded to the
     nearest KiB unit, so no rate smaller than 1024 bytes per second is
@@ -3195,26 +3435,28 @@ your home directory (remove the '=' for that).
     rsync writes out a block of data and then sleeps to bring the average rate
     into compliance.
 
-    Due to the internal buffering of data, the `--progress` option may not be
-    an accurate reflection on how fast the data is being sent.  This is because
-    some files can show up as being rapidly sent when the data is quickly
-    buffered, while other can show up as very slow when the flushing of the
-    output buffer occurs.  This may be fixed in a future version.
+    Due to the internal buffering of data, the [`--progress`](#opt) option may
+    not be an accurate reflection on how fast the data is being sent.  This is
+    because some files can show up as being rapidly sent when the data is
+    quickly buffered, while other can show up as very slow when the flushing of
+    the output buffer occurs.  This may be fixed in a future version.
+
+    See also [the daemon version of the `--bwlimit` option](#dopt--bwlimit).
 
-0.  `--stop-after=MINS
+0.  `--stop-after=MINS`, (`--time-limit=MINS`)
 
     This option tells rsync to stop copying when the specified number of
     minutes has elapsed.
 
-    Rsync also accepts an earlier version of this option: `--time-limit=MINS`.
-
     For maximal flexibility, rsync does not communicate this option to the
     remote rsync since it is usually enough that one side of the connection
     quits as specified.  This allows the option's use even when only one side
     of the connection supports it.  You can tell the remote side about the time
-    limit using `--remote-option` (`-M`), should the need arise.
+    limit using [`--remote-option`](#opt) (`-M`), should the need arise.
 
-0.  `--stop-at=y-m-dTh:m
+    The `--time-limit` version of this option is deprecated.
+
+0.  `--stop-at=y-m-dTh:m`
 
     This option tells rsync to stop copying when the specified point in time
     has been reached. The date & time can be fully specified in a numeric
@@ -3237,27 +3479,33 @@ your home directory (remove the '=' for that).
     remote rsync since it is usually enough that one side of the connection
     quits as specified.  This allows the option's use even when only one side
     of the connection supports it.  You can tell the remote side about the time
-    limit using `--remote-option` (`-M`), should the need arise.  Do keep in
-    mind that the remote host may have a different default timezone than your
-    local host.
+    limit using [`--remote-option`](#opt) (`-M`), should the need arise.  Do
+    keep in mind that the remote host may have a different default timezone
+    than your local host.
+
+0.  `--fsync`
+
+    Cause the receiving side to fsync each finished file.  This may slow down
+    the transfer, but can help to provide peace of mind when updating critical
+    files.
 
 0.  `--write-batch=FILE`
 
     Record a file that can later be applied to another identical destination
-    with `--read-batch`.  See the "BATCH MODE" section for details, and also
-    the `--only-write-batch` option.
+    with [`--read-batch`](#opt).  See the "BATCH MODE" section for details, and
+    also the [`--only-write-batch`](#opt) option.
 
     This option overrides the negotiated checksum & compress lists and always
     negotiates a choice based on old-school md5/md4/zlib choices.  If you want
-    a more modern choice, use the `--checksum-choice` (`--cc`) and/or
-    `--compress-choice` (`--zc`) options.
+    a more modern choice, use the [`--checksum-choice`](#opt) (`--cc`) and/or
+    [`--compress-choice`](#opt) (`--zc`) options.
 
 0.  `--only-write-batch=FILE`
 
-    Works like `--write-batch`, except that no updates are made on the
+    Works like [`--write-batch`](#opt), except that no updates are made on the
     destination system when creating the batch.  This lets you transport the
     changes to the destination system via some other means and then apply the
-    changes via `--read-batch`.
+    changes via [`--read-batch`](#opt).
 
     Note that you can feel free to write the batch directly to some portable
     media: if this media fills to capacity before the end of the transfer, you
@@ -3274,18 +3522,18 @@ your home directory (remove the '=' for that).
 0.  `--read-batch=FILE`
 
     Apply all of the changes stored in FILE, a file previously generated by
-    `--write-batch`.  If _FILE_ is `-`, the batch data will be read from
-    standard input. See the "BATCH MODE" section for details.
+    [`--write-batch`](#opt).  If _FILE_ is `-`, the batch data will be read
+    from standard input. See the "BATCH MODE" section for details.
 
 0.  `--protocol=NUM`
 
     Force an older protocol version to be used.  This is useful for creating a
     batch file that is compatible with an older version of rsync.  For
-    instance, if rsync 2.6.4 is being used with the `--write-batch` option, but
-    rsync 2.6.3 is what will be used to run the `--read-batch` option, you
-    should use "--protocol=28" when creating the batch file to force the older
-    protocol version to be used in the batch file (assuming you can't upgrade
-    the rsync on the reading system).
+    instance, if rsync 2.6.4 is being used with the [`--write-batch`](#opt)
+    option, but rsync 2.6.3 is what will be used to run the
+    [`--read-batch`](#opt) option, you should use "--protocol=28" when creating
+    the batch file to force the older protocol version to be used in the batch
+    file (assuming you can't upgrade the rsync on the reading system).
 
 0.  `--iconv=CONVERT_SPEC`
 
@@ -3297,15 +3545,15 @@ your home directory (remove the '=' for that).
     This order ensures that the option will stay the same whether you're
     pushing or pulling files.  Finally, you can specify either `--no-iconv` or
     a CONVERT_SPEC of "-" to turn off any conversion.  The default setting of
-    this option is site-specific, and can also be affected via the RSYNC_ICONV
-    environment variable.
+    this option is site-specific, and can also be affected via the
+    [`RSYNC_ICONV`](#) environment variable.
 
     For a list of what charset names your local iconv library supports, you can
     run "`iconv --list`".
 
-    If you specify the `--protect-args` option (`-s`), rsync will translate the
-    filenames you specify on the command-line that are being sent to the remote
-    host.  See also the `--files-from` option.
+    If you specify the [`--protect-args`](#opt) (`-s`) option, rsync will
+    translate the filenames you specify on the command-line that are being sent
+    to the remote host.  See also the [`--files-from`](#opt) option.
 
     Note that rsync does not do any conversion of names in filter files
     (including include/exclude files).  It is up to you to ensure that you're
@@ -3326,12 +3574,12 @@ your home directory (remove the '=' for that).
     socket when directly contacting an rsync daemon, as well as the forwarding
     of the `-4` or `-6` option to ssh when rsync can deduce that ssh is being
     used as the remote shell.  For other remote shells you'll need to specify
-    the "`--rsh SHELL -4`" option directly (or whatever ipv4/ipv6 hint options
+    the "`--rsh SHELL -4`" option directly (or whatever IPv4/IPv6 hint options
     it uses).
 
-    These options also exist in the `--daemon` mode section.
+    See also [the daemon version of these options](#dopt--ipv4).
 
-    If rsync was complied without support for IPv6, the `--ipv6` option will
+    If rsync was compiled without support for IPv6, the `--ipv6` option will
     have no effect.  The `rsync --version` output will contain "`no IPv6`" if
     is the case.
 
@@ -3346,7 +3594,7 @@ your home directory (remove the '=' for that).
     user wants a more random checksum seed.  Setting NUM to 0 causes rsync to
     use the default of **time**() for checksum seed.
 
-# DAEMON OPTIONS
+## DAEMON OPTIONS
 
 The options allowed when starting an rsync daemon are as follows:
 
@@ -3359,31 +3607,37 @@ The options allowed when starting an rsync daemon are as follows:
     If standard input is a socket then rsync will assume that it is being run
     via inetd, otherwise it will detach from the current terminal and become a
     background daemon.  The daemon will read the config file (rsyncd.conf) on
-    each connect made by a client and respond to requests accordingly.  See the
-    **rsyncd.conf**(5) man page for more details.
+    each connect made by a client and respond to requests accordingly.
+
+    See the [**rsyncd.conf**(5)](rsyncd.conf.5) manpage for more details.
 
 0.  `--address=ADDRESS`
 
     By default rsync will bind to the wildcard address when run as a daemon
     with the `--daemon` option.  The `--address` option allows you to specify a
     specific IP address (or hostname) to bind to.  This makes virtual hosting
-    possible in conjunction with the `--config` option.  See also the "address"
-    global option in the rsyncd.conf manpage.
+    possible in conjunction with the `--config` option.
+
+    See also the [address](rsyncd.conf.5#address) global option in the
+    rsyncd.conf manpage and the [client version of the `--address`
+    option](#opt--address).
 
 0.  `--bwlimit=RATE`
 
     This option allows you to specify the maximum transfer rate for the data
     the daemon sends over the socket.  The client can still specify a smaller
-    `--bwlimit` value, but no larger value will be allowed.  See the client
-    version of this option (above) for some extra details.
+    `--bwlimit` value, but no larger value will be allowed.
+
+    See the [client version of the `--bwlimit` option](#opt--bwlimit) for some
+    extra details.
 
 0.  `--config=FILE`
 
     This specifies an alternate config file than the default.  This is only
-    relevant when `--daemon` is specified.  The default is /etc/rsyncd.conf
-    unless the daemon is running over a remote shell program and the remote
-    user is not the super-user; in that case the default is rsyncd.conf in the
-    current directory (typically $HOME).
+    relevant when [`--daemon`](#dopt) is specified.  The default is
+    /etc/rsyncd.conf unless the daemon is running over a remote shell program
+    and the remote user is not the super-user; in that case the default is
+    rsyncd.conf in the current directory (typically $HOME).
 
 0.  `--dparam=OVERRIDE`, `-M`
 
@@ -3407,14 +3661,18 @@ The options allowed when starting an rsync daemon are as follows:
 0.  `--port=PORT`
 
     This specifies an alternate TCP port number for the daemon to listen on
-    rather than the default of 873.  See also the "port" global option in the
-    rsyncd.conf manpage.
+    rather than the default of 873.
+
+    See also [the client version of the `--port` option](#opt--port) and the
+    [port](rsyncd.conf.5#port) global setting in the rsyncd.conf manpage.
 
 0.  `--log-file=FILE`
 
     This option tells the rsync daemon to use the given log-file name instead
     of using the "`log file`" setting in the config file.
 
+    See also [the client version of the `--log-file` option](#opt--log-file).
+
 0.  `--log-file-format=FORMAT`
 
     This option tells the rsync daemon to use the given FORMAT string instead
@@ -3422,10 +3680,15 @@ The options allowed when starting an rsync daemon are as follows:
     "`transfer logging`" unless the string is empty, in which case transfer
     logging is turned off.
 
+    See also [the client version of the `--log-file-format`
+    option](#opt--log-file-format).
+
 0.  `--sockopts`
 
-    This overrides the `socket options` setting in the rsyncd.conf file and has
-    the same syntax.
+    This overrides the [`socket options`](rsyncd.conf.5#socket_options)
+    setting in the rsyncd.conf file and has the same syntax.
+
+    See also [the client version of the `--sockopts` option](#opt--sockopts).
 
 0.  `--verbose`, `-v`
 
@@ -3434,6 +3697,8 @@ The options allowed when starting an rsync daemon are as follows:
     will be controlled by the options that the client used and the
     "`max verbosity`" setting in the module's config section.
 
+    See also [the client version of the `--verbose` option](#opt--verbose).
+
 0.  `--ipv4`, `-4` or `--ipv6`, `-6`
 
     Tells rsync to prefer IPv4/IPv6 when creating the incoming sockets that the
@@ -3443,9 +3708,9 @@ The options allowed when starting an rsync daemon are as follows:
     using the port, try specifying `--ipv6` or `--ipv4` when starting the
     daemon).
 
-    These options also exist in the regular rsync options section.
+    See also [the client version of these options](#opt--ipv4).
 
-    If rsync was complied without support for IPv6, the `--ipv6` option will
+    If rsync was compiled without support for IPv6, the `--ipv6` option will
     have no effect.  The `rsync --version` output will contain "`no IPv6`" if
     is the case.
 
@@ -3454,7 +3719,7 @@ The options allowed when starting an rsync daemon are as follows:
     When specified after `--daemon`, print a short help page describing the
     options available for starting an rsync daemon.
 
-# FILTER RULES
+## FILTER RULES
 
 The filter rules allow for flexible selection of which files to transfer
 (include) and which files to skip (exclude).  The rules either directly specify
@@ -3467,6 +3732,14 @@ first matching pattern is acted on: if it is an exclude pattern, then that file
 is skipped; if it is an include pattern then that filename is not skipped; if
 no matching pattern is found, then the filename is not skipped.
 
+Aside: because the interactions of filter rules can be complex, it is useful to
+use the `--debug=FILTER` option if things aren't working the way you expect.
+The level-1 output (the default if no level number is specified) mentions the
+filter rule that is first matched by each file in the transfer.  It also warns
+if a filter rule has trailing whitespace.  The level-2 output mentions a lot
+more filter events, including the definition of each rule and the handling of
+per-directory filter files.
+
 Rsync builds an ordered list of filter rules as specified on the command-line.
 Filter rules have the following syntax:
 
@@ -3489,31 +3762,33 @@ available rule prefixes:
 0.  `risk, 'R'` files that match the pattern are not protected.
 0.  `clear, '!'` clears the current include/exclude list (takes no arg)
 
-When rules are being read from a file, empty lines are ignored, as are comment
-lines that start with a "#".
+When rules are being read from a file, empty lines are ignored, as are
+whole-line comments that start with a '`#`' (filename rules that contain a hash
+are unaffected).
 
 [comment]: # (Remember that markdown strips spaces from start/end of ` ... ` sequences!)
 [comment]: # (Thus, the `x ` sequences below use a literal non-breakable space!)
 
-Note that the `--include` & `--exclude` command-line options do not allow the
-full range of rule parsing as described above -- they only allow the
-specification of include / exclude patterns plus a "`!`" token to clear the
+Note that the [`--include`](#opt) & [`--exclude`](#opt) command-line options do
+not allow the full range of rule parsing as described above -- they only allow
+the specification of include / exclude patterns plus a "`!`" token to clear the
 list (and the normal comment parsing when rules are read from a file).  If a
 pattern does not begin with "`- `" (dash, space) or "`+ `" (plus, space), then
 the rule will be interpreted as if "`+ `" (for an include option) or "`- `"
-(for an exclude option) were prefixed to the string.  A `--filter` option, on
-the other hand, must always contain either a short or long rule name at the
-start of the rule.
+(for an exclude option) were prefixed to the string.  A [`--filter`](#opt)
+option, on the other hand, must always contain either a short or long rule name
+at the start of the rule.
 
-Note also that the `--filter`, `--include`, and `--exclude` options take one
-rule/pattern each.  To add multiple ones, you can repeat the options on the
-command-line, use the merge-file syntax of the `--filter` option, or the
-`--include-from` / `--exclude-from` options.
+Note also that the [`--filter`](#opt), [`--include`](#opt), and
+[`--exclude`](#opt) options take one rule/pattern each.  To add multiple ones,
+you can repeat the options on the command-line, use the merge-file syntax of
+the [`--filter`](#opt) option, or the [`--include-from`](#opt) /
+[`--exclude-from`](#opt) options.
 
-# INCLUDE/EXCLUDE PATTERN RULES
+## INCLUDE/EXCLUDE PATTERN RULES
 
 You can include and exclude files by specifying patterns using the "+", "-",
-etc. filter rules (as introduced in the FILTER RULES section above).  The
+etc. filter rules (as introduced in the [FILTER RULES](#) section above).  The
 include/exclude rules each specify a pattern that is matched against the names
 of the files that are going to be transferred.  These patterns can take several
 forms:
@@ -3555,12 +3830,13 @@ forms:
   had been specified) and everything in the directory (as if "`dir_name/**`"
   had been specified).  This behavior was added in version 2.6.7.
 
-Note that, when using the `--recursive` (`-r`) option (which is implied by
-`-a`), every subdir component of every path is visited left to right, with each
-directory having a chance for exclusion before its content.  In this way
-include/exclude patterns are applied recursively to the pathname of each node
-in the filesystem's tree (those inside the transfer).  The exclude patterns
-short-circuit the directory traversal stage as rsync finds the files to send.
+Note that, when using the [`--recursive`](#opt) (`-r`) option (which is implied
+by [`-a`](#opt)), every subdir component of every path is visited left to
+right, with each directory having a chance for exclusion before its content.
+In this way include/exclude patterns are applied recursively to the pathname of
+each node in the filesystem's tree (those inside the transfer).  The exclude
+patterns short-circuit the directory traversal stage as rsync finds the files
+to send.
 
 For instance, to include "`/foo/bar/baz`", the directories "`/foo`" and "`/foo/bar`"
 must not be excluded.  Excluding one of those parent directories prevents the
@@ -3579,7 +3855,7 @@ This fails because the parent directory "some" is excluded by the '`*`' rule, so
 rsync never visits any of the files in the "some" or "some/path" directories.
 One solution is to ask for all directories in the hierarchy to be included by
 using a single rule: "`+ */`" (put it somewhere before the "`- *`" rule), and
-perhaps use the `--prune-empty-dirs` option.  Another solution is to add
+perhaps use the [`--prune-empty-dirs`](#opt) option.  Another solution is to add
 specific include rules for all the parent dirs that need to be visited.  For
 instance, this set of rules works fine:
 
@@ -3601,7 +3877,7 @@ Here are some examples of exclude/include matching:
   directory named foo in the transfer-root directory
 - The combination of "`+ */`", "`+ *.c`", and "`- *`" would include all
   directories and C source files but nothing else (see also the
-  `--prune-empty-dirs` option)
+  [`--prune-empty-dirs`](#opt) option)
 - The combination of "`+ foo/`", "`+ foo/bar.c`", and "`- *`" would include
   only the foo directory and foo/bar.c (the foo directory must be explicitly
   included or it would be excluded by the "`*`")
@@ -3620,29 +3896,30 @@ The following modifiers are accepted after a "`+`" or "`-`":
   inserted as excludes in place of the "-C".  No arg should follow.
 - An `s` is used to indicate that the rule applies to the sending side.  When a
   rule affects the sending side, it prevents files from being transferred.  The
-  default is for a rule to affect both sides unless `--delete-excluded` was
-  specified, in which case default rules become sender-side only.  See also the
-  hide (H) and show (S) rules, which are an alternate way to specify
+  default is for a rule to affect both sides unless [`--delete-excluded`](#opt)
+  was specified, in which case default rules become sender-side only.  See also
+  the hide (H) and show (S) rules, which are an alternate way to specify
   sending-side includes/excludes.
 - An `r` is used to indicate that the rule applies to the receiving side.  When
   a rule affects the receiving side, it prevents files from being deleted.  See
   the `s` modifier for more info.  See also the protect (P) and risk (R) rules,
   which are an alternate way to specify receiver-side includes/excludes.
 - A `p` indicates that a rule is perishable, meaning that it is ignored in
-  directories that are being deleted.  For instance, the `-C` option's default
-  rules that exclude things like "CVS" and "`*.o`" are marked as perishable,
-  and will not prevent a directory that was removed on the source from being
-  deleted on the destination.
+  directories that are being deleted.  For instance, the
+  [`--cvs-exclude`](#opt) (`-C`) option's default rules that exclude things
+  like "CVS" and "`*.o`" are marked as perishable, and will not prevent a
+  directory that was removed on the source from being deleted on the
+  destination.
 - An `x` indicates that a rule affects xattr names in xattr copy/delete
   operations (and is thus ignored when matching file/dir names).  If no
   xattr-matching rules are specified, a default xattr filtering rule is used
-  (see the `--xattrs` option).
+  (see the [`--xattrs`](#opt) option).
 
-# MERGE-FILE FILTER RULES
+## MERGE-FILE FILTER RULES
 
 You can merge whole files into your filter rules by specifying either a merge
-(.) or a dir-merge (:) filter rule (as introduced in the FILTER RULES section
-above).
+(.) or a dir-merge (:) filter rule (as introduced in the [FILTER RULES](#)
+section above).
 
 There are two kinds of merged files -- single-instance ('.') and per-directory
 (':').  A single-instance merge file is read one time, and its rules are
@@ -3653,7 +3930,7 @@ list of inherited rules.  These per-directory rule files must be created on the
 sending side because it is the sending side that is being scanned for the
 available files to transfer.  These rule files may also need to be transferred
 to the receiving side if you want them to affect what files don't get deleted
-(see PER-DIRECTORY RULES AND DELETE below).
+(see [PER-DIRECTORY RULES AND DELETE](#) below).
 
 Some examples:
 
@@ -3724,7 +4001,7 @@ transfer).
 If a per-directory merge-file is specified with a path that is a parent
 directory of the first transfer directory, rsync will scan all the parent dirs
 from that starting point to the transfer directory for the indicated
-per-directory file.  For instance, here is a common filter (see `-F`):
+per-directory file.  For instance, here is a common filter (see [`-F`](#opt)):
 
 >     --filter=': /.rsync-filter'
 
@@ -3748,11 +4025,11 @@ the ".rsync-filter" files in each directory that is a part of the transfer.
 If you want to include the contents of a ".cvsignore" in your patterns, you
 should use the rule ":C", which creates a dir-merge of the .cvsignore file, but
 parsed in a CVS-compatible manner.  You can use this to affect where the
-`--cvs-exclude` (`-C`) option's inclusion of the per-directory .cvsignore file
-gets placed into your rules by putting the ":C" wherever you like in your
-filter rules.  Without this, rsync would add the dir-merge rule for the
-.cvsignore file at the end of all your other rules (giving it a lower priority
-than your command-line rules).  For example:
+[`--cvs-exclude`](#opt) (`-C`) option's inclusion of the per-directory
+.cvsignore file gets placed into your rules by putting the ":C" wherever you
+like in your filter rules.  Without this, rsync would add the dir-merge rule
+for the .cvsignore file at the end of all your other rules (giving it a lower
+priority than your command-line rules).  For example:
 
 > ```
 > cat <<EOT | rsync -avC --filter='. -' a/ b
@@ -3772,15 +4049,15 @@ $HOME/.cvsignore, and the value of $CVSIGNORE) you should omit the `-C`
 command-line option and instead insert a "-C" rule into your filter rules; e.g.
 "`--filter=-C`".
 
-# LIST-CLEARING FILTER RULE
+## LIST-CLEARING FILTER RULE
 
 You can clear the current include/exclude list by using the "!" filter rule (as
-introduced in the FILTER RULES section above).  The "current" list is either
+introduced in the [FILTER RULES](#) section above).  The "current" list is either
 the global list of rules (if the rule is encountered while parsing the filter
 options) or a set of per-directory rules (which are inherited in their own
 sub-list, so a subdirectory can use this to clear out the parent's rules).
 
-# ANCHORING INCLUDE/EXCLUDE PATTERNS
+## ANCHORING INCLUDE/EXCLUDE PATTERNS
 
 As mentioned earlier, global include/exclude patterns are anchored at the "root
 of the transfer" (as opposed to per-directory patterns, which are anchored at
@@ -3790,10 +4067,10 @@ the tree starts to be duplicated in the destination directory.  This root
 governs where patterns that start with a / match.
 
 Because the matching is relative to the transfer-root, changing the trailing
-slash on a source path or changing your use of the `--relative` option affects
-the path you need to use in your matching (in addition to changing how much of
-the file tree is duplicated on the destination host).  The following examples
-demonstrate this.
+slash on a source path or changing your use of the [`--relative`](#opt) option
+affects the path you need to use in your matching (in addition to changing how
+much of the file tree is duplicated on the destination host).  The following
+examples demonstrate this.
 
 Let's say that we want to match two source files, one with an absolute
 path of "/home/me/foo/bar", and one with a path of "/home/you/bar/baz".
@@ -3831,11 +4108,11 @@ Here is how the various command choices differ for a 2-source transfer:
 > Target file: /dest/you/bar/baz
 > ```
 
-The easiest way to see what name you should filter is to just
-look at the output when using `--verbose` and put a / in front of the name
-(use the `--dry-run` option if you're not yet ready to copy any files).
+The easiest way to see what name you should filter is to just look at the
+output when using [`--verbose`](#opt) and put a / in front of the name (use the
+`--dry-run` option if you're not yet ready to copy any files).
 
-# PER-DIRECTORY RULES AND DELETE
+## PER-DIRECTORY RULES AND DELETE
 
 Without a delete option, per-directory rules are only relevant on the sending
 side, so you can feel free to exclude the merge files themselves without
@@ -3848,9 +4125,9 @@ for you, as seen in these two equivalent commands:
 However, if you want to do a delete on the receiving side AND you want some
 files to be excluded from being deleted, you'll need to be sure that the
 receiving side knows what files to exclude.  The easiest way is to include the
-per-directory merge files in the transfer and use `--delete-after`, because
-this ensures that the receiving side gets all the same exclude rules as the
-sending side before it tries to delete anything:
+per-directory merge files in the transfer and use [`--delete-after`](#opt),
+because this ensures that the receiving side gets all the same exclude rules as
+the sending side before it tries to delete anything:
 
 >     rsync -avF --delete-after host:src/dir /dest
 
@@ -3881,7 +4158,7 @@ one of these commands:
 > rsync -avFF --delete host:src/dir /dest
 > ```
 
-# BATCH MODE
+## BATCH MODE
 
 Batch mode can be used to apply the same set of updates to many identical
 systems.  Suppose one has a tree which is replicated on a number of hosts.  Now
@@ -3934,10 +4211,10 @@ flexibility you have in how you deal with batches:
   options when running the read-batch command on the remote host.
 - The second example reads the batch data via standard input so that the batch
   file doesn't need to be copied to the remote machine first.  This example
-  avoids the foo.sh script because it needed to use a modified `--read-batch`
-  option, but you could edit the script file if you wished to make use of it
-  (just be sure that no other option is trying to use standard input, such as
-  the "`--exclude-from=-`" option).
+  avoids the foo.sh script because it needed to use a modified
+  [`--read-batch`](#opt) option, but you could edit the script file if you
+  wished to make use of it (just be sure that no other option is trying to use
+  standard input, such as the [`--exclude-from=-`](#opt) option).
 
 Caveats:
 
@@ -3949,37 +4226,38 @@ already) or the file-update may be attempted and then, if the file fails to
 verify, the update discarded with an error.  This means that it should be safe
 to re-run a read-batch operation if the command got interrupted.  If you wish
 to force the batched-update to always be attempted regardless of the file's
-size and date, use the `-I` option (when reading the batch).  If an error
-occurs, the destination tree will probably be in a partially updated state.  In
-that case, rsync can be used in its regular (non-batch) mode of operation to
-fix up the destination tree.
+size and date, use the [`-I`](#opt) option (when reading the batch).  If an
+error occurs, the destination tree will probably be in a partially updated
+state.  In that case, rsync can be used in its regular (non-batch) mode of
+operation to fix up the destination tree.
 
 The rsync version used on all destinations must be at least as new as the one
 used to generate the batch file.  Rsync will die with an error if the protocol
 version in the batch file is too new for the batch-reading rsync to handle.
-See also the `--protocol` option for a way to have the creating rsync generate
-a batch file that an older rsync can understand.  (Note that batch files
-changed format in version 2.6.3, so mixing versions older than that with newer
-versions will not work.)
+See also the [`--protocol`](#opt) option for a way to have the creating rsync
+generate a batch file that an older rsync can understand.  (Note that batch
+files changed format in version 2.6.3, so mixing versions older than that with
+newer versions will not work.)
 
 When reading a batch file, rsync will force the value of certain options to
 match the data in the batch file if you didn't set them to the same as the
 batch-writing command.  Other options can (and should) be changed.  For
-instance `--write-batch` changes to `--read-batch`, `--files-from` is dropped,
-and the `--filter` / `--include` / `--exclude` options are not needed unless
-one of the `--delete` options is specified.
+instance [`--write-batch`](#opt) changes to [`--read-batch`](#opt),
+[`--files-from`](#opt) is dropped, and the [`--filter`](#opt) /
+[`--include`](#opt) / [`--exclude`](#opt) options are not needed unless one of
+the [`--delete`](#opt) options is specified.
 
 The code that creates the BATCH.sh file transforms any filter/include/exclude
 options into a single list that is appended as a "here" document to the shell
 script file.  An advanced user can use this to modify the exclude list if a
-change in what gets deleted by `--delete` is desired.  A normal user can ignore
-this detail and just use the shell script as an easy way to run the appropriate
-`--read-batch` command for the batched data.
+change in what gets deleted by [`--delete`](#opt) is desired.  A normal user
+can ignore this detail and just use the shell script as an easy way to run the
+appropriate [`--read-batch`](#opt) command for the batched data.
 
 The original batch mode in rsync was based on "rsync+", but the latest
 version uses a new implementation.
 
-# SYMBOLIC LINKS
+## SYMBOLIC LINKS
 
 Three basic behaviors are possible when rsync encounters a symbolic
 link in the source directory.
@@ -3987,40 +4265,53 @@ link in the source directory.
 By default, symbolic links are not transferred at all.  A message "skipping
 non-regular" file is emitted for any symlinks that exist.
 
-If `--links` is specified, then symlinks are recreated with the same target on
-the destination.  Note that `--archive` implies `--links`.
+If [`--links`](#opt) is specified, then symlinks are added to the transfer
+(instead of being noisily ignored), and the default handling is to recreate
+them with the same target on the destination.  Note that [`--archive`](#opt)
+implies [`--links`](#opt).
 
-If `--copy-links` is specified, then symlinks are "collapsed" by
+If [`--copy-links`](#opt) is specified, then symlinks are "collapsed" by
 copying their referent, rather than the symlink.
 
 Rsync can also distinguish "safe" and "unsafe" symbolic links.  An example
 where this might be used is a web site mirror that wishes to ensure that the
 rsync module that is copied does not include symbolic links to `/etc/passwd` in
-the public section of the site.  Using `--copy-unsafe-links` will cause any
-links to be copied as the file they point to on the destination.  Using
-`--safe-links` will cause unsafe links to be omitted altogether. (Note that you
-must specify `--links` for `--safe-links` to have any effect.)
+the public section of the site.  Using [`--copy-unsafe-links`](#opt) will cause
+any links to be copied as the file they point to on the destination.  Using
+[`--safe-links`](#opt) will cause unsafe links to be omitted by the receiver.
+(Note that you must specify or imply [`--links`](#opt) for
+[`--safe-links`](#opt) to have any effect.)
 
-Symbolic links are considered unsafe if they are absolute symlinks
-(start with `/`), empty, or if they contain enough ".."
-components to ascend from the directory being copied.
+Symbolic links are considered unsafe if they are absolute symlinks (start with
+`/`), empty, or if they contain enough ".." components to ascend from the top
+of the transfer.
 
 Here's a summary of how the symlink options are interpreted.  The list is in
 order of precedence, so if your combination of options isn't mentioned, use the
 first line that is a complete subset of your options:
 
-0.  `--copy-links` Turn all symlinks into normal files (leaving no symlinks for
-    any other options to affect).
-0.  `--links --copy-unsafe-links` Turn all unsafe symlinks into files and
-    duplicate all safe symlinks.
-0.  `--copy-unsafe-links` Turn all unsafe symlinks into files, noisily skip all
-    safe symlinks.
-0.  `--links --safe-links` Duplicate safe symlinks and skip unsafe ones.
-0.  `--links` Duplicate all symlinks.
+0.  `--copy-links` Turn all symlinks into normal files and directories
+    (leaving no symlinks in the transfer for any other options to affect).
+0.  `--copy-dirlinks` Turn just symlinks to directories into real
+    directories, leaving all other symlinks to be handled as described below.
+0.  `--links --copy-unsafe-links` Turn all unsafe symlinks
+    into files and create all safe symlinks.
+0.  `--copy-unsafe-links` Turn all unsafe symlinks into files, noisily
+    skip all safe symlinks.
+0.  `--links --safe-links` The receiver skips creating
+    unsafe symlinks found in the transfer and creates the safe ones.
+0.  `--links` Create all symlinks.
+
+For the effect of [`--munge-links`](#opt), see the discussion in that option's
+section.
 
-# DIAGNOSTICS
+Note that the [`--keep-dirlinks`](#opt) option does not effect symlinks in the
+transfer but instead affects how rsync treats a symlink to a directory that
+already exists on the receiving side.  See that option's section for a warning.
 
-rsync occasionally produces error messages that may seem a little cryptic.  The
+## DIAGNOSTICS
+
+Rsync occasionally produces error messages that may seem a little cryptic.  The
 one that seems to cause the most confusion is "protocol version mismatch -- is
 your shell clean?".
 
@@ -4041,108 +4332,166 @@ If you are having trouble debugging filter patterns, then try specifying the
 `-vv` option.  At this level of verbosity rsync will show why each individual
 file is included or excluded.
 
-# EXIT VALUES
-
-0.  **0** Success
-0.  **1** Syntax or usage error
-0.  **2** Protocol incompatibility
-0.  **3** Errors selecting input/output files, dirs
-0.  **4** Requested action not supported: an attempt was made to manipulate
-    64-bit files on a platform that cannot support them; or an option was
-    specified that is supported by the client and not by the server.
-0.  **5** Error starting client-server protocol
-0.  **6** Daemon unable to append to log-file
-0.  **10** Error in socket I/O
-0.  **11** Error in file I/O
-0.  **12** Error in rsync protocol data stream
-0.  **13** Errors with program diagnostics
-0.  **14** Error in IPC code
-0.  **20** Received SIGUSR1 or SIGINT
-0.  **21** Some error returned by **waitpid()**
-0.  **22** Error allocating core memory buffers
-0.  **23** Partial transfer due to error
-0.  **24** Partial transfer due to vanished source files
-0.  **25** The --max-delete limit stopped deletions
-0.  **30** Timeout in data send/receive
-0.  **35** Timeout waiting for daemon connection
-
-# ENVIRONMENT VARIABLES
+## EXIT VALUES
+
+- **0** - Success
+- **1** - Syntax or usage error
+- **2** - Protocol incompatibility
+- **3** - Errors selecting input/output files, dirs
+- **4** - Requested action not supported. Either:
+  - an attempt was made to manipulate 64-bit files on a platform that cannot support them
+  - an option was specified that is supported by the client and not by the server
+- **5** - Error starting client-server protocol
+- **6** - Daemon unable to append to log-file
+- **10** - Error in socket I/O
+- **11** - Error in file I/O
+- **12** - Error in rsync protocol data stream
+- **13** - Errors with program diagnostics
+- **14** - Error in IPC code
+- **20** - Received SIGUSR1 or SIGINT
+- **21** - Some error returned by **waitpid()**
+- **22** - Error allocating core memory buffers
+- **23** - Partial transfer due to error
+- **24** - Partial transfer due to vanished source files
+- **25** - The --max-delete limit stopped deletions
+- **30** - Timeout in data send/receive
+- **35** - Timeout waiting for daemon connection
+
+## ENVIRONMENT VARIABLES
 
 0.  `CVSIGNORE`
 
     The CVSIGNORE environment variable supplements any ignore patterns in
-    .cvsignore files.  See the `--cvs-exclude` option for more details.
+    .cvsignore files.  See the [`--cvs-exclude`](#opt) option for more details.
 
 0.  `RSYNC_ICONV`
 
-    Specify a default `--iconv` setting using this environment variable. (First
-    supported in 3.0.0.)
+    Specify a default [`--iconv`](#opt) setting using this environment
+    variable. First supported in 3.0.0.
+
+0.  `RSYNC_OLD_ARGS`
+
+    Specify a "1" if you want the [`--old-args`](#opt) option to be enabled by
+    default, a "2" (or more) if you want it to be enabled in the
+    repeated-option state, or a "0" to make sure that it is disabled by
+    default. When this environment variable is set to a non-zero value, it
+    supersedes the [`RSYNC_PROTECT_ARGS`](#) variable.
+
+    This variable is ignored if [`--old-args`](#opt), `--no-old-args`, or
+    [`--protect-args`](#opt) is specified on the command line.
+
+    First supported in 3.2.4.
 
 0.  `RSYNC_PROTECT_ARGS`
 
-    Specify a non-zero numeric value if you want the `--protect-args` option to
-    be enabled by default, or a zero value to make sure that it is disabled by
-    default. (First supported in 3.1.0.)
+    Specify a non-zero numeric value if you want the [`--protect-args`](#opt)
+    option to be enabled by default, or a zero value to make sure that it is
+    disabled by default.
+
+    This variable is ignored if [`--protect-args`](#opt), `--no-protect-args`,
+    or [`--old-args`](#opt) is specified on the command line.
+
+    First supported in 3.1.0.  Starting in 3.2.4, this variable is ignored if
+    [`RSYNC_OLD_ARGS`](#) is set to a non-zero value.
 
 0.  `RSYNC_RSH`
 
-    The RSYNC_RSH environment variable allows you to override the default shell
-    used as the transport for rsync.  Command line options are permitted after
-    the command name, just as in the `-e` option.
+    This environment variable allows you to override the default shell used as
+    the transport for rsync.  Command line options are permitted after the
+    command name, just as in the [`--rsh`](#opt) (`-e`) option.
 
 0.  `RSYNC_PROXY`
 
-    The RSYNC_PROXY environment variable allows you to redirect your rsync
-    client to use a web proxy when connecting to a rsync daemon.  You should
-    set RSYNC_PROXY to a hostname:port pair.
+    This environment variable allows you to redirect your rsync
+    client to use a web proxy when connecting to an rsync daemon.  You should
+    set `RSYNC_PROXY` to a hostname:port pair.
 
 0.  `RSYNC_PASSWORD`
 
-    Setting RSYNC_PASSWORD to the required password allows you to run
-    authenticated rsync connections to an rsync daemon without user
-    intervention.  Note that this does not supply a password to a remote shell
-    transport such as ssh; to learn how to do that, consult the remote shell's
-    documentation.
+    This environment variable allows you to set the password for an rsync
+    **daemon** connection, which avoids the password prompt.  Note that this
+    does **not** supply a password to a remote shell transport such as ssh
+    (consult its documentation for how to do that).
 
 0.  `USER` or `LOGNAME`
 
     The USER or LOGNAME environment variables are used to determine the default
     username sent to an rsync daemon.  If neither is set, the username defaults
-    to "nobody".
+    to "nobody".  If both are set, `USER` takes precedence.
+
+0. `RSYNC_PARTIAL_DIR`
+
+    This environment variable specifies the directory to use for a
+    [`--partial`](#opt) transfer without implying that partial transfers be
+    enabled.  See the [`--partial-dir`](#opt) option for full details.
+
+0. `RSYNC_COMPRESS_LIST`
+
+    This environment variable allows you to customize the negotiation of the
+    compression algorithm by specifying an alternate order or a reduced list of
+    names.  Use the command `rsync --version` to see the available compression
+    names.  See the [`--compress`](#opt) option for full details.
+
+0. `RSYNC_CHECKSUM_LIST`
+
+    This environment variable allows you to customize the negotiation of the
+    checksum algorithm by specifying an alternate order or a reduced list of
+    names.  Use the command `rsync --version` to see the available checksum
+    names.  See the [`--checksum-choice`](#opt) option for full details.
+
+0. `RSYNC_MAX_ALLOC`
+
+    This environment variable sets an allocation maximum as if you had used the
+    [`--max-alloc`](#opt) option.
+
+0. `RSYNC_PORT`
+
+    This environment variable is not read by rsync, but is instead set in
+    its sub-environment when rsync is running the remote shell in combination
+    with a daemon connection.  This allows a script such as
+    [`rsync-ssl`](rsync-ssl.1) to be able to know the port number that the user
+    specified on the command line.
 
 0.  `HOME`
 
-    The HOME environment variable is used to find the user's default .cvsignore
+    This environment variable is used to find the user's default .cvsignore
     file.
 
-# FILES
+0. `RSYNC_CONNECT_PROG`
 
-/etc/rsyncd.conf or rsyncd.conf
+    This environment variable is mainly used in debug setups to set the program
+    to use when making a daemon connection.  See [CONNECTING TO AN RSYNC
+    DAEMON](#) for full details.
 
-# SEE ALSO
+0. `RSYNC_SHELL`
 
-**rsync-ssl**(1), **rsyncd.conf**(5)
+    This environment variable is mainly used in debug setups to set the program
+    to use to run the program specified by [`RSYNC_CONNECT_PROG`].  See
+    [CONNECTING TO AN RSYNC DAEMON](#) for full details.
 
-# BUGS
+## FILES
 
-times are transferred as \*nix time_t values
+/etc/rsyncd.conf or rsyncd.conf
+
+## SEE ALSO
 
-When transferring to FAT filesystems rsync may re-sync
-unmodified files.
-See the comments on the `--modify-window` option.
+[**rsync-ssl**(1)](rsync-ssl.1), [**rsyncd.conf**(5)](rsyncd.conf.5), [**rrsync**(1)](rrsync.1)
 
-file permissions, devices, etc. are transferred as native numerical
-values
+## BUGS
 
-see also the comments on the `--delete` option
+- Times are transferred as \*nix time_t values.
+- When transferring to FAT filesystems rsync may re-sync unmodified files.  See
+  the comments on the [`--modify-window`](#opt) option.
+- File permissions, devices, etc. are transferred as native numerical values.
+- See also the comments on the [`--delete`](#opt) option.
 
 Please report bugs! See the web site at <https://rsync.samba.org/>.
 
-# VERSION
+## VERSION
 
-This man page is current for version @VERSION@ of rsync.
+This manpage is current for version @VERSION@ of rsync.
 
-# INTERNAL OPTIONS
+## INTERNAL OPTIONS
 
 The options `--server` and `--sender` are used internally by rsync, and should
 never be typed by a user under normal circumstances.  Some awareness of these
@@ -4151,13 +4500,16 @@ that can only run an rsync command.  For instance, the support directory of the
 rsync distribution has an example script named rrsync (for restricted rsync)
 that can be used with a restricted ssh login.
 
-# CREDITS
+## CREDITS
+
+Rsync is distributed under the GNU General Public License.  See the file
+[COPYING](COPYING) for details.
 
-rsync is distributed under the GNU General Public License.  See the file
-COPYING for details.
+An rsync web site is available at <https://rsync.samba.org/>.  The site
+includes an FAQ-O-Matic which may cover questions unanswered by this manual
+page.
 
-A web site is available at <https://rsync.samba.org/>.  The site includes an
-FAQ-O-Matic which may cover questions unanswered by this manual page.
+The rsync github project is <https://github.com/WayneD/rsync>.
 
 We would be delighted to hear from you if you like this program.  Please
 contact the mailing-list at <rsync@lists.samba.org>.
@@ -4165,7 +4517,7 @@ contact the mailing-list at <rsync@lists.samba.org>.
 This program uses the excellent zlib compression library written by Jean-loup
 Gailly and Mark Adler.
 
-# THANKS
+## THANKS
 
 Special thanks go out to: John Van Essen, Matt McCutchen, Wesley W. Terpstra,
 David Dykstra, Jos Backus, Sebastian Krahmer, Martin Pool, and our
@@ -4174,9 +4526,9 @@ gone-but-not-forgotten compadre, J.W. Schultz.
 Thanks also to Richard Brent, Brendan Mackay, Bill Waite, Stephen Rothwell and
 David Bell.  I've probably missed some people, my apologies if I have.
 
-# AUTHOR
+## AUTHOR
 
-rsync was originally written by Andrew Tridgell and Paul Mackerras.  Many
+Rsync was originally written by Andrew Tridgell and Paul Mackerras.  Many
 people have later contributed to it. It is currently maintained by Wayne
 Davison.
 
diff --git a/rsync.c b/rsync.c
index e7f1f96a..102e72ed 100644
--- a/rsync.c
+++ b/rsync.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -32,7 +32,9 @@ extern int preserve_acls;
 extern int preserve_xattrs;
 extern int preserve_perms;
 extern int preserve_executability;
-extern int preserve_times;
+extern int preserve_mtimes;
+extern int omit_dir_times;
+extern int omit_link_times;
 extern int am_root;
 extern int am_server;
 extern int am_daemon;
@@ -63,8 +65,7 @@ extern char *iconv_opt;
 #define UPDATED_ATIME (1<<3)
 #define UPDATED_ACLS  (1<<4)
 #define UPDATED_MODE  (1<<5)
-
-#define UPDATED_TIMES (UPDATED_MTIME|UPDATED_ATIME)
+#define UPDATED_CRTIME (1<<6)
 
 #ifdef ICONV_CONST
 iconv_t ic_chck = (iconv_t)-1;
@@ -576,17 +577,20 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp,
 		set_xattr(fname, file, fnamecmp, sxp);
 #endif
 
-	if (!preserve_times
-	 || (!(preserve_times & PRESERVE_DIR_TIMES) && S_ISDIR(sxp->st.st_mode))
-	 || (!(preserve_times & PRESERVE_LINK_TIMES) && S_ISLNK(sxp->st.st_mode)))
-		flags |= ATTRS_SKIP_MTIME | ATTRS_SKIP_ATIME;
-	else if (sxp != &sx2)
-		memcpy(&sx2.st, &sxp->st, sizeof (sx2.st));
-	if (!atimes_ndx || S_ISDIR(sxp->st.st_mode))
-		flags |= ATTRS_SKIP_ATIME;
-	/* Don't set the creation date on the root folder of an HFS+ volume. */
-	if (sxp->st.st_ino == 2 && S_ISDIR(sxp->st.st_mode))
-		flags |= ATTRS_SKIP_CRTIME;
+	if ((omit_dir_times && S_ISDIR(sxp->st.st_mode))
+	 || (omit_link_times && S_ISLNK(sxp->st.st_mode)))
+		flags |= ATTRS_SKIP_MTIME | ATTRS_SKIP_ATIME | ATTRS_SKIP_CRTIME;
+	else {
+		if (!preserve_mtimes)
+			flags |= ATTRS_SKIP_MTIME;
+		if (!atimes_ndx || S_ISDIR(sxp->st.st_mode))
+			flags |= ATTRS_SKIP_ATIME;
+		/* Don't set the creation date on the root folder of an HFS+ volume. */
+		if (sxp->st.st_ino == 2 && S_ISDIR(sxp->st.st_mode))
+			flags |= ATTRS_SKIP_CRTIME;
+	}
+	if (sxp != &sx2)
+		memcpy(&sx2.st, &sxp->st, sizeof sx2.st);
 	if (!(flags & ATTRS_SKIP_MTIME) && !same_mtime(file, &sxp->st, flags & ATTRS_ACCURATE_TIME)) {
 		sx2.st.st_mtime = file->modtime;
 #ifdef ST_MTIME_NSEC
@@ -604,28 +608,36 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp,
 			updated |= UPDATED_ATIME;
 		}
 	}
-	if (updated & UPDATED_TIMES) {
+#ifdef SUPPORT_CRTIMES
+	if (crtimes_ndx && !(flags & ATTRS_SKIP_CRTIME)) {
+		time_t file_crtime = F_CRTIME(file);
+		if (sxp->crtime == 0)
+			sxp->crtime = get_create_time(fname, &sxp->st);
+		if (!same_time(sxp->crtime, 0L, file_crtime, 0L)) {
+			if (
+#ifdef HAVE_GETATTRLIST
+			     do_setattrlist_crtime(fname, file_crtime) == 0
+#elif defined __CYGWIN__
+			     do_SetFileTime(fname, file_crtime) == 0
+#else
+#error Unknown crtimes implementation
+#endif
+			)
+				updated |= UPDATED_CRTIME;
+		}
+	}
+#endif
+	if (updated & (UPDATED_MTIME|UPDATED_ATIME)) {
 		int ret = set_times(fname, &sx2.st);
 		if (ret < 0) {
-			rsyserr(FERROR_XFER, errno, "failed to set times on %s",
-				full_fname(fname));
+			rsyserr(FERROR_XFER, errno, "failed to set times on %s", full_fname(fname));
 			goto cleanup;
 		}
 		if (ret > 0) { /* ret == 1 if symlink could not be set */
-			updated &= ~UPDATED_TIMES;
+			updated &= ~(UPDATED_MTIME|UPDATED_ATIME);
 			file->flags |= FLAG_TIME_FAILED;
 		}
 	}
-#ifdef SUPPORT_CRTIMES
-	if (crtimes_ndx && !(flags & ATTRS_SKIP_CRTIME)) {
-		time_t file_crtime = F_CRTIME(file);
-		if (sxp->crtime == 0)
-			sxp->crtime = get_create_time(fname);
-		if (!same_time(sxp->crtime, 0L, file_crtime, 0L)
-		 && set_create_time(fname, file_crtime) == 0)
-			updated = 1;
-	}
-#endif
 
 #ifdef SUPPORT_ACLS
 	/* It's OK to call set_acl() now, even for a dir, as the generator
diff --git a/rsync.h b/rsync.h
index 0f5304ee..e5aacd25 100644
--- a/rsync.h
+++ b/rsync.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1996, 2000 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -108,12 +108,22 @@
 #define BITS_EQUAL(b1,b2,mask) (((unsigned)(b1) & (unsigned)(mask)) \
 			     == ((unsigned)(b2) & (unsigned)(mask)))
 
-/* update this if you make incompatible changes */
+/* Update this if you make incompatible changes and ALSO update the
+ * SUBPROTOCOL_VERSION if it is not a final (official) release. */
 #define PROTOCOL_VERSION 31
 
-/* This is used when working on a new protocol version in CVS, and should
- * be a new non-zero value for each CVS change that affects the protocol.
- * It must ALWAYS be 0 when the protocol goes final (and NEVER before)! */
+/* This is used when working on a new protocol version or for any unofficial
+ * protocol tweaks.  It should be a non-zero value for each pre-release repo
+ * change that affects the protocol. The official pre-release versions should
+ * start with 1 (after incrementing the PROTOCOL_VERSION) and go up by 1 for
+ * each new protocol change.  For unofficial changes, pick a fairly large
+ * random number that will hopefully not collide with anyone else's unofficial
+ * protocol.  It must ALWAYS be 0 when the protocol goes final (and official)
+ * and NEVER before!  When rsync negotiates a protocol match, it will only
+ * allow the newest protocol to be used if the SUBPROTOCOL_VERSION matches.
+ * All older protocol versions MUST be compatible with the final, official
+ * release of the protocol, so don't tweak the code to change the protocol
+ * behavior for an older protocol version. */
 #define SUBPROTOCOL_VERSION 0
 
 /* We refuse to interoperate with versions that are not in this range.
@@ -267,6 +277,10 @@ enum msgcode {
 	MSG_NO_SEND=102,/* sender failed to open a file we wanted */
 };
 
+enum filetype {
+	FT_UNSUPPORTED, FT_REG, FT_DIR, FT_SYMLINK, FT_SPECIAL, FT_DEVICE
+};
+
 #define NDX_DONE -1
 #define NDX_FLIST_EOF -2
 #define NDX_DEL_STATS -3
@@ -300,7 +314,6 @@ enum delret {
 #include "errcode.h"
 
 #include "config.h"
-#include "version.h"
 
 /* The default RSYNC_RSH is always set in config.h. */
 
@@ -478,7 +491,6 @@ enum delret {
 #ifndef __TANDEM
 #define MAKEDEV(devmajor,devminor) makedev(devmajor,devminor)
 #else
-# include <sys/stat.h>
 # define major DEV_TO_MAJOR
 # define minor DEV_TO_MINOR
 # define MAKEDEV MAJORMINOR_TO_DEV
@@ -570,11 +582,11 @@ typedef unsigned int size_t;
 #endif
 #endif
 
-#ifndef __APPLE__ /* Do we need a configure check for this? */
+#if !defined __APPLE__ || defined HAVE_GETATTRLIST
 #define SUPPORT_ATIMES 1
 #endif
 
-#ifdef HAVE_GETATTRLIST
+#if defined HAVE_GETATTRLIST || defined __CYGWIN__
 #define SUPPORT_CRTIMES 1
 #endif
 
@@ -766,6 +778,11 @@ struct ht_int64_node {
 
 #if defined __STDC_VERSION__ && __STDC_VERSION__ >= 199901L
 #define USE_FLEXIBLE_ARRAY 1
+#define SIZE_T_FMT_MOD "z" /* printf supports %zd */
+#define SIZE_T_FMT_CAST size_t
+#else
+#define SIZE_T_FMT_MOD "l" /* printf supports %ld */
+#define SIZE_T_FMT_CAST long
 #endif
 
 union file_extras {
@@ -904,8 +921,9 @@ extern int xattrs_ndx;
  * Start the flist array at FLIST_START entries and grow it
  * by doubling until FLIST_LINEAR then grow by FLIST_LINEAR
  */
-#define FLIST_START	(32 * 1024)
-#define FLIST_LINEAR	(FLIST_START * 512)
+#define FLIST_START		(32)
+#define FLIST_START_LARGE	(32 * 1024)
+#define FLIST_LINEAR		(FLIST_START_LARGE * 512)
 
 /*
  * Extent size for allocation pools: A minimum size of 128KB
@@ -1151,9 +1169,13 @@ struct name_num_obj {
 	uchar *saw;
 	int saw_len;
 	int negotiated_num;
-	struct name_num_item list[8]; /* A big-enough len (we'll get a compile error if it is ever too small) */
+	struct name_num_item list[10]; /* we'll get a compile error/warning if this is ever too small */
 };
 
+#ifdef EXTERNAL_ZLIB
+#define read_buf read_buf_
+#endif
+
 #ifndef __cplusplus
 #include "proto.h"
 #endif
@@ -1312,10 +1334,6 @@ extern int errno;
 #define IS_SPECIAL(mode) (S_ISSOCK(mode) || S_ISFIFO(mode))
 #define IS_DEVICE(mode) (S_ISCHR(mode) || S_ISBLK(mode))
 
-#define PRESERVE_FILE_TIMES	(1<<0)
-#define PRESERVE_DIR_TIMES	(1<<1)
-#define PRESERVE_LINK_TIMES	(1<<2)
-
 /* Initial mask on permissions given to temporary files.  Mask off setuid
      bits and group access because of potential race-condition security
      holes, and mask other access because mode 707 is bizarre */
@@ -1405,7 +1423,8 @@ extern short info_levels[], debug_levels[];
 #define INFO_MISC (INFO_FLIST+1)
 #define INFO_MOUNT (INFO_MISC+1)
 #define INFO_NAME (INFO_MOUNT+1)
-#define INFO_PROGRESS (INFO_NAME+1)
+#define INFO_NONREG (INFO_NAME+1)
+#define INFO_PROGRESS (INFO_NONREG+1)
 #define INFO_REMOVE (INFO_PROGRESS+1)
 #define INFO_SKIP (INFO_REMOVE+1)
 #define INFO_STATS (INFO_SKIP+1)
@@ -1460,3 +1479,9 @@ const char *get_panic_action(void);
     fprintf(stderr, "%s in %s at line %d\n", msg, __FILE__, __LINE__); \
     exit_cleanup(RERR_UNSUPPORTED); \
 } while (0)
+
+#ifdef HAVE_MALLINFO2
+#define MEM_ALLOC_INFO mallinfo2
+#elif defined HAVE_MALLINFO
+#define MEM_ALLOC_INFO mallinfo
+#endif
diff --git a/rsyncd.conf.5.md b/rsyncd.conf.5.md
index b70532b1..c61765a7 100644
--- a/rsyncd.conf.5.md
+++ b/rsyncd.conf.5.md
@@ -1,12 +1,15 @@
-# NAME
+## NAME
 
 rsyncd.conf - configuration file for rsync in daemon mode
 
-# SYNOPSIS
+## SYNOPSIS
 
 rsyncd.conf
 
-# DESCRIPTION
+The online version of this manpage (that includes cross-linking of topics)
+is available at <https://download.samba.org/pub/rsync/rsyncd.conf.5>.
+
+## DESCRIPTION
 
 The rsyncd.conf file is the runtime configuration file for rsync when run as an
 rsync daemon.
@@ -14,7 +17,7 @@ rsync daemon.
 The rsyncd.conf file controls authentication, access, logging and available
 modules.
 
-# FILE FORMAT
+## FILE FORMAT
 
 The file consists of modules and parameters. A module begins with the name of
 the module in square brackets and continues until the next module begins.
@@ -40,10 +43,9 @@ The values following the equals sign in parameters are all either a string (no
 quotes needed) or a boolean, which may be given as yes/no, 0/1 or true/false.
 Case is not significant in boolean values, but is preserved in string values.
 
-# LAUNCHING THE RSYNC DAEMON
+## LAUNCHING THE RSYNC DAEMON
 
-The rsync daemon is launched by specifying the `--daemon` option to
-rsync.
+The rsync daemon is launched by specifying the `--daemon` option to rsync.
 
 The daemon must run with root privileges if you wish to use chroot, to bind to
 a port numbered under 1024 (as is the default 873), or to set file ownership.
@@ -60,16 +62,16 @@ When run via inetd you should add a line like this to /etc/services:
 
 and a single line something like this to /etc/inetd.conf:
 
->     rsync   stream  tcp     nowait  root   /usr/bin/rsync rsyncd --daemon
+>     rsync   stream  tcp     nowait  root   @BINDIR@/rsync rsyncd --daemon
 
-Replace "/usr/bin/rsync" with the path to where you have rsync installed on
+Replace "@BINDIR@/rsync" with the path to where you have rsync installed on
 your system.  You will then need to send inetd a HUP signal to tell it to
 reread its config file.
 
 Note that you should **not** send the rsync daemon a HUP signal to force it to
 reread the `rsyncd.conf` file. The file is re-read on each client connection.
 
-# GLOBAL PARAMETERS
+## GLOBAL PARAMETERS
 
 The first parameters in the file (before a [module] header) are the global
 parameters.  Rsync also allows for the use of a "[global]" module name to
@@ -96,9 +98,9 @@ a literal % into a value is to use %%.
 
 0.  `motd file`
 
-    This parameter allows you to specify a "message of the day" to display to
-    clients on each connect. This usually contains site information and any
-    legal notices. The default is no motd file.  This can be overridden by the
+    This parameter allows you to specify a "message of the day" (MOTD) to display
+    to clients on each connect. This usually contains site information and any
+    legal notices. The default is no MOTD file.  This can be overridden by the
     `--dparam=motdfile=FILE` command-line option when starting the daemon.
 
 0.  `pid file`
@@ -126,7 +128,7 @@ a literal % into a value is to use %%.
 
     This parameter can provide endless fun for people who like to tune their
     systems to the utmost degree. You can set all sorts of socket options which
-    may make transfers faster (or slower!). Read the man page for the
+    may make transfers faster (or slower!). Read the manpage for the
     **setsockopt()** system call for details on some of the options you may be
     able to set. By default no special socket options are set.  These settings
     can also be specified via the `--sockopts` command-line option.
@@ -136,7 +138,7 @@ a literal % into a value is to use %%.
     You can override the default backlog value when the daemon listens for
     connections.  It defaults to 5.
 
-# MODULE PARAMETERS
+## MODULE PARAMETERS
 
 After the global parameters you should define a number of modules, each module
 exports a directory tree as a symbolic name. Modules are exported by specifying
@@ -177,7 +179,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
 0.  `use chroot`
 
-    If "use chroot" is true, the rsync daemon will chroot to the "path" before
+    If "use chroot" is true, the rsync daemon will chroot to the "[path](#)" before
     starting the file transfer with the client.  This has the advantage of
     extra protection against possible implementation security holes, but it has
     the disadvantages of requiring super-user privileges, of not being able to
@@ -186,7 +188,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     below).
 
     As an additional safety feature, you can specify a dot-dir in the module's
-    "path" to indicate the point where the chroot should occur.  This allows
+    "[path](#)" to indicate the point where the chroot should occur.  This allows
     rsync to run in a chroot with a non-"/" path for the top of the transfer
     hierarchy.  Doing this guards against unintended library loading (since
     those absolute paths will not be inside the transfer hierarchy unless you
@@ -197,18 +199,18 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     chroot would have used the whole path, and the inside-chroot path would
     have been "/".
 
-    When both "use chroot" and "daemon chroot" are false, OR the inside-chroot
+    When both "use chroot" and "[daemon chroot](#)" are false, OR the inside-chroot
     path of "use chroot" is not "/", rsync will: (1) munge symlinks by default
-    for security reasons (see "munge symlinks" for a way to turn this off, but
+    for security reasons (see "[munge symlinks](#)" for a way to turn this off, but
     only if you trust your users), (2) substitute leading slashes in absolute
     paths with the module's path (so that options such as `--backup-dir`,
     `--compare-dest`, etc. interpret an absolute path as rooted in the module's
-    "path" dir), and (3) trim ".." path elements from args if rsync believes
+    "[path](#)" dir), and (3) trim ".." path elements from args if rsync believes
     they would escape the module hierarchy.  The default for "use chroot" is
     true, and is the safer choice (especially if the module is not read-only).
 
-    When this parameter is enabled *and* the "name converter" parameter is
-    *not* set, the "numeric ids" parameter will default to being enabled
+    When this parameter is enabled *and* the "[name converter](#)" parameter is
+    *not* set, the "[numeric ids](#)" parameter will default to being enabled
     (disabling name lookups).  This means that if you manually setup
     name-lookup libraries in your chroot (instead of using a name converter)
     that you need to explicitly set `numeric ids = false` for rsync to do name
@@ -217,16 +219,16 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     If you copy library resources into the module's chroot area, you should
     protect them through your OS's normal user/group or ACL settings (to
     prevent the rsync module's user from being able to change them), and then
-    hide them from the user's view via "exclude" (see how in the discussion of
+    hide them from the user's view via "[exclude](#)" (see how in the discussion of
     that parameter).  However, it's easier and safer to setup a name converter.
 
 0.  `daemon chroot`
 
     This parameter specifies a path to which the daemon will chroot before
-    beginning communication with clients. Module paths (and any "use chroot"
+    beginning communication with clients. Module paths (and any "[use chroot](#)"
     settings) will then be related to this one. This lets you choose if you
     want the whole daemon to be chrooted (with this setting), just the
-    transfers to be chrooted (with "use chroot"), or both.  Keep in mind that
+    transfers to be chrooted (with "[use chroot](#)"), or both.  Keep in mind that
     the "daemon chroot" area may need various OS/lib/etc files installed to
     allow the daemon to function.  By default the daemon runs without any
     chrooting.
@@ -284,11 +286,11 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     transfer behave as if the client had passed the `--numeric-ids`
     command-line option.  By default, this parameter is enabled for chroot
     modules and disabled for non-chroot modules.  Also keep in mind that
-    uid/gid preservation requires the module to be running as root (see "uid")
-    or for "fake super" to be configured.
+    uid/gid preservation requires the module to be running as root (see "[uid](#)")
+    or for "[fake super](#)" to be configured.
 
     A chroot-enabled module should not have this parameter set to false unless
-    you're using a "name converter" program *or* you've taken steps to ensure
+    you're using a "[name converter](#)" program *or* you've taken steps to ensure
     that the module has the necessary resources it needs to translate names and
     that it is not possible for a user to change those resources.
 
@@ -298,12 +300,12 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     (non-daemon-affecting) `--munge-links` command-line option (using a method
     described below).  This should help protect your files from user trickery
     when your daemon module is writable.  The default is disabled when
-    "use chroot" is on with an inside-chroot path of "/", OR if "daemon chroot"
+    "[use chroot](#)" is on with an inside-chroot path of "/", OR if "[daemon chroot](#)"
     is on, otherwise it is enabled.
 
     If you disable this parameter on a daemon that is not read-only, there are
     tricks that a user can play with uploaded symlinks to access
-    daemon-excluded items (if your module has any), and, if "use chroot" is
+    daemon-excluded items (if your module has any), and, if "[use chroot](#)" is
     off, rsync can even be tricked into showing or changing data that is
     outside the module's path (as access-permissions allow).
 
@@ -324,7 +326,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     the source code named "munge-symlinks" that can be used to add or remove
     this prefix from your symlinks.
 
-    When this parameter is disabled on a writable module and "use chroot" is
+    When this parameter is disabled on a writable module and "[use chroot](#)" is
     off (or the inside-chroot path is not "/"), incoming symlinks will be
     modified to drop a leading slash and to remove ".." path elements that
     rsync believes will allow a symlink to escape the module's hierarchy.
@@ -340,10 +342,10 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     conversion in a chroot module without extra files in the chroot area, and
     also ensures that name-translation is done in a consistent manner.  If the
     "charset" parameter is not set, the `--iconv` option is refused, just as if
-    "iconv" had been specified via "refuse options".
+    "iconv" had been specified via "[refuse options](#)".
 
     If you wish to force users to always use `--iconv` for a particular module,
-    add "no-iconv" to the "refuse options" parameter.  Keep in mind that this
+    add "no-iconv" to the "[refuse options](#)" parameter.  Keep in mind that this
     will restrict access to your module to very new rsync clients.
 
 0.  `max connections`
@@ -352,7 +354,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     connections you will allow.  Any clients connecting when the maximum has
     been reached will receive a message telling them to try later.  The default
     is 0, which means no limit.  A negative value disables the module.  See
-    also the "lock file" parameter.
+    also the "[lock file](#)" parameter.
 
 0.  `log file`
 
@@ -381,7 +383,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     facility name which is defined on your system. Common names are auth,
     authpriv, cron, daemon, ftp, kern, lpr, mail, news, security, syslog, user,
     uucp, local0, local1, local2, local3, local4, local5, local6 and local7.
-    The default is daemon.  This setting has no effect if the "log file"
+    The default is daemon.  This setting has no effect if the "[log file](#)"
     setting is a non-empty string (either set in the per-modules settings, or
     inherited from the global settings).
 
@@ -389,7 +391,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
     This parameter allows you to specify the syslog tag to use when logging
     messages from the rsync daemon. The default is "rsyncd".  This setting has
-    no effect if the "log file" setting is a non-empty string (either set in
+    no effect if the "[log file](#)" setting is a non-empty string (either set in
     the per-modules settings, or inherited from the global settings).
 
     For example, if you wanted each authenticated user's name to be included in
@@ -414,7 +416,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
 0.  `lock file`
 
-    This parameter specifies the file to use to support the "max connections"
+    This parameter specifies the file to use to support the "[max connections](#)"
     parameter. The rsync daemon uses record locking on this file to ensure that
     the max connections limit is not exceeded for the modules sharing the lock
     file.  The default is `/var/run/rsyncd.lock`.
@@ -426,7 +428,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     "read only" is false then uploads will be possible if file permissions on
     the daemon side allow them. The default is for all modules to be read only.
 
-    Note that "auth users" can override this setting on a per-user basis.
+    Note that "[auth users](#)" can override this setting on a per-user basis.
 
 0.  `write only`
 
@@ -460,8 +462,8 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     This parameter determines whether this module is listed when the client
     asks for a listing of available modules.  In addition, if this is false,
     the daemon will pretend the module does not exist when a client denied by
-    "hosts allow" or "hosts deny" attempts to access it.  Realize that if
-    "reverse lookup" is disabled globally but enabled for the module, the
+    "[hosts allow](#)" or "[hosts deny](#)" attempts to access it.  Realize that if
+    "[reverse lookup](#)" is disabled globally but enabled for the module, the
     resulting reverse lookup to a potentially client-controlled DNS server may
     still reveal to the client that it hit an existing module.  The default is
     for modules to be listable.
@@ -470,10 +472,10 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
     This parameter specifies the user name or user ID that file transfers to
     and from that module should take place as when the daemon was run as root.
-    In combination with the "gid" parameter this determines what file
+    In combination with the "[gid](#)" parameter this determines what file
     permissions are available. The default when run by a super-user is to
     switch to the system's "nobody" user.  The default for a non-super-user is
-    to not try to change the user.  See also the "gid" parameter.
+    to not try to change the user.  See also the "[gid](#)" parameter.
 
     The RSYNC_USER_NAME environment variable may be used to request that rsync
     run as the authorizing user.  For example, if you want a rsync to run as
@@ -489,7 +491,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     accessing the module.  The first one will be the default group, and any
     extra ones be set as supplemental groups.  You may also specify a "`*`" as
     the first gid in the list, which will be replaced by all the normal groups
-    for the transfer's user (see "uid").  The default when run by a super-user
+    for the transfer's user (see "[uid](#)").  The default when run by a super-user
     is to switch to your OS's "nobody" (or perhaps "nogroup") group with no
     other supplementary groups.  The default for a non-super-user is to not
     change any group attributes (and indeed, your OS may not allow a
@@ -505,13 +507,13 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
     This parameter specifies a uid under which the daemon will run. The daemon
     usually runs as user root, and when this is left unset the user is left
-    unchanged. See also the "uid" parameter.
+    unchanged. See also the "[uid](#)" parameter.
 
 0.  `daemon gid`
 
     This parameter specifies a gid under which the daemon will run. The daemon
     usually runs as group root, and when this is left unset, the group is left
-    unchanged. See also the "gid" parameter.
+    unchanged. See also the "[gid](#)" parameter.
 
 0.  `fake super`
 
@@ -532,8 +534,8 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     or tampering with private administrative files, such as files you may add
     to support uid/gid name translations.
 
-    The daemon filter chain is built from the "filter", "include from",
-    "include", "exclude from", and "exclude" parameters, in that order of
+    The daemon filter chain is built from the "filter", "[include from](#)",
+    "[include](#)", "[exclude from](#)", and "[exclude](#)" parameters, in that order of
     priority.  Anchored patterns are anchored at the root of the module.  To
     prevent access to an entire subtree, for example, "`/secret`", you **must**
     exclude everything in the subtree; the easiest way to do this is with a
@@ -560,8 +562,8 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
 0.  `include`
 
-    Use an "include" to override the effects of the "exclude" parameter.  Only
-    one "include" parameter can apply to a given module.  See the "filter"
+    Use an "include" to override the effects of the "[exclude](#)" parameter.  Only
+    one "include" parameter can apply to a given module.  See the "[filter](#)"
     parameter for a description of how excluded files affect the daemon.
 
 0.  `exclude from`
@@ -569,14 +571,14 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     This parameter specifies the name of a file on the daemon that contains
     daemon exclude patterns, one per line.  Only one "exclude from" parameter
     can apply to a given module; if you have multiple exclude-from files, you
-    can specify them as a merge file in the "filter" parameter.  See the
-    "filter" parameter for a description of how excluded files affect the
+    can specify them as a merge file in the "[filter](#)" parameter.  See the
+    "[filter](#)" parameter for a description of how excluded files affect the
     daemon.
 
 0.  `include from`
 
-    Analogue of "exclude from" for a file of daemon include patterns.  Only one
-    "include from" parameter can apply to a given module.  See the "filter"
+    Analogue of "[exclude from](#)" for a file of daemon include patterns.  Only one
+    "include from" parameter can apply to a given module.  See the "[filter](#)"
     parameter for a description of how excluded files affect the daemon.
 
 0.  `incoming chmod`
@@ -611,7 +613,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     to supply a username and password to connect to the module. A challenge
     response authentication protocol is used for this exchange. The plain text
     usernames and passwords are stored in the file specified by the
-    "secrets file" parameter. The default is for all users to be able to
+    "[secrets file](#)" parameter. The default is for all users to be able to
     connect without a password (this is called "anonymous rsync").
 
     In addition to username matching, you can specify groupname matching via a
@@ -623,7 +625,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     Finally, options may be specified after a colon (:).  The options allow you
     to "deny" a user or a group, set the access to "ro" (read-only), or set the
     access to "rw" (read/write).  Setting an auth-rule-specific ro/rw setting
-    overrides the module's "read only" setting.
+    overrides the module's "[read only](#)" setting.
 
     Be sure to put the rules in the order you want them to be matched, because
     the checking stops at the first matching user or group, and that is the
@@ -661,7 +663,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
     This parameter specifies the name of a file that contains the
     username:password and/or @groupname:password pairs used for authenticating
-    this module. This file is only consulted if the "auth users" parameter is
+    this module. This file is only consulted if the "[auth users](#)" parameter is
     specified.  The file is line-based and contains one name:password pair per
     line.  Any line has a hash (#) as the very first character on the line is
     considered a comment and is skipped.  The passwords can contain any
@@ -675,14 +677,14 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     "@groupname:password" line for the group that triggered the authentication.
 
     It is up to you what kind of password entries you want to include, either
-    users, groups, or both.  The use of group rules in "auth users" does not
+    users, groups, or both.  The use of group rules in "[auth users](#)" does not
     require that you specify a group password if you do not want to use shared
     passwords.
 
     There is no default for the "secrets file" parameter, you must choose a
     name (such as `/etc/rsyncd.secrets`).  The file must normally not be
-    readable by "other"; see "strict modes".  If the file is not found or is
-    rejected, no logins for a "user auth" module will be possible.
+    readable by "other"; see "[strict modes](#)".  If the file is not found or is
+    rejected, no logins for an "[auth users](#)" module will be possible.
 
 0.  `strict modes`
 
@@ -714,11 +716,11 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
       addresses which match the masked IP address will be allowed in.
     - a hostname pattern using wildcards. If the hostname of the connecting IP
       (as determined by a reverse lookup) matches the wildcarded name (using
-      the same rules as normal unix filename matching), the client is allowed
-      in.  This only works if "reverse lookup" is enabled (the default).
+      the same rules as normal Unix filename matching), the client is allowed
+      in.  This only works if "[reverse lookup](#)" is enabled (the default).
     - a hostname. A plain hostname is matched against the reverse DNS of the
-      connecting IP (if "reverse lookup" is enabled), and/or the IP of the
-      given hostname is matched against the connecting IP (if "forward lookup"
+      connecting IP (if "[reverse lookup](#)" is enabled), and/or the IP of the
+      given hostname is matched against the connecting IP (if "[forward lookup](#)"
       is enabled, as it is by default).  Any match will be allowed in.
     - an '@' followed by a netgroup name, which will match if the reverse DNS
       of the connecting IP is in the specified netgroup.
@@ -730,11 +732,11 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     >     fe80::%link1/64
     >     fe80::%link1/ffff:ffff:ffff:ffff::
 
-    You can also combine "hosts allow" with "hosts deny" as a way to add
+    You can also combine "hosts allow" with "[hosts deny](#)" as a way to add
     exceptions to your deny list.  When both parameters are specified, the
     "hosts allow" parameter is checked first and a match results in the client
     being able to connect.  A non-allowed host is then matched against the
-    "hosts deny" list to see if it should be rejected.  A host that does not
+    "[hosts deny](#)" list to see if it should be rejected.  A host that does not
     match either list is allowed to connect.
 
     The default is no "hosts allow" parameter, which means all hosts can
@@ -745,7 +747,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     This parameter allows you to specify a list of comma- and/or
     whitespace-separated patterns that are matched against a connecting clients
     hostname and IP address. If the pattern matches then the connection is
-    rejected. See the "hosts allow" parameter for more information.
+    rejected. See the "[hosts allow](#)" parameter for more information.
 
     The default is no "hosts deny" parameter, which means all hosts can
     connect.
@@ -753,8 +755,8 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 0.  `reverse lookup`
 
     Controls whether the daemon performs a reverse lookup on the client's IP
-    address to determine its hostname, which is used for "hosts allow" &
-    "hosts deny" checks and the "%h" log escape.  This is enabled by default,
+    address to determine its hostname, which is used for "[hosts allow](#)" &
+    "[hosts deny](#)" checks and the "%h" log escape.  This is enabled by default,
     but you may wish to disable it to save time if you know the lookup will not
     return a useful result, in which case the daemon will use the name
     "UNDETERMINED" instead.
@@ -794,7 +796,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     logs the transfer at the end, so if a transfer is aborted, no mention will
     be made in the log file.
 
-    If you want to customize the log lines, see the "log format" parameter.
+    If you want to customize the log lines, see the "[log format](#)" parameter.
 
 0.  `log format`
 
@@ -811,7 +813,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     (e.g. "`%''l %'b %f`").
 
     The default log format is "`%o %h [%a] %m (%u) %f %l`", and a "`%t [%p] `"
-    is always prefixed when using the "log file" parameter.  (A perl script
+    is always prefixed when using the "[log file](#)" parameter.  (A perl script
     that will summarize this default log format is included in the rsync source
     code distribution in the "support" subdirectory: rsyncstats.)
 
@@ -922,17 +924,19 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
 
     >     refuse options = * !a !delete* delete-after
 
-    A note on refusing "compress" -- it is better to set the "dont compress"
-    daemon parameter to "`*`" because that disables compression silently
+    A note on refusing "compress": it may be better to set the "[dont compress](#)"
+    daemon parameter to "`*`" and ensure that `RSYNC_COMPRESS_LIST=zlib` is set
+    in the environment of the daemon in order to disable compression silently
     instead of returning an error that forces the client to remove the `-z`
     option.
 
-    If you are un-refusing the compress option, you probably want to match
-    "`!compress*`" so that you also accept the `--compress-level` option.
+    If you are un-refusing the compress option, you may want to match
+    "`!compress*`" if you also want to allow the `--compress-level` option.
 
-    Note that the "write-devices" option is refused by default, but can be
-    explicitly accepted with "`!write-devices`".  The options "log-file" and
-    "log-file-format" are forcibly refused and cannot be accepted.
+    Note that the "copy-devices" & "write-devices" options are refused by
+    default, but they can be explicitly accepted with "`!copy-devices`" and/or
+    "`!write-devices`".  The options "log-file" and "log-file-format" are
+    forcibly refused and cannot be accepted.
 
     Here are all the options that are not matched by wild-cards:
 
@@ -942,18 +946,22 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
       receiver.  While rsync passes the older alias `--log-format` for
       compatibility reasons, this options should not be confused with
       `--log-file-format`.
-    - `--sender`: Use "write only" parameter instead of refusing this.
+    - `--sender`: Use "[write only](#)" parameter instead of refusing this.
     - `--dry-run`, `-n`: Who would want to disable this?
     - `--protect-args`, `-s`: This actually makes transfers safer.
     - `--from0`, `-0`: Makes it easier to accept/refuse `--files-from` without
       affecting this helpful modifier.
-    - `--iconv`: This is auto-disabled based on "charset" parameter.
+    - `--iconv`: This is auto-disabled based on "[charset](#)" parameter.
     - `--no-iconv`: Most transfers use this option.
     - `--checksum-seed`: Is a fairly rare, safe option.
     - `--write-devices`: Is non-wild but also auto-disabled.
 
 0.  `dont compress`
 
+    **NOTE:** This parameter currently has no effect except in one instance: if
+    it is set to "`*`" then it minimizes or disables compression for all files
+    (for those that don't want to refuse the `--compress` option completely).
+
     This parameter allows you to select filenames based on wildcard patterns
     that should not be compressed when pulling files from the daemon (no
     analogous parameter exists to govern the pushing of files to a daemon).
@@ -964,14 +972,14 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     The "dont compress" parameter takes a space-separated list of
     case-insensitive wildcard patterns. Any source filename matching one of the
     patterns will be compressed as little as possible during the transfer.  If
-    the compression algorithm has an "off" level (such as zlib/zlibx) then no
-    compression occurs for those files.  Other algorithms have the level
-    minimized to reduces the CPU usage as much as possible.
+    the compression algorithm has an "off" level, then no compression occurs
+    for those files.  If an algorithms has the ability to change the level in
+    mid-stream, it will be minimized to reduce the CPU usage as much as
+    possible.
 
     See the `--skip-compress` parameter in the **rsync**(1) manpage for the
-    list of file suffixes that are not compressed by default.  Specifying a
-    value for the "dont compress" parameter changes the default when the daemon
-    is the sender.
+    list of file suffixes that are skipped by default if this parameter is not
+    set.
 
 0.  `early exec`, `pre-xfer exec`, `post-xfer exec`
 
@@ -1033,7 +1041,7 @@ the values of parameters.  See the GLOBAL PARAMETERS section for more details.
     **system()** call's default shell), and use RSYNC_NO_XFER_EXEC to disable
     both options completely.
 
-# CONFIG DIRECTIVES
+## CONFIG DIRECTIVES
 
 There are currently two config directives available that allow a config file to
 incorporate the contents of other files:  `&include` and `&merge`.  Both allow
@@ -1088,7 +1096,7 @@ This would merge any `/etc/rsyncd.d/*.inc` files (for global values that should
 stay in effect), and then include any `/etc/rsyncd.d/*.conf` files (defining
 modules without any global-value cross-talk).
 
-# AUTHENTICATION STRENGTH
+## AUTHENTICATION STRENGTH
 
 The authentication protocol used in rsync is a 128 bit MD4 based challenge
 response system. This is fairly weak protection, though (with at least one
@@ -1103,7 +1111,7 @@ authentication is provided. Use ssh as the transport if you want encryption.
 You can also make use of SSL/TLS encryption if you put rsync behind an
 SSL proxy.
 
-# SSL/TLS Daemon Setup
+## SSL/TLS Daemon Setup
 
 When setting up an rsync daemon for access via SSL/TLS, you will need to
 configure a proxy (such as haproxy or nginx) as the front-end that handles the
@@ -1148,7 +1156,7 @@ An example nginx proxy setup is as follows:
 > }
 > ```
 
-# EXAMPLES
+## EXAMPLES
 
 A simple rsyncd.conf file that allow anonymous rsync to a ftp area at
 `/home/ftp` would be:
@@ -1197,45 +1205,39 @@ The /etc/rsyncd.secrets file would look something like this:
 >     tridge:mypass
 >     susan:herpass
 
-# FILES
+## FILES
 
 /etc/rsyncd.conf or rsyncd.conf
 
-# SEE ALSO
+## SEE ALSO
 
-**rsync**(1), **rsync-ssl**(1)
+[**rsync**(1)](rsync.1), [**rsync-ssl**(1)](rsync-ssl.1)
 
-# BUGS
+## BUGS
 
 Please report bugs! The rsync bug tracking system is online at
 <https://rsync.samba.org/>.
 
-# VERSION
-
-This man page is current for version @VERSION@ of rsync.
-
-# CREDITS
-
-rsync is distributed under the GNU General Public License.  See the file
-COPYING for details.
+## VERSION
 
-The primary ftp site for rsync is <ftp://rsync.samba.org/pub/rsync>
+This manpage is current for version @VERSION@ of rsync.
 
-A web site is available at <https://rsync.samba.org/>.
+## CREDITS
 
-We would be delighted to hear from you if you like this program.
+Rsync is distributed under the GNU General Public License.  See the file
+[COPYING](COPYING) for details.
 
-This program uses the zlib compression library written by Jean-loup Gailly and
-Mark Adler.
+An rsync web site is available at <https://rsync.samba.org/> and its github
+project is <https://github.com/WayneD/rsync>.
 
-# THANKS
+## THANKS
 
 Thanks to Warren Stanley for his original idea and patch for the rsync daemon.
 Thanks to Karsten Thygesen for his many suggestions and documentation!
 
-# AUTHOR
+## AUTHOR
 
-rsync was written by Andrew Tridgell and Paul Mackerras.  Many people have
+Rsync was written by Andrew Tridgell and Paul Mackerras.  Many people have
 later contributed to it.
 
 Mailing lists for support and development are available at
diff --git a/runtests.sh b/runtests.sh
index ecb383e8..0c463bec 100755
--- a/runtests.sh
+++ b/runtests.sh
@@ -1,7 +1,7 @@
 #! /bin/sh
 
 # Copyright (C) 2001, 2002 by Martin Pool <mbp@samba.org>
-# Copyright (C) 2003-2020 Wayne Davison
+# Copyright (C) 2003-2022 Wayne Davison
 
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version
@@ -155,7 +155,7 @@ if test x"$TOOLDIR" = x; then
     TOOLDIR=`pwd`
 fi
 srcdir=`dirname $0`
-if test x"$srcdir" = x -o x"$srcdir" = x.; then
+if test x"$srcdir" = x || test x"$srcdir" = x.; then
     srcdir="$TOOLDIR"
 fi
 if test x"$rsync_bin" = x; then
@@ -167,10 +167,10 @@ RSYNC="$rsync_bin $*"
 #RSYNC="valgrind $rsync_bin $*"
 
 TLS_ARGS=''
-if egrep '^#define HAVE_LUTIMES 1' config.h >/dev/null; then
+if grep -E '^#define HAVE_LUTIMES 1' config.h >/dev/null; then
     TLS_ARGS="$TLS_ARGS -l"
 fi
-if egrep '#undef CHOWN_MODIFIES_SYMLINK' config.h >/dev/null; then
+if grep -E '#undef CHOWN_MODIFIES_SYMLINK' config.h >/dev/null; then
     TLS_ARGS="$TLS_ARGS -L"
 fi
 
@@ -226,6 +226,8 @@ if [ ! -d "$srcdir" ]; then
     exit 2
 fi
 
+expect_skipped="${RSYNC_EXPECT_SKIPPED-IGNORE}"
+skipped_list=''
 skipped=0
 missing=0
 passed=0
@@ -236,7 +238,7 @@ failed=0
 # failure to aid investigation.  We don't remove the testtmp subdir at
 # the end so that it can be configured as a symlink to a filesystem that
 # has ACLs and xattr support enabled (if desired).
-scratchbase="$TOOLDIR"/testtmp
+scratchbase="${scratchbase:-$TOOLDIR}"/testtmp
 echo "    scratchbase=$scratchbase"
 [ -d "$scratchbase" ] || mkdir "$scratchbase"
 
@@ -265,10 +267,12 @@ maybe_discard_scratch() {
 
 if [ "x$whichtests" = x ]; then
     whichtests="*.test"
+    full_run=yes
+else
+    full_run=no
 fi
 
-for testscript in $suitedir/$whichtests
-do
+for testscript in $suitedir/$whichtests; do
     testbase=`echo $testscript | sed -e 's!.*/!!' -e 's/.test\$//'`
     scratchdir="$scratchbase/$testbase"
 
@@ -284,7 +288,7 @@ do
     result=$?
     set -e
 
-    if [ "x$always_log" = xyes -o $ $result != 0 -a $result != 77 -a $result != 78 $ ]
+    if [ "x$always_log" = xyes ] || ( [ $result != 0 ] && [ $result != 77 ] && [ $result != 78 ] )
     then
 	echo "----- $testbase log follows"
 	cat "$scratchdir/test.log"
@@ -306,6 +310,7 @@ do
 	# backticks will fill the whole file onto one line, which is a feature
 	whyskipped=`cat "$scratchdir/whyskipped"`
 	echo "SKIP    $testbase ($whyskipped)"
+	skipped_list="$skipped_list,$testbase"
 	skipped=`expr $skipped + 1`
 	maybe_discard_scratch
 	;;
@@ -331,6 +336,15 @@ echo "      $passed passed"
 [ "$failed" -gt 0 ]  && echo "      $failed failed"
 [ "$skipped" -gt 0 ] && echo "      $skipped skipped"
 [ "$missing" -gt 0 ] && echo "      $missing missing"
+if [ "$full_run" = yes ] && [ "$expect_skipped" != IGNORE ]; then
+    skipped_list=`echo "$skipped_list" | sed 's/^,//'`
+    echo "----- skipped results:"
+    echo "      expected: $expect_skipped"
+    echo "      got:      $skipped_list"
+else
+    skipped_list=''
+    expect_skipped=''
+fi
 echo '------------------------------------------------------------'
 
 # OK, so expr exits with 0 if the result is neither null nor zero; and
@@ -339,7 +353,7 @@ echo '------------------------------------------------------------'
 # because -e is set.
 
 result=`expr $failed + $missing || true`
-if [ "$result" = 0 -a "$skipped" -gt "${RSYNC_MAX_SKIPPED:-9999}" ]; then
+if [ "$result" = 0 ] && [ "$skipped_list" != "$expect_skipped" ]; then
     result=1
 fi
 echo "overall result is $result"
diff --git a/sender.c b/sender.c
index 94761c26..9159da4d 100644
--- a/sender.c
+++ b/sender.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -35,7 +35,9 @@ extern int append_mode;
 extern int copy_links;
 extern int io_error;
 extern int flist_eof;
+extern int whole_file;
 extern int allowed_lull;
+extern int copy_devices;
 extern int preserve_xattrs;
 extern int protocol_version;
 extern int remove_source_files;
@@ -204,6 +206,9 @@ void send_files(int f_in, int f_out)
 	if (DEBUG_GTE(SEND, 1))
 		rprintf(FINFO, "send_files starting\n");
 
+	if (whole_file < 0)
+		whole_file = 0;
+
 	progress_init();
 
 	while (1) {
@@ -362,6 +367,25 @@ void send_files(int f_in, int f_out)
 			exit_cleanup(RERR_FILEIO);
 		}
 
+		if (IS_DEVICE(st.st_mode)) {
+			if (!copy_devices) {
+				rprintf(FERROR, "attempt to copy device contents without --copy-devices\n");
+				exit_cleanup(RERR_PROTOCOL);
+			}
+			if (st.st_size == 0)
+				st.st_size = get_device_size(fd, fname);
+		}
+
+		if (append_mode > 0 && st.st_size < F_LENGTH(file)) {
+			rprintf(FWARNING, "skipped diminished file: %s\n",
+				full_fname(fname));
+			free_sums(s);
+			close(fd);
+			if (protocol_version >= 30)
+				send_msg_int(MSG_NO_SEND, ndx);
+			continue;
+		}
+
 		if (st.st_size) {
 			int32 read_size = MAX(s->blength * 3, MAX_MAP_SIZE);
 			mbuf = map_file(fd, st.st_size, read_size, s->blength);
diff --git a/simd-checksum-avx2.S b/simd-checksum-avx2.S
new file mode 100644
index 00000000..549cc3ef
--- /dev/null
+++ b/simd-checksum-avx2.S
@@ -0,0 +1,177 @@
+#include "config.h"
+
+#ifdef USE_ROLL_ASM /* { */
+
+#define CHAR_OFFSET 0 /* Keep this the same as rsync.h, which isn't likely to change. */
+
+#ifdef __APPLE__
+#define get_checksum1_avx2_asm  _get_checksum1_avx2_asm
+#endif
+
+.intel_syntax noprefix
+.text
+
+	.p2align 5
+	.globl get_checksum1_avx2_asm
+
+# rdi=*buf, esi=len, edx=i, rcx= *ps1, r8= *ps2
+get_checksum1_avx2_asm:
+	vmovd	xmm6,[rcx] # load *ps1
+	lea	eax, [rsi-128] # at least 128 bytes to process?
+	cmp	edx, eax
+	jg	.exit
+	lea	rax, .mul_T2[rip]
+	vmovntdqa ymm7, [rax]   # load T2 multiplication constants
+	vmovntdqa ymm12,[rax+32]# from memory.
+	vpcmpeqd  ymm15, ymm15, ymm15 # set all elements to -1.
+
+#if CHAR_OFFSET != 0
+	mov	eax, 32*CHAR_OFFSET
+	vmovd	xmm10, eax
+	vpbroadcastd	ymm10, xmm10
+	mov	eax, 528*CHAR_OFFSET
+	vmovd	xmm13, eax
+	vpbroadcastd ymm13, xmm13
+#endif
+	vpabsb	ymm15, ymm15  # set all byte size elements to 1.
+	add	rdi, rdx
+	vmovdqu ymm2, [rdi]   # preload the first 64 bytes.
+	vmovdqu ymm3, [rdi+32]
+	and	esi, ~63   # only needed during final reduction, 
+			   # done here to avoid a longer nop for 
+			   # alignment below.
+	add	edx, esi
+	shr	rsi, 6	   # longer opcode for alignment
+	add	rdi, 64
+	vpxor	xmm1, xmm1, xmm1 # reset both partial sums accumulators.
+	vpxor	xmm4, xmm4, xmm4
+	mov	eax, [r8]
+	.p2align 4 		# should fit into the LSD allocation queue.
+.loop:
+	vpmaddubsw	ymm0, ymm15, ymm2  # s1 partial sums
+	vpmaddubsw	ymm5, ymm15, ymm3 
+	vmovdqu	ymm8,  [rdi]	# preload the next 
+	vmovdqu	ymm9,  [rdi+32] # 64 bytes.
+	add	rdi, 64
+	vpaddd	ymm4, ymm4, ymm6
+	vpaddw	ymm5, ymm5, ymm0
+	vpsrld	ymm0, ymm5, 16
+	vpaddw	ymm5, ymm0, ymm5
+	vpaddd	ymm6, ymm5, ymm6
+	vpmaddubsw	ymm2, ymm7, ymm2  # s2 partial sums
+	vpmaddubsw	ymm3, ymm12, ymm3
+	prefetcht0	[rdi+384] # prefetch 6 cachelines ahead.
+	vpaddw	ymm3, ymm2, ymm3
+	vpsrldq	ymm2, ymm3, 2
+	vpaddd	ymm3, ymm2, ymm3
+	vpaddd	ymm1, ymm1, ymm3
+
+#if CHAR_OFFSET != 0
+	vpaddd ymm6, ymm10, ymm6  #  32*CHAR_OFFSET
+	vpaddd ymm1, ymm13, ymm1  # 528*CHAR_OFFSET
+#endif
+	vmovdqa ymm2, ymm8   # move the next 64 bytes 
+	vmovdqa ymm3, ymm9   # into the right registers
+	sub	esi, 1
+	jnz	.loop
+
+	# now we reduce the partial sums.
+	vpslld	ymm3, ymm4, 6
+	vpsrldq	ymm2, ymm6, 4
+	
+	vpaddd  ymm0, ymm3, ymm1
+	vpaddd	ymm6, ymm2, ymm6
+	vpsrlq	ymm3, ymm0, 32
+	
+	vpsrldq	ymm2, ymm6, 8
+	vpaddd	ymm0, ymm3, ymm0
+	vpsrldq	ymm3, ymm0, 8
+	vpaddd	ymm6, ymm2, ymm6
+	vpaddd	ymm0, ymm3, ymm0
+	vextracti128	xmm2, ymm6, 0x1
+	vextracti128	xmm1, ymm0, 0x1
+	vpaddd	xmm6, xmm2, xmm6
+	vmovd	[rcx], xmm6
+	vpaddd	xmm1, xmm1, xmm0
+	vmovd	ecx, xmm1
+	add	eax, ecx
+	mov	[r8], eax
+.exit:
+	vzeroupper
+	mov	eax, edx
+	ret
+
+#ifdef __APPLE__
+.data
+	.align 6
+#else
+.section	.rodata
+	.p2align 6 
+#endif
+.mul_T2: 
+	.byte 64
+	.byte 63
+	.byte 62
+	.byte 61
+	.byte 60
+	.byte 59
+	.byte 58
+	.byte 57
+	.byte 56
+	.byte 55
+	.byte 54
+	.byte 53
+	.byte 52
+	.byte 51
+	.byte 50
+	.byte 49
+	.byte 48
+	.byte 47
+	.byte 46
+	.byte 45
+	.byte 44
+	.byte 43
+	.byte 42
+	.byte 41
+	.byte 40
+	.byte 39
+	.byte 38
+	.byte 37
+	.byte 36
+	.byte 35
+	.byte 34
+	.byte 33
+	.byte 32
+	.byte 31
+	.byte 30
+	.byte 29
+	.byte 28
+	.byte 27
+	.byte 26
+	.byte 25
+	.byte 24
+	.byte 23
+	.byte 22
+	.byte 21
+	.byte 20
+	.byte 19
+	.byte 18
+	.byte 17
+	.byte 16
+	.byte 15
+	.byte 14
+	.byte 13
+	.byte 12
+	.byte 11
+	.byte 10
+	.byte 9
+	.byte 8
+	.byte 7
+	.byte 6
+	.byte 5
+	.byte 4
+	.byte 3
+	.byte 2
+	.byte 1
+
+#endif /* } USE_ROLL_ASM */
diff --git a/simd-checksum-x86_64.cpp b/simd-checksum-x86_64.cpp
index a1f5c502..33f26e92 100644
--- a/simd-checksum-x86_64.cpp
+++ b/simd-checksum-x86_64.cpp
@@ -51,12 +51,12 @@
  * GCC 4.x are not supported to ease configure.ac logic.
  */
 
-#ifdef __x86_64__
-#ifdef __cplusplus
+#ifdef __x86_64__ /* { */
+#ifdef __cplusplus /* { */
 
 #include "rsync.h"
 
-#ifdef HAVE_SIMD
+#ifdef USE_ROLL_SIMD /* { */
 
 #include <immintrin.h>
 
@@ -85,7 +85,9 @@ typedef long long __m256i_u __attribute__((__vector_size__(32), __may_alias__, _
 #define SSE2_HADDS_EPI16(a, b) _mm_adds_epi16(SSE2_INTERLEAVE_EVEN_EPI16(a, b), SSE2_INTERLEAVE_ODD_EPI16(a, b))
 #define SSE2_MADDUBS_EPI16(a, b) _mm_adds_epi16(SSE2_MULU_EVEN_EPI8(a, b), SSE2_MULU_ODD_EPI8(a, b))
 
+#ifndef USE_ROLL_ASM
 __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_avx2_64(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
+#endif
 __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_ssse3_32(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
 __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_sse2_32(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
 
@@ -311,6 +313,12 @@ __attribute__ ((target("sse2"))) MVSTATIC int32 get_checksum1_sse2_32(schar* buf
     return i;
 }
 
+#ifdef USE_ROLL_ASM /* { */
+
+extern "C" __attribute__ ((target("avx2"))) int32 get_checksum1_avx2_asm(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2);
+
+#else /* } { */
+
 /*
   AVX2 loop per 64 bytes:
     int16 t1[16];
@@ -326,113 +334,107 @@ __attribute__ ((target("sse2"))) MVSTATIC int32 get_checksum1_sse2_32(schar* buf
     s1 += (uint32)(t1[0] + t1[1] + t1[2] + t1[3] + t1[4] + t1[5] + t1[6] + t1[7] + t1[8] + t1[9] + t1[10] + t1[11] + t1[12] + t1[13] + t1[14] + t1[15]) +
           64*CHAR_OFFSET;
  */
+
 __attribute__ ((target("avx2"))) MVSTATIC int32 get_checksum1_avx2_64(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2)
 {
     if (len > 64) {
-        // Instructions reshuffled compared to SSE2 for slightly better performance
-        int aligned = ((uintptr_t)buf & 31) == 0;
 
-        uint32 x[8] = {0};
-        x[0] = *ps1;
-        __m256i ss1 = _mm256_lddqu_si256((__m256i_u*)x);
-        x[0] = *ps2;
-        __m256i ss2 = _mm256_lddqu_si256((__m256i_u*)x);
+        uint32 x[4] = {0};
+        __m128i ss1 = _mm_cvtsi32_si128(*ps1);
+        __m128i ss2 = _mm_cvtsi32_si128(*ps2);
 
-        // The order gets shuffled compared to SSE2
-        const int16 mul_t1_buf[16] = {60, 56, 52, 48, 28, 24, 20, 16, 44, 40, 36, 32, 12, 8, 4, 0};
-        __m256i mul_t1 = _mm256_lddqu_si256((__m256i_u*)mul_t1_buf);
+        const char mul_t1_buf[16] = {60, 56, 52, 48, 44, 40, 36, 32, 28, 24, 20, 16, 12, 8, 4, 0};
+	__m128i tmp = _mm_load_si128((__m128i*) mul_t1_buf);
+        __m256i mul_t1 = _mm256_cvtepu8_epi16(tmp);
+	__m256i mul_const = _mm256_broadcastd_epi32(_mm_cvtsi32_si128(4 | (3 << 8) | (2 << 16) | (1 << 24)));
+        __m256i mul_one;
+       	    mul_one = _mm256_abs_epi8(_mm256_cmpeq_epi16(mul_one,mul_one)); // set all vector elements to 1
 
         for (; i < (len-64); i+=64) {
-            // Load ... 2*[int8*32]
+            // Load ... 4*[int8*16]
             __m256i in8_1, in8_2;
-            if (!aligned) {
-                in8_1 = _mm256_lddqu_si256((__m256i_u*)&buf[i]);
-                in8_2 = _mm256_lddqu_si256((__m256i_u*)&buf[i + 32]);
-            } else {
-                in8_1 = _mm256_load_si256((__m256i_u*)&buf[i]);
-                in8_2 = _mm256_load_si256((__m256i_u*)&buf[i + 32]);
-            }
-
-            // Prefetch for next loops. This has no observable effect on the
-            // tested AMD but makes as much as 20% difference on the Intel.
-            // Curiously that same Intel sees no benefit from this with SSE2
-            // or SSSE3.
-            _mm_prefetch(&buf[i + 64], _MM_HINT_T0);
-            _mm_prefetch(&buf[i + 96], _MM_HINT_T0);
-            _mm_prefetch(&buf[i + 128], _MM_HINT_T0);
-            _mm_prefetch(&buf[i + 160], _MM_HINT_T0);
+	    __m128i in8_1_low, in8_2_low, in8_1_high, in8_2_high;
+	    in8_1_low = _mm_loadu_si128((__m128i_u*)&buf[i]);
+	    in8_2_low = _mm_loadu_si128((__m128i_u*)&buf[i+16]);
+	    in8_1_high = _mm_loadu_si128((__m128i_u*)&buf[i+32]);
+	    in8_2_high = _mm_loadu_si128((__m128i_u*)&buf[i+48]);
+	    in8_1 = _mm256_inserti128_si256(_mm256_castsi128_si256(in8_1_low), in8_1_high,1);
+	    in8_2 = _mm256_inserti128_si256(_mm256_castsi128_si256(in8_2_low), in8_2_high,1);
 
-            // (1*buf[i] + 1*buf[i+1]), (1*buf[i+2], 1*buf[i+3]), ... 2*[int16*16]
+            // (1*buf[i] + 1*buf[i+1]), (1*buf[i+2], 1*buf[i+3]), ... 2*[int16*8]
             // Fastest, even though multiply by 1
-            __m256i mul_one = _mm256_set1_epi8(1);
             __m256i add16_1 = _mm256_maddubs_epi16(mul_one, in8_1);
             __m256i add16_2 = _mm256_maddubs_epi16(mul_one, in8_2);
 
-            // (4*buf[i] + 3*buf[i+1]), (2*buf[i+2], buf[i+3]), ... 2*[int16*16]
-            __m256i mul_const = _mm256_set1_epi32(4 + (3 << 8) + (2 << 16) + (1 << 24));
+            // (4*buf[i] + 3*buf[i+1]), (2*buf[i+2], buf[i+3]), ... 2*[int16*8]
             __m256i mul_add16_1 = _mm256_maddubs_epi16(mul_const, in8_1);
             __m256i mul_add16_2 = _mm256_maddubs_epi16(mul_const, in8_2);
 
             // s2 += 64*s1
-            ss2 = _mm256_add_epi32(ss2, _mm256_slli_epi32(ss1, 6));
+            ss2 = _mm_add_epi32(ss2, _mm_slli_epi32(ss1, 6));
 
-            // [t1[0] + t1[1], t1[2] + t1[3] ...] [int16*16]
-            __m256i add16 = _mm256_hadds_epi16(add16_1, add16_2);
+            // [sum(t1[0]..t1[7]), X, X, X] [int32*4]; faster than multiple _mm_hadds_epi16
+            __m256i sum_add32 = _mm256_add_epi16(add16_1, add16_2);
+            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_srli_epi32(sum_add32, 16));
+            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_srli_si256(sum_add32, 4));
+            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_srli_si256(sum_add32, 8));
 
-            // [t1[0], t1[1], ...] -> [t1[0]*60 + t1[1]*56, ...] [int32*8]
-            __m256i mul32 = _mm256_madd_epi16(add16, mul_t1);
+            // [sum(t2[0]..t2[7]), X, X, X] [int32*4]; faster than multiple _mm_hadds_epi16
+            __m256i sum_mul_add32 = _mm256_add_epi16(mul_add16_1, mul_add16_2);
+            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_srli_epi32(sum_mul_add32, 16));
+            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_srli_si256(sum_mul_add32, 4));
+            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_srli_si256(sum_mul_add32, 8));
 
-            // [sum(t1[0]..t1[15]), X, X, X, X, X, X, X] [int32*8]
-            __m256i sum_add32 = _mm256_add_epi16(add16_1, add16_2);
-            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_permute4x64_epi64(sum_add32, 2 + (3 << 2) + (0 << 4) + (1 << 6)));
-            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_slli_si256(sum_add32, 2));
-            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_slli_si256(sum_add32, 4));
-            sum_add32 = _mm256_add_epi16(sum_add32, _mm256_slli_si256(sum_add32, 8));
-            sum_add32 = _mm256_srai_epi32(sum_add32, 16);
-            sum_add32 = _mm256_shuffle_epi32(sum_add32, 3);
+            // s1 += t1[0] + t1[1] + t1[2] + t1[3] + t1[4] + t1[5] + t1[6] + t1[7]
+	    __m128i sum_add32_hi = _mm256_extracti128_si256(sum_add32, 0x1);
+            ss1 = _mm_add_epi32(ss1, _mm256_castsi256_si128(sum_add32));
+            ss1 = _mm_add_epi32(ss1, sum_add32_hi);
 
-            // s1 += t1[0] + t1[1] + t1[2] + t1[3] + t1[4] + t1[5] + t1[6] + t1[7] + t1[8] + t1[9] + t1[10] + t1[11] + t1[12] + t1[13] + t1[14] + t1[15]
-            ss1 = _mm256_add_epi32(ss1, sum_add32);
+            // s2 += t2[0] + t2[1] + t2[2] + t2[3] + t2[4] + t2[5] + t2[6] + t2[7]
+	    __m128i sum_mul_add32_hi = _mm256_extracti128_si256(sum_mul_add32, 0x1);
+            ss2 = _mm_add_epi32(ss2, _mm256_castsi256_si128(sum_mul_add32));
+            ss2 = _mm_add_epi32(ss2, sum_mul_add32_hi);
 
-            // [sum(t2[0]..t2[15]), X, X, X, X, X, X, X] [int32*8]
-            __m256i sum_mul_add32 = _mm256_add_epi16(mul_add16_1, mul_add16_2);
-            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_permute4x64_epi64(sum_mul_add32, 2 + (3 << 2) + (0 << 4) + (1 << 6)));
-            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_slli_si256(sum_mul_add32, 2));
-            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_slli_si256(sum_mul_add32, 4));
-            sum_mul_add32 = _mm256_add_epi16(sum_mul_add32, _mm256_slli_si256(sum_mul_add32, 8));
-            sum_mul_add32 = _mm256_srai_epi32(sum_mul_add32, 16);
-            sum_mul_add32 = _mm256_shuffle_epi32(sum_mul_add32, 3);
-
-            // s2 += t2[0] + t2[1] + t2[2] + t2[3] + t2[4] + t2[5] + t2[6] + t2[7] + t2[8] + t2[9] + t2[10] + t2[11] + t2[12] + t2[13] + t2[14] + t2[15]
-            ss2 = _mm256_add_epi32(ss2, sum_mul_add32);
-
-            // [sum(mul32), X, X, X, X, X, X, X] [int32*8]
-            mul32 = _mm256_add_epi32(mul32, _mm256_permute2x128_si256(mul32, mul32, 1));
+            // [t1[0] + t1[1], t1[2] + t1[3] ...] [int16*8]
+            // We could've combined this with generating sum_add32 above and
+            // save an instruction but benchmarking shows that as being slower
+            __m256i add16 = _mm256_hadds_epi16(add16_1, add16_2);
+
+            // [t1[0], t1[1], ...] -> [t1[0]*28 + t1[1]*24, ...] [int32*4]
+            __m256i mul32 = _mm256_madd_epi16(add16, mul_t1);
+
+            // [sum(mul32), X, X, X] [int32*4]; faster than multiple _mm_hadd_epi32
             mul32 = _mm256_add_epi32(mul32, _mm256_srli_si256(mul32, 4));
             mul32 = _mm256_add_epi32(mul32, _mm256_srli_si256(mul32, 8));
+	    // prefetch 2 cacheline ahead
+            _mm_prefetch(&buf[i + 160], _MM_HINT_T0);
 
-            // s2 += 60*t1[0] + 56*t1[1] + 52*t1[2] + 48*t1[3] + 44*t1[4] + 40*t1[5] + 36*t1[6] + 32*t1[7] + 28*t1[8] + 24*t1[9] + 20*t1[10] + 16*t1[11] + 12*t1[12] + 8*t1[13] + 4*t1[14]
-            ss2 = _mm256_add_epi32(ss2, mul32);
+            // s2 += 28*t1[0] + 24*t1[1] + 20*t1[2] + 16*t1[3] + 12*t1[4] + 8*t1[5] + 4*t1[6]
+	    __m128i mul32_hi = _mm256_extracti128_si256(mul32, 0x1);
+            ss2 = _mm_add_epi32(ss2, _mm256_castsi256_si128(mul32));
+            ss2 = _mm_add_epi32(ss2, mul32_hi);
 
 #if CHAR_OFFSET != 0
-            // s1 += 64*CHAR_OFFSET
-            __m256i char_offset_multiplier = _mm256_set1_epi32(64 * CHAR_OFFSET);
-            ss1 = _mm256_add_epi32(ss1, char_offset_multiplier);
+            // s1 += 32*CHAR_OFFSET
+            __m128i char_offset_multiplier = _mm_set1_epi32(32 * CHAR_OFFSET);
+            ss1 = _mm_add_epi32(ss1, char_offset_multiplier);
 
-            // s2 += 2080*CHAR_OFFSET
-            char_offset_multiplier = _mm256_set1_epi32(2080 * CHAR_OFFSET);
-            ss2 = _mm256_add_epi32(ss2, char_offset_multiplier);
+            // s2 += 528*CHAR_OFFSET
+            char_offset_multiplier = _mm_set1_epi32(528 * CHAR_OFFSET);
+            ss2 = _mm_add_epi32(ss2, char_offset_multiplier);
 #endif
         }
 
-        _mm256_store_si256((__m256i_u*)x, ss1);
+        _mm_store_si128((__m128i_u*)x, ss1);
         *ps1 = x[0];
-        _mm256_store_si256((__m256i_u*)x, ss2);
+        _mm_store_si128((__m128i_u*)x, ss2);
         *ps2 = x[0];
     }
     return i;
 }
 
+#endif /* } !USE_ROLL_ASM */
+
 static int32 get_checksum1_default_1(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2)
 {
     uint32 s1 = *ps1;
@@ -459,7 +461,11 @@ static inline uint32 get_checksum1_cpp(char *buf1, int32 len)
     uint32 s2 = 0;
 
     // multiples of 64 bytes using AVX2 (if available)
+#ifdef USE_ROLL_ASM
+    i = get_checksum1_avx2_asm((schar*)buf1, len, i, &s1, &s2);
+#else
     i = get_checksum1_avx2_64((schar*)buf1, len, i, &s1, &s2);
+#endif
 
     // multiples of 32 bytes using SSSE3 (if available)
     i = get_checksum1_ssse3_32((schar*)buf1, len, i, &s1, &s2);
@@ -521,14 +527,18 @@ static int32 get_checksum1_auto(schar* buf, int32 len, int32 i, uint32* ps1, uin
 
 int main() {
     int i;
-    unsigned char* buf = (unsigned char*)malloc(BLOCK_LEN);
+    unsigned char* buf = (unsigned char*)aligned_alloc(64,BLOCK_LEN);
     for (i = 0; i < BLOCK_LEN; i++) buf[i] = (i + (i % 3) + (i % 11)) % 256;
 
     benchmark("Auto", get_checksum1_auto, (schar*)buf, BLOCK_LEN);
     benchmark("Raw-C", get_checksum1_default_1, (schar*)buf, BLOCK_LEN);
     benchmark("SSE2", get_checksum1_sse2_32, (schar*)buf, BLOCK_LEN);
     benchmark("SSSE3", get_checksum1_ssse3_32, (schar*)buf, BLOCK_LEN);
+#ifdef USE_ROLL_ASM
+    benchmark("AVX2-ASM", get_checksum1_avx2_asm, (schar*)buf, BLOCK_LEN);
+#else
     benchmark("AVX2", get_checksum1_avx2_64, (schar*)buf, BLOCK_LEN);
+#endif
 
     free(buf);
     return 0;
@@ -538,6 +548,6 @@ int main() {
 #pragma clang optimize on
 #endif /* BENCHMARK_SIMD_CHECKSUM1 */
 
-#endif /* HAVE_SIMD */
-#endif /* __cplusplus */
-#endif /* __x86_64__ */
+#endif /* } USE_ROLL_SIMD */
+#endif /* } __cplusplus */
+#endif /* } __x86_64__ */
diff --git a/support/atomic-rsync b/support/atomic-rsync
index 0346fb49..1964090d 100755
--- a/support/atomic-rsync
+++ b/support/atomic-rsync
@@ -1,92 +1,94 @@
-#!/usr/bin/env perl
-#
+#!/usr/bin/env python3
 # This script lets you update a hierarchy of files in an atomic way by
 # first creating a new hierarchy using rsync's --link-dest option, and
 # then swapping the hierarchy into place.  **See the usage message for
 # more details and some important caveats!**
 
-use strict;
-use warnings;
-use Cwd 'abs_path';
-
-my $RSYNC_PROG = '/usr/bin/rsync';
-my $RM_PROG = '/bin/rm';
-
-my $dest_dir = $ARGV[-1];
-&usage if !defined $dest_dir || $dest_dir =~ /(^-|^$)/ || grep(/^--help/, @ARGV);
-$dest_dir =~ s{(?<=.)/+$} {};
-
-if (!-d $dest_dir) {
-    die "$dest_dir is not a directory.\nUse --help for help.\n";
-}
-
-if (@_ = grep(/^--[a-z]+-dest\b/, @ARGV)) {
-    $_ = join(' or ', @_);
-    die "You cannot use the $_ option with atomic-rsync.\nUse --help for help.\n";
-}
-
-my $symlink_content = readlink $dest_dir; # undef when a real dir
-
-my $dest_arg = $dest_dir;
-# This gives us the real destination dir, with all symlinks dereferenced.
-$dest_dir = abs_path($dest_dir);
-if ($dest_dir eq '/') {
-    die qq|You must not use "/" as the destination directory.\nUse --help for help.\n|;
-}
-
-my($old_dir, $new_dir);
-if (defined $symlink_content && $dest_dir =~ /-([12])$/) {
-    my $num = 3 - $1;
-    $old_dir = undef;
-    ($new_dir = $dest_dir) =~ s/-[12]$/-$num/;
-    $symlink_content =~ s/-[12]$/-$num/;
-} else {
-    $old_dir = "$dest_dir~old~";
-    $new_dir = "$dest_dir~new~";
-}
-
-$ARGV[-1] = "$new_dir/";
-
-system($RM_PROG, '-rf', $old_dir) if defined $old_dir && -d $old_dir;
-system($RM_PROG, '-rf', $new_dir) if -d $new_dir;
-
-if (system($RSYNC_PROG, "--link-dest=$dest_dir", @ARGV)) {
-    if ($? == -1) {
-	print "failed to execute $RSYNC_PROG: $!\n";
-    } elsif ($? & 127) {
-	printf "child died with signal %d, %s coredump\n",
-	    ($? & 127),  ($? & 128) ? 'with' : 'without';
-    } else {
-	printf "child exited with value %d\n", $? >> 8;
-    }
-    exit 1;
-}
-
-if (!defined $old_dir) {
-    atomic_symlink($symlink_content, $dest_arg);
-    exit;
-}
-
-rename($dest_dir, $old_dir) or die "Unable to rename $dest_dir to $old_dir: $!";
-rename($new_dir, $dest_dir) or die "Unable to rename $new_dir to $dest_dir: $!";
-
-exit;
-
-sub atomic_symlink
-{
-    my($target, $link) = @_;
-    my $newlink = "$link~new~";
-
-    unlink($newlink); # Just in case
-    symlink($target, $newlink) or die "Unable to symlink $newlink -> $target: $!\n";
-    rename($newlink, $link) or die "Unable to rename $newlink to $link: $!\n";
-}
-
-
-sub usage
-{
-    die <<EOT;
-Usage: atomic-rsync [RSYNC-OPTIONS] HOST:/SOURCE/DIR/ /DEST/DIR/
+import os, sys, re, subprocess, shutil
+
+ALT_DEST_ARG_RE = re.compile('^--[a-z][^ =]+-dest(=|$)')
+
+RSYNC_PROG = '/usr/bin/rsync'
+
+def main():
+    cmd_args = sys.argv[1:]
+    if '--help' in cmd_args:
+        usage_and_exit()
+
+    if len(cmd_args) < 2:
+        usage_and_exit(True)
+
+    dest_dir = cmd_args[-1].rstrip('/')
+    if dest_dir == '' or dest_dir.startswith('-'):
+        usage_and_exit(True)
+
+    if not os.path.isdir(dest_dir):
+        die(dest_dir, "is not a directory or a symlink to a dir.\nUse --help for help.")
+
+    bad_args = [ arg for arg in cmd_args if ALT_DEST_ARG_RE.match(arg) ]
+    if bad_args:
+        die("You cannot use the", ' or '.join(bad_args), "option with atomic-rsync.\nUse --help for help.")
+
+    # We ignore exit-code 24 (file vanished) by default.
+    allowed_exit_codes = '0 ' + os.environ.get('ATOMIC_RSYNC_OK_CODES', '24')
+    try:
+        allowed_exit_codes = set(int(num) for num in re.split(r'[, ]+', allowed_exit_codes) if num != '')
+    except ValueError:
+        die('Invalid integer in ATOMIC_RSYNC_OK_CODES:', allowed_exit_codes[2:])
+
+    symlink_content = os.readlink(dest_dir) if os.path.islink(dest_dir) else None
+
+    dest_arg = dest_dir
+    dest_dir = os.path.realpath(dest_dir) # The real destination dir with all symlinks dereferenced
+    if dest_dir == '/':
+        die('You must not use "/" as the destination directory.\nUse --help for help.')
+
+    old_dir = new_dir = None
+    if symlink_content is not None and dest_dir.endswith(('-1','-2')):
+        if not symlink_content.endswith(dest_dir[-2:]):
+            die("Symlink suffix out of sync with dest_dir name:", symlink_content, 'vs', dest_dir)
+        num = 3 - int(dest_dir[-1]);
+        old_dir = None
+        new_dir = dest_dir[:-1] + str(num)
+        symlink_content = symlink_content[:-1] + str(num)
+    else:
+        old_dir = dest_dir + '~old~'
+        new_dir = dest_dir + '~new~'
+
+    cmd_args[-1] = new_dir + '/'
+
+    if old_dir is not None and os.path.isdir(old_dir):
+        shutil.rmtree(old_dir)
+    if os.path.isdir(new_dir):
+        shutil.rmtree(new_dir)
+
+    child = subprocess.run([RSYNC_PROG, '--link-dest=' + dest_dir, *cmd_args])
+    if child.returncode not in allowed_exit_codes:
+        die('The rsync copy failed with code', child.returncode, exitcode=child.returncode)
+
+    if not os.path.isdir(new_dir):
+        die('The rsync copy failed to create:', new_dir)
+
+    if old_dir is None:
+        atomic_symlink(symlink_content, dest_arg)
+    else:
+        os.rename(dest_dir, old_dir)
+        os.rename(new_dir, dest_dir)
+
+
+def atomic_symlink(target, link):
+    newlink = link + "~new~"
+    try:
+        os.unlink(newlink); # Just in case
+    except OSError:
+        pass
+    os.symlink(target, newlink)
+    os.rename(newlink, link)
+
+
+def usage_and_exit(use_stderr=False):
+    usage_msg = """\
+Usage: atomic-rsync [RSYNC-OPTIONS] [HOST:]/SOURCE/DIR/ /DEST/DIR/
        atomic-rsync [RSYNC-OPTIONS] HOST::MOD/DIR/ /DEST/DIR/
 
 This script lets you update a hierarchy of files in an atomic way by first
@@ -96,27 +98,41 @@ to a local directory, and that directory must already exist.  For example:
 
     mkdir /local/files-1
     ln -s files-1 /local/files
-    atomic-rsync -av host:/remote/files/ /local/files/
+    atomic-rsync -aiv host:/remote/files/ /local/files/
 
-If /local/files is a symlink to a directory that ends in -1 or -2, the
-copy will go to the alternate suffix and the symlink will be changed to
-point to the new dir.  This is a fully atomic update.  If the destination
-is not a symlink (or not a symlink to a *-1 or a *-2 directory), this
-will instead create a directory with "~new~" suffixed, move the current
-directory to a name with "~old~" suffixed, and then move the ~new~
-directory to the original destination name (this double rename is not
-fully atomic, but is rapid).  In both cases, the prior destintaion
-directory will be preserved until the next update, at which point it
-will be deleted.
+If /local/files is a symlink to a directory that ends in -1 or -2, the copy
+will go to the alternate suffix and the symlink will be changed to point to
+the new dir.  This is a fully atomic update.  If the destination is not a
+symlink (or not a symlink to a *-1 or a *-2 directory), this will instead
+create a directory with "~new~" suffixed, move the current directory to a
+name with "~old~" suffixed, and then move the ~new~ directory to the original
+destination name (this double rename is not fully atomic, but is rapid).  In
+both cases, the prior destintaion directory will be preserved until the next
+update, at which point it will be deleted.
 
-In all likelihood, you do NOT want to specify this command:
+By default, rsync exit-code 24 (file vanished) is allowed without halting the
+atomic update.  If you want to change that, specify the environment variable
+ATOMIC_RSYNC_OK_CODES with numeric values separated by spaces and/or commas.
+Specify an empty string to only allow a successful copy.  An override example:
 
-    atomic-rsync -av host:/remote/files /local/
+    ATOMIC_RSYNC_OK_CODES='23 24' atomic-rsync -aiv host:src/ dest/
 
-... UNLESS you want the entire /local dir to be swapped out!
+See the errcode.h file for a list of all the exit codes.
 
 See the "rsync" command for its list of options.  You may not use the
 --link-dest, --compare-dest, or --copy-dest options (since this script
 uses --link-dest to make the transfer efficient).
-EOT
-}
+"""
+    print(usage_msg, file=sys.stderr if use_stderr else sys.stdout)
+    sys.exit(1 if use_stderr else 0)
+
+
+def die(*args, exitcode=1):
+    print(*args, file=sys.stderr)
+    sys.exit(exitcode)
+
+
+if __name__ == '__main__':
+    main()
+
+# vim: sw=4 et
diff --git a/support/git-set-file-times b/support/git-set-file-times
index 51962d37..e06f0737 100755
--- a/support/git-set-file-times
+++ b/support/git-set-file-times
@@ -27,17 +27,18 @@ def main():
 
     if not args.tree:
         # All modified files keep their current mtime.
-        proc = subprocess.Popen(git + 'ls-files -m -z'.split(), stdout=subprocess.PIPE, encoding='utf-8')
+        proc = subprocess.Popen(git + 'status -z --no-renames'.split(), stdout=subprocess.PIPE, encoding='utf-8')
         out = proc.communicate()[0]
         for fn in out.split('\0'):
-            if fn == '':
+            if fn == '' or (fn[0] != 'M' and fn[1] != 'M'):
                 continue
+            fn = fn[3:]
             if args.list:
                 mtime = os.lstat(fn).st_mtime
                 print_line(fn, mtime, mtime)
             ls.discard(fn)
 
-    cmd = git + 'log -r --name-only --no-color --pretty=raw --no-renames -z'.split()
+    cmd = git + 'log -r --name-only --format=%x00commit%x20%H%n%x00commit_time%x20%ct%n --no-renames -z'.split()
     if args.tree:
         cmd.append(args.tree)
     cmd += ['--'] + args.files
@@ -45,7 +46,7 @@ def main():
     proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, encoding='utf-8')
     for line in proc.stdout:
         line = line.strip()
-        m = re.match(r'^committer .*? (\d+) [-+]\d+$', line)
+        m = re.match(r'^\0commit_time (\d+)$', line)
         if m:
             commit_time = int(m[1])
         elif NULL_COMMIT_RE.search(line):
diff --git a/support/lsh b/support/lsh
index be29310c..7b3c0656 100755
--- a/support/lsh
+++ b/support/lsh
@@ -15,6 +15,8 @@ GetOptions(
     'b|c|D|e|F|i|L|m|O|o|p|R|S|w=s' => sub { }, # Ignore
     'no-cd' => \( my $no_chdir ),
     'sudo' => \( my $use_sudo ),
+    'rrsync=s' => \( my $rrsync_dir ),
+    'rropts=s' => \( my $rrsync_opts ),
 ) or &usage;
 &usage unless @ARGV > 1;
 
@@ -67,22 +69,40 @@ unless ($no_chdir) {
     chdir $home_dir or die "Unable to chdir to $home_dir: $!\n";
 }
 
-push @cmd, '/bin/sh', '-c', "@ARGV";
+if ($rrsync_dir) {
+    $ENV{SSH_ORIGINAL_COMMAND} = join(' ', @ARGV);
+    push @cmd, 'rrsync';
+    if ($rrsync_opts) {
+	foreach my $opt (split(/[ ,]+/, $rrsync_opts)) {
+	    $opt = "-$opt" unless $opt =~ /^-/;
+	    push @cmd, $opt;
+	}
+    }
+    push @cmd, $rrsync_dir;
+} else {
+    push @cmd, '/bin/sh', '-c', "@ARGV";
+}
 exec @cmd;
 die "Failed to exec: $!\n";
 
 sub usage
 {
     die <<EOT;
-Usage: lsh [-l USER] [--sudo] [--no-cd] localhost COMMAND [...]
+Usage: lsh [OPTIONS] localhost|lh COMMAND [...]
 
 This is a "local shell" command that works like a remote shell but only for the
 local host.  This is useful for rsync testing or for running a local copy where
 the sender and the receiver need to use different options (e.g. --fake-super).
-If the -l option is used, we try to become the USER, either directly (when
-root) or by using "sudo -H -u USER" (requires --sudo option).
 
-Note that if you pass hostname "lh" instead of "localhost" that the --no-cd
-option is implied.  The default is to "cd \$HOME" to simulate ssh behavior.
+Options:
+
+-l USER        Choose the USER that lsh tries to become.
+--no-cd        Skip the chdir \$HOME (the default with hostname "lh")
+--sudo         Use sudo -H -l USER to become root or the specified USER.
+--rrsync=DIR   Test rrsync restricted copying without using ssh.
+--rropts=STR   The string "munge,no-del,no-lock" would pass 3 options to
+               rrsync (must be combined with --rrsync=DIR).
+
+The script also ignores a bunch of single-letter ssh options.
 EOT
 }
diff --git a/support/lsh.sh b/support/lsh.sh
index f74a8ef4..db034228 100755
--- a/support/lsh.sh
+++ b/support/lsh.sh
@@ -4,7 +4,8 @@
 # for testing or for running a local copy where the sender and the
 # receiver needs to use different options (e.g. --fake-super).  If
 # we get a -l USER option, we try to use "sudo -u USER" to run the
-# command.
+# command.  Supports only the hostnames "localhost" and "lh", with
+# the latter implying the --no-cd option.
 
 user=''
 do_cd=y # Default path is user's home dir (just like ssh) unless host is "lh".
diff --git a/support/munge-symlinks b/support/munge-symlinks
index 3e5f3ad2..e7a54741 100755
--- a/support/munge-symlinks
+++ b/support/munge-symlinks
@@ -1,60 +1,71 @@
-#!/usr/bin/env perl
+#!/usr/bin/env python3
 # This script will either prefix all symlink values with the string
 # "/rsyncd-munged/" or remove that prefix.
 
-use strict;
-use Getopt::Long;
-
-my $SYMLINK_PREFIX = '/rsyncd-munged/';
-
-my $munge_opt;
-
-&GetOptions(
-    'munge' => sub { $munge_opt = 1 },
-    'unmunge' => sub { $munge_opt = 0 },
-    'all' => \( my $all_opt ),
-    'help|h' => \( my $help_opt ),
-) or &usage;
-
-&usage if $help_opt || !defined $munge_opt;
-
-my $munged_re = $all_opt ? qr/^($SYMLINK_PREFIX)+(?=.)/ : qr/^$SYMLINK_PREFIX(?=.)/;
-
-push(@ARGV, '.') unless @ARGV;
-
-open(PIPE, '-|', 'find', @ARGV, '-type', 'l') or die $!;
-
-while (<PIPE>) {
-    chomp;
-    my $lnk = readlink($_) or next;
-    if ($munge_opt) {
-	next if !$all_opt && $lnk =~ /$munged_re/;
-	$lnk =~ s/^/$SYMLINK_PREFIX/;
-    } else {
-	next unless $lnk =~ s/$munged_re//;
-    }
-    if (!unlink($_)) {
-	warn "Unable to unlink symlink: $_ ($!)\n";
-    } elsif (!symlink($lnk, $_)) {
-	warn "Unable to recreate symlink: $_ -> $lnk ($!)\n";
-    } else {
-	print "$_ -> $lnk\n";
-    }
-}
-
-close PIPE;
-exit;
-
-sub usage
-{
-    die <<EOT;
-Usage: munge-symlinks --munge|--unmunge [--all] [DIR|SYMLINK...]
-
---munge      Add the $SYMLINK_PREFIX prefix to symlinks if not already
-             present, or always when combined with --all.
---unmunge    Remove one $SYMLINK_PREFIX prefix from symlinks or all
-             such prefixes with --all.
-
-See the "munge symlinks" option in the rsyncd.conf manpage for more details.
-EOT
-}
+import os, sys, argparse
+
+SYMLINK_PREFIX = '/rsyncd-munged/'
+PREFIX_LEN = len(SYMLINK_PREFIX)
+
+def main():
+    for arg in args.names:
+        if os.path.islink(arg):
+            process_one_arg(arg)
+        elif os.path.isdir(arg):
+            for fn in find_symlinks(arg):
+                process_one_arg(fn)
+        else:
+            print("Arg is not a symlink or a dir:", arg, file=sys.stderr)
+
+
+def find_symlinks(path):
+    for entry in os.scandir(path):
+        if entry.is_symlink():
+            yield entry.path
+        elif entry.is_dir(follow_symlinks=False):
+            yield from find_symlinks(entry.path)
+
+
+def process_one_arg(fn):
+    lnk = os.readlink(fn)
+    if args.unmunge:
+        if not lnk.startswith(SYMLINK_PREFIX):
+            return
+        lnk = lnk[PREFIX_LEN:]
+        while args.all and lnk.startswith(SYMLINK_PREFIX):
+            lnk = lnk[PREFIX_LEN:]
+    else:
+        if not args.all and lnk.startswith(SYMLINK_PREFIX):
+            return
+        lnk = SYMLINK_PREFIX + lnk
+
+    try:
+        os.unlink(fn)
+    except OSError as e:
+        print("Unable to unlink symlink:", str(e), file=sys.stderr)
+        return
+    try:
+        os.symlink(lnk, fn)
+    except OSError as e:
+        print("Unable to recreate symlink", fn, '->', lnk + ':', str(e), file=sys.stderr)
+        return
+    print(fn, '->', lnk)
+
+
+if __name__ == '__main__':
+    our_desc = """\
+Adds or removes the %s prefix to/from the start of each symlink's value.
+When given the name of a directory, affects all the symlinks in that directory hierarchy.
+""" % SYMLINK_PREFIX
+    epilog = 'See the "munge symlinks" option in the rsyncd.conf manpage for more details.'
+    parser = argparse.ArgumentParser(description=our_desc, epilog=epilog, add_help=False)
+    uniq_group = parser.add_mutually_exclusive_group()
+    uniq_group.add_argument('--munge', action='store_true', help="Add the prefix to symlinks (the default).")
+    uniq_group.add_argument('--unmunge', action='store_true', help="Remove the prefix from symlinks.")
+    parser.add_argument('--all', action='store_true', help="Always adds the prefix when munging (even if already munged) or removes multiple instances of the prefix when unmunging.")
+    parser.add_argument('--help', '-h', action='help', help="Output this help message and exit.")
+    parser.add_argument('names', metavar='NAME', nargs='+', help="One or more directories and/or symlinks to process.")
+    args = parser.parse_args()
+    main()
+
+# vim: sw=4 et
diff --git a/support/rrsync b/support/rrsync
old mode 100644
new mode 100755
index eabec3dc..629aa182
--- a/support/rrsync
+++ b/support/rrsync
@@ -1,252 +1,378 @@
-#!/usr/bin/env perl
-# Name: /usr/local/bin/rrsync (should also have a symlink in /usr/bin)
-# Purpose: Restricts rsync to subdirectory declared in .ssh/authorized_keys
-# Author: Joe Smith <js-cgi@inwap.com> 30-Sep-2004
-# Modified by: Wayne Davison <wayne@opencoder.net>
-use strict;
-
-use Socket;
-use Cwd 'abs_path';
-use File::Glob ':glob';
-
-# You may configure these values to your liking.  See also the section
-# of options if you want to disable any options that rsync accepts.
-use constant RSYNC => '/usr/bin/rsync';
-use constant LOGFILE => 'rrsync.log';
-
-my $Usage = <<EOM;
-Use 'command="$0 [-ro|-wo] SUBDIR"'
-	in front of lines in $ENV{HOME}/.ssh/authorized_keys
-EOM
-
-# Handle the -ro and -wo options.
-our $only = '';
-while (@ARGV && $ARGV[0] =~ /^-([rw])o$/) {
-    my $r_or_w = $1;
-    if ($only && $only ne $r_or_w) {
-	die "$0: the -ro and -wo options conflict.\n";
-    }
-    $only = $r_or_w;
-    shift;
-}
+#!/usr/bin/env python3
+
+# Restricts rsync to subdirectory declared in .ssh/authorized_keys.  See
+# the rrsync man page for details of how to make use of this script.
+
+# NOTE: install python3 braceexpand to support brace expansion in the args!
+
+# Originally a perl script by: Joe Smith <js-cgi@inwap.com> 30-Sep-2004
+# Python version by: Wayne Davison <wayne@opencoder.net>
+
+# You may configure these 2 values to your liking.  See also the section of
+# short & long options if you want to disable any options that rsync accepts.
+RSYNC = '/usr/bin/rsync'
+LOGFILE = 'rrsync.log' # NOTE: the file must exist for a line to be appended!
+
+# The following options are mainly the options that a client rsync can send
+# to the server, and usually just in the one option format that the stock
+# rsync produces. However, there are some additional convenience options
+# added as well, and thus a few options are present in both the short and
+# long lists (such as --group, --owner, and --perms).
 
-our $subdir = shift;
-die "$0: No subdirectory specified\n$Usage" unless defined $subdir;
-$subdir = abs_path($subdir);
-die "$0: Restricted directory does not exist!\n" if $subdir ne '/' && !-d $subdir;
-
-# The client uses "rsync -av -e ssh src/ server:dir/", and sshd on the server
-# executes this program when .ssh/authorized_keys has 'command="..."'.
-# For example:
-# command="rrsync logs/client" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzGhEeNlPr...
-# command="rrsync -ro results" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAmkHG1WCjC...
-#
-# Format of the environment variables set by sshd:
-# SSH_ORIGINAL_COMMAND=rsync --server          -vlogDtpr --partial . ARG # push
-# SSH_ORIGINAL_COMMAND=rsync --server --sender -vlogDtpr --partial . ARGS # pull
-# SSH_CONNECTION=client_addr client_port server_port
-
-my $command = $ENV{SSH_ORIGINAL_COMMAND};
-die "$0: Not invoked via sshd\n$Usage"	unless defined $command;
-die "$0: SSH_ORIGINAL_COMMAND='$command' is not rsync\n" unless $command =~ s/^rsync\s+//;
-die "$0: --server option is not first\n" unless $command =~ /^--server\s/;
-our $am_sender = $command =~ /^--server\s+--sender\s/; # Restrictive on purpose!
-die "$0 sending to read-only server not allowed\n" if $only eq 'r' && !$am_sender;
-die "$0 reading from write-only server not allowed\n" if $only eq 'w' && $am_sender;
-
-### START of options data produced by the cull_options script. ###
-
-# These options are the only options that rsync might send to the server,
-# and only in the option format that the stock rsync produces.
+# NOTE when disabling: check for both a short & long version of the option!
+
+### START of options data produced by the cull-options script. ###
 
 # To disable a short-named option, add its letter to this string:
-our $short_disabled = 's';
+short_disabled = 's'
+
+# These are also disabled when the restricted dir is not "/":
+short_disabled_subdir = 'KLk'
 
-our $short_no_arg = 'ACDEHIJKLORSUWXbcdgklmnopqrstuvxyz'; # DO NOT REMOVE ANY
-our $short_with_num = '@B'; # DO NOT REMOVE ANY
+# These are all possible short options that we will accept (when not disabled above):
+short_no_arg = 'ACDEHIJKLNORSUWXbcdgklmnopqrstuvxyz' # DO NOT REMOVE ANY
+short_with_num = '@B' # DO NOT REMOVE ANY
 
 # To disable a long-named option, change its value to a -1.  The values mean:
 # 0 = the option has no arg; 1 = the arg doesn't need any checking; 2 = only
 # check the arg when receiving; and 3 = always check the arg.
-our %long_opt = (
-  'append' => 0,
-  'backup-dir' => 2,
-  'block-size' => 1,
-  'bwlimit' => 1,
-  'checksum-choice' => 1,
-  'checksum-seed' => 1,
-  'compare-dest' => 2,
-  'compress-choice' => 1,
-  'compress-level' => 1,
-  'copy-dest' => 2,
-  'copy-unsafe-links' => 0,
-  'daemon' => -1,
-  'debug' => 1,
-  'delay-updates' => 0,
-  'delete' => 0,
-  'delete-after' => 0,
-  'delete-before' => 0,
-  'delete-delay' => 0,
-  'delete-during' => 0,
-  'delete-excluded' => 0,
-  'delete-missing-args' => 0,
-  'existing' => 0,
-  'fake-super' => 0,
-  'files-from' => 3,
-  'force' => 0,
-  'from0' => 0,
-  'fuzzy' => 0,
-  'group' => 0,
-  'groupmap' => 1,
-  'hard-links' => 0,
-  'iconv' => 1,
-  'ignore-errors' => 0,
-  'ignore-existing' => 0,
-  'ignore-missing-args' => 0,
-  'ignore-times' => 0,
-  'info' => 1,
-  'inplace' => 0,
-  'link-dest' => 2,
-  'links' => 0,
-  'list-only' => 0,
-  'log-file' => $only eq 'r' ? -1 : 3,
-  'log-format' => 1,
-  'max-alloc' => 1,
-  'max-delete' => 1,
-  'max-size' => 1,
-  'min-size' => 1,
-  'modify-window' => 1,
-  'new-compress' => 0,
-  'no-implied-dirs' => 0,
-  'no-r' => 0,
-  'no-relative' => 0,
-  'no-specials' => 0,
-  'numeric-ids' => 0,
-  'old-compress' => 0,
-  'one-file-system' => 0,
-  'only-write-batch' => 1,
-  'open-noatime' => 0,
-  'owner' => 0,
-  'partial' => 0,
-  'partial-dir' => 2,
-  'perms' => 0,
-  'preallocate' => 0,
-  'recursive' => 0,
-  'remove-sent-files' => $only eq 'r' ? -1 : 0,
-  'remove-source-files' => $only eq 'r' ? -1 : 0,
-  'safe-links' => 0,
-  'sender' => $only eq 'w' ? -1 : 0,
-  'server' => 0,
-  'size-only' => 0,
-  'skip-compress' => 1,
-  'specials' => 0,
-  'stats' => 0,
-  'suffix' => 1,
-  'super' => 0,
-  'temp-dir' => 2,
-  'timeout' => 1,
-  'times' => 0,
-  'use-qsort' => 0,
-  'usermap' => 1,
-  'write-devices' => -1,
-);
-
-### END of options data produced by the cull_options script. ###
-
-if ($short_disabled ne '') {
-    $short_no_arg =~ s/[$short_disabled]//go;
-    $short_with_num =~ s/[$short_disabled]//go;
-}
-$short_no_arg = "[$short_no_arg]" if length($short_no_arg) > 1;
-$short_with_num = "[$short_with_num]" if length($short_with_num) > 1;
-
-my $write_log = -f LOGFILE && open(LOG, '>>', LOGFILE);
-
-chdir($subdir) or die "$0: Unable to chdir to restricted dir: $!\n";
-
-my(@opts, @args);
-my $in_options = 1;
-my $last_opt = '';
-my $check_type;
-while ($command =~ /((?:[^\s\\]+|\\.[^\s\\]*)+)/g) {
-  $_ = $1;
-  if ($check_type) {
-    push(@opts, check_arg($last_opt, $_, $check_type));
-    $check_type = 0;
-  } elsif ($in_options) {
-    push(@opts, $_);
-    if ($_ eq '.') {
-      $in_options = 0;
-    } else {
-      die "$0: invalid option: '-'\n" if $_ eq '-';
-      next if /^-$short_no_arg*(e\d*\.\w*)?$/o || /^-$short_with_num\d+$/o;
-
-      my($opt,$arg) = /^--([^=]+)(?:=(.*))?$/;
-      my $disabled;
-      if (defined $opt) {
-	my $ct = $long_opt{$opt};
-	last unless defined $ct;
-	next if $ct == 0;
-	if ($ct > 0) {
-	  if (!defined $arg) {
-	    $check_type = $ct;
-	    $last_opt = $opt;
-	    next;
-	  }
-	  $arg = check_arg($opt, $arg, $ct);
-	  $opts[-1] =~ s/=.*/=$arg/;
-	  next;
-	}
-	$disabled = 1;
-	$opt = "--$opt";
-      } elsif ($short_disabled ne '') {
-	$disabled = /^-$short_no_arg*([$short_disabled])/o;
-	$opt = "-$1";
-      }
-
-      last unless $disabled; # Generate generic failure
-      die "$0: option $opt has been disabled on this server.\n";
-    }
-  } else {
-    if ($subdir ne '/') {
-      # Validate args to ensure they don't try to leave our restricted dir.
-      s{//+}{/}g;
-      s{^/}{};
-      s{^$}{.};
-    }
-    push(@args, bsd_glob($_, GLOB_LIMIT|GLOB_NOCHECK|GLOB_BRACE|GLOB_QUOTE));
-  }
+long_opts = {
+  'append': 0,
+  'backup-dir': 2,
+  'block-size': 1,
+  'bwlimit': 1,
+  'checksum-choice': 1,
+  'checksum-seed': 1,
+  'compare-dest': 2,
+  'compress-choice': 1,
+  'compress-level': 1,
+  'copy-dest': 2,
+  'copy-unsafe-links': 0,
+  'daemon': -1,
+  'debug': 1,
+  'delay-updates': 0,
+  'delete': 0,
+  'delete-after': 0,
+  'delete-before': 0,
+  'delete-delay': 0,
+  'delete-during': 0,
+  'delete-excluded': 0,
+  'delete-missing-args': 0,
+  'existing': 0,
+  'fake-super': 0,
+  'files-from': 3,
+  'force': 0,
+  'from0': 0,
+  'fsync': 0,
+  'fuzzy': 0,
+  'group': 0,
+  'groupmap': 1,
+  'hard-links': 0,
+  'iconv': 1,
+  'ignore-errors': 0,
+  'ignore-existing': 0,
+  'ignore-missing-args': 0,
+  'ignore-times': 0,
+  'info': 1,
+  'inplace': 0,
+  'link-dest': 2,
+  'links': 0,
+  'list-only': 0,
+  'log-file': 3,
+  'log-format': 1,
+  'max-alloc': 1,
+  'max-delete': 1,
+  'max-size': 1,
+  'min-size': 1,
+  'mkpath': 0,
+  'modify-window': 1,
+  'msgs2stderr': 0,
+  'munge-links': 0,
+  'new-compress': 0,
+  'no-W': 0,
+  'no-implied-dirs': 0,
+  'no-msgs2stderr': 0,
+  'no-munge-links': -1,
+  'no-r': 0,
+  'no-relative': 0,
+  'no-specials': 0,
+  'numeric-ids': 0,
+  'old-compress': 0,
+  'one-file-system': 0,
+  'only-write-batch': 1,
+  'open-noatime': 0,
+  'owner': 0,
+  'partial': 0,
+  'partial-dir': 2,
+  'perms': 0,
+  'preallocate': 0,
+  'recursive': 0,
+  'remove-sent-files': 0,
+  'remove-source-files': 0,
+  'safe-links': 0,
+  'sender': 0,
+  'server': 0,
+  'size-only': 0,
+  'skip-compress': 1,
+  'specials': 0,
+  'stats': 0,
+  'stderr': 1,
+  'suffix': 1,
+  'super': 0,
+  'temp-dir': 2,
+  'timeout': 1,
+  'times': 0,
+  'use-qsort': 0,
+  'usermap': 1,
+  'write-devices': -1,
 }
-die "$0: invalid rsync-command syntax or options\n" if $in_options;
 
-if ($subdir ne '/') {
-    die "$0: do not use .. in any path!\n" if grep m{(^|/)\.\.(/|$)}, @args;
-}
+### END of options data produced by the cull-options script. ###
 
-@args = ( '.' ) if !@args;
+import os, sys, re, argparse, glob, socket, time, subprocess
+from argparse import RawTextHelpFormatter
 
-if ($write_log) {
-  my ($mm,$hh) = (localtime)[1,2];
-  my $host = $ENV{SSH_CONNECTION} || 'unknown';
-  $host =~ s/ .*//; # Keep only the client's IP addr
-  $host =~ s/^::ffff://;
-  $host = gethostbyaddr(inet_aton($host),AF_INET) || $host;
-  printf LOG "%02d:%02d %-13s [%s]\n", $hh, $mm, $host, "@opts @args";
-  close LOG;
-}
+try:
+    from braceexpand import braceexpand
+except:
+    braceexpand = lambda x: [ DE_BACKSLASH_RE.sub(r'\1', x) ]
 
-# Note: This assumes that the rsync protocol will not be maliciously hijacked.
-exec(RSYNC, @opts, '--', @args) or die "exec(rsync @opts -- @args) failed: $? $!";
-
-sub check_arg
-{
-  my($opt, $arg, $type) = @_;
-  $arg =~ s/\\(.)/$1/g;
-  if ($subdir ne '/' && ($type == 3 || ($type == 2 && !$am_sender))) {
-    $arg =~ s{//}{/}g;
-    die "Do not use .. in --$opt; anchor the path at the root of your restricted dir.\n"
-      if $arg =~ m{(^|/)\.\.(/|$)};
-    $arg =~ s{^/}{$subdir/};
-  }
-  $arg;
-}
+HAS_DOT_DOT_RE = re.compile(r'(^|/)\.\.(/|$)')
+LONG_OPT_RE = re.compile(r'^--([^=]+)(?:=(.*))?$')
+DE_BACKSLASH_RE = re.compile(r'\\(.)')
+
+def main():
+    if not os.path.isdir(args.dir):
+        die("Restricted directory does not exist!")
+
+    # The format of the environment variables set by sshd:
+    #   SSH_ORIGINAL_COMMAND:
+    #     rsync --server          -vlogDtpre.iLsfxCIvu --etc . ARG  # push
+    #     rsync --server --sender -vlogDtpre.iLsfxCIvu --etc . ARGS # pull
+    #   SSH_CONNECTION (client_ip client_port server_ip server_port):
+    #     192.168.1.100 64106 192.168.1.2 22
+
+    command = os.environ.get('SSH_ORIGINAL_COMMAND', None)
+    if not command:
+        die("Not invoked via sshd")
+    command = command.split(' ', 2)
+    if command[0:1] != ['rsync']:
+        die("SSH_ORIGINAL_COMMAND does not run rsync")
+    if command[1:2] != ['--server']:
+        die("--server option is not the first arg")
+    command = '' if len(command) < 3 else command[2]
+
+    global am_sender
+    am_sender = command.startswith("--sender ") # Restrictive on purpose!
+    if args.ro and not am_sender:
+        die("sending to read-only server is not allowed")
+    if args.wo and am_sender:
+        die("reading from write-only server is not allowed")
+
+    if args.wo or not am_sender:
+        long_opts['sender'] = -1
+    if args.no_del:
+        for opt in long_opts:
+            if opt.startswith(('remove', 'delete')):
+                long_opts[opt] = -1
+    if args.ro:
+        long_opts['log-file'] = -1
+
+    if args.dir != '/':
+        global short_disabled
+        short_disabled += short_disabled_subdir
+
+    short_no_arg_re = short_no_arg
+    short_with_num_re = short_with_num
+    if short_disabled:
+        for ltr in short_disabled:
+            short_no_arg_re = short_no_arg_re.replace(ltr, '')
+            short_with_num_re = short_with_num_re.replace(ltr, '')
+        short_disabled_re = re.compile(r'^-[%s]*([%s])' % (short_no_arg_re, short_disabled))
+    short_no_arg_re = re.compile(r'^-(?=.)[%s]*(e\d*\.\w*)?$' % short_no_arg_re)
+    short_with_num_re = re.compile(r'^-[%s]\d+$' % short_with_num_re)
+
+    log_fh = open(LOGFILE, 'a') if os.path.isfile(LOGFILE) else None
+
+    try:
+        os.chdir(args.dir)
+    except OSError as e:
+        die('unable to chdir to restricted dir:', str(e))
+
+    rsync_opts = [ '--server' ]
+    rsync_args = [ ]
+    saw_the_dot_arg = False
+    last_opt = check_type = None
+
+    for arg in re.findall(r'(?:[^\s\\]+|\\.[^\s\\]*)+', command):
+        if check_type:
+            rsync_opts.append(validated_arg(last_opt, arg, check_type))
+            check_type = None
+        elif saw_the_dot_arg:
+            # NOTE: an arg that starts with a '-' is safe due to our use of "--" in the cmd tuple.
+            try:
+                b_e = braceexpand(arg) # Also removes backslashes
+            except: # Handle errors such as unbalanced braces by just de-backslashing the arg:
+                b_e = [ DE_BACKSLASH_RE.sub(r'\1', arg) ]
+            for xarg in b_e:
+                rsync_args += validated_arg('arg', xarg, wild=True)
+        else: # parsing the option args
+            if arg == '.':
+                saw_the_dot_arg = True
+                continue
+            rsync_opts.append(arg)
+            if short_no_arg_re.match(arg) or short_with_num_re.match(arg):
+                continue
+            disabled = False
+            m = LONG_OPT_RE.match(arg)
+            if m:
+                opt = m.group(1)
+                opt_arg = m.group(2)
+                ct = long_opts.get(opt, None)
+                if ct is None:
+                    break # Generate generic failure due to unfinished arg parsing
+                if ct == 0:
+                    continue
+                opt = '--' + opt
+                if ct > 0:
+                    if opt_arg is not None:
+                        rsync_opts[-1] = opt + '=' + validated_arg(opt, opt_arg, ct)
+                    else:
+                        check_type = ct
+                        last_opt = opt
+                    continue
+                disabled = True
+            elif short_disabled:
+                m = short_disabled_re.match(arg)
+                if m:
+                    disabled = True
+                    opt = '-' + m.group(1)
+
+            if disabled:
+                die("option", opt, "has been disabled on this server.")
+            break # Generate a generic failure
+
+    if not saw_the_dot_arg:
+        die("invalid rsync-command syntax or options")
+
+    if args.munge:
+        rsync_opts.append('--munge-links')
+
+    if not rsync_args:
+        rsync_args = [ '.' ]
+
+    cmd = (RSYNC, *rsync_opts, '--', '.', *rsync_args)
+
+    if log_fh:
+        now = time.localtime()
+        host = os.environ.get('SSH_CONNECTION', 'unknown').split()[0] # Drop everything after the IP addr
+        if host.startswith('::ffff:'):
+            host = host[7:]
+        try:
+            host = socket.gethostbyaddr(socket.inet_aton(host))
+        except:
+            pass
+        log_fh.write("%02d:%02d:%02d %-16s %s\n" % (now.tm_hour, now.tm_min, now.tm_sec, host, str(cmd)))
+        log_fh.close()
+
+    # NOTE: This assumes that the rsync protocol will not be maliciously hijacked.
+    if args.no_lock:
+        os.execlp(RSYNC, *cmd)
+        die("execlp(", RSYNC, *cmd, ')  failed')
+    child = subprocess.run(cmd)
+    if child.returncode != 0:
+        sys.exit(child.returncode)
+
+
+def validated_arg(opt, arg, typ=3, wild=False):
+    if opt != 'arg': # arg values already have their backslashes removed.
+        arg = DE_BACKSLASH_RE.sub(r'\1', arg)
+
+    orig_arg = arg
+    if arg.startswith('./'):
+        arg = arg[1:]
+    arg = arg.replace('//', '/')
+    if args.dir != '/':
+        if HAS_DOT_DOT_RE.search(arg):
+            die("do not use .. in", opt, "(anchor the path at the root of your restricted dir)")
+        if arg.startswith('/'):
+            arg = args.dir + arg
+
+    if wild:
+        got = glob.glob(arg)
+        if not got:
+            got = [ arg ]
+    else:
+        got = [ arg ]
+
+    ret = [ ]
+    for arg in got:
+        if args.dir != '/' and arg != '.' and (typ == 3 or (typ == 2 and not am_sender)):
+            arg_has_trailing_slash = arg.endswith('/')
+            if arg_has_trailing_slash:
+                arg = arg[:-1]
+            else:
+                arg_has_trailing_slash_dot = arg.endswith('/.')
+                if arg_has_trailing_slash_dot:
+                    arg = arg[:-2]
+            real_arg = os.path.realpath(arg)
+            if arg != real_arg and not real_arg.startswith(args.dir_slash):
+                die('unsafe arg:', orig_arg, [arg, real_arg])
+            if arg_has_trailing_slash:
+                arg += '/'
+            elif arg_has_trailing_slash_dot:
+                arg += '/.'
+            if opt == 'arg' and arg.startswith(args.dir_slash):
+                arg = arg[args.dir_slash_len:]
+                if arg == '':
+                    arg = '.'
+        ret.append(arg)
+
+    return ret if wild else ret[0]
+
+
+def lock_or_die(dirname):
+    import fcntl
+    global lock_handle
+    lock_handle = os.open(dirname, os.O_RDONLY)
+    try:
+        fcntl.flock(lock_handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except:
+        die('Another instance of rrsync is already accessing this directory.')
+
+
+def die(*msg):
+    print(sys.argv[0], 'error:', *msg, file=sys.stderr)
+    if sys.stdin.isatty():
+        arg_parser.print_help(sys.stderr)
+    sys.exit(1)
+
+
+# This class displays the --help to the user on argparse error IFF they're running it interactively.
+class OurArgParser(argparse.ArgumentParser):
+    def error(self, msg):
+        die(msg)
+
+
+if __name__ == '__main__':
+    our_desc = """Use "man rrsync" to learn how to restrict ssh users to using a restricted rsync command."""
+    arg_parser = OurArgParser(description=our_desc, add_help=False)
+    only_group = arg_parser.add_mutually_exclusive_group()
+    only_group.add_argument('-ro', action='store_true', help="Allow only reading from the DIR. Implies -no-del and -no-lock.")
+    only_group.add_argument('-wo', action='store_true', help="Allow only writing to the DIR.")
+    arg_parser.add_argument('-munge', action='store_true', help="Enable rsync's --munge-links on the server side.")
+    arg_parser.add_argument('-no-del', action='store_true', help="Disable rsync's --delete* and --remove* options.")
+    arg_parser.add_argument('-no-lock', action='store_true', help="Avoid the single-run (per-user) lock check.")
+    arg_parser.add_argument('-help', '-h', action='help', help="Output this help message and exit.")
+    arg_parser.add_argument('dir', metavar='DIR', help="The restricted directory to use.")
+    args = arg_parser.parse_args()
+    args.dir = os.path.realpath(args.dir)
+    args.dir_slash = args.dir + '/'
+    args.dir_slash_len = len(args.dir_slash)
+    if args.ro:
+        args.no_del = True
+    elif not args.no_lock:
+        lock_or_die(args.dir)
+    main()
+
+# vim: sw=4 et
diff --git a/support/rrsync.1.md b/support/rrsync.1.md
new file mode 100644
index 00000000..54980db0
--- /dev/null
+++ b/support/rrsync.1.md
@@ -0,0 +1,139 @@
+## NAME
+
+rrsync - a script to setup restricted rsync users via ssh logins
+
+## SYNOPSIS
+
+```
+rrsync [-ro|-rw] [-munge] [-no-del] [-no-lock] DIR
+```
+
+The single non-option argument specifies the restricted _DIR_ to use. It can be
+relative to the user's home directory or an absolute path.
+
+The online version of this man page (that includes cross-linking of topics)
+is available at <https://download.samba.org/pub/rsync/rrsync.1>.
+
+## DESCRIPTION
+
+A user's ssh login can be restricted to only allow the running of an rsync
+transfer in one of two easy ways: forcing the running of the rrsync script
+or forcing the running of an rsync daemon-over-ssh command.
+
+To use the rrsync script, edit the user's `~/.ssh/authorized_keys` file and add
+a prefix like one of the following (followed by a space) in front of each
+ssh-key line that should be restricted:
+
+> ```
+> command="rrsync DIR"
+> command="rrsync -ro DIR"
+> command="rrsync -munge -no-del DIR"
+> ```
+
+Then, ensure that the rrsync script has your desired option restrictions. You
+may want to copy the script to a local bin dir with a unique name if you want
+to have multiple configurations. One or more rrsync options can be specified
+prior to the _DIR_ if you want to further restrict the transfer.
+
+To use an rsync daemon setup, edit the user's `~/.ssh/authorized_keys` file and
+add a prefix like one of the following (followed by a space) in front of each
+ssh-key line that should be restricted:
+
+> ```
+> command="rsync --server --daemon ."
+> command="rsync --server --daemon --config=/PATH/TO/rsyncd.conf ."
+> ```
+
+Then, ensure that the rsyncd.conf file is created with one or more module names
+with the appropriate path and option restrictions.  If rsync's
+[`--config`](rsync.1#dopt) option is omitted, it defaults to `~/rsyncd.conf`.
+See the `rsyncd.conf` man page for details of how to configure an rsync daemon.
+
+When using rrsync, there can be just one restricted dir per authorized key.  A
+daemon setup, on the other hand, allows multiple module names inside the config
+file, each one with its own path setting.
+
+The remainder of this man page is dedicated to using the rrsync script.
+
+## OPTIONS
+
+0.  `-ro`
+
+    Allow only reading from the DIR. Implies [`-no-del`](#opt) and
+    [`-no-lock`](#opt).
+
+0.  `-wo`
+
+    Allow only writing to the DIR.
+
+0.  `-munge`
+
+    Enable rsync's [`--munge-links`](rsync.1#opt) on the server side.
+
+0.  `-no-del`
+
+    Disable rsync's `--delete*` and `--remove*` options.
+
+0.  `-no-lock`
+
+    Avoid the single-run (per-user) lock check.  Useful with [`-munge`](#opt).
+
+0.  `-help`, `-h`
+
+    Output this help message and exit.
+
+## SECURITY RESTRICTIONS
+
+The rrsync script validates the path arguments it is sent to try to restrict
+them to staying within the specified DIR.
+
+The rrsync script rejects rsync's [`--copy-links`](rsync.1#opt) option (by
+default) so that a copy cannot dereference a symlink within the DIR to get to a
+file outside the DIR.
+
+The rrsync script rejects rsync's [`--protect-args`](rsync.1#opt) (`-s`) option
+because it would allow options to be sent to the server-side that the script
+cannot check.  If you want to support `--protect-args`, use a daemon-over-ssh
+setup.
+
+The rrsync script accepts just a subset of rsync's options that the real rsync
+uses when running the server command.  A few extra convenience options are also
+included to help it to interact with BackupPC and accept some convenient user
+overrides.
+
+The script (or a copy of it) can be manually edited if you want it to customize
+the option handling.
+
+## EXAMPLES
+
+The `~/.ssh/authorized_keys` file might have lines in it like this:
+
+> ```
+> command="rrsync client/logs" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzG...
+> command="rrsync -ro results" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAmk...
+> ```
+
+## FILES
+
+~/.ssh/authorized_keys
+
+## SEE ALSO
+
+[**rsync**(1)](rsync.1)
+
+## VERSION
+
+This man page is current for version @VERSION@ of rsync.
+
+## CREDITS
+
+rsync is distributed under the GNU General Public License.  See the file
+[COPYING](COPYING) for details.
+
+An rsync web site is available at <https://rsync.samba.org/> and its github
+project is <https://github.com/WayneD/rsync>.
+
+## AUTHOR
+
+The original rrsync perl script was written by Joe Smith.  Many people have
+later contributed to it.  The python version was created by Wayne Davison.
diff --git a/support/rsync-no-vanished b/support/rsync-no-vanished
index cc3c29ce..b31a5d21 100755
--- a/support/rsync-no-vanished
+++ b/support/rsync-no-vanished
@@ -1,12 +1,21 @@
 #!/usr/bin/env bash
 
+REAL_RSYNC=/usr/bin/rsync
 IGNOREEXIT=24
 IGNOREOUT='^(file has vanished: |rsync warning: some files vanished before they could be transferred)'
 
+# If someone installs this as "rsync", make sure we don't affect a server run.
+for arg in "${@}"; do
+    if [[ "$arg" == --server ]]; then
+	exec $REAL_RSYNC "${@}"
+	exit $? # Not reached
+    fi
+done
+
 set -o pipefail
 
-rsync "${@}" 2>&1 | (egrep -v "$IGNOREOUT" || true)
-ret=$?
+# This filters stderr without merging it with stdout:
+{ $REAL_RSYNC "${@}" 2>&1 1>&3 3>&- | grep -E -v "$IGNOREOUT"; ret=${PIPESTATUS[0]}; } 3>&1 1>&2
 
 if [[ $ret == $IGNOREEXIT ]]; then
     ret=0
diff --git a/support/rsync-slash-strip b/support/rsync-slash-strip
index 2869e45c..b57e61c5 100755
--- a/support/rsync-slash-strip
+++ b/support/rsync-slash-strip
@@ -6,12 +6,19 @@
 #
 # To use this, name it something like "rs", put it somewhere in your path, and
 # then use "rs" in place of "rsync" when you are typing your copy commands.
+
+REAL_RSYNC=/usr/bin/rsync
+
 args=()
 for arg in "${@}"; do
+    if [[ "$arg" == --server ]]; then
+	exec $REAL_RSYNC "${@}"
+	exit $? # Not reached
+    fi
     if [[ "$arg" == / ]]; then
 	args=("${args[@]}" /)
     else
 	args=("${args[@]}" "${arg%/}")
     fi
 done
-exec /usr/bin/rsync "${args[@]}"
+exec $REAL_RSYNC "${args[@]}"
diff --git a/syscall.c b/syscall.c
index b9c3b4ef..d92074aa 100644
--- a/syscall.c
+++ b/syscall.c
@@ -4,7 +4,7 @@
  *
  * Copyright (C) 1998 Andrew Tridgell
  * Copyright (C) 2002 Martin Pool
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -55,12 +55,16 @@ extern int open_noatime;
 #endif
 
 #ifdef SUPPORT_CRTIMES
+#ifdef HAVE_GETATTRLIST
 #pragma pack(push, 4)
 struct create_time {
 	uint32 length;
 	struct timespec crtime;
 };
 #pragma pack(pop)
+#elif defined __CYGWIN__
+#include <windows.h>
+#endif
 #endif
 
 #define RETURN_ERROR_IF(x,e) \
@@ -73,15 +77,15 @@ struct create_time {
 
 #define RETURN_ERROR_IF_RO_OR_LO RETURN_ERROR_IF(read_only || list_only, EROFS)
 
-int do_unlink(const char *fname)
+int do_unlink(const char *path)
 {
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
-	return unlink(fname);
+	return unlink(path);
 }
 
 #ifdef SUPPORT_LINKS
-int do_symlink(const char *lnk, const char *fname)
+int do_symlink(const char *lnk, const char *path)
 {
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
@@ -91,7 +95,7 @@ int do_symlink(const char *lnk, const char *fname)
 	 * and write the lnk into it. */
 	if (am_root < 0) {
 		int ok, len = strlen(lnk);
-		int fd = open(fname, O_WRONLY|O_CREAT|O_TRUNC, S_IWUSR|S_IRUSR);
+		int fd = open(path, O_WRONLY|O_CREAT|O_TRUNC, S_IWUSR|S_IRUSR);
 		if (fd < 0)
 			return -1;
 		ok = write(fd, lnk, len) == len;
@@ -101,7 +105,7 @@ int do_symlink(const char *lnk, const char *fname)
 	}
 #endif
 
-	return symlink(lnk, fname);
+	return symlink(lnk, path);
 }
 
 #if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS
@@ -227,27 +231,43 @@ int do_open(const char *pathname, int flags, mode_t mode)
 #ifdef HAVE_CHMOD
 int do_chmod(const char *path, mode_t mode)
 {
+	static int switch_step = 0;
 	int code;
+
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
+
+	switch (switch_step) {
 #ifdef HAVE_LCHMOD
-	code = lchmod(path, mode & CHMOD_BITS);
-#else
-	if (S_ISLNK(mode)) {
+	case 0:
+		if ((code = lchmod(path, mode & CHMOD_BITS)) == 0)
+			break;
+		if (errno == ENOSYS)
+			switch_step++;
+		else if (errno != ENOTSUP)
+			break;
+#endif
+		/* FALLTHROUGH */
+	default:
+		if (S_ISLNK(mode)) {
 # if defined HAVE_SETATTRLIST
-		struct attrlist attrList;
-		uint32_t m = mode & CHMOD_BITS; /* manpage is wrong: not mode_t! */
-
-		memset(&attrList, 0, sizeof attrList);
-		attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
-		attrList.commonattr = ATTR_CMN_ACCESSMASK;
-		code = setattrlist(path, &attrList, &m, sizeof m, FSOPT_NOFOLLOW);
+			struct attrlist attrList;
+			uint32_t m = mode & CHMOD_BITS; /* manpage is wrong: not mode_t! */
+
+			memset(&attrList, 0, sizeof attrList);
+			attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
+			attrList.commonattr = ATTR_CMN_ACCESSMASK;
+			if ((code = setattrlist(path, &attrList, &m, sizeof m, FSOPT_NOFOLLOW)) == 0)
+				break;
+			if (errno == ENOTSUP)
+				code = 1;
 # else
-		code = 1;
+			code = 1;
 # endif
-	} else
-		code = chmod(path, mode & CHMOD_BITS); /* DISCOURAGED FUNCTION */
-#endif /* !HAVE_LCHMOD */
+		} else
+			code = chmod(path, mode & CHMOD_BITS); /* DISCOURAGED FUNCTION */
+		break;
+	}
 	if (code != 0 && (preserve_perms || preserve_executability))
 		return code;
 	return 0;
@@ -295,12 +315,12 @@ void trim_trailing_slashes(char *name)
 	}
 }
 
-int do_mkdir(char *fname, mode_t mode)
+int do_mkdir(char *path, mode_t mode)
 {
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
-	trim_trailing_slashes(fname);
-	return mkdir(fname, mode);
+	trim_trailing_slashes(path);
+	return mkdir(path, mode);
 }
 
 /* like mkstemp but forces permissions */
@@ -334,25 +354,25 @@ int do_mkstemp(char *template, mode_t perms)
 #endif
 }
 
-int do_stat(const char *fname, STRUCT_STAT *st)
+int do_stat(const char *path, STRUCT_STAT *st)
 {
 #ifdef USE_STAT64_FUNCS
-	return stat64(fname, st);
+	return stat64(path, st);
 #else
-	return stat(fname, st);
+	return stat(path, st);
 #endif
 }
 
-int do_lstat(const char *fname, STRUCT_STAT *st)
+int do_lstat(const char *path, STRUCT_STAT *st)
 {
 #ifdef SUPPORT_LINKS
 # ifdef USE_STAT64_FUNCS
-	return lstat64(fname, st);
+	return lstat64(path, st);
 # else
-	return lstat(fname, st);
+	return lstat(path, st);
 # endif
 #else
-	return do_stat(fname, st);
+	return do_stat(path, st);
 #endif
 }
 
@@ -380,7 +400,29 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence)
 }
 
 #ifdef HAVE_SETATTRLIST
-int do_setattrlist_times(const char *fname, STRUCT_STAT *stp)
+int do_setattrlist_times(const char *path, STRUCT_STAT *stp)
+{
+	struct attrlist attrList;
+	struct timespec ts[2];
+
+	if (dry_run) return 0;
+	RETURN_ERROR_IF_RO_OR_LO;
+
+	/* Yes, this is in the opposite order of utime and similar. */
+	ts[0].tv_sec = stp->st_mtime;
+	ts[0].tv_nsec = stp->ST_MTIME_NSEC;
+
+	ts[1].tv_sec = stp->st_atime;
+	ts[1].tv_nsec = stp->ST_ATIME_NSEC;
+
+	memset(&attrList, 0, sizeof attrList);
+	attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
+	attrList.commonattr = ATTR_CMN_MODTIME | ATTR_CMN_ACCTIME;
+	return setattrlist(path, &attrList, ts, sizeof ts, FSOPT_NOFOLLOW);
+}
+
+#ifdef SUPPORT_CRTIMES
+int do_setattrlist_crtime(const char *path, time_t crtime)
 {
 	struct attrlist attrList;
 	struct timespec ts;
@@ -388,52 +430,70 @@ int do_setattrlist_times(const char *fname, STRUCT_STAT *stp)
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
 
-	ts.tv_sec = stp->st_mtime;
-	ts.tv_nsec = stp->ST_MTIME_NSEC;
+	ts.tv_sec = crtime;
+	ts.tv_nsec = 0;
 
 	memset(&attrList, 0, sizeof attrList);
 	attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
-	attrList.commonattr = ATTR_CMN_MODTIME;
-	return setattrlist(fname, &attrList, &ts, sizeof ts, FSOPT_NOFOLLOW);
+	attrList.commonattr = ATTR_CMN_CRTIME;
+	return setattrlist(path, &attrList, &ts, sizeof ts, FSOPT_NOFOLLOW);
 }
 #endif
+#endif /* HAVE_SETATTRLIST */
 
 #ifdef SUPPORT_CRTIMES
-time_t get_create_time(const char *path)
+time_t get_create_time(const char *path, STRUCT_STAT *stp)
 {
+#ifdef HAVE_GETATTRLIST
 	static struct create_time attrBuf;
 	struct attrlist attrList;
 
+	(void)stp;
 	memset(&attrList, 0, sizeof attrList);
 	attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
 	attrList.commonattr = ATTR_CMN_CRTIME;
 	if (getattrlist(path, &attrList, &attrBuf, sizeof attrBuf, FSOPT_NOFOLLOW) < 0)
 		return 0;
 	return attrBuf.crtime.tv_sec;
-}
+#elif defined __CYGWIN__
+	(void)path;
+	return stp->st_birthtime;
+#else
+#error Unknown crtimes implementation
 #endif
+}
 
-#ifdef SUPPORT_CRTIMES
-int set_create_time(const char *path, time_t crtime)
+#if defined __CYGWIN__
+int do_SetFileTime(const char *path, time_t crtime)
 {
-	struct attrlist attrList;
-	struct timespec ts;
-
 	if (dry_run) return 0;
 	RETURN_ERROR_IF_RO_OR_LO;
 
-	ts.tv_sec = crtime;
-	ts.tv_nsec = 0;
-
-	memset(&attrList, 0, sizeof attrList);
-	attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
-	attrList.commonattr = ATTR_CMN_CRTIME;
-	return setattrlist(path, &attrList, &ts, sizeof ts, FSOPT_NOFOLLOW);
+	int cnt = MultiByteToWideChar(CP_UTF8, 0, path, -1, NULL, 0);
+	if (cnt == 0)
+	    return -1;
+	WCHAR *pathw = new_array(WCHAR, cnt);
+	if (!pathw)
+	    return -1;
+	MultiByteToWideChar(CP_UTF8, 0, path, -1, pathw, cnt);
+	HANDLE handle = CreateFileW(pathw, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+				    NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
+	free(pathw);
+	if (handle == INVALID_HANDLE_VALUE)
+	    return -1;
+	int64 temp_time = Int32x32To64(crtime, 10000000) + 116444736000000000LL;
+	FILETIME birth_time;
+	birth_time.dwLowDateTime = (DWORD)temp_time;
+	birth_time.dwHighDateTime = (DWORD)(temp_time >> 32);
+	int ok = SetFileTime(handle, &birth_time, NULL, NULL);
+	CloseHandle(handle);
+	return ok ? 0 : -1;
 }
 #endif
+#endif /* SUPPORT_CRTIMES */
 
 #ifdef HAVE_UTIMENSAT
-int do_utimensat(const char *fname, STRUCT_STAT *stp)
+int do_utimensat(const char *path, STRUCT_STAT *stp)
 {
 	struct timespec t[2];
 
@@ -452,12 +512,12 @@ int do_utimensat(const char *fname, STRUCT_STAT *stp)
 #else
 	t[1].tv_nsec = 0;
 #endif
-	return utimensat(AT_FDCWD, fname, t, AT_SYMLINK_NOFOLLOW);
+	return utimensat(AT_FDCWD, path, t, AT_SYMLINK_NOFOLLOW);
 }
 #endif
 
 #ifdef HAVE_LUTIMES
-int do_lutimes(const char *fname, STRUCT_STAT *stp)
+int do_lutimes(const char *path, STRUCT_STAT *stp)
 {
 	struct timeval t[2];
 
@@ -476,12 +536,12 @@ int do_lutimes(const char *fname, STRUCT_STAT *stp)
 #else
 	t[1].tv_usec = 0;
 #endif
-	return lutimes(fname, t);
+	return lutimes(path, t);
 }
 #endif
 
 #ifdef HAVE_UTIMES
-int do_utimes(const char *fname, STRUCT_STAT *stp)
+int do_utimes(const char *path, STRUCT_STAT *stp)
 {
 	struct timeval t[2];
 
@@ -500,11 +560,11 @@ int do_utimes(const char *fname, STRUCT_STAT *stp)
 #else
 	t[1].tv_usec = 0;
 #endif
-	return utimes(fname, t);
+	return utimes(path, t);
 }
 
 #elif defined HAVE_UTIME
-int do_utime(const char *fname, STRUCT_STAT *stp)
+int do_utime(const char *path, STRUCT_STAT *stp)
 {
 #ifdef HAVE_STRUCT_UTIMBUF
 	struct utimbuf tbuf;
@@ -518,11 +578,11 @@ int do_utime(const char *fname, STRUCT_STAT *stp)
 # ifdef HAVE_STRUCT_UTIMBUF
 	tbuf.actime = stp->st_atime;
 	tbuf.modtime = stp->st_mtime;
-	return utime(fname, &tbuf);
+	return utime(path, &tbuf);
 # else
 	t[0] = stp->st_atime;
 	t[1] = stp->st_mtime;
-	return utime(fname, t);
+	return utime(path, t);
 # endif
 }
 
diff --git a/t_stub.c b/t_stub.c
index 1e1e4046..a9ce5848 100644
--- a/t_stub.c
+++ b/t_stub.c
@@ -3,7 +3,7 @@
  * functions, so that module test harnesses can run standalone.
  *
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -21,6 +21,7 @@
 
 #include "rsync.h"
 
+int do_fsync = 0;
 int inplace = 0;
 int modify_window = 0;
 int preallocate_files = 0;
@@ -28,10 +29,11 @@ int protect_args = 0;
 int module_id = -1;
 int relative_paths = 0;
 int module_dirlen = 0;
-int preserve_times = 0;
+int preserve_mtimes = 0;
 int preserve_xattrs = 0;
 int preserve_perms = 0;
 int preserve_executability = 0;
+int omit_link_times = 0;
 int open_noatime = 0;
 size_t max_alloc = 0; /* max_alloc is needed when combined with util2.o */
 char *partial_dir;
diff --git a/testsuite/00-hello.test b/testsuite/00-hello.test
index ecb26348..ebd06836 100644
--- a/testsuite/00-hello.test
+++ b/testsuite/00-hello.test
@@ -1,9 +1,11 @@
-#! /bin/sh
+#!/bin/sh
 
-test_fail() {
-    echo "$@" >&2
-    exit 1
-}
+# Test some foundational things.
+
+. "$suitedir/rsync.fns"
+
+RSYNC_RSH="$scratchdir/src/support/lsh.sh"
+export RSYNC_RSH
 
 echo $0 running
 
@@ -12,3 +14,48 @@ $RSYNC --version || test_fail '--version output failed'
 $RSYNC --info=help || test_fail '--info=help output failed'
 
 $RSYNC --debug=help || test_fail '--debug=help output failed'
+
+weird_name="A weird)name"
+
+mkdir "$fromdir"
+mkdir "$fromdir/$weird_name"
+
+append_line() {
+    echo "$1"
+    echo "$1" >>"$fromdir/$weird_name/file"
+}
+
+append_line test1
+checkit "$RSYNC -ai '$fromdir/' '$todir/'" "$fromdir" "$todir"
+
+copy_weird() {
+    checkit "$RSYNC $1 --rsync-path='$RSYNC' '$2$fromdir/$weird_name/' '$3$todir/$weird_name'" "$fromdir" "$todir"
+}
+
+append_line test2
+copy_weird '-ai' 'lh:' ''
+
+append_line test3
+copy_weird '-ai' '' 'lh:'
+
+append_line test4
+copy_weird '-ais' 'lh:' ''
+
+append_line test5
+copy_weird '-ais' '' 'lh:'
+
+echo test6
+
+touch "$fromdir/one" "$fromdir/two"
+(cd "$fromdir" && $RSYNC -ai --old-args --rsync-path="$RSYNC" lh:'one two' "$todir/")
+if [ ! -f "$todir/one" ] || [ ! -f "$todir/two" ]; then
+    test_fail "old-args copy of 'one two' failed"
+fi
+
+echo test7
+
+rm "$todir/one" "$todir/two"
+(cd "$fromdir" && RSYNC_OLD_ARGS=1 $RSYNC -ai --rsync-path="$RSYNC" lh:'one two' "$todir/")
+
+# The script would have aborted on error, so getting here means we've won.
+exit 0
diff --git a/testsuite/README.testsuite b/testsuite/README.testsuite
index d2fbe90c..782cb1ca 100644
--- a/testsuite/README.testsuite
+++ b/testsuite/README.testsuite
@@ -26,5 +26,3 @@ you could include the log messages when reporting a failure.
 
 These tests also run automatically on the build farm, and you can see
 the results on http://build.samba.org/.
-
-
diff --git a/testsuite/default-acls.test b/testsuite/acls-default.test
similarity index 98%
rename from testsuite/default-acls.test
rename to testsuite/acls-default.test
index 17893f93..a0a482ce 100644
--- a/testsuite/default-acls.test
+++ b/testsuite/acls-default.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -21,7 +21,7 @@ testit() {
     todir="$scratchdir/$1"
     mkdir "$todir"
     $setfacl_nodef "$todir"
-    if [ "$2" ]; then
+    if [ -n "$2" ]; then
 	case "$setfacl_nodef" in
 	*-k*) opts="-dm $2" ;;
 	*) opts="-m `echo $2 | sed 's/$[ugom]:$/d:\1/g'`"
diff --git a/testsuite/acls.test b/testsuite/acls.test
index 5728cd57..23449018 100644
--- a/testsuite/acls.test
+++ b/testsuite/acls.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -17,8 +17,8 @@ files='foo file1 file2'
 
 case "$setfacl_nodef" in
 true)
-    if ! chmod --help 2>&1 | fgrep +a >/dev/null; then
-	test_skipped "I don't know how to use setfacl or chmod for ACLs"
+    if ! chmod --help 2>&1 | grep -F +a >/dev/null; then
+        test_skipped "I don't know how to use setfacl or chmod for ACLs"
     fi
     chmod +a "root allow read,write,execute" "$fromdir/foo" || test_skipped "Your filesystem has ACLs disabled"
     chmod +a "root allow read,execute" "$fromdir/file1"
@@ -27,7 +27,7 @@ true)
     chmod +a "root allow read,execute" "$fromdir/file2"
 
     see_acls() {
-	ls -le "${@}"
+        ls -le "${@}"
     }
     ;;
 *)
@@ -45,7 +45,7 @@ true)
     setfacl -m u:0:5 "$fromdir/file2"
 
     see_acls() {
-	getfacl "${@}"
+        getfacl "${@}"
     }
     ;;
 esac
diff --git a/testsuite/alt-dest.test b/testsuite/alt-dest.test
new file mode 100644
index 00000000..d2fb5a1b
--- /dev/null
+++ b/testsuite/alt-dest.test
@@ -0,0 +1,68 @@
+#!/bin/sh
+
+# Copyright (C) 2004-2022 Wayne Davison
+
+# This program is distributable under the terms of the GNU GPL (see
+# COPYING).
+
+# Test rsync handling of --compare-dest and similar options.
+
+. "$suitedir/rsync.fns"
+
+alt1dir="$tmpdir/alt1"
+alt2dir="$tmpdir/alt2"
+alt3dir="$tmpdir/alt3"
+
+SSH="$scratchdir/src/support/lsh.sh"
+
+# Build some files/dirs/links to copy
+
+hands_setup
+
+# Setup the alt and chk dirs
+$RSYNC -av --include=text --include='*/' --exclude='*' "$fromdir/" "$alt1dir/"
+$RSYNC -av --include=etc-ltr-list --include='*/' --exclude='*' "$fromdir/" "$alt2dir/"
+
+# Create a side dir where there is a candidate destfile of the same name as a sourcefile
+echo "This is a test file" >"$fromdir/likely"
+
+mkdir "$alt3dir"
+echo "This is a test file" >"$alt3dir/likely"
+
+sleep 1
+touch "$fromdir/dir/text" "$fromdir/likely"
+
+$RSYNC -av --exclude=/text --exclude=etc-ltr-list "$fromdir/" "$chkdir/"
+
+# Let's do it!
+checkit "$RSYNC -avv --no-whole-file \
+    --compare-dest='$alt1dir' --compare-dest='$alt2dir' \
+    '$fromdir/' '$todir/'" "$chkdir" "$todir"
+
+rm -rf "$todir"
+checkit "$RSYNC -avv --no-whole-file \
+    --copy-dest='$alt1dir' --copy-dest='$alt2dir' \
+    '$fromdir/' '$todir/'" "$fromdir" "$todir"
+
+# Test that copy_file() works correctly with tmpfiles
+for maybe_inplace in '' --inplace; do
+    rm -rf "$todir"
+    checkit "$RSYNC -av $maybe_inplace --copy-dest='$alt3dir' \
+	'$fromdir/' '$todir/'" "$fromdir" "$todir"
+
+    for srchost in '' 'localhost:'; do
+	if [ -z "$srchost" ]; then
+	    desthost='localhost:'
+	else
+	    desthost=''
+	fi
+
+	rm -rf "$todir"
+	checkit "$RSYNC -ave '$SSH' --rsync-path='$RSYNC' $maybe_inplace \
+	    --copy-dest='$alt3dir' '$srchost$fromdir/' '$desthost$todir/'" \
+	    "$fromdir" "$todir"
+    done
+done
+
+# The script would have aborted on error, so getting here means we've won.
+exit 0
diff --git a/testsuite/atimes.test b/testsuite/atimes.test
index 6dd58136..3bdb1d46 100644
--- a/testsuite/atimes.test
+++ b/testsuite/atimes.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Test rsync copying atimes
 
diff --git a/testsuite/backup.test b/testsuite/backup.test
index 87db33e5..4de38674 100644
--- a/testsuite/backup.test
+++ b/testsuite/backup.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2004-2020 Wayne Davison
+# Copyright (C) 2004-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -15,8 +15,6 @@ makepath "$fromdir/deep" "$bakdir/dname"
 name1="$fromdir/deep/name1"
 name2="$fromdir/deep/name2"
 
-outfile="$scratchdir/rsync.out"
-
 cat "$srcdir"/[gr]*.[ch] > "$name1"
 cat "$srcdir"/[et]*.[ch] > "$name2"
 
@@ -26,8 +24,7 @@ checkit "$RSYNC -ai --info=backup '$fromdir/' '$chkdir/'" "$fromdir" "$chkdir"
 cat "$srcdir"/[fgpr]*.[ch] > "$name1"
 cat "$srcdir"/[etw]*.[ch] > "$name2"
 
-$RSYNC -ai --info=backup --no-whole-file --backup "$fromdir/" "$todir/" \
-    | tee "$outfile"
+checktee "$RSYNC -ai --info=backup --no-whole-file --backup '$fromdir/' '$todir/'"
 for fn in deep/name1 deep/name2; do
     grep "backed up $fn to $fn~" "$outfile" >/dev/null || test_fail "no backup message output for $fn"
     diff $diffopt "$fromdir/$fn" "$todir/$fn" || test_fail "copy of $fn failed"
diff --git a/testsuite/batch-mode.test b/testsuite/batch-mode.test
index 7f92e482..cf4e94d3 100644
--- a/testsuite/batch-mode.test
+++ b/testsuite/batch-mode.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2004 by Chris Shoemaker <c.shoemaker@cox.net>
 
diff --git a/testsuite/chgrp.test b/testsuite/chgrp.test
index 8cd6c107..467d4029 100644
--- a/testsuite/chgrp.test
+++ b/testsuite/chgrp.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
@@ -16,8 +16,7 @@
 mygrps="`rsync_getgroups`" || test_fail "Can't get groups"
 mkdir "$fromdir"
 
-for g in $mygrps
-do
+for g in $mygrps; do
     name="$fromdir/foo-$g"
     date > "$name"
     chgrp "$g" "$name" || test_fail "Can't chgrp"
diff --git a/testsuite/chmod-option.test b/testsuite/chmod-option.test
index 81fd38c7..ddf764cf 100644
--- a/testsuite/chmod-option.test
+++ b/testsuite/chmod-option.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
@@ -31,7 +31,7 @@ chmod 770 "$dir2"
 # Copy the files we've created over to another directory
 checkit "$RSYNC -avv '$fromdir/' '$checkdir/'" "$fromdir" "$checkdir"
 
-# And then manually make the changes which should occur 
+# And then manually make the changes which should occur
 umask 002
 chmod ug-s,a+rX "$checkdir"/*
 chmod +w "$checkdir" "$checkdir"/dir*
diff --git a/testsuite/chmod-temp-dir.test b/testsuite/chmod-temp-dir.test
index d31a1bdf..362d9d99 100644
--- a/testsuite/chmod-temp-dir.test
+++ b/testsuite/chmod-temp-dir.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2004-2020 Wayne Davison
+# Copyright (C) 2004-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -17,7 +17,7 @@ sdev=`$TOOLDIR/getfsdev $scratchdir`
 tdev=$sdev
 
 for tmpdir2 in "${RSYNC_TEST_TMP:-/override-tmp-not-specified}" /run/shm /var/tmp /tmp; do
-    [ -d "$tmpdir2" -a -w "$tmpdir2" ] || continue
+    [ -d "$tmpdir2" ] && [ -w "$tmpdir2" ] || continue
     tdev=`$TOOLDIR/getfsdev "$tmpdir2"`
     [ x$sdev != x$tdev ] && break
 done
diff --git a/testsuite/chmod.test b/testsuite/chmod.test
index f2dd4399..1646a9c8 100644
--- a/testsuite/chmod.test
+++ b/testsuite/chmod.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2004-2020 Wayne Davison
+# Copyright (C) 2004-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/chown.test b/testsuite/chown.test
index 3aec55a9..5dadb836 100644
--- a/testsuite/chown.test
+++ b/testsuite/chown.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
diff --git a/testsuite/compare-dest.test b/testsuite/compare-dest.test
deleted file mode 100644
index 7f193c58..00000000
--- a/testsuite/compare-dest.test
+++ /dev/null
@@ -1,37 +0,0 @@
-#! /bin/sh
-
-# Copyright (C) 2004-2020 Wayne Davison
-
-# This program is distributable under the terms of the GNU GPL (see
-# COPYING).
-
-# Test rsync handling of the --compare-dest option.
-
-. "$suitedir/rsync.fns"
-
-alt1dir="$tmpdir/alt1"
-alt2dir="$tmpdir/alt2"
-
-# Build some files/dirs/links to copy
-
-hands_setup
-
-# Setup the alt and chk dirs
-$RSYNC -av --include=text --include='*/' --exclude='*' "$fromdir/" "$alt1dir/"
-$RSYNC -av --include=etc-ltr-list --include='*/' --exclude='*' "$fromdir/" "$alt2dir/"
-
-sleep 1
-touch "$fromdir/dir/text"
-
-$RSYNC -av --exclude=/text --exclude=etc-ltr-list "$fromdir/" "$chkdir/"
-
-# Let's do it!
-checkit "$RSYNC -avv --no-whole-file \
-    --compare-dest='$alt1dir' --compare-dest='$alt2dir' \
-    '$fromdir/' '$todir/'" "$chkdir" "$todir"
-checkit "$RSYNC -avv --no-whole-file \
-    --copy-dest='$alt1dir' --copy-dest='$alt2dir' \
-    '$fromdir/' '$todir/'" "$fromdir" "$todir"
-
-# The script would have aborted on error, so getting here means we've won.
-exit 0
diff --git a/testsuite/crtimes.test b/testsuite/crtimes.test
index aa71b456..07d9269b 100644
--- a/testsuite/crtimes.test
+++ b/testsuite/crtimes.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Test rsync copying create times
 
@@ -10,7 +10,7 @@ $RSYNC --version | grep "[, ] crtimes" >/dev/null || test_skipped "Rsync is conf
 # Setting it to a newer time affects just the mtime.
 
 mkdir "$fromdir"
-echo hiho "$fromdir/foo"
+echo hiho >"$fromdir/foo"
 
 touch -t 200101011111.11 "$fromdir"
 touch -t 200202022222.22 "$fromdir"
diff --git a/testsuite/daemon.test b/testsuite/daemon.test
index 836ce33b..80d2baf6 100644
--- a/testsuite/daemon.test
+++ b/testsuite/daemon.test
@@ -21,9 +21,6 @@
 
 . "$suitedir/rsync.fns"
 
-chkfile="$scratchdir/rsync.chk"
-outfile="$scratchdir/rsync.out"
-
 SSH="src/support/lsh.sh --no-cd"
 FILE_REPL='s/^$[^d][^ ]*$ *$..........[0-9]$ /\1 \2 /'
 DIR_REPL='s/^$d[^ ]*$  *[0-9][.,0-9]* /\1         DIR /'
@@ -57,21 +54,17 @@ test-to        	r/w
 test-scratch   	NOCOMMENT
 EOT
 
-$RSYNC -ve "$SSH" --rsync-path="$RSYNC$confopt" localhost:: | tee "$outfile"
+checkdiff2 "$RSYNC -ve '$SSH' --rsync-path='$RSYNC$confopt' localhost::"
 echo '===='
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 0 failed"
 
 RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon"
 export RSYNC_CONNECT_PROG
 
-$RSYNC -v localhost:: | tee "$outfile"
+checkdiff2 "$RSYNC -v localhost::"
 echo '===='
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 1 failed"
 
-$RSYNC -r localhost::test-hidden \
-    | sed "$FILE_REPL" | sed "$DIR_REPL" | sed "$LS_REPL" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -r localhost::test-hidden" \
+	"sed -e '$FILE_REPL' -e '$DIR_REPL' -e '$LS_REPL'" <<EOT
 drwxr-xr-x         DIR ####/##/## ##:##:## .
 drwxr-xr-x         DIR ####/##/## ##:##:## bar
 -rw-r--r--           4 ####/##/## ##:##:## bar/two
@@ -80,24 +73,18 @@ drwxr-xr-x         DIR ####/##/## ##:##:## bar/baz
 drwxr-xr-x         DIR ####/##/## ##:##:## foo
 -rw-r--r--           4 ####/##/## ##:##:## foo/one
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 2 failed"
 
-$RSYNC -r localhost::test-from/f* \
-    | sed "$FILE_REPL" | sed "$DIR_REPL" | sed "$LS_REPL" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -r localhost::test-from/f*" \
+	"sed -e '$FILE_REPL' -e '$DIR_REPL' -e '$LS_REPL'" <<EOT
 drwxr-xr-x         DIR ####/##/## ##:##:## foo
 -rw-r--r--           4 ####/##/## ##:##:## foo/one
 EOT
 diff $diffopt "$chkfile" "$outfile" || test_fail "test 3 failed"
 
 if $RSYNC --version | grep "[, ] atimes" >/dev/null; then
-    $RSYNC -rU localhost::test-from/f* \
-	| sed "$FILE_REPL" | sed "$DIR_REPL" | sed "$LS_REPL" \
-	| tee "$outfile"
-    cat <<EOT >"$chkfile"
+    checkdiff "$RSYNC -rU localhost::test-from/f*" \
+	"sed -e '$FILE_REPL' -e '$DIR_REPL' -e '$LS_REPL'" <<EOT
 drwxr-xr-x         DIR ####/##/## ##:##:##                     foo
 -rw-r--r--           4 ####/##/## ##:##:## ####/##/## ##:##:## foo/one
 EOT
-    diff $diffopt "$chkfile" "$outfile" || test_fail "test 3 failed"
 fi
diff --git a/testsuite/delay-updates.test b/testsuite/delay-updates.test
new file mode 100644
index 00000000..3b6226b4
--- /dev/null
+++ b/testsuite/delay-updates.test
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Test rsync --delay-updates
+
+. "$suitedir/rsync.fns"
+
+mkdir "$fromdir"
+
+echo 1 > "$fromdir/foo"
+
+checkit "$RSYNC -aiv --delay-updates \"$fromdir/\" \"$todir/\"" "$fromdir" "$todir"
+
+mkdir "$todir/.~tmp~"
+echo 2 > "$todir/.~tmp~/foo"
+touch -r .. "$todir/.~tmp~/foo" "$todir/foo"
+echo 3 > "$fromdir/foo"
+
+checkit "$RSYNC -aiv --delay-updates \"$fromdir/\" \"$todir/\"" "$fromdir" "$todir"
+
+# The script would have aborted on error, so getting here means we've won.
+exit 0
diff --git a/testsuite/delete.test b/testsuite/delete.test
index 8c19827b..2a9df7c9 100644
--- a/testsuite/delete.test
+++ b/testsuite/delete.test
@@ -1,11 +1,11 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2005-2020 Wayne Davison
+# Copyright (C) 2005-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
 
-# Test rsync handling of various delete directives.  
+# Test rsync handling of various delete directives.
 
 . "$suitedir/rsync.fns"
 
@@ -23,12 +23,12 @@ echo extra >"$todir"/emptydir/subdir/remove4
 # Also, make sure that --dry-run --del doesn't output anything extraneous.
 $RSYNC -av "$fromdir/" "$chkdir/copy/" >"$tmpdir/copy.out" 2>&1
 cat "$tmpdir/copy.out"
-egrep -v '^(created directory|sent|total size) ' "$tmpdir/copy.out" >"$tmpdir/copy.new"
+grep -E -v '^(created directory|sent|total size) ' "$tmpdir/copy.out" >"$tmpdir/copy.new"
 mv "$tmpdir/copy.new" "$tmpdir/copy.out"
 
 $RSYNC -avn --del "$fromdir/" "$chkdir/copy2/" >"$tmpdir/copy2.out" 2>&1 || true
 cat "$tmpdir/copy2.out"
-egrep -v '^(created directory|sent|total size) ' "$tmpdir/copy2.out" >"$tmpdir/copy2.new"
+grep -E -v '^(created directory|sent|total size) ' "$tmpdir/copy2.out" >"$tmpdir/copy2.new"
 mv "$tmpdir/copy2.new" "$tmpdir/copy2.out"
 
 diff $diffopt "$tmpdir/copy.out" "$tmpdir/copy2.out"
diff --git a/testsuite/devices.test b/testsuite/devices.test
index 56ab2c52..cd9cf3a2 100644
--- a/testsuite/devices.test
+++ b/testsuite/devices.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
@@ -9,9 +9,6 @@
 
 . "$suitedir/rsync.fns"
 
-chkfile="$scratchdir/rsync.chk"
-outfile="$scratchdir/rsync.out"
-
 # Build some hardlinks
 
 case $0 in
@@ -116,33 +113,21 @@ mkfifo "$fromdir/fifo" || mknod "$fromdir/fifo" p || test_skipped "Can't run mkf
 # Work around time rounding/truncating issue by touching both files.
 touch -r "$fromdir/block" "$fromdir/block" "$fromdir/block2"
 
-$RSYNC -ai "$fromdir/block" "$todir/block2" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ai '$fromdir/block' '$todir/block2'" <<EOT
 cD$all_plus block
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 1 failed"
 
-$RSYNC -ai "$fromdir/block2" "$todir/block" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ai '$fromdir/block2' '$todir/block'" <<EOT
 cD$all_plus block2
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 2 failed"
 
 sleep 1
 
-$RSYNC -Di "$fromdir/block3" "$todir/block" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -Di '$fromdir/block3' '$todir/block'" <<EOT
 cDc.T.$dots block3
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 3 failed"
 
-$RSYNC -aiHvv "$fromdir/" "$todir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+cat >"$chkfile" <<EOT
 .d..t.$dots ./
 cDc.t.$dots block
 cDc...$dots block2
@@ -157,7 +142,8 @@ if test "$CAN_HLINK_SPECIAL" = no; then
     grep -v block3.5 <"$chkfile" >"$chkfile.new"
     mv "$chkfile.new" "$chkfile"
 fi
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 4 failed"
+
+checkdiff2 "$RSYNC -aiHvv '$fromdir/' '$todir/'" v_filt
 
 echo "check how the directory listings compare with diff:"
 echo ""
@@ -167,9 +153,8 @@ diff $diffopt "$tmpdir/ls-from" "$tmpdir/ls-to"
 
 if test "$CAN_HLINK_SPECIAL" = yes; then
     set -x
-    $RSYNC -aii --link-dest="$todir" "$fromdir/" "$chkdir/" \
-	| tee "$outfile"
-    cat <<EOT >"$chkfile"
+    checkdiff "$RSYNC -aii --link-dest='$todir' '$fromdir/' '$chkdir/'" <<EOT
+created directory $chkdir
 cd$allspace ./
 hD$allspace block
 hD$allspace block2
@@ -180,7 +165,6 @@ hD$allspace char2
 hD$allspace char3
 hS$allspace fifo
 EOT
-    diff $diffopt "$chkfile" "$outfile" || test_fail "test 5 failed"
 fi
 
 # The script would have aborted on error, so getting here means we've won.
diff --git a/testsuite/dir-sgid.test b/testsuite/dir-sgid.test
index dadc5507..d6b9a3c5 100644
--- a/testsuite/dir-sgid.test
+++ b/testsuite/dir-sgid.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/duplicates.test b/testsuite/duplicates.test
index e64b8083..3317e72f 100644
--- a/testsuite/duplicates.test
+++ b/testsuite/duplicates.test
@@ -1,11 +1,11 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
 
-# Test rsync handling of duplicate filenames.  
+# Test rsync handling of duplicate filenames.
 
 # It's quite possible that the user might specify the same source file
 # more than once on the command line, perhaps through shell variables
@@ -29,18 +29,14 @@ name2="$fromdir/name2"
 echo "This is the file" > "$name1"
 ln -s "$name1" "$name2" || test_fail "can't create symlink"
 
-outfile="$scratchdir/rsync.out"
-
 checkit "$RSYNC -avv '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$fromdir/' '$todir/'" "$fromdir" "$todir" \
     | tee "$outfile"
 
 # Make sure each file was only copied once...
-if [ `grep -c '^name1$' "$outfile"` != 1 ]
-then
+if [ `grep -c '^name1$' "$outfile"` != 1 ]; then
     test_fail "name1 was not copied exactly once"
 fi
-if [ `grep -c '^name2 -> ' "$outfile"` != 1 ]
-then
+if [ `grep -c '^name2 -> ' "$outfile"` != 1 ]; then
     test_fail "name2 was not copied exactly once"
 fi
 
diff --git a/testsuite/exclude.test b/testsuite/exclude.test
index fad4fd72..4b1a1a05 100644
--- a/testsuite/exclude.test
+++ b/testsuite/exclude.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2003-2020 Wayne Davison
+# Copyright (C) 2003-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -12,9 +12,6 @@
 
 . "$suitedir/rsync.fns"
 
-chkfile="$scratchdir/rsync.chk"
-outfile="$scratchdir/rsync.out"
-
 CVSIGNORE='*.junk'
 export CVSIGNORE
 
@@ -118,7 +115,8 @@ ln -s too "$fromdir/bar/down/to/foo/sym"
 
 # Start to prep an --update test dir
 mkdir "$scratchdir/up1" "$scratchdir/up2"
-touch "$scratchdir/up1/older" "$scratchdir/up2/newer"
+touch "$scratchdir/up1/dst-newness" "$scratchdir/up2/src-newness"
+touch "$scratchdir/up1/same-newness" "$scratchdir/up2/same-newness"
 touch "$scratchdir/up1/extra-src" "$scratchdir/up2/extra-dest"
 
 # Create chkdir with what we expect to be excluded.
@@ -133,7 +131,7 @@ rm "$chkdir"/bar/down/to/foo/to "$chkdir"/bar/down/to/foo/file[235-9]
 rm "$chkdir"/mid/for/foo/extra
 
 # Finish prep for the --update test (run last)
-touch "$scratchdir/up1/newer" "$scratchdir/up2/older"
+touch "$scratchdir/up1/src-newness" "$scratchdir/up2/dst-newness"
 
 # Un-tweak the directory times in our first (weak) exclude test (though
 # it's a good test of the --existing option).
@@ -227,13 +225,13 @@ checkit "$RSYNC -avv $relative_opts --exclude='$fromdir/foo/down' \
     '$fromdir/foo' '$todir'" "$chkdir$fromdir/foo" "$todir$fromdir/foo"
 
 # Now we'll test the --update option.
-$RSYNC -aiO --update touch "$scratchdir/up1/" "$scratchdir/up2/" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -aiiO --update --info=skip '$scratchdir/up1/' '$scratchdir/up2/'" \
+	"grep -v '^\.d$allspace'" <<EOT
+dst-newness is newer
 >f$all_plus extra-src
->f..t.$dots newer
+.f$allspace same-newness
+>f..t.$dots src-newness
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "--update test failed"
 
 # The script would have aborted on error, so getting here means we've won.
 exit 0
diff --git a/testsuite/executability.test b/testsuite/executability.test
index 05a64e48..8f09d8f8 100644
--- a/testsuite/executability.test
+++ b/testsuite/executability.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/fuzzy.test b/testsuite/fuzzy.test
index 05c5b068..101ffd3c 100644
--- a/testsuite/fuzzy.test
+++ b/testsuite/fuzzy.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2005-2020 Wayne Davison
+# Copyright (C) 2005-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/hardlinks.test b/testsuite/hardlinks.test
index 740d725f..af2ea408 100644
--- a/testsuite/hardlinks.test
+++ b/testsuite/hardlinks.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
@@ -13,8 +13,6 @@
 
 SSH="$scratchdir/src/support/lsh.sh"
 
-outfile="$scratchdir/rsync.out"
-
 # Build some hardlinks
 
 fromdir="$scratchdir/from"
@@ -70,7 +68,7 @@ echo "This is another file" >"$fromdir/solo"
 ln "$fromdir/solo" "$chkdir/solo" || test_fail "Can't create hardlink"
 
 # Make sure that the checksum data doesn't slide due to an HLINK_BUMP() change.
-$RSYNC -aHivc --debug=HLINK5 "$fromdir/" "$chkdir/" | tee "$outfile"
+checktee "$RSYNC -aHivc --debug=HLINK5 '$fromdir/' '$chkdir/'"
 grep solo "$outfile" && test_fail "Erroneous copy of solo file occurred!"
 
 # Make sure there's nothing wrong with sending a single file with -H
diff --git a/testsuite/itemize.test b/testsuite/itemize.test
index 9988cb72..7c29f696 100644
--- a/testsuite/itemize.test
+++ b/testsuite/itemize.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2005-2020 Wayne Davison
+# Copyright (C) 2005-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -12,9 +12,6 @@
 
 to2dir="$tmpdir/to2"
 
-chkfile="$scratchdir/rsync.chk"
-outfile="$scratchdir/rsync.out"
-
 makepath "$fromdir/foo"
 makepath "$fromdir/bar/baz"
 cp_p "$srcdir/configure.ac" "$fromdir/foo/config1"
@@ -28,10 +25,18 @@ ln "$fromdir/foo/config1" "$fromdir/foo/extra"
 rm -f "$to2dir"
 
 # Check if rsync is set to hard-link symlinks.
-if egrep '^#define CAN_HARDLINK_SYMLINK 1' config.h >/dev/null; then
+if $RSYNC --version | grep "[, ] hardlink-symlinks" >/dev/null; then
     L=hL
+    sym_dots="$allspace"
+    L_sym_dots=".L$allspace"
+    is_uptodate='is uptodate'
+    touch "$chkfile.extra"
 else
     L=cL
+    sym_dots="c.t.$dots"
+    L_sym_dots="cL$sym_dots"
+    is_uptodate='-> ../bar/baz/rsync'
+    echo "cL$sym_dots foo/sym $is_uptodate" >"$chkfile.extra"
 fi
 
 # Check if rsync can preserve time on symlinks
@@ -48,9 +53,8 @@ case "$RSYNC" in
     ;;
 esac
 
-$RSYNC -iplr "$fromdir/" "$todir/" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -iplr '$fromdir/' '$todir/'" <<EOT
+created directory $todir
 cd$all_plus ./
 cd$all_plus bar/
 cd$all_plus bar/baz/
@@ -61,22 +65,18 @@ cd$all_plus foo/
 >f$all_plus foo/extra
 cL$all_plus foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 1 failed"
 
 # Ensure there are no accidental directory-time problems.
 $RSYNC -a -f '-! */' "$fromdir/" "$todir"
 
 cp_p "$srcdir/configure.ac" "$fromdir/foo/config2"
 chmod 601 "$fromdir/foo/config2"
-$RSYNC -iplrH "$fromdir/" "$todir/" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -iplrH '$fromdir/' '$todir/'" <<EOT
 >f..T.$dots bar/baz/rsync
 >f..T.$dots foo/config1
 >f.sTp$dots foo/config2
 hf..T.$dots foo/extra => foo/config1
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 2 failed"
 
 $RSYNC -a -f '-! */' "$fromdir/" "$todir"
 cp_p "$srcdir/config.sub" "$fromdir/foo/config2"
@@ -88,38 +88,30 @@ umask 022
 chmod 600 "$fromdir/foo/config2"
 chmod 777 "$todir/bar/baz/rsync"
 
-$RSYNC -iplrtc "$fromdir/" "$todir/" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -iplrtc '$fromdir/' '$todir/'" <<EOT
 .f..tp$dots bar/baz/rsync
 .d..t.$dots foo/
 .f..t.$dots foo/config1
 >fcstp$dots foo/config2
 cLc$T.$dots foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 3 failed"
 
 cp_p "$srcdir/configure.ac" "$fromdir/foo/config2"
 chmod 600 "$fromdir/foo/config2"
 # Lack of -t is for unchanged hard-link stress-test!
-$RSYNC -vvplrH "$fromdir/" "$todir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -vvplrH '$fromdir/' '$todir/'" \
+	v_filt <<EOT
 bar/baz/rsync is uptodate
 foo/config1 is uptodate
 foo/extra is uptodate
 foo/sym is uptodate
 foo/config2
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 4 failed"
 
 chmod 747 "$todir/bar/baz/rsync"
 $RSYNC -a -f '-! */' "$fromdir/" "$todir"
-$RSYNC -ivvplrtH "$fromdir/" "$todir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ivvplrtH '$fromdir/' '$todir/'" \
+	v_filt <<EOT
 .d$allspace ./
 .d$allspace bar/
 .d$allspace bar/baz/
@@ -130,47 +122,23 @@ cat <<EOT >"$chkfile"
 hf$allspace foo/extra
 .L$allspace foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 5 failed"
 
 chmod 757 "$todir/foo/config1"
 touch "$todir/foo/config2"
-$RSYNC -vplrtH "$fromdir/" "$todir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -vplrtH '$fromdir/' '$todir/'" \
+	v_filt <<EOT
 foo/config2
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 6 failed"
 
 chmod 757 "$todir/foo/config1"
 touch "$todir/foo/config2"
-$RSYNC -iplrtH "$fromdir/" "$todir/" \
-    | tee "$outfile"
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -iplrtH '$fromdir/' '$todir/'" <<EOT
 .f...p$dots foo/config1
 >f..t.$dots foo/config2
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 7 failed"
 
-$RSYNC -ivvplrtH --copy-dest=../to "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-case `tail -1 "$outfile"` in
-cLc.t*)
-    sym_dots="c.t.$dots"
-    L_sym_dots="cL$sym_dots"
-    is_uptodate='-> ../bar/baz/rsync'
-    echo "cL$sym_dots foo/sym $is_uptodate" >"$chkfile.extra"
-    L=cL
-    ;;
-*)
-    sym_dots="$allspace"
-    L_sym_dots=".L$allspace"
-    is_uptodate='is uptodate'
-    touch "$chkfile.extra"
-    ;;
-esac
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ivvplrtH --copy-dest=../to '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 cd$allspace ./
 cd$allspace bar/
 cd$allspace bar/baz/
@@ -181,21 +149,17 @@ cf$allspace foo/config2
 hf$allspace foo/extra => foo/config1
 cL$sym_dots foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 8 failed"
 
 rm -rf "$to2dir"
-$RSYNC -iplrtH --copy-dest=../to "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
 cat - "$chkfile.extra" <<EOT >"$chkfile"
+created directory $to2dir
 hf$allspace foo/extra => foo/config1
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 9 failed"
+checkdiff2 "$RSYNC -iplrtH --copy-dest=../to '$fromdir/' '$to2dir/'"
 
 rm -rf "$to2dir"
-$RSYNC -vvplrtH --copy-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -vvplrtH --copy-dest='$todir' '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 ./ is uptodate
 bar/ is uptodate
 bar/baz/ is uptodate
@@ -206,13 +170,10 @@ foo/config2 is uptodate
 foo/sym $is_uptodate
 foo/extra => foo/config1
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 10 failed"
 
 rm -rf "$to2dir"
-$RSYNC -ivvplrtH --link-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ivvplrtH --link-dest='$todir' '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 cd$allspace ./
 cd$allspace bar/
 cd$allspace bar/baz/
@@ -223,27 +184,19 @@ hf$allspace foo/config2
 hf$allspace foo/extra => foo/config1
 $L$sym_dots foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 11 failed"
 
 rm -rf "$to2dir"
-$RSYNC -iplrtH --dry-run --link-dest=../to "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
 cat - "$chkfile.extra" <<EOT >"$chkfile"
+created directory $to2dir
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 12 failed"
+checkdiff2 "$RSYNC -iplrtH --dry-run --link-dest=../to '$fromdir/' '$to2dir/'"
 
 rm -rf "$to2dir"
-$RSYNC -iplrtH --link-dest=../to "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-cat - "$chkfile.extra" <<EOT >"$chkfile"
-EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 13 failed"
+checkdiff2 "$RSYNC -iplrtH --link-dest=../to '$fromdir/' '$to2dir/'"
 
 rm -rf "$to2dir"
-$RSYNC -vvplrtH --link-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -vvplrtH --link-dest='$todir' '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 ./ is uptodate
 bar/ is uptodate
 bar/baz/ is uptodate
@@ -254,13 +207,10 @@ foo/config2 is uptodate
 foo/extra is uptodate
 foo/sym $is_uptodate
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 14 failed"
 
 rm -rf "$to2dir"
-$RSYNC -ivvplrtH --compare-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -ivvplrtH --compare-dest='$todir' '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 cd$allspace ./
 cd$allspace bar/
 cd$allspace bar/baz/
@@ -271,20 +221,16 @@ cd$allspace foo/
 .f$allspace foo/extra
 $L_sym_dots foo/sym -> ../bar/baz/rsync
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 15 failed"
 
 rm -rf "$to2dir"
-$RSYNC -iplrtH --compare-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
 cat - "$chkfile.extra" <<EOT >"$chkfile"
+created directory $to2dir
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 16 failed"
+checkdiff2 "$RSYNC -iplrtH --compare-dest='$todir' '$fromdir/' '$to2dir/'"
 
 rm -rf "$to2dir"
-$RSYNC -vvplrtH --compare-dest="$todir" "$fromdir/" "$to2dir/" \
-    | tee "$outfile"
-filter_outfile
-cat <<EOT >"$chkfile"
+checkdiff "$RSYNC -vvplrtH --compare-dest='$todir' '$fromdir/' '$to2dir/'" \
+	v_filt <<EOT
 ./ is uptodate
 bar/ is uptodate
 bar/baz/ is uptodate
@@ -295,7 +241,6 @@ foo/config2 is uptodate
 foo/extra is uptodate
 foo/sym $is_uptodate
 EOT
-diff $diffopt "$chkfile" "$outfile" || test_fail "test 17 failed"
 
 # The script would have aborted on error, so getting here means we've won.
 exit 0
diff --git a/testsuite/merge.test b/testsuite/merge.test
index 9b20f73d..17050a1d 100644
--- a/testsuite/merge.test
+++ b/testsuite/merge.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2004-2020 Wayne Davison
+# Copyright (C) 2004-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/missing.test b/testsuite/missing.test
index c6c8e576..2fbf4616 100644
--- a/testsuite/missing.test
+++ b/testsuite/missing.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/mkpath.test b/testsuite/mkpath.test
old mode 100755
new mode 100644
index 6efb2105..80463454
--- a/testsuite/mkpath.test
+++ b/testsuite/mkpath.test
@@ -25,6 +25,10 @@ rm $deep_dir/text
 mkdir $deep_dir/new
 $RSYNC -aiv --mkpath from/text $deep_dir/new
 test -f $deep_dir/new/text || test_fail "'text' file not found in $deep_dir/new dir"
+
+# ... and an existing path when an alternate dest filename is specified
+$RSYNC -aiv --mkpath from/text $deep_dir/new/text2
+test -f $deep_dir/new/text2 || test_fail "'text2' file not found in $deep_dir/new dir"
 rm -rf to/foo
 
 # Try the tests again with multiple source args
diff --git a/testsuite/protected-regular.test b/testsuite/protected-regular.test
new file mode 100644
index 00000000..40416b0d
--- /dev/null
+++ b/testsuite/protected-regular.test
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Copyright (C) 2021 by Achim Leitner <aleitner@lis-engineering.de>
+# This program is distributable under the terms of the GNU GPL (see COPYING)
+#
+# Modern linux systems have the protected_regular feature set to 1 or 2
+# See https://www.kernel.org/doc/Documentation/sysctl/fs.txt
+# Make sure we can still write these files in --inplace mode
+
+. "$suitedir/rsync.fns"
+
+test -f /proc/sys/fs/protected_regular || test_skipped "Can't find protected_regular setting (only available on Linux)"
+pr_lvl=`cat /proc/sys/fs/protected_regular 2>/dev/null` || test_skipped "Can't check if fs.protected_regular is enabled (probably need root)"
+test "$pr_lvl" != 0 || test_skipped "fs.protected_regular is not enabled"
+
+workdir="$tmpdir/files"
+mkdir "$workdir"
+chmod 1777 "$workdir"
+
+echo "Source" > "$workdir/src"
+echo ""       > "$workdir/dst"
+chown 5001 "$workdir/dst" || test_skipped "Can't chown (probably need root)"
+
+# Output is only shown in case of an error
+echo "Contents of $workdir:"
+ls -al "$workdir"
+
+$RSYNC --inplace "$workdir/src" "$workdir/dst" || test_fail
+
+# The script would have aborted on error, so getting here means we've won.
+exit 0
diff --git a/testsuite/relative.test b/testsuite/relative.test
index 89e4ce17..5546291b 100644
--- a/testsuite/relative.test
+++ b/testsuite/relative.test
@@ -20,8 +20,6 @@ echo wowza >"$extrafile"
 
 $RSYNC -av --existing --include='*/' --exclude='*' "$fromdir/" "$extradir/"
 
-outfile="$scratchdir/rsync.out"
-
 cd "$fromdir"
 
 # Main script starts here
diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
index 68389e70..2ab97b69 100644
--- a/testsuite/rsync.fns
+++ b/testsuite/rsync.fns
@@ -12,7 +12,7 @@
 # WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
-# 
+#
 # You should have received a copy of the GNU Lesser General Public
 # License along with this program; if not, write to the Free Software
 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
@@ -22,6 +22,9 @@ fromdir="$tmpdir/from"
 todir="$tmpdir/to"
 chkdir="$tmpdir/chk"
 
+chkfile="$scratchdir/rsync.chk"
+outfile="$scratchdir/rsync.out"
+
 # For itemized output:
 all_plus='+++++++++'
 allspace='         '
@@ -42,13 +45,12 @@ export HOME
 
 runtest() {
     echo $ECHO_N "Test $1: $ECHO_C"
-    if eval "$2"
-    then
-	echo "$ECHO_T	done."
-	return 0
+    if eval "$2"; then
+        echo "$ECHO_T	done."
+        return 0
     else
-	echo "$ECHO_T failed!"
-	return 1
+        echo "$ECHO_T failed!"
+        return 1
     fi
 }
 
@@ -63,7 +65,7 @@ set_cp_destdir() {
 # even if the copy rounded microsecond times on the destination file.
 cp_touch() {
     cp_p "${@}"
-    if test $# -gt 2 -o -d "$2"; then
+    if test $# -gt 2 || test -d "$2"; then
 	set_cp_destdir "${@}" # sets destdir var
 	while test $# -gt 1; do
 	    destname="$destdir/`basename $1`"
@@ -75,10 +77,10 @@ cp_touch() {
     fi
 }
 
-# Call this if you want to filter out verbose messages (-v or -vv) from
-# the output of an rsync run (whittling the output down to just the file
-# messages).  This isn't needed if you use -i without -v.
-filter_outfile() {
+# Call this if you want to filter (stdin -> stdout) verbose messages (-v or
+# -vv) from an rsync run (whittling the output down to just the file messages).
+# This isn't needed if you use -i without -v.
+v_filt() {
     sed -e '/^building file list /d' \
 	-e '/^sending incremental file list/d' \
 	-e '/^created directory /d' \
@@ -87,9 +89,7 @@ filter_outfile() {
 	-e '/^total: /d' \
 	-e '/^client charset: /d' \
 	-e '/^server charset: /d' \
-	-e '/^$/,$d' \
-	<"$outfile" >"$outfile.new"
-    mv "$outfile.new" "$outfile"
+	-e '/^$/,$d'
 }
 
 printmsg() {
@@ -149,7 +149,7 @@ check_perms() {
     test_fail "failed test $3"
 }
 
-rsync_getgroups() { 
+rsync_getgroups() {
     "$TOOLDIR/getgroups"
 }
 
@@ -171,7 +171,7 @@ hands_setup() {
     # the links behave in the future, and it cannot be changed using
     # chmod!  rsync always sets its umask to 000 so that it can
     # accurately recreate permissions, but this script is probably run
-    # with a different umask. 
+    # with a different umask.
 
     # This causes a little problem that "ls -l" of the two will not be
     # the same.  So, we need to set our umask before doing any creations.
@@ -213,22 +213,19 @@ hands_setup() {
 
 ####################
 # Many machines do not have "mkdir -p", so we have to build up long paths.
-# How boring.  
+# How boring.
 makepath() {
     for p in "${@}"; do
 	(echo "        makepath $p"
 
 	# Absolute Unix path.
-	if echo $p | grep '^/' >/dev/null
-	then
+	if echo $p | grep '^/' >/dev/null; then
 	    cd /
 	fi
-    
+
 	# This will break if $p contains a space.
-	for c in `echo $p | tr '/' ' '`
-	do 
-	    if [ -d "$c" ] || mkdir "$c" 
-	    then
+	for c in `echo $p | tr '/' ' '`; do
+	    if [ -d "$c" ] || mkdir "$c"; then
 		cd "$c" || return $?
 	    else
 		echo "failed to create $c" >&2; return $?
@@ -238,7 +235,6 @@ makepath() {
 }
 
 
-
 ###########################
 # Run a test (in '$1') then compare directories $2 and $3 to see if
 # there are any difference.  If there are, explain them.
@@ -262,8 +258,8 @@ checkit() {
 	;;
     esac
 
-    echo "Running: \"$1\""  
-    eval "$1" 
+    echo "Running: \"$1\""
+    eval "$1"
     status=$?
     if [ $status != 0 ]; then
 	failed="$failed status=$status"
@@ -293,7 +289,7 @@ checkit() {
     fi
 
     echo "-------------"
-    if [ -z "$failed" ] ; then
+    if [ -z "$failed" ]; then
 	return 0
     fi
 
@@ -302,6 +298,57 @@ checkit() {
 }
 
 
+# Run a test in $1 and make sure it has a zero exit status.  Capture the
+# output into $outfile and echo it to stdout.
+checktee() {
+    echo "Running: \"$1\""
+    eval "$1" >"$outfile"
+    status=$?
+    cat "$outfile"
+    if [ $status != 0 ]; then
+	echo "Failed: status=$status"
+	return 1
+    fi
+    return 0
+}
+
+
+# Slurp stdin into $chkfile and then call checkdiff2().
+checkdiff() {
+    cat >"$chkfile" # Save off stdin
+    checkdiff2 "${@}"
+}
+
+
+# Run a test in $1 and make sure it has a zero exit status.  Capture the output
+# into $outfile.  If $2 is set, use it to filter the outfile.  If resulting
+# outfile differs from the chkfile data, fail with an error.
+checkdiff2() {
+    failed=
+
+    echo "Running: \"$1\""
+    eval "$1" >"$outfile"
+    status=$?
+    cat "$outfile"
+    if [ $status != 0 ]; then
+	failed="$failed status=$status"
+    fi
+
+    if [ -n "$2" ]; then
+	eval "cat '$outfile' | $2 >'$outfile.new'"
+	mv "$outfile.new" "$outfile"
+    fi
+
+    diff $diffopt "$chkfile" "$outfile" || failed="$failed output differs"
+
+    if [ -n "$failed" ]; then
+	echo "Failed:$failed"
+	return 1
+    fi
+    return 0
+}
+
+
 build_rsyncd_conf() {
     # Build an appropriate configuration file
     conf="$scratchdir/test-rsyncd.conf"
@@ -404,7 +451,7 @@ test_skipped() {
     exit 77
 }
 
-# It failed, but we expected that.  don't dump out error logs, 
+# It failed, but we expected that.  Don't dump out error logs,
 # because most users won't want to see them.  But do leave
 # the working directory around.
 test_xfail() {
@@ -414,30 +461,26 @@ test_xfail() {
 
 # Determine what shell command will appropriately test for links.
 ln -s foo "$scratchdir/testlink"
-for cmd in test /bin/test /usr/bin/test /usr/ucb/bin/test /usr/ucb/test
-do
-    for switch in -h -L
-    do
-        if $cmd $switch "$scratchdir/testlink" 2>/dev/null
-	then
-	    # how nice
-	    TEST_SYMLINK_CMD="$cmd $switch"
-	    # i wonder if break 2 is portable?
-	    break 2
-	fi
-   done
+for cmd in test /bin/test /usr/bin/test /usr/ucb/bin/test /usr/ucb/test; do
+    for switch in -h -L; do
+        if $cmd $switch "$scratchdir/testlink" 2>/dev/null; then
+            # how nice
+            TEST_SYMLINK_CMD="$cmd $switch"
+            # i wonder if break 2 is portable?
+            break 2
+        fi
+    done
 done
 # ok, now get rid of it
 rm "$scratchdir/testlink"
 
 
-if [ "x$TEST_SYMLINK_CMD" = 'x' ]
-then
+if [ "x$TEST_SYMLINK_CMD" = 'x' ]; then
     test_fail "Couldn't determine how to test for symlinks"
 else
     echo "Testing for symlinks using '$TEST_SYMLINK_CMD'"
 fi
-	
+
 
 # Test whether something is a link, allowing for shell peculiarities
 is_a_link() {
@@ -451,5 +494,5 @@ is_a_link() {
 # directory has to be writable by the nobody user in some cases.  The
 # best thing is probably to explicitly chmod those directories after
 # creation.
- 
+
 umask 022
diff --git a/testsuite/ssh-basic.test b/testsuite/ssh-basic.test
index 4bcbdfe9..1559ca23 100644
--- a/testsuite/ssh-basic.test
+++ b/testsuite/ssh-basic.test
@@ -13,7 +13,7 @@
 SSH="$scratchdir/src/support/lsh.sh"
 
 if test x"$rsync_enable_ssh_tests" = xyes; then
-    if type ssh >/dev/null ; then
+    if type ssh >/dev/null; then
 	SSH=ssh
     fi
 fi
diff --git a/testsuite/symlink-ignore.test b/testsuite/symlink-ignore.test
index eec7a301..7055a920 100644
--- a/testsuite/symlink-ignore.test
+++ b/testsuite/symlink-ignore.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2001 by Martin Pool <mbp@samba.org>
 
@@ -18,18 +18,15 @@ $RSYNC -r "$fromdir/" "$todir" || test_fail "$RSYNC returned $?"
 
 [ -f "$todir/referent" ] || test_fail "referent was not copied"
 [ -d "$todir/from" ] && test_fail "extra level of directories"
-if is_a_link "$todir/dangling" 
-then 
+if is_a_link "$todir/dangling"; then
     test_fail "dangling symlink was copied"
 fi
 
-if is_a_link "$todir/relative" 
-then
-    test_fail "relative symlink was copied" 
+if is_a_link "$todir/relative"; then
+    test_fail "relative symlink was copied"
 fi
 
-if is_a_link "$todir/absolute" 
-then
+if is_a_link "$todir/absolute"; then
     test_fail "absolute symlink was copied"
 fi
 
diff --git a/testsuite/trimslash.test b/testsuite/trimslash.test
index ec551e65..2efaa078 100644
--- a/testsuite/trimslash.test
+++ b/testsuite/trimslash.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool <mbp@samba.org>
 
diff --git a/testsuite/unsafe-byname.test b/testsuite/unsafe-byname.test
index 55df0865..75e72014 100644
--- a/testsuite/unsafe-byname.test
+++ b/testsuite/unsafe-byname.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Copyright (C) 2002 by Martin Pool
 
@@ -13,9 +13,8 @@ test_unsafe() {
     # or "unsafe" otherwise
 
     result=`"$TOOLDIR/t_unsafe" "$1" "$2"` || test_fail "Failed to check $1 $2"
-    if [ "$result" != "$3" ]
-    then
-	test_fail "t_unsafe $1 $2 returned \"$result\", expected \"$3\""
+    if [ "$result" != "$3" ]; then
+        test_fail "t_unsafe $1 $2 returned \"$result\", expected \"$3\""
     fi
 }
 
diff --git a/testsuite/unsafe-links.test b/testsuite/unsafe-links.test
index 479d606c..2d209eb6 100644
--- a/testsuite/unsafe-links.test
+++ b/testsuite/unsafe-links.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # Originally by Vladimír Michl <Vladimir.Michl@hlubocky.del.cz>
 
@@ -6,13 +6,13 @@
 
 test_symlink() {
 	is_a_link "$1" || test_fail "File $1 is not a symlink"
-};
+}
 
 test_regular() {
 	if [ ! -f "$1" ]; then
-		test_fail "File $1 is not regular file or not exists";
-	fi;
-};
+		test_fail "File $1 is not regular file or not exists"
+	fi
+}
 
 cd "$tmpdir"
 
@@ -32,7 +32,7 @@ ln -s ../files/file1 "from/safe/links/"
 ln -s ../files/file2 "from/safe/links/"
 ln -s ../../unsafe/unsafefile "from/safe/links/"
 
-echo "rsync with relative path and just -a";
+echo "rsync with relative path and just -a"
 $RSYNC -avv from/safe/ to
 test_symlink to/links/file1
 test_symlink to/links/file2
@@ -44,23 +44,22 @@ test_regular to/links/file1
 test_regular to/links/file2
 test_regular to/links/unsafefile
 
-echo "rsync with relative path and --copy-unsafe-links";
+echo "rsync with relative path and --copy-unsafe-links"
 $RSYNC -avv --copy-unsafe-links from/safe/ to
 test_symlink to/links/file1
 test_symlink to/links/file2
 test_regular to/links/unsafefile
 
 rm -rf to
-echo "rsync with relative2 path";
+echo "rsync with relative2 path"
 (cd from; $RSYNC -avv --copy-unsafe-links safe/ ../to)
 test_symlink to/links/file1
 test_symlink to/links/file2
 test_regular to/links/unsafefile
 
 rm -rf to
-echo "rsync with absolute path";
+echo "rsync with absolute path"
 $RSYNC -avv --copy-unsafe-links `pwd`/from/safe/ to
 test_symlink to/links/file1
 test_symlink to/links/file2
 test_regular to/links/unsafefile
-
diff --git a/testsuite/wildmatch.test b/testsuite/wildmatch.test
index 12b872c8..cfe75841 100644
--- a/testsuite/wildmatch.test
+++ b/testsuite/wildmatch.test
@@ -1,6 +1,6 @@
-#! /bin/sh
+#!/bin/sh
 
-# Copyright (C) 2003-2020 Wayne Davison
+# Copyright (C) 2003-2022 Wayne Davison
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
diff --git a/testsuite/xattrs.test b/testsuite/xattrs.test
index 59fe1601..455abef1 100644
--- a/testsuite/xattrs.test
+++ b/testsuite/xattrs.test
@@ -1,4 +1,4 @@
-#! /bin/sh
+#!/bin/sh
 
 # This program is distributable under the terms of the GNU GPL (see
 # COPYING).
@@ -150,7 +150,7 @@ xls $dirs $files | diff $diffopt "$scratchdir/xattrs.txt" -
 
 cd "$fromdir"
 
-if [ "$dashH" ]; then
+if [ -n "$dashH" ]; then
     for fn in $files; do
 	name=`basename $fn`
 	ln $fn ../lnk/$name
@@ -162,7 +162,7 @@ checkit "$RSYNC -aiX $XFILT $dashH --super $altDest=../chk . ../to" "$fromdir" "
 cd "$todir"
 xls $dirs $files | diff $diffopt "$scratchdir/xattrs.txt" -
 
-[ "$dashH" ] && rm -rf "$lnkdir"
+[ -n "$dashH" ] && rm -rf "$lnkdir"
 
 cd "$fromdir"
 rm -rf "$todir"
@@ -177,7 +177,7 @@ cd "$todir"
 xls $dirs $files | diff $diffopt "$scratchdir/xattrs.txt" -
 
 sed -n -e '/^[^d ][^ ]*  *[^ ][^ ]*  *[^ ][^ ]*  *1 /p' "$scratchdir/ls-to" >"$scratchdir/ls-diff-all"
-fgrep -v './file1' "$scratchdir/ls-diff-all" >"$scratchdir/ls-diff" || :
+grep -F -v './file1' "$scratchdir/ls-diff-all" >"$scratchdir/ls-diff" || :
 if [ -s "$scratchdir/ls-diff" ]; then
     echo "Missing hard links on:"
     cat "$scratchdir/ls-diff"
@@ -213,13 +213,13 @@ $RSYNC -aX file1 file2
 $RSYNC -aX file1 file2 ../chk/
 $RSYNC -aX --del ../chk/ .
 $RSYNC -aX file1 ../lnk/
-[ "$dashH" ] && ln "$chkdir/file1" ../lnk/extra-link
+[ -n "$dashH" ] && ln "$chkdir/file1" ../lnk/extra-link
 
 xls file1 file2 >"$scratchdir/xattrs.txt"
 
 checkit "$RSYNC -aiiX $XFILT $dashH $altDest=../lnk . ../to" "$chkdir" "$todir"
 
-[ "$dashH" ] && rm ../lnk/extra-link
+[ -n "$dashH" ] && rm ../lnk/extra-link
 
 cd "$todir"
 xls file1 file2 | diff $diffopt "$scratchdir/xattrs.txt" -
diff --git a/tls.c b/tls.c
index c50fa6c3..e6b0708a 100644
--- a/tls.c
+++ b/tls.c
@@ -2,7 +2,7 @@
  * Trivial ls for comparing two directories after running an rsync.
  *
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -60,7 +60,8 @@ int nsec_times = 0;
 
 static int stat_xattr(const char *fname, STRUCT_STAT *fst)
 {
-	int mode, rdev_major, rdev_minor, uid, gid, len;
+	unsigned int mode;
+	int rdev_major, rdev_minor, uid, gid, len;
 	char buf[256];
 
 	if (am_root >= 0 || IS_DEVICE(fst->st_mode) || IS_SPECIAL(fst->st_mode))
@@ -159,7 +160,7 @@ static void list_file(const char *fname)
 	if (do_lstat(fname, &buf) < 0)
 		failed("stat", fname);
 #ifdef SUPPORT_CRTIMES
-	if (display_crtimes && (crtime = get_create_time(fname)) == 0)
+	if (display_crtimes && (crtime = get_create_time(fname, &buf)) == 0)
 		failed("get_create_time", fname);
 #endif
 #ifdef SUPPORT_XATTRS
diff --git a/token.c b/token.c
index 61be8dd9..c108b3af 100644
--- a/token.c
+++ b/token.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 1996 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -39,7 +39,6 @@ extern char *skip_compress;
 #define Z_INSERT_ONLY Z_SYNC_FLUSH
 #endif
 
-static int compression_level; /* The compression level for the current file. */
 static int skip_compression_level; /* The least possible compressing for handling skip-compress files. */
 static int per_file_default_level; /* The default level that each new file gets prior to checking its suffix. */
 
@@ -224,9 +223,11 @@ static void init_set_compression(void)
 /* determine the compression level based on a wildcard filename list */
 void set_compression(const char *fname)
 {
+#if 0 /* No compression algorithms currently allow mid-stream changing of the level. */
 	const struct suffix_tree *node;
 	const char *s;
 	char ltr;
+#endif
 
 	if (!do_compression)
 		return;
@@ -234,6 +235,7 @@ void set_compression(const char *fname)
 	if (!match_list)
 		init_set_compression();
 
+#if 0
 	compression_level = per_file_default_level;
 
 	if (!*match_list && !suftree)
@@ -270,6 +272,9 @@ void set_compression(const char *fname)
 		if (!(node = node->child))
 			return;
 	}
+#else
+	(void)fname;
+#endif
 }
 
 /* non-compressing recv token */
@@ -361,7 +366,7 @@ send_deflated_token(int f, int32 token, struct map_struct *buf, OFF_T offset, in
 			tx_strm.next_in = NULL;
 			tx_strm.zalloc = NULL;
 			tx_strm.zfree = NULL;
-			if (deflateInit2(&tx_strm, compression_level,
+			if (deflateInit2(&tx_strm, per_file_default_level,
 					 Z_DEFLATED, -15, 8,
 					 Z_DEFAULT_STRATEGY) != Z_OK) {
 				rprintf(FERROR, "compression init failed\n");
@@ -570,7 +575,7 @@ static int32 recv_deflated_token(int f, char **data)
 				rx_strm.avail_in = 4;
 				rx_strm.next_in = (Bytef *)cbuf;
 				cbuf[0] = cbuf[1] = 0;
-				cbuf[2] = cbuf[3] = 0xff;
+				cbuf[2] = cbuf[3] = (char)0xff;
 				inflate(&rx_strm, Z_SYNC_FLUSH);
 				recv_state = r_idle;
 			}
diff --git a/uidlist.c b/uidlist.c
index 88847424..6100b503 100644
--- a/uidlist.c
+++ b/uidlist.c
@@ -63,6 +63,16 @@ struct idlist {
 static struct idlist *uidlist, *uidmap;
 static struct idlist *gidlist, *gidmap;
 
+static inline int id_eq_uid(id_t id, uid_t uid)
+{
+	return id == (id_t)uid;
+}
+
+static inline int id_eq_gid(id_t id, gid_t gid)
+{
+	return id == (id_t)gid;
+}
+
 static id_t id_parse(const char *num_str)
 {
 	id_t tmp, num = 0;
@@ -263,10 +273,10 @@ static struct idlist *recv_add_id(struct idlist **idlist_ptr, struct idlist *idm
 	else if (*name && id) {
 		if (idlist_ptr == &uidlist) {
 			uid_t uid;
-			id2 = user_to_uid(name, &uid, False) ? uid : id;
+			id2 = user_to_uid(name, &uid, False) ? (id_t)uid : id;
 		} else {
 			gid_t gid;
-			id2 = group_to_gid(name, &gid, False) ? gid : id;
+			id2 = group_to_gid(name, &gid, False) ? (id_t)gid : id;
 		}
 	} else
 		id2 = id;
@@ -289,11 +299,11 @@ uid_t match_uid(uid_t uid)
 	static struct idlist *last = NULL;
 	struct idlist *list;
 
-	if (last && uid == last->id)
+	if (last && id_eq_uid(last->id, uid))
 		return last->id2;
 
 	for (list = uidlist; list; list = list->next) {
-		if (list->id == uid)
+		if (id_eq_uid(list->id, uid))
 			break;
 	}
 
@@ -309,11 +319,11 @@ gid_t match_gid(gid_t gid, uint16 *flags_ptr)
 	static struct idlist *last = NULL;
 	struct idlist *list;
 
-	if (last && gid == last->id)
+	if (last && id_eq_gid(last->id, gid))
 		list = last;
 	else {
 		for (list = gidlist; list; list = list->next) {
-			if (list->id == gid)
+			if (id_eq_gid(list->id, gid))
 				break;
 		}
 		if (!list)
@@ -334,7 +344,7 @@ const char *add_uid(uid_t uid)
 	union name_or_id noiu;
 
 	for (list = uidlist; list; list = list->next) {
-		if (list->id == uid)
+		if (id_eq_uid(list->id, uid))
 			return NULL;
 	}
 
@@ -351,7 +361,7 @@ const char *add_gid(gid_t gid)
 	union name_or_id noiu;
 
 	for (list = gidlist; list; list = list->next) {
-		if (list->id == gid)
+		if (id_eq_gid(list->id, gid))
 			return NULL;
 	}
 
diff --git a/usage.c b/usage.c
index 66857bb4..cbca83e3 100644
--- a/usage.c
+++ b/usage.c
@@ -1,7 +1,7 @@
 /*
  * Some usage & version related functions.
  *
- * Copyright (C) 2002-2020 Wayne Davison
+ * Copyright (C) 2002-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -18,6 +18,7 @@
  */
 
 #include "rsync.h"
+#include "version.h"
 #include "latest-year.h"
 #include "git-version.h"
 #include "default-cvsignore.h"
@@ -52,6 +53,16 @@ static void print_info_flags(enum logcode f)
 #endif
 			"socketpairs",
 
+#ifndef SUPPORT_LINKS
+		"no "
+#endif
+			"symlinks",
+
+#ifndef CAN_SET_SYMLINK_TIMES
+		"no "
+#endif
+			"symtimes",
+
 #ifndef SUPPORT_HARD_LINKS
 		"no "
 #endif
@@ -62,10 +73,10 @@ static void print_info_flags(enum logcode f)
 #endif
 			"hardlink-specials",
 
-#ifndef SUPPORT_LINKS
+#ifndef CAN_HARDLINK_SYMLINK
 		"no "
 #endif
-			"symlinks",
+			"hardlink-symlinks",
 
 #ifndef INET6
 		"no "
@@ -111,11 +122,6 @@ static void print_info_flags(enum logcode f)
 #endif
 			"iconv",
 
-#ifndef CAN_SET_SYMLINK_TIMES
-		"no "
-#endif
-			"symtimes",
-
 #ifndef SUPPORT_PREALLOCATION
 		"no "
 #endif
@@ -133,21 +139,26 @@ static void print_info_flags(enum logcode f)
 
 	"*Optimizations",
 
-#ifndef HAVE_SIMD
+#ifndef USE_ROLL_SIMD
 		"no "
 #endif
-			"SIMD",
+			"SIMD-roll",
 
-#ifndef HAVE_ASM
+#ifndef USE_ROLL_ASM
 		"no "
 #endif
-			"asm",
+			"asm-roll",
 
 #ifndef USE_OPENSSL
 		"no "
 #endif
 			"openssl-crypto",
 
+#ifndef USE_MD5_ASM
+		"no "
+#endif
+			"asm-MD5",
+
 		NULL
 	};
 
@@ -234,7 +245,7 @@ void usage(enum logcode F)
 #include "help-rsync.h"
   rprintf(F,"\n");
   rprintf(F,"Use \"rsync --daemon --help\" to see the daemon-mode command-line options.\n");
-  rprintf(F,"Please see the rsync(1) and rsyncd.conf(5) man pages for full documentation.\n");
+  rprintf(F,"Please see the rsync(1) and rsyncd.conf(5) manpages for full documentation.\n");
   rprintf(F,"See https://rsync.samba.org/ for updates, bug reports, and answers\n");
 }
 
@@ -247,12 +258,16 @@ void daemon_usage(enum logcode F)
 #include "help-rsyncd.h"
   rprintf(F,"\n");
   rprintf(F,"If you were not trying to invoke rsync as a daemon, avoid using any of the\n");
-  rprintf(F,"daemon-specific rsync options.  See also the rsyncd.conf(5) man page.\n");
+  rprintf(F,"daemon-specific rsync options.  See also the rsyncd.conf(5) manpage.\n");
 }
 
 const char *rsync_version(void)
 {
+#ifdef RSYNC_GITVER
 	return RSYNC_GITVER;
+#else
+	return RSYNC_VERSION;
+#endif
 }
 
 const char *default_cvsignore(void)
diff --git a/util.c b/util1.c
similarity index 95%
rename from util.c
rename to util1.c
index b2b19892..5f14723e 100644
--- a/util.c
+++ b/util1.c
@@ -4,7 +4,7 @@
  * Copyright (C) 1996-2000 Andrew Tridgell
  * Copyright (C) 1996 Paul Mackerras
  * Copyright (C) 2001, 2002 Martin Pool <mbp@samba.org>
- * Copyright (C) 2003-2020 Wayne Davison
+ * Copyright (C) 2003-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -27,11 +27,13 @@
 
 extern int dry_run;
 extern int module_id;
+extern int do_fsync;
 extern int protect_args;
 extern int modify_window;
 extern int relative_paths;
-extern int preserve_times;
+extern int preserve_mtimes;
 extern int preserve_xattrs;
+extern int omit_link_times;
 extern int preallocate_files;
 extern char *module_dir;
 extern unsigned int module_dirlen;
@@ -158,8 +160,8 @@ int set_times(const char *fname, STRUCT_STAT *stp)
 
 #include "case_N.h"
 		switch_step++;
-		if (preserve_times & PRESERVE_LINK_TIMES) {
-			preserve_times &= ~PRESERVE_LINK_TIMES;
+		if (!omit_link_times) {
+			omit_link_times = 1;
 			if (S_ISLNK(stp->st_mode))
 				return 1;
 		}
@@ -318,16 +320,48 @@ static int safe_read(int desc, char *ptr, size_t len)
 	return n_chars;
 }
 
-/* Copy a file.  If ofd < 0, copy_file unlinks and opens the "dest" file.
- * Otherwise, it just writes to and closes the provided file descriptor.
+/* Remove existing file @dest and reopen, creating a new file with @mode */
+static int unlink_and_reopen(const char *dest, mode_t mode)
+{
+	int ofd;
+
+	if (robust_unlink(dest) && errno != ENOENT) {
+		int save_errno = errno;
+		rsyserr(FERROR_XFER, errno, "unlink %s", full_fname(dest));
+		errno = save_errno;
+		return -1;
+	}
+
+#ifdef SUPPORT_XATTRS
+	if (preserve_xattrs)
+		mode |= S_IWUSR;
+#endif
+	mode &= INITACCESSPERMS;
+	if ((ofd = do_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) {
+		int save_errno = errno;
+		rsyserr(FERROR_XFER, save_errno, "open %s", full_fname(dest));
+		errno = save_errno;
+		return -1;
+	}
+	return ofd;
+}
+
+/* Copy contents of file @source to file @dest with mode @mode.
+ *
+ * If @tmpfilefd is < 0, copy_file unlinks @dest and then opens a new
+ * file with name @dest.
+ *
+ * Otherwise, copy_file writes to and closes the provided file
+ * descriptor.
+ *
  * In either case, if --xattrs are being preserved, the dest file will
  * have its xattrs set from the source file.
  *
  * This is used in conjunction with the --temp-dir, --backup, and
  * --copy-dest options. */
-int copy_file(const char *source, const char *dest, int ofd, mode_t mode)
+int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
 {
-	int ifd;
+	int ifd, ofd;
 	char buf[1024 * 8];
 	int len;   /* Number of bytes read into `buf'. */
 	OFF_T prealloc_len = 0, offset = 0;
@@ -339,23 +373,12 @@ int copy_file(const char *source, const char *dest, int ofd, mode_t mode)
 		return -1;
 	}
 
-	if (ofd < 0) {
-		if (robust_unlink(dest) && errno != ENOENT) {
-			int save_errno = errno;
-			rsyserr(FERROR_XFER, errno, "unlink %s", full_fname(dest));
-			close(ifd);
-			errno = save_errno;
-			return -1;
-		}
-
-#ifdef SUPPORT_XATTRS
-		if (preserve_xattrs)
-			mode |= S_IWUSR;
-#endif
-		mode &= INITACCESSPERMS;
-		if ((ofd = do_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) {
+	if (tmpfilefd >= 0) {
+		ofd = tmpfilefd;
+	} else {
+		ofd = unlink_and_reopen(dest, mode);
+		if (ofd < 0) {
 			int save_errno = errno;
-			rsyserr(FERROR_XFER, save_errno, "open %s", full_fname(dest));
 			close(ifd);
 			errno = save_errno;
 			return -1;
@@ -406,16 +429,28 @@ int copy_file(const char *source, const char *dest, int ofd, mode_t mode)
 
 	/* Source file might have shrunk since we fstatted it.
 	 * Cut off any extra preallocated zeros from dest file. */
-	if (offset < prealloc_len && do_ftruncate(ofd, offset) < 0) {
+	if (offset < prealloc_len) {
+#ifdef HAVE_FTRUNCATE
 		/* If we fail to truncate, the dest file may be wrong, so we
 		 * must trigger the "partial transfer" error. */
-		rsyserr(FERROR_XFER, errno, "ftruncate %s", full_fname(dest));
+		if (do_ftruncate(ofd, offset) < 0)
+			rsyserr(FERROR_XFER, errno, "ftruncate %s", full_fname(dest));
+#else
+		rprintf(FERROR_XFER, "no ftruncate for over-long pre-alloc: %s", full_fname(dest));
+#endif
+	}
+
+	if (do_fsync && fsync(ofd) < 0) {
+		int save_errno = errno;
+		rsyserr(FERROR, errno, "fsync failed on %s", full_fname(dest));
+		close(ofd);
+		errno = save_errno;
+		return -1;
 	}
 
 	if (close(ofd) < 0) {
 		int save_errno = errno;
-		rsyserr(FERROR_XFER, errno, "close failed on %s",
-			full_fname(dest));
+		rsyserr(FERROR_XFER, errno, "close failed on %s", full_fname(dest));
 		errno = save_errno;
 		return -1;
 	}
@@ -1349,7 +1384,7 @@ int same_time(time_t f1_sec, unsigned long f1_nsec, time_t f2_sec, unsigned long
 		return f1_sec == f2_sec;
 	if (modify_window < 0)
 		return f1_sec == f2_sec && f1_nsec == f2_nsec;
-	/* The nano seconds doesn't figure into these checks -- time windows don't care about that. */
+	/* The nanoseconds do not figure into these checks -- time windows don't care about that. */
 	if (f2_sec > f1_sec)
 		return f2_sec - f1_sec <= modify_window;
 	return f1_sec - f2_sec <= modify_window;
diff --git a/version.h b/version.h
index e2fb963b..4ce61d8f 100644
--- a/version.h
+++ b/version.h
@@ -1 +1 @@
-#define RSYNC_VERSION "3.2.3"
+#define RSYNC_VERSION "3.2.4pre4"
diff --git a/xattrs.c b/xattrs.c
index bcb4bcac..1f2bfacd 100644
--- a/xattrs.c
+++ b/xattrs.c
@@ -3,7 +3,7 @@
  * Written by Jay Fenlason, vaguely based on the ACLs patch.
  *
  * Copyright (C) 2004 Red Hat, Inc.
- * Copyright (C) 2006-2020 Wayne Davison
+ * Copyright (C) 2006-2022 Wayne Davison
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -1055,7 +1055,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
 {
 	rsync_xa_list *glst = rsync_xal_l.items;
 	item_list *lst;
-	int ndx;
+	int ndx, added_write_perm = 0;
 
 	if (dry_run)
 		return 1; /* FIXME: --dry-run needs to compute this value */
@@ -1084,10 +1084,23 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
 	}
 #endif
 
+	/* If the target file lacks write permission, we try to add it
+	 * temporarily so we can change the extended attributes. */
+	if (!am_root
+#ifdef SUPPORT_LINKS
+	 && !S_ISLNK(sxp->st.st_mode)
+#endif
+	 && access(fname, W_OK) < 0
+	 && do_chmod(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0)
+		added_write_perm = 1;
+
 	ndx = F_XATTR(file);
 	glst += ndx;
 	lst = &glst->xa_items;
-	return rsync_xal_set(fname, lst, fnamecmp, sxp);
+	int return_value = rsync_xal_set(fname, lst, fnamecmp, sxp);
+	if (added_write_perm) /* remove the temporary write permission */
+		do_chmod(fname, sxp->st.st_mode);
+	return return_value;
 }
 
 #ifdef SUPPORT_ACLS
@@ -1118,7 +1131,8 @@ int del_def_xattr_acl(const char *fname)
 
 int get_stat_xattr(const char *fname, int fd, STRUCT_STAT *fst, STRUCT_STAT *xst)
 {
-	int mode, rdev_major, rdev_minor, uid, gid, len;
+	unsigned int mode;
+	int rdev_major, rdev_minor, uid, gid, len;
 	char buf[256];
 
 	if (am_root >= 0 || IS_DEVICE(fst->st_mode) || IS_SPECIAL(fst->st_mode))
diff --git a/zlib/deflate.c b/zlib/deflate.c
index 529c5e8d..2cbc4fc2 100644
--- a/zlib/deflate.c
+++ b/zlib/deflate.c
@@ -227,11 +227,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
     int wrap = 1;
     static const char my_version[] = ZLIB_VERSION;
 
-    ushf *overlay;
-    /* We overlay pending_buf and d_buf+l_buf. This works since the average
-     * output size for (length,distance) codes is <= 24 bits.
-     */
-
     if (version == Z_NULL || version[0] != my_version[0] ||
         stream_size != sizeof(z_stream)) {
         return Z_VERSION_ERROR;
@@ -300,9 +295,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
 
     s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */
 
-    overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2);
-    s->pending_buf = (uchf *) overlay;
-    s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L);
+    /* We overlay pending_buf and sym_buf. This works since the average size
+     * for length/distance pairs over any compressed block is assured to be 31
+     * bits or less.
+     *
+     * Analysis: The longest fixed codes are a length code of 8 bits plus 5
+     * extra bits, for lengths 131 to 257. The longest fixed distance codes are
+     * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
+     * possible fixed-codes length/distance pair is then 31 bits total.
+     *
+     * sym_buf starts one-fourth of the way into pending_buf. So there are
+     * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
+     * in sym_buf is three bytes -- two for the distance and one for the
+     * literal/length. As each symbol is consumed, the pointer to the next
+     * sym_buf value to read moves forward three bytes. From that symbol, up to
+     * 31 bits are written to pending_buf. The closest the written pending_buf
+     * bits gets to the next sym_buf symbol to read is just before the last
+     * code is written. At that time, 31*(n-2) bits have been written, just
+     * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
+     * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
+     * symbols are written.) The closest the writing gets to what is unread is
+     * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
+     * can range from 128 to 32768.
+     *
+     * Therefore, at a minimum, there are 142 bits of space between what is
+     * written and what is read in the overlain buffers, so the symbols cannot
+     * be overwritten by the compressed data. That space is actually 139 bits,
+     * due to the three-bit fixed-code block header.
+     *
+     * That covers the case where either Z_FIXED is specified, forcing fixed
+     * codes, or when the use of fixed codes is chosen, because that choice
+     * results in a smaller compressed block than dynamic codes. That latter
+     * condition then assures that the above analysis also covers all dynamic
+     * blocks. A dynamic-code block will only be chosen to be emitted if it has
+     * fewer bits than a fixed-code block would for the same set of symbols.
+     * Therefore its average symbol length is assured to be less than 31. So
+     * the compressed data for a dynamic block also cannot overwrite the
+     * symbols from which it is being constructed.
+     */
+
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
+    s->pending_buf_size = (ulg)s->lit_bufsize * 4;
 
     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
         s->pending_buf == Z_NULL) {
@@ -311,8 +344,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
         deflateEnd (strm);
         return Z_MEM_ERROR;
     }
-    s->d_buf = overlay + s->lit_bufsize/sizeof(ush);
-    s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize;
+    s->sym_buf = s->pending_buf + s->lit_bufsize;
+    s->sym_end = (s->lit_bufsize - 1) * 3;
+    /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
+     * on 16 bit machines and because stored blocks are restricted to
+     * 64K-1 bytes.
+     */
 
     s->level = level;
     s->strategy = strategy;
@@ -473,7 +510,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
 
     if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR;
     s = strm->state;
-    if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3))
+    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;
@@ -1022,7 +1059,6 @@ int ZEXPORT deflateCopy (dest, source)
 #else
     deflate_state *ds;
     deflate_state *ss;
-    ushf *overlay;
 
 
     if (source == Z_NULL || dest == Z_NULL || source->state == Z_NULL) {
@@ -1042,8 +1078,7 @@ int ZEXPORT deflateCopy (dest, source)
     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
-    overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2);
-    ds->pending_buf = (uchf *) overlay;
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
 
     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
         ds->pending_buf == Z_NULL) {
@@ -1057,8 +1092,7 @@ int ZEXPORT deflateCopy (dest, source)
     zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
 
     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
-    ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush);
-    ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize;
+    ds->sym_buf = ds->pending_buf + ds->lit_bufsize;
 
     ds->l_desc.dyn_tree = ds->dyn_ltree;
     ds->d_desc.dyn_tree = ds->dyn_dtree;
@@ -1737,7 +1771,7 @@ local block_state deflate_fast(s, flush)
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -1878,7 +1912,7 @@ local block_state deflate_slow(s, flush)
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -1953,7 +1987,7 @@ local block_state deflate_rle(s, flush)
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
@@ -1992,7 +2026,7 @@ local block_state deflate_huff(s, flush)
         FLUSH_BLOCK(s, 1);
         return finish_done;
     }
-    if (s->last_lit)
+    if (s->sym_next)
         FLUSH_BLOCK(s, 0);
     return block_done;
 }
diff --git a/zlib/deflate.h b/zlib/deflate.h
index ce0299ed..a300a28d 100644
--- a/zlib/deflate.h
+++ b/zlib/deflate.h
@@ -214,7 +214,7 @@ typedef struct internal_state {
     /* Depth of each subtree used as tie breaker for trees of equal frequency
      */
 
-    uchf *l_buf;          /* buffer for literals or lengths */
+    uchf *sym_buf;        /* buffer for distances and literals/lengths */
 
     uInt  lit_bufsize;
     /* Size of match buffer for literals/lengths.  There are 4 reasons for
@@ -236,13 +236,8 @@ typedef struct internal_state {
      *   - I can't count above 4
      */
 
-    uInt last_lit;      /* running index in l_buf */
-
-    ushf *d_buf;
-    /* Buffer for distances. To simplify the code, d_buf and l_buf have
-     * the same number of elements. To use different lengths, an extra flag
-     * array would be necessary.
-     */
+    uInt sym_next;      /* running index in sym_buf */
+    uInt sym_end;       /* symbol table full when sym_next reaches this */
 
     ulg opt_len;        /* bit length of current block with optimal trees */
     ulg static_len;     /* bit length of current block with static trees */
@@ -322,20 +317,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf,
 
 # define _tr_tally_lit(s, c, flush) \
   { uch cc = (c); \
-    s->d_buf[s->last_lit] = 0; \
-    s->l_buf[s->last_lit++] = cc; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = 0; \
+    s->sym_buf[s->sym_next++] = cc; \
     s->dyn_ltree[cc].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
    }
 # define _tr_tally_dist(s, distance, length, flush) \
   { uch len = (length); \
     ush dist = (distance); \
-    s->d_buf[s->last_lit] = dist; \
-    s->l_buf[s->last_lit++] = len; \
+    s->sym_buf[s->sym_next++] = dist; \
+    s->sym_buf[s->sym_next++] = dist >> 8; \
+    s->sym_buf[s->sym_next++] = len; \
     dist--; \
     s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \
     s->dyn_dtree[d_code(dist)].Freq++; \
-    flush = (s->last_lit == s->lit_bufsize-1); \
+    flush = (s->sym_next == s->sym_end); \
   }
 #else
 # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c)
diff --git a/zlib/trees.c b/zlib/trees.c
index 1fd7759e..9c667702 100644
--- a/zlib/trees.c
+++ b/zlib/trees.c
@@ -418,7 +418,7 @@ local void init_block(s)
 
     s->dyn_ltree[END_BLOCK].Freq = 1;
     s->opt_len = s->static_len = 0L;
-    s->last_lit = s->matches = 0;
+    s->sym_next = s->matches = 0;
 }
 
 #define SMALLEST 1
@@ -943,7 +943,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last)
 
         Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ",
                 opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len,
-                s->last_lit));
+                s->sym_next / 3));
 
         if (static_lenb <= opt_lenb) opt_lenb = static_lenb;
 
@@ -1012,8 +1012,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
     unsigned dist;  /* distance of matched string */
     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
 {
-    s->d_buf[s->last_lit] = (ush)dist;
-    s->l_buf[s->last_lit++] = (uch)lc;
+    s->sym_buf[s->sym_next++] = dist;
+    s->sym_buf[s->sym_next++] = dist >> 8;
+    s->sym_buf[s->sym_next++] = lc;
     if (dist == 0) {
         /* lc is the unmatched char */
         s->dyn_ltree[lc].Freq++;
@@ -1028,30 +1029,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
         s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++;
         s->dyn_dtree[d_code(dist)].Freq++;
     }
-
-#ifdef TRUNCATE_BLOCK
-    /* Try to guess if it is profitable to stop the current block here */
-    if ((s->last_lit & 0x1fff) == 0 && s->level > 2) {
-        /* Compute an upper bound for the compressed length */
-        ulg out_length = (ulg)s->last_lit*8L;
-        ulg in_length = (ulg)((long)s->strstart - s->block_start);
-        int dcode;
-        for (dcode = 0; dcode < D_CODES; dcode++) {
-            out_length += (ulg)s->dyn_dtree[dcode].Freq *
-                (5L+extra_dbits[dcode]);
-        }
-        out_length >>= 3;
-        Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ",
-               s->last_lit, in_length, out_length,
-               100L - out_length*100L/in_length));
-        if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1;
-    }
-#endif
-    return (s->last_lit == s->lit_bufsize-1);
-    /* We avoid equality with lit_bufsize because of wraparound at 64K
-     * on 16 bit machines and because stored blocks are restricted to
-     * 64K-1 bytes.
-     */
+    return (s->sym_next == s->sym_end);
 }
 
 /* ===========================================================================
@@ -1064,13 +1042,14 @@ local void compress_block(s, ltree, dtree)
 {
     unsigned dist;      /* distance of matched string */
     int lc;             /* match length or unmatched char (if dist == 0) */
-    unsigned lx = 0;    /* running index in l_buf */
+    unsigned sx = 0;    /* running index in sym_buf */
     unsigned code;      /* the code to send */
     int extra;          /* number of extra bits to send */
 
-    if (s->last_lit != 0) do {
-        dist = s->d_buf[lx];
-        lc = s->l_buf[lx++];
+    if (s->sym_next != 0) do {
+        dist = s->sym_buf[sx++] & 0xff;
+        dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8;
+        lc = s->sym_buf[sx++];
         if (dist == 0) {
             send_code(s, lc, ltree); /* send a literal byte */
             Tracecv(isgraph(lc), (stderr," '%c' ", lc));
@@ -1095,11 +1074,10 @@ local void compress_block(s, ltree, dtree)
             }
         } /* literal or match pair ? */
 
-        /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */
-        Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx,
-               "pendingBuf overflow");
+        /* Check that the overlay between pending_buf and sym_buf is ok: */
+        Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
 
-    } while (lx < s->last_lit);
+    } while (sx < s->sym_next);
 
     send_code(s, END_BLOCK, ltree);
 }

Places

File master.patch of Package rsync (Revision d38f0167e81d64819212d664ad2d0d81)

Places