nixos: remove rsync from environment.defaultPackages

[ehmry]

Rsync is a security liability and we shouldn't include packages that are known to be insecure in the default system package set.

When I say "insecure" I am referring to the vulnerabilties that are in rsync right now that haven't be discovered or disclosed yet.

If remove this breaks anyones system then that happens because we didn't remove it earlier.

I was a maintainer of the rsync package until the latest batch of vulnerabilties.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[D-u-c-k-s-e-l]

I agree with this, but this might not need to be done, assuming that #373845 gets merged.

[ehmry]

No. Updating rsync doesn't fix rsync being installed by default. A new release is just new problems.

[Yarny0]

I'm not sure if I understand the motivation of this pull request (however, english is not my mother tongue).

When I say "insecure" I am referring to the vulnerabilties that are in rsync right now that haven't be discovered or disclosed yet.

Doesn't that apply to most packages? There are possibly also undiscovered vulnerabilties in perl, also in many other packages the are installed with NixOS, and most certainly in the linux kernel.