Quote rsync transport safely

[salva]

Summary

Make rsync transport command quoting safe for POSIX shell command strings.

Changes

• Quote every transport argument with POSIX single-quote escaping.
• Preserve embedded single quotes.
• Double all % characters, not just the first one.
• Add focused regression tests for whitespace, single quotes, percent escaping, and list context.
• Add the new test to MANIFEST.

Fixes #41.

Testing

• perl -Ilib -c lib/Net/OpenSSH.pm
• perl -Ilib t/rsync-quote.t

[Copilot]

Pull request overview

This PR aims to make the rsync -e transport command construction shell-safe by consistently quoting transport arguments and adding regression tests to prevent future quoting/escaping regressions.

Changes:

• Update _rsync_quote to quote all rsync transport arguments and to escape % globally.
• Add a focused regression test covering whitespace, single quotes, percent escaping, and list context behavior.
• Register the new test in MANIFEST.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lib/Net/OpenSSH.pm	Updates rsync transport argument quoting/escaping logic used to build the -e command string.
t/rsync-quote.t	Adds regression tests for _rsync_quote behavior.
MANIFEST	Includes the new test file in the distribution manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[salva]

This appears to be a false positive. The substitution produces the standard POSIX shell form 'a'\''b', not a backslash inside a single-quoted string. I verified both the unit test and an actual shell round-trip on this branch:\n\nperl -Ilib t/rsync-quote.t passes.\n\nperl -Ilib -MNet::OpenSSH -e 'print Net::OpenSSH->_rsync_quote(q(a'"'"'b)), qq(\n)' prints 'a'\''b'.\n\nPassing that quoted string through sh -c 'printf %s ...' produces a'b.