filter out --delete rsync option

rsync does not have a --no-delete, so do it this way instead

Remote/Rsync.hs

@@ -48,9 +48,7 @@ remote = RemoteType {
 
 gen :: Git.Repo -> UUID -> Maybe RemoteConfig -> Annex (Remote Annex)
 gen r u c = do
-	url <- getConfig r "rsyncurl" (error "missing rsyncurl")
-	opts <- getConfig r "rsync-options" ""
-	let o = RsyncOpts url $ map Param $ words opts
+	o <- genRsyncOpts r
 	cst <- remoteCost r expensiveRemoteCost
 	return $ encryptableRemote c
 		(storeEncrypted o)
@@ -67,6 +65,20 @@ gen r u c = do
 			config = Nothing
 		}
 
+genRsyncOpts :: Git.Repo -> Annex RsyncOpts
+genRsyncOpts r = do
+	url <- getConfig r "rsyncurl" (error "missing rsyncurl")
+	opts <- getConfig r "rsync-options" ""
+	return $ RsyncOpts url $ map Param $ filter safe $ words opts
+	where
+		safe o
+			-- Don't allow user to pass --delete to rsync;
+			-- that could cause it to delete other keys
+			-- in the same hash bucket as a key it sends.
+			| o == "--delete" = False
+			| o == "--delete-excluded" = False
+			| otherwise = True
+
 rsyncSetup :: UUID -> RemoteConfig -> Annex RemoteConfig
 rsyncSetup u c = do
 	-- verify configuration is sane

debian/changelog

@@ -3,7 +3,7 @@ git-annex (0.20110426) UNRELEASED; urgency=low
   * Switch back to haskell SHA library, so git-annex remains buildable on
     Debian stable.
   * Added rsync special remotes. This could be used, for example, to 
-    store annexed content on rsync.net, encrypted naturally. Or anywhere else.
+    store annexed content on rsync.net (encrypted naturally). Or anywhere else.
 
  -- Joey Hess <joeyh@debian.org>  Tue, 26 Apr 2011 11:23:54 -0400
 

doc/special_remotes/rsync.mdwn

@@ -19,5 +19,4 @@ These parameters can be passed to `git annex initremote` to configure rsync:
   pass to rsync to tell it where to store content.
 
 The `annex-rsync-options` git configuration setting can be used to pass
-parameters to rsync. Note that it is **not safe** to put "--delete"
-in `annex-rsync-options` when using rsync special remotes.
+parameters to rsync.