phase1: rsync based on checksum, not mtime