doc: quick-start: rework flag description (#1496)

Add a link to the manual install procedure, use a
quote to make the manual install path more visible
and mention the --default-access-key option.

Closes: #1446

Rendered output:

![image](/attachments/84bbe650-daff-40d1-b4bd-629abece27b0)

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/1496

CONTRIBUTING.md

@@ -0,0 +1,231 @@
+# Contributing to Garage
+
+## Policy on AI
+
+To ensure the quality of the codebase and documentation, the use of AI,
+including LLMs and coding agents, is strictly restricted in the following way:
+
+- AI **must not** be used to write documentation
+
+- **Do not** use AI to write bug reports, commit descriptions and pull request
+  messages
+
+- **Do not** use AI agents to make contributions to Garage, all contributions
+  must be led by a human that know what they are doing at all times
+
+- AI **may** be used for some tedious code generation tasks, limited to very
+  mechanical translations from API docs or boilerplate writing. The code
+  generated must be so simple as to make it clear that it cannot be covered by
+  copyright.
+
+You are free to make use of AI privately to explore the codebase and solve
+conceptual problems, but please restrain from copying the output from an LLM
+anywhere in your code or on the issue tracker, or from letting an agent edit
+the codebase directly.
+
+
+## Asking questions
+
+Read the documentation before asking questions.
+Do not use the issue tracker to ask questions about Garage.
+Questions asked on the issue tracker will be closed.
+
+Ask questions on the Matrix channel `#garage:deuxfleurs.fr` so that any
+community member can see your question and help you out.
+
+If you need in-depth support from the Garage developers specifically, write to
+`garagehq@deuxfleurs.fr`. Even if you do so, we do not commit to giving you an
+answer.
+
+
+## Reporting bugs
+
+When writing a bug report, use this checklist:
+
+- For bugs that can be reproduced:
+    - confirm that you are using the latest version of Garage and that the bug still exists in this version
+    - set the log level to debug using the `RUST_LOG=garage=debug` environment variable and reproduce the bug to get more verbose logs
+
+- Check whether there is already an open issue in the bug tracker. If so, your bug report is still valuable but please add it as a comment to the existing issue instead of opening a new one.
+
+- Collect as much information as possible:
+  - logs of the Garage daemon at the time the issue happened, including logs that show what was happening before the issue occurred
+  - the output of `garage status`
+  - the output of `garage stats -a`
+  - the output of `garage layout history`
+
+- Write a detailed bug report, including:
+  - a description of your cluster (number of nodes, hardware, operating system, networking, etc)
+  - a detailed description of what you did that led to the issue, including any code or command line that invoked a Garage API
+  - what you were expecting
+  - what actually happened, and how that's different from what you expected
+  - the information collected previously
+  - if possible, simple steps to help the developers reproduce the issue locally
+
+Bug reports that are imprecise or otherwise unactionable will be closed.
+
+
+## Suggesting new features
+
+Garage can be improved in many ways, but just suggesting a new feature does not mean we will implement it.
+Feature requests that may lead to an actual implementation are feature requests that:
+
+- are precise and actionable, i.e. include a precise description of the expected behavior and any necessary architectural details required for the implementation
+- are motivated by actual need from a variety of users
+
+Moreover, a certain number of features are defined as out-of-scope for Garage, including but not limited to:
+
+- extensions to the S3 API that are not present on AWS
+- features that require the implementation of a consensus algorithm
+- more generally, features that are incompatible with the architecture of Garage and its goal of staying simple
+
+Only feature requests in one of the following category may stay open in the issue tracker:
+
+- features that the Garage team wants to work on
+- features that are being actively worked on by an external contributor which is clearly identified
+- features that are easy to implement and could be an easy task for a new contributor that wants to get to know the codebase
+
+All other feature requests will be closed after a few months of inactivity, so as to keep the number of open issues to a manageable level.
+Feature requests that are clearly out of scope will be closed directly.
+
+
+## Improving the documentation
+
+An easy way to contribute to Garage which also adds a lot of value is to
+improve the documentation.  Make sure to write in clear technical English, and
+write unambiguously.  Documentation contributions are very appreciated if they
+are well-written.
+
+
+## For developers
+
+We welcome code contributions to Garage that adhere to our standards for quality:
+
+- Changes should be reviewed from a functional perspective to ensure that they work well with the existing codebase and do not introduce bugs or subtle issues.
+
+- You must have tested your contribution to make sure that it does what it says. The amount of testing required is proportional to the complexity of the change introduced.
+
+- Any new feature must be properly documented following existing practices (see below).
+
+- Unit tests should be included when relevant.
+
+- Contributions should pass basic lints for syntactic quality (`cargo fmt`, `cargo clippy`, `typos`).
+
+- Contributions should pass our CI test suite.
+
+- No user-facing breaking changes may be introduced between major releases.
+
+- No internal data model change may be introduced between major releases, to
+  ensure that Garage daemons with different minor/patch versions numbers can
+  work together in a cluster. For major releases, a proper migration path
+  should be implemented and tested thoroughly.
+
+Please follow up on your work when changes are requested, to avoid stale PRs.
+Do not take it personally if a Garage developer pushes directly to your branch
+to modify your contribution, as this might be necessary to get it merged
+faster.
+
+### Properly documenting your contribution
+
+#### Configuration options
+
+New configuration options should be documented in
+`doc/book/reference-manual/configuration.md`.  The documentation for a
+configuration option should be exhaustive. For instance, for choice options all
+choices should be listed explicitly with a precise description of their
+meaning.
+
+In terms of syntax, all configuration options should appear in three places:
+
+- in the example at the top, with an example value
+- in the index of all configuration options which is sorted by alphabetical order
+- in its dedicated subsection with full reference text
+
+#### CLI commands and command flags
+
+CLI commands are self-documented using the doc commends in the codebase.
+Make sure to write clear and precise comments for all options you are adding.
+
+#### S3 features
+
+If you implement new S3 features, make sure to update the compatibility matrix in `doc/book/reference-manual/s3-compatibility.md`.
+
+#### Admin API
+
+The admin API has an OpenAPI specification that is automatically generated
+using Utoipa, from a description of each endpoint that is given in
+`src/api/admin/openapi.rs` and a description of data structure schemas in
+`src/api/admin/api.rs`. The code in `openapi.rs` is only used to generate the
+OpenAPI specification document and not for the actual implementation in Garage,
+whereas structures defined in `api.rs` are also used for the implementation of
+API calls. Make sure to write good doc comments for all of these items so that
+the OpenAPI specification will be precise and accurate.
+
+An up-to-date version of the OpenAPI specification document should be kept in
+the repository in `doc/api/garage-admin-v2.json`. When you are making changes
+to the admin API, update this document with the following command:
+
+```
+cargo run -- admin-api-schema > doc/api/garage-admin-v2.json
+```
+
+
+## Garage team organization
+
+Alex (handle `lx`) is the lead developer and is responsible of ensuring the
+correctness of Garage and stability between version upgrades.
+
+The other maintainers are Trinity (handle `trinity-1686a`), Quentin (handle `quentin`) and Maximilien (handle `halfa`).
+
+Maximilien is responsible for coordinating effort on the Kubernetes integration / Helm chart.
+
+## Pull request merging criteria
+
+The following PRs should only be merged after review and approval from Alex:
+
+- PRs that introduce architectural changes, such as changes in the data model
+  or change in the coordination protocols between nodes
+
+- PRs that introduce changes on the format of data structures used for
+  persistent disk storage and internal cluster communication (RPC)
+
+- PRs that are suspected of introducing some kind of breakage or unexpected
+  behavior due to their complexity
+
+PRs that introduce breaking change for users but don't fall in one of the
+previous category should be discussed between maintainers to evaluate the
+impact on users when upgrading.  Alex's approval is not required to merge them
+as long as they are clearly identified as breaking in the PR title, and are
+properly merged in the branch for the next major version and not in the current
+main branch.
+
+All other PRs can be merged by any maintainer on their own, once they are
+confident that the quality standards defined in this document are respected
+before merging.
+
+## Merging strategy
+
+When merging PRs, maintainers should ensure that a Git commit is created by
+Forgejo that records the PR number, its title and its text in the commit
+message.  If a PR is fixing an issue, make sure that the issue number is
+included in the PR title as well.  This is to ensure that when releasing a new
+version of Garage, the changelog in the release notes can be properly
+constructed by reading the Git log since the last release.
+
+We also want to keep the history "almost linear" to facilitate the use of `git
+bisect` if it ever were necessary. This leaves the following two merging
+strategies:
+
+- For PRs that consist of many commits that should stay independent, the
+  "rebase and create merge commit" strategy should be used. The merge commit is
+  created automatically by Forgejo and saves the PR's number, title and text in
+  the commit message.
+
+- For PRs that consist of only one commit, or a few number of commits that can
+  be merged, the "create squash commit" strategy should be used. This way a
+  single commit will be created by Forgejo which also saves the PR's number,
+  title and text in the commit message.
+
+When cherry-picking commits from one branch to the other, a simple fast-forward
+merging strategy can be used if the commit message already references a PR
+number.

Cargo.toml

@@ -16,6 +16,7 @@ members = [
 	"src/garage",
 	"src/k2v-client",
 	"src/format-table",
+    "fuzz",
 ]
 
 default-members = ["src/garage"]
@@ -40,6 +41,7 @@ k2v-client = { version = "0.0.4", path = "src/k2v-client" }
 
 # External crates from crates.io
 arc-swap = "1.8"
+arbitrary = { version = "1.4.2"}
 argon2 = "0.5"
 async-trait = "0.1"
 backtrace = "0.3"
@@ -51,20 +53,23 @@ cfg-if = "1.0"
 chrono = { version = "0.4", features = ["serde"] }
 crc-fast = "1.9"
 crypto-common = "0.1"
+fundu = "2.0"
+fundu-systemd = "0.3"
 gethostname = "1.1"
 git-version = "0.3"
 hex = "0.4"
 hexdump = "0.1"
+html-escape = "0.2.13"
 hmac = "0.12"
 itertools = "0.14"
 ipnet = "2.11"
 lazy_static = "1.5"
+libfuzzer-sys = "0.4"
 md-5 = "0.10"
 mktemp = "0.5"
 nix = { version = "0.31", default-features = false, features = ["fs"] }
 nom = "8.0"
 parking_lot = "0.12"
-parse_duration = "2.1"
 paste = "1.0"
 pin-project = "1.1"
 pnet_datalink = "0.35"
@@ -113,7 +118,7 @@ kube = { version = "3.0", default-features = false, features = [
 ] }
 schemars = "1.2"
 reqwest = { version = "0.13", default-features = false, features = [
-    "rustls",
+    "rustls-no-provider",
     "json",
 ] }
 

GOVERNANCE.md

@@ -0,0 +1,45 @@
+# Governance of Gararge
+
+This documents how the Garage project operates. It reflects the state of the project as of July 2026 and is not optimal. The team is interested to improve it in the future.
+
+## Team organization
+
+* **Contributors**: anyone can contribute by proposing changes in issues and pull requests.
+
+* **Maintainers**: they are responsible for reviewing, merging pull requests, publishing releases and triaging issues.
+  The current maintainers are:
+   * Alex (handle `lx`)
+   * Trinity (handle `trinity-1686a`)
+   * Quentin (handle `quentin`)
+   * Maximilien (handle `halfa`), who is in particular responsible for coordinating effort on the Kubernetes integration / Helm chart.
+ 
+  They are added to a white-list of the branch protection rule of the repository to enable them to merge pull requests.
+  To become a maintainer, you need to be a long-term contributor and earn the personal trust of Alex.
+  There is no set process for leaving the maintainer role.
+
+* **Lead developer**: Alex (handle `lx`) is the lead developer and is responsible of ensuring the
+correctness of Garage and stability between version upgrades. He may transfer this role to someone else as he sees fit.
+
+## Communication channels
+
+The team coordinates in the following channels:
+* The issue tracker and pull requests of the official repository.
+* The `#garage:deuxfleurs.fr` matrix channel (in English), open to anyone.
+  On this channel, users may ask for support and discussions about development also happen.
+* The `#garage-dev:deuxfleurs.fr` matrix channel (in French), not advertised to contributors but de facto accessible to anyone.
+  Discussions about development and project coordination happen there.
+
+The moderators for those discussion channels are the Garage maintainers.
+
+## Decision procedures
+
+Decisions are taken by lazy consensus, with the lead developer settling discussions when a consensus cannot be reached.
+
+## Governance changes
+
+There is no set process for changing the governance of garage.
+
+## See also
+
+* [Project goals](https://garagehq.deuxfleurs.fr/documentation/design/goals/)
+* [Contributing instructions](https://git.deuxfleurs.fr/Deuxfleurs/garage/src/branch/main-v2/CONTRIBUTING.md)

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Reporting
+
+If you wish to report responsibly a security vulnerability about Garage, we ask that you follow the following process.
+
+Please report each security vulnerabilities by filling out the following template:
+
+- PROJECT: A URL to the code repository containing the vulnerable version - be reminded that the source of truth is at https://git.deuxfleurs.fr/deuxfleurs/garage
+- PUBLIC: Please let us know if this vulnerability has been made or discussed publicly already, and if so, please let us know where.
+- DESCRIPTION: Please provide precise description of the security vulnerability you have found with as much information as you are able and willing to provide.
+
+Please send the above info, along with any other information you feel is pertinent by emailing the core team at: garagehq@deuxfleurs.fr
+
+The Garage Core Team will let you know within a few weeks whether or not your report has been accepted or rejected.
+We ask that you please keep the report confidential until we have either responded or made a public announcement.

doc/api/garage-admin-v2.json

@@ -1797,6 +1797,17 @@
               "type": "string"
             },
             "description": "Plain-text information about the layout computation\n(do not try to parse this)"
+          },
+          "statistics": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/ComputationStat",
+                "description": "Structured statistics about the layout computation"
+              }
+            ]
           }
         }
       },
@@ -2119,6 +2130,180 @@
           "Historical"
         ]
       },
+      "ComputationStat": {
+        "type": "object",
+        "required": [
+          "replicationFactor",
+          "effectiveZoneRedundancy",
+          "partitionSize",
+          "lowPartitionSize",
+          "usableCapacity",
+          "totalCapacity",
+          "effectiveCapacity",
+          "lowUsableCapacity",
+          "zones"
+        ],
+        "properties": {
+          "effectiveCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The final effective capacity of the cluster, accounting for replication",
+            "minimum": 0
+          },
+          "effectiveZoneRedundancy": {
+            "type": "integer",
+            "description": "The zone redundancy factor achieved by this layout",
+            "minimum": 0
+          },
+          "lowPartitionSize": {
+            "type": "boolean",
+            "description": "Warning flag indicating when partitions are very small"
+          },
+          "lowUsableCapacity": {
+            "type": "boolean",
+            "description": "Warning flag indicating that the raw node capacity could not be used\neffectively"
+          },
+          "partitionSize": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The size of a partition, in bytes",
+            "minimum": 0
+          },
+          "previousPartitionSize": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "format": "int64",
+            "description": "The size of a partition, in bytes, in the previous layout",
+            "minimum": 0
+          },
+          "replicationFactor": {
+            "type": "integer",
+            "description": "The cluster's replication factor",
+            "minimum": 0
+          },
+          "totalCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The total raw capacity of nodes",
+            "minimum": 0
+          },
+          "totalMovedPartitions": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "description": "The total number of partitions that will be moved to a new storage node",
+            "minimum": 0
+          },
+          "usableCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The portion of total raw node capacity that is used by partitions",
+            "minimum": 0
+          },
+          "zones": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ComputationStatZone"
+            },
+            "description": "Per-zone storage statistics"
+          }
+        }
+      },
+      "ComputationStatNode": {
+        "type": "object",
+        "required": [
+          "id",
+          "tags",
+          "storedPartitions",
+          "newPartitions",
+          "totalCapacity",
+          "usableCapacity"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "The node's ID"
+          },
+          "newPartitions": {
+            "type": "integer",
+            "description": "The number of partitions that are newly replicated on this node",
+            "minimum": 0
+          },
+          "storedPartitions": {
+            "type": "integer",
+            "description": "The number of partitions that are replicated on this node",
+            "minimum": 0
+          },
+          "tags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "The node's tags as defined in the layout"
+          },
+          "totalCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The node's raw capacity",
+            "minimum": 0
+          },
+          "usableCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The portion of the node's raw capacity that is used by partitions it stores",
+            "minimum": 0
+          }
+        }
+      },
+      "ComputationStatZone": {
+        "type": "object",
+        "required": [
+          "name",
+          "nodes",
+          "totalReplicatedPartitions",
+          "uniquePartitions",
+          "totalCapacity",
+          "usableCapacity"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The name of the zone"
+          },
+          "nodes": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ComputationStatNode"
+            },
+            "description": "Per-node storage statistics for nodes in this zone"
+          },
+          "totalCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The total raw capacity of nodes in this zone",
+            "minimum": 0
+          },
+          "totalReplicatedPartitions": {
+            "type": "integer",
+            "description": "The total number of partition replicas in this zone",
+            "minimum": 0
+          },
+          "uniquePartitions": {
+            "type": "integer",
+            "description": "The number of unique partitions that have at least one replica in this zone",
+            "minimum": 0
+          },
+          "usableCapacity": {
+            "type": "integer",
+            "format": "int64",
+            "description": "The used portion of the raw capacity of nodes in this zones",
+            "minimum": 0
+          }
+        }
+      },
       "ConnectClusterNodesRequest": {
         "type": "array",
         "items": {
@@ -4221,6 +4406,17 @@
               "newLayout": {
                 "$ref": "#/components/schemas/GetClusterLayoutResponse",
                 "description": "Details about the new cluster layout"
+              },
+              "statistics": {
+                "oneOf": [
+                  {
+                    "type": "null"
+                  },
+                  {
+                    "$ref": "#/components/schemas/ComputationStat",
+                    "description": "Structured statistics about the layout computation"
+                  }
+                ]
               }
             }
           }

doc/book/connect/apps/index.md

@@ -547,7 +547,7 @@ ejabberdctl module_install mod_s3_upload
 Create the required key and bucket with:
 
 ```bash
-garage key new --name ejabberd
+garage key create ejabberd
 garage bucket create objects.xmpp-server.fr
 garage bucket allow objects.xmpp-server.fr --read --write --key ejabberd
 garage bucket website --allow objects.xmpp-server.fr
@@ -678,7 +678,7 @@ For more information on deployment you can check the [ente documentation](https:
 This is the usual Garage setup:
 
 ```bash
-garage key new --name pleroma-key
+garage key create pleroma-key
 garage bucket create pleroma
 garage bucket allow pleroma --read --write --owner --key pleroma-key
 ```
@@ -759,7 +759,7 @@ This feature requires `pict-rs >= 4.0.0`.
 This is the usual Garage setup:
 
 ```bash
-garage key new --name pictrs-key
+garage key create pictrs-key
 garage bucket create pictrs-data
 garage bucket allow pictrs-data --read --write --key pictrs-key
 ```

doc/book/connect/backup.md

@@ -22,7 +22,7 @@ Note that `git-annex` requires to be compiled with Haskell package version
 `aws-0.24` to work with Garage.
 
 ```bash
-garage key new --name my-key
+garage key create my-key
 garage bucket create my-git-annex
 garage bucket allow my-git-annex --read --write --key my-key
 ```

doc/book/connect/cli.md

@@ -268,7 +268,7 @@ duck --delete garage:/my-files/an-object.txt
 
 ## WinSCP (libs3) {#winscp}
 
-*You can find instructions on how to use the GUI in french [in our wiki](https://guide.deuxfleurs.fr/prise_en_main/winscp/).*
+*You can find instructions on how to use the GUI in french [in our wiki](https://guide.deuxfleurs.fr/services/winscp/).*
 
 How to use `winscp.com`, the CLI interface of WinSCP:
 

doc/book/connect/observability.md

@@ -27,7 +27,7 @@ which support storing metrics in an object store:
 This can be configured with Garage with the following:
 
 ```bash
-garage key new --name vector-system-logs
+garage key create vector-system-logs
 garage bucket create system-logs
 garage bucket allow system-logs --read --write --key vector-system-logs
 ```

doc/book/cookbook/exposing-websites.md

@@ -25,6 +25,13 @@ garage bucket website --allow my-website
 
 Now it will be **publicly** exposed on the web endpoint (by default listening on port 3902).
 
+> The bucket needs to have a *global alias* to be exposed as a website. If the
+> bucket was created with `garage bucket create` it will have an alias;
+> if created via the S3 API [you will have to manually add the alias
+> ](https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/742) first.
+> Creating globally aliased buckets from the S3 API is [currently under
+> discussion](https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/649).
+
 ## How exposed websites work
 
 Our website serving logic is as follow:

doc/book/operations/durability-repairs.md

@@ -91,7 +91,7 @@ is definitely lost, then there is no other choice than to declare your S3 object
 as unrecoverable, and to delete them properly from the data store. This can be done
 using the `garage block purge` command.
 
-## Rebalancing data directories
+## Rebalancing data directories {#rebalance}
 
 In [multi-HDD setups](@/documentation/operations/multi-hdd.md), to ensure that
 data blocks are well balanced between storage locations, you may run a

doc/book/operations/multi-hdd.md

@@ -68,10 +68,11 @@ To rebalance data, two strategies can be used:
   secondary directory. This might never end up rebalancing everything if there
   are data blocks that are only read and never written.
 
-- Active rebalancing: an operator of a Garage node can explicitly launch a repair
+- Active rebalancing: an operator of a Garage node can [explicitly launch a
-  procedure that rebalances the data directories, moving all blocks to their
+  repair procedure](@/documentation/operations/durability-repairs.md#rebalance)
-  primary location. Once done, all secondary locations for all hash slices are
+  that rebalances the data directories, moving all blocks to their primary
-  removed so that they won't be checked anymore when looking for a data block.
+  location. Once done, all secondary locations for all hash slices are removed
+  so that they won't be checked anymore when looking for a data block.
 
 ## Read-only storage locations
 

doc/book/quick-start/_index.md

@@ -133,12 +133,17 @@ Use the following command to launch the Garage server:
 garage server --single-node --default-bucket
 ```
 
-The `--single-node` flag instructs Garage to automatically configure a single-node cluster without data replication.
+- the `--single-node` flag instructs Garage to automatically configure a
-The `--default-bucket` flag instructs Garage to create a default access key and a default bucket using the environment variables we defined above.
+  single-node cluster without data replication;
-Both flags are optional and can be omitted, in which case you will have to follow manual configuration steps described below.
+- the `--default-bucket` flag instructs Garage to create a default access key
+  and a default bucket using the environment variables we defined above (it
+  implies `--default-access-key`).
 
-**For older versions of Garage (before v2.3.0):** automatic configuration using `--single-node` and `--default-bucket` is not available,
+> You can refer to the [manual configuration
-you must follow the manual configuration steps.
+> steps](#manual-configuration) if:
+>
+> - you decide to no use these optional flags;
+> - you are running an **older version of Garage (before v2.3.0)**.
 
 Alternatively, if you cannot or do not wish to run the Garage binary directly,
 you may use Docker to run Garage in a container using the following command:
@@ -292,7 +297,7 @@ An exhaustive list is maintained in the ["Integrations" > "Browsing tools" secti
 
 
 
-## Manual configuration
+## Manual configuration {#manual-configuration}
 
 This section provides instructions that are equivalent to using the
 `--single-node` and `--default-bucket` flags for automatic configuration.  If

doc/book/reference-manual/configuration.md

@@ -448,7 +448,7 @@ If this value is set, Garage will automatically take a snapshot of the metadata
 DB file at a regular interval and save it in the metadata directory,
 or in [`metadata_snapshots_dir`](#metadata_snapshots_dir) if it is set.
 This parameter can take any duration string that can be parsed by
-the [`parse_duration`](https://docs.rs/parse_duration/latest/parse_duration/#syntax) crate.
+the [`fundu_systemd`](https://docs.rs/fundu-systemd) crate.
 
 Snapshots can allow to recover from situations where the metadata DB file is
 corrupted, for instance after an unclean shutdown.  See [this

doc/drafts/k2v-spec.md

@@ -166,6 +166,25 @@ that map to zeroes.  Note that we need to filter out values from nodes that are
 no longer part of the cluster layout, as when nodes are removed they won't
 necessarily have had the time to set their counters to zero.
 
+### Consistency guarantees
+
+K2V provides the following consistency guarantees:
+
+**Read after Write**. After a write has been acknowledged (the request returned
+successfully), a subsequent read is guaranteed to contain the value that was
+written.
+
+**Monotonic Reads**. Two sequential reads will return values in an order that is
+consistent with the order in which they are written (e.g. by concurrent writes).
+For example, consider a scenario where a value is set initially set to 0 and a
+request writing 1 is performed. Doing two subsequent reads concurrently with the
+write is guaranteed to return either `0`, `0` or `0`,`1` or `1`,`1`, but not
+`1`,`0`.
+
+It is also possible to perform non-monotonic reads (allowing this last
+behavior), which are slightly faster than monotonic reads. This is done by
+passing a dedicated flag to read operations (see the endpoints documentation).
+
 ## Important details
 
 **THIS SECTION CONTAINS A FEW WARNINGS ON THE K2V API WHICH ARE IMPORTANT
@@ -210,6 +229,12 @@ Query parameters:
 |------------|---------------|----------------------------------|
 | `sort_key` | **mandatory** | The sort key of the item to read |
 
+Headers:
+
+| name                          | default value | meaning                                  |
+|-------------------------------|---------------|------------------------------------------|
+| `X-Garage-Non-Monotonic-Read` | `false`       | Whether to allow for non-monotonic reads |
+
 Returns the item with specified partition key and sort key. Values can be
 returned in either of two ways:
 
@@ -325,6 +350,12 @@ Query parameters:
 
 The timeout can be set to any number of seconds, with a maximum of 600 seconds (10 minutes).
 
+Headers:
+
+| name                          | default value | meaning                                  |
+|-------------------------------|---------------|------------------------------------------|
+| `X-Garage-Non-Monotonic-Read` | `false`       | Whether to allow for non-monotonic reads |
+
 
 **InsertItem: `PUT /<bucket>/<partition key>?sort_key=<sort_key>`**
 
@@ -521,6 +552,14 @@ HTTP/1.1 204 NO CONTENT
 
 Batch read of triplets in a bucket.
 
+Headers:
+
+| name                          | default value | meaning                                  |
+|-------------------------------|---------------|------------------------------------------|
+| `X-Garage-Non-Monotonic-Read` | `false`       | Whether to allow for non-monotonic reads |
+
+Body:
+
 The request body is a JSON list of searches, that each specify a range of
 items to get (to get single items, set `singleItem` to `true`). A search is a
 JSON struct with the following fields:
@@ -711,6 +750,14 @@ HTTP/1.1 200 OK
 
 Polls a range of items for changes.
 
+Headers:
+
+| name                          | default value | meaning                                  |
+|-------------------------------|---------------|------------------------------------------|
+| `X-Garage-Non-Monotonic-Read` | `false`       | Whether to allow for non-monotonic reads |
+
+Body:
+
 The query body is a JSON object consisting of the following fields:
 
 | name            | default value | meaning                                                                                |

flake.lock

@@ -81,17 +81,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1763952169,
+        "lastModified": 1776914043,
-        "narHash": "sha256-+PeDBD8P+NKauH+w7eO/QWCIp8Cx4mCfWnh9sJmy9CM=",
+        "narHash": "sha256-qug5r56yW1qOsjSI99l3Jm15JNT9CvS2otkXNRNtrPI=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ab726555a9a72e6dc80649809147823a813fa95b",
+        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
         "type": "github"
       },
       "original": {
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ab726555a9a72e6dc80649809147823a813fa95b",
+        "rev": "2d35c4358d7de3a0e606a6e8b27925d981c01cc3",
         "type": "github"
       }
     },

flake.nix

@@ -6,9 +6,9 @@
   inputs.nixpkgs.url =
     "github:NixOS/nixpkgs/cfe2c7d5b5d3032862254e68c37a6576b633d632";
 
-  # Rust overlay as of 2025-11-24
+  # Rust overlay as of 2026-04-23
   inputs.rust-overlay.url =
-  "github:oxalica/rust-overlay/ab726555a9a72e6dc80649809147823a813fa95b";
+  "github:oxalica/rust-overlay/2d35c4358d7de3a0e606a6e8b27925d981c01cc3";
   inputs.rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
 
   # Crane as of 2025-01-24
@@ -95,6 +95,14 @@
                 killall
               ];
             };
+
+            # dev shell for fuzzing
+            fuzz = pkgs.mkShell {
+              buildInputs = with pkgs; [
+                targets.toolchainNightly
+                cargo-fuzz
+              ];
+            };
           };
       });
 }

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,73 @@
+[package]
+name = "garage-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+arbitrary = { workspace = true, features = ["derive"]}
+libfuzzer-sys = { workspace = true }
+
+garage_db.workspace = true
+garage_table.workspace = true
+garage_util.workspace = true
+garage_model = { workspace = true, default-features = false, features = ["arbitrary", "k2v"] }
+
+[[bin]]
+name = "version_crdt"
+path = "fuzz_targets/version_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "mpu_crdt"
+path = "fuzz_targets/mpu_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "bucket_crdt"
+path = "fuzz_targets/bucket_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "block_ref_crdt"
+path = "fuzz_targets/block_ref_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "admin_api_token_crdt"
+path = "fuzz_targets/admin_api_token_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "key_crdt"
+path = "fuzz_targets/key_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "bucket_alias_crdt"
+path = "fuzz_targets/bucket_alias_crdt.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "k2v_item_crdt"
+path = "fuzz_targets/k2v_item_crdt.rs"
+test = false
+doc = false
+bench = false

fuzz/README.md

@@ -0,0 +1,11 @@
+# Fuzzing
+
+## Setup
+
+Install cargo fuzz: `cargo install cargo-fuzz`
+
+## Launch
+
+Run `cargo fuzz run <fuzz_target>` where `<fuzz_target>` is the name (without extension) of one of the `.rs` files in the `fuzz_targets` directory.
+
+If you launch the command outside of the fuzz directory, you need to force the nightly toolchain with `cargo +nightly`.

fuzz/fuzz_targets/admin_api_token_crdt.rs

@@ -0,0 +1,38 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::admin_token_table::{AdminApiToken, AdminApiTokenParams, AdminApiTokenScope};
+use garage_model::permission::ExpirationTime;
+use garage_util::crdt;
+use libfuzzer_sys::fuzz_target;
+
+type Input = (
+	bool,
+	crdt::Lww<String>,
+	crdt::Lww<crdt::MergingOption<ExpirationTime>>,
+	crdt::Lww<AdminApiTokenScope>,
+);
+
+fn make(input: Input) -> AdminApiToken {
+	let (deleted, name, expiration, scope) = input;
+	let state = if deleted {
+		crdt::Deletable::Deleted
+	} else {
+		crdt::Deletable::present(AdminApiTokenParams {
+			created: 0,
+			token_hash: String::new(),
+			name,
+			expiration,
+			scope,
+		})
+	};
+	AdminApiToken {
+		prefix: String::new(),
+		state,
+	}
+}
+
+fuzz_target!(|inputs: (Input, Input, Input)| {
+	let (a, b, c) = inputs;
+	check_crdt_laws(make(a), make(b), make(c));
+});

fuzz/fuzz_targets/block_ref_crdt.rs

@@ -0,0 +1,20 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::s3::block_ref_table::BlockRef;
+use libfuzzer_sys::fuzz_target;
+
+/// Build a BlockRef with a fixed block hash and version UUID so that CRDT state
+/// can be compared across merge results. Only the deleted flag varies.
+fn make_block_ref(deleted: bool) -> BlockRef {
+	BlockRef {
+		block: [0u8; 32].into(),
+		version: [0u8; 32].into(),
+		deleted: deleted.into(),
+	}
+}
+
+fuzz_target!(|inputs: (bool, bool, bool)| {
+	let (d1, d2, d3) = inputs;
+	check_crdt_laws(make_block_ref(d1), make_block_ref(d2), make_block_ref(d3));
+});

fuzz/fuzz_targets/bucket_alias_crdt.rs

@@ -0,0 +1,25 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::bucket_alias_table::BucketAlias;
+use garage_util::data::Uuid;
+use libfuzzer_sys::fuzz_target;
+
+/// Build a BucketAlias with a fixed name so that CRDT state can be compared
+/// across merge results. The timestamp and optional bucket ID are the CRDT state.
+fn make_bucket_alias(ts: u64, bucket_id: Option<[u8; 32]>) -> BucketAlias {
+	BucketAlias::new(String::new(), ts, bucket_id.map(Uuid::from))
+}
+
+fuzz_target!(|inputs: (
+	(u64, Option<[u8; 32]>),
+	(u64, Option<[u8; 32]>),
+	(u64, Option<[u8; 32]>)
+)| {
+	let ((ts1, b1), (ts2, b2), (ts3, b3)) = inputs;
+	check_crdt_laws(
+		make_bucket_alias(ts1, b1),
+		make_bucket_alias(ts2, b2),
+		make_bucket_alias(ts3, b3),
+	);
+});

fuzz/fuzz_targets/bucket_crdt.rs

@@ -0,0 +1,22 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::bucket_table::{Bucket, BucketParams};
+use garage_util::crdt::{self, Deletable};
+use libfuzzer_sys::fuzz_target;
+
+fn make(state: Deletable<BucketParams>) -> Bucket {
+	Bucket {
+		id: [0u8; 32].into(),
+		state,
+	}
+}
+
+fuzz_target!(|inputs: (
+	crdt::Deletable<BucketParams>,
+	crdt::Deletable<BucketParams>,
+	crdt::Deletable<BucketParams>
+)| {
+	let (a, b, c) = inputs;
+	check_crdt_laws(make(a), make(b), make(c));
+});

fuzz/fuzz_targets/k2v_item_crdt.rs

@@ -0,0 +1,36 @@
+#![no_main]
+
+use std::collections::BTreeMap;
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::k2v::item_table::{DvvsEntry, DvvsValue, K2VItem};
+use libfuzzer_sys::fuzz_target;
+
+// Timestamps are encoded as `(ts << 32) | shift` so that items built with different
+// shifts (0, 1, 2) have disjoint timestamp spaces that still interleave in the sorted merge.
+fn make(raw: BTreeMap<u64, (u32, BTreeMap<u32, DvvsValue>)>, shift: u32) -> K2VItem {
+	let shift = shift as u64;
+	let items = raw
+		.into_iter()
+		.map(|(node, (t_discard, values))| {
+			let entry = DvvsEntry::from_raw(
+				(t_discard as u64) << 32 | shift,
+				values
+					.into_iter()
+					.map(|(ts, v)| ((ts as u64) << 32 | shift, v))
+					.collect(),
+			);
+			(node, entry)
+		})
+		.collect();
+	K2VItem::with_raw_items(items)
+}
+
+fuzz_target!(|inputs: (
+	BTreeMap<u64, (u32, BTreeMap<u32, DvvsValue>)>,
+	BTreeMap<u64, (u32, BTreeMap<u32, DvvsValue>)>,
+	BTreeMap<u64, (u32, BTreeMap<u32, DvvsValue>)>,
+)| {
+	let (a, b, c) = inputs;
+	check_crdt_laws(make(a, 0), make(b, 1), make(c, 2));
+});

fuzz/fuzz_targets/key_crdt.rs

@@ -0,0 +1,43 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::key_table::{Key, KeyParams};
+use garage_model::permission::{BucketKeyPerm, ExpirationTime};
+use garage_util::crdt;
+use garage_util::data::Uuid;
+use libfuzzer_sys::fuzz_target;
+
+type Input = (
+	bool,
+	crdt::Lww<String>,
+	crdt::Lww<crdt::MergingOption<ExpirationTime>>,
+	crdt::Lww<bool>,
+	crdt::Map<Uuid, BucketKeyPerm>,
+	crdt::LwwMap<String, crdt::CancelingOption<Uuid>>,
+);
+
+fn make(input: Input) -> Key {
+	let (deleted, name, expiration, allow_create_bucket, authorized_buckets, local_aliases) = input;
+	let state = if deleted {
+		crdt::Deletable::Deleted
+	} else {
+		crdt::Deletable::present(KeyParams {
+			created: None,
+			secret_key: String::new(),
+			name,
+			expiration,
+			allow_create_bucket,
+			authorized_buckets,
+			local_aliases,
+		})
+	};
+	Key {
+		key_id: String::new(),
+		state,
+	}
+}
+
+fuzz_target!(|inputs: (Input, Input, Input)| {
+	let (a, b, c) = inputs;
+	check_crdt_laws(make(a), make(b), make(c));
+});

fuzz/fuzz_targets/mpu_crdt.rs

@@ -0,0 +1,37 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::s3::mpu_table::{MpuPart, MpuPartKey, MultipartUpload};
+use libfuzzer_sys::fuzz_target;
+
+/// Build a MultipartUpload from an arbitrary deleted flag and parts list, using a fixed
+/// upload_id/bucket_id/key so that CRDT state can be compared across merge results.
+/// `MpuPart.version` is fixed to a constant since it is identity data, not CRDT state:
+/// two replicas of the same part (same MpuPartKey) always share the same version UUID.
+/// If deleted, parts are cleared to ensure a valid initial CRDT state.
+fn make_mpu(deleted: bool, parts: Vec<(MpuPartKey, MpuPart)>) -> MultipartUpload {
+	let mut mpu = MultipartUpload::new(
+		[0u8; 32].into(),
+		0,
+		[0u8; 32].into(),
+		String::new(),
+		deleted,
+	);
+	for (key, mut part) in parts {
+		part.version = [0u8; 32].into();
+		mpu.parts.put(key, part);
+	}
+	if mpu.deleted.get() {
+		mpu.parts.clear();
+	}
+	mpu
+}
+
+fuzz_target!(|inputs: (
+	(bool, Vec<(MpuPartKey, MpuPart)>),
+	(bool, Vec<(MpuPartKey, MpuPart)>),
+	(bool, Vec<(MpuPartKey, MpuPart)>)
+)| {
+	let ((d1, p1), (d2, p2), (d3, p3)) = inputs;
+	check_crdt_laws(make_mpu(d1, p1), make_mpu(d2, p2), make_mpu(d3, p3));
+});

fuzz/fuzz_targets/version_crdt.rs

@@ -0,0 +1,42 @@
+#![no_main]
+
+use garage_fuzz::check_crdt_laws;
+use garage_model::s3::version_table::{Version, VersionBacklink, VersionBlock, VersionBlockKey};
+use libfuzzer_sys::fuzz_target;
+
+/// Build a Version from an arbitrary deleted flag and block list, using a fixed uuid/backlink
+/// so that CRDT state can be compared across merge results.
+/// Duplicate block keys are dropped before construction.
+/// If deleted, blocks are cleared to ensure a valid initial CRDT state.
+fn make_version(deleted: bool, mut blocks: Vec<(VersionBlockKey, VersionBlock)>) -> Version {
+	blocks.sort_by_key(|(k, _)| *k);
+	blocks.dedup_by_key(|(k, _)| *k);
+	let mut v = Version::new(
+		[0u8; 32].into(),
+		VersionBacklink::Object {
+			bucket_id: [0u8; 32].into(),
+			key: String::new(),
+		},
+		deleted,
+	);
+	for (key, block) in blocks {
+		v.blocks.put(key, block);
+	}
+	if v.deleted.get() {
+		v.blocks.clear();
+	}
+	v
+}
+
+fuzz_target!(|inputs: (
+	(bool, Vec<(VersionBlockKey, VersionBlock)>),
+	(bool, Vec<(VersionBlockKey, VersionBlock)>),
+	(bool, Vec<(VersionBlockKey, VersionBlock)>)
+)| {
+	let ((d1, b1), (d2, b2), (d3, b3)) = inputs;
+	check_crdt_laws(
+		make_version(d1, b1),
+		make_version(d2, b2),
+		make_version(d3, b3),
+	);
+});

fuzz/rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "nightly"

fuzz/src/lib.rs

@@ -0,0 +1,56 @@
+use garage_table::crdt::Crdt;
+use std::fmt::Debug;
+
+pub fn check_crdt_laws<T>(a: T, b: T, c: T)
+where
+	T: Crdt + PartialEq + Clone + Debug,
+{
+	// Idempotency: merge(a, a) == a
+	{
+		let mut a2 = a.clone();
+		a2.merge(&a);
+		assert_eq!(a2, a, "merge is not idempotent: {a2:#?} != {a:#?}");
+	}
+
+	// Commutativity: merge(a, b) == merge(b, a)
+	let ab = {
+		let mut t = a.clone();
+		t.merge(&b);
+		t
+	};
+	let ba = {
+		let mut t = b.clone();
+		t.merge(&a);
+		t
+	};
+	assert_eq!(ab, ba, "merge is not commutative: {ab:#?} != {ba:#?}");
+
+	// LX's corrolary: merge(merge(a,b),b) = merge(a,b)
+	let ab_b = {
+		let mut t = ab.clone();
+		t.merge(&b);
+		t
+	};
+	assert_eq!(ab, ab_b);
+
+	// Associativity: merge(merge(a, b), c) == merge(a, merge(b, c))
+	let ab_c = {
+		let mut t = ab;
+		t.merge(&c);
+		t
+	};
+	let bc = {
+		let mut t = b;
+		t.merge(&c);
+		t
+	};
+	let a_bc = {
+		let mut t = a;
+		t.merge(&bc);
+		t
+	};
+	assert_eq!(
+		ab_c, a_bc,
+		"merge is not associative: {ab_c:#?} != {a_bc:#?}"
+	);
+}

nix/compile.nix

@@ -48,7 +48,7 @@ let
 
   inherit (pkgs) lib stdenv;
 
-  toolchainFn = (p: p.rust-bin.stable."1.91.0".default.override {
+  toolchainFn = (p: p.rust-bin.stable."1.95.0".default.override {
     targets = lib.optionals (target != null) [ rustTarget ];
     extensions = [
       "rust-src"
@@ -148,6 +148,14 @@ let
 in rec {
   toolchain = toolchainFn pkgs;
 
+  toolchainNightly = pkgs.rust-bin.selectLatestNightlyWith (toolchain: toolchain.default.override {
+    targets = lib.optionals (target != null) [ rustTarget ];
+    extensions = [
+      "rust-src"
+      "rustfmt"
+    ];
+  });
+
   devShell = pkgs.mkShell {
     buildInputs = [
       toolchain

script/helm/garage/README.md

@@ -33,11 +33,14 @@ S3-compatible object store for small self-hosted geo-distributed deployments
 | garage.replicationFactor | string | `"3"` | Default to 3 replicas, see the replication_factor section at https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#replication_factor |
 | garage.consistencyMode | string | `"consistent"` | Default to read-after-write consistency, see the consistency_mode section at https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#consistency_mode |
 | garage.metadataAutoSnapshotInterval | string | `""` | If this value is set, Garage will automatically take a snapshot of the metadata DB file at a regular interval and save it in the metadata directory. https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#metadata_auto_snapshot_interval |
+| garage.admin.apiBindAddr | string | `"[::]:3903"` |  |
 | garage.rpcBindAddr | string | `"[::]:3901"` |  |
 | garage.rpcSecret | string | `""` | If not given, a random secret will be generated and stored in a Secret object |
+| garage.s3.api.bindAddr | string | `"[::]:3900"` |  |
 | garage.s3.api.region | string | `"garage"` |  |
 | garage.s3.api.rootDomain | string | `".s3.garage.tld"` |  |
 | garage.s3.web.index | string | `"index.html"` |  |
+| garage.s3.web.bindAddr | string | `"[::]:3902"` |  |
 | garage.s3.web.rootDomain | string | `".web.garage.tld"` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"dxflrs/amd64_garage"` | default to amd64 docker image |

script/helm/garage/templates/_helpers.tpl

@@ -71,6 +71,13 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{/*
+Extract the trailing port number from a bind address like [::]:3900 or 0.0.0.0:3900.
+*/}}
+{{- define "garage.portFromBindAddr" -}}
+{{- regexFind "[0-9]+$" . -}}
+{{- end }}
+
 {{/*
     Returns given number of random Hex characters.
     In practice, it generates up to 100 randAlphaNum strings

script/helm/garage/templates/configmap.yaml

@@ -45,16 +45,16 @@ data:
 
     [s3_api]
     s3_region = "{{ .Values.garage.s3.api.region }}"
-    api_bind_addr = "[::]:3900"
+    api_bind_addr = "{{ .Values.garage.s3.api.bindAddr }}"
     root_domain = "{{ .Values.garage.s3.api.rootDomain }}"
 
     [s3_web]
-    bind_addr = "[::]:3902"
+    bind_addr = "{{ .Values.garage.s3.web.bindAddr }}"
     root_domain = "{{ .Values.garage.s3.web.rootDomain }}"
     index = "{{ .Values.garage.s3.web.index }}"
 
     [admin]
-    api_bind_addr = "[::]:3903"
+    api_bind_addr = "{{ .Values.garage.admin.apiBindAddr }}"
     {{- if .Values.monitoring.tracing.sink }}
     trace_sink = "{{ .Values.monitoring.tracing.sink }}"
     {{- end }}

script/helm/garage/templates/service-headless.yaml

@@ -10,11 +10,11 @@ spec:
   clusterIP: None
   ports:
     - port: {{ .Values.service.s3.api.port }}
-      targetPort: 3900
+      targetPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.api.bindAddr | int }}
       protocol: TCP
       name: s3-api
     - port: {{ .Values.service.s3.web.port }}
-      targetPort: 3902
+      targetPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.web.bindAddr | int }}
       protocol: TCP
       name: s3-web
   selector:

script/helm/garage/templates/service.yaml

@@ -12,11 +12,11 @@ spec:
   type: {{ .Values.service.type }}
   ports:
     - port: {{ .Values.service.s3.api.port }}
-      targetPort: 3900
+      targetPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.api.bindAddr | int }}
       protocol: TCP
       name: s3-api
     - port: {{ .Values.service.s3.web.port }}
-      targetPort: 3902
+      targetPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.web.bindAddr | int }}
       protocol: TCP
       name: s3-web
   selector:
@@ -35,8 +35,8 @@ spec:
   type: ClusterIP
   clusterIP: None
   ports:
-    - port: 3903
+    - port: {{ include "garage.portFromBindAddr" .Values.garage.admin.apiBindAddr | int }}
-      targetPort: 3903
+      targetPort: {{ include "garage.portFromBindAddr" .Values.garage.admin.apiBindAddr | int }}
       protocol: TCP
       name: metrics
   selector:

script/helm/garage/templates/workload.yaml

@@ -60,11 +60,11 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
-            - containerPort: 3900
+            - containerPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.api.bindAddr | int }}
               name: s3-api
-            - containerPort: 3902
+            - containerPort: {{ include "garage.portFromBindAddr" .Values.garage.s3.web.bindAddr | int }}
               name: web-api
-            - containerPort: 3903
+            - containerPort: {{ include "garage.portFromBindAddr" .Values.garage.admin.apiBindAddr | int }}
               name: admin
           {{- with .Values.environment }}
           env:

script/helm/garage/values.yaml

@@ -48,11 +48,15 @@ garage:
   kubernetesSkipCrd: false
   s3:
     api:
+      bindAddr: "[::]:3900"
       region: "garage"
       rootDomain: ".s3.garage.tld"
     web:
+      bindAddr: "[::]:3902"
       rootDomain: ".web.garage.tld"
       index: "index.html"
+  admin:
+    apiBindAddr: "[::]:3903"
 
   # -- Additional configuration to append to garage.toml. Use a multi-line string for custom config.
   # Example:
@@ -221,14 +225,14 @@ resources: {}
 livenessProbe: {}
   #httpGet:
   #  path: /health
-  #  port: 3903
+  #  port: 3903 # or the port from garage.admin.apiBindAddr
   #initialDelaySeconds: 5
   #periodSeconds: 30
 # -- Specifies a readinessProbe
 readinessProbe: {}
   #httpGet:
   #  path: /health
-  #  port: 3903
+  #  port: 3903 # or the port from garage.admin.apiBindAddr
   #initialDelaySeconds: 5
   #periodSeconds: 30
 

src/api/admin/admin_token.rs

@@ -7,6 +7,7 @@ use garage_util::time::now_msec;
 
 use garage_model::admin_token_table::*;
 use garage_model::garage::Garage;
+use garage_model::permission::ExpirationTime;
 
 use crate::api::*;
 use crate::error::*;
@@ -244,8 +245,8 @@ fn admin_token_info_results(token: &AdminApiToken, now: u64) -> GetAdminTokenInf
 				.expect("invalid timestamp stored in db"),
 		),
 		name: params.name.get().to_string(),
-		expiration: params.expiration.get().map(|x| {
+		expiration: params.expiration.get().inner().map(|x| {
-			DateTime::from_timestamp_millis(x as i64).expect("invalid timestamp stored in db")
+			DateTime::from_timestamp_millis(x.0 as i64).expect("invalid timestamp stored in db")
 		}),
 		expired: params.is_expired(now),
 		scope: params.scope.get().0.clone(),
@@ -279,10 +280,10 @@ fn apply_token_updates(
 	if let Some(expiration) = updates.expiration {
 		params
 			.expiration
-			.update(Some(expiration.timestamp_millis() as u64));
+			.update(Some(ExpirationTime(expiration.timestamp_millis() as u64)).into());
 	}
 	if updates.never_expires {
-		params.expiration.update(None);
+		params.expiration.update(None.into());
 	}
 	if let Some(scope) = updates.scope {
 		params.scope.update(AdminApiTokenScope(scope));

src/api/admin/api.rs

@@ -618,6 +618,10 @@ pub enum PreviewClusterLayoutChangesResponse {
 		/// Plain-text information about the layout computation
 		/// (do not try to parse this)
 		message: Vec<String>,
+		/// Structured statistics about the layout computation
+		// FIXME for v3: remove default and skip_serializing_if
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		statistics: Option<Box<garage_rpc::layout::ComputationStat>>,
 		/// Details about the new cluster layout
 		new_layout: GetClusterLayoutResponse,
 	},
@@ -639,6 +643,10 @@ pub struct ApplyClusterLayoutResponse {
 	/// Plain-text information about the layout computation
 	/// (do not try to parse this)
 	pub message: Vec<String>,
+	/// Structured statistics about the layout computation
+	// FIXME for v3: remove default and skip_serializing_if
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub statistics: Option<garage_rpc::layout::ComputationStat>,
 	/// Details about the new cluster layout
 	pub layout: GetClusterLayoutResponse,
 }
@@ -1165,6 +1173,29 @@ pub struct LocalGetNodeInfoResponse {
 	pub rust_version: String,
 	/// database engine used for metadata
 	pub db_engine: String,
+	// FIXME for v3: remove Option<> and serde(default) for field below
+	// FIXME for v3: merge LocalGetNodeInfoResponse and NodeResp
+	/// Socket address used by other nodes to connect to this node for RPC
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	#[schema(value_type = Option<String>)]
+	pub addr: Option<SocketAddr>,
+	/// Whether this node is connected in the cluster
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub is_up: Option<bool>,
+	/// Role assigned to this node in the current cluster layout
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub role: Option<NodeAssignedRole>,
+	/// Whether this node is part of an older layout version and is draining data.
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub draining: Option<bool>,
+	/// Total and available space on the disk partition(s) containing the data
+	/// directory(ies)
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub data_partition: Option<FreeSpaceResp>,
+	/// Total and available space on the disk partition containing the
+	/// metadata directory
+	#[serde(default, skip_serializing_if = "Option::is_none")]
+	pub metadata_partition: Option<FreeSpaceResp>,
 }
 
 // ---- GetNodeStatistics ----

src/api/admin/bucket.rs

@@ -90,7 +90,7 @@ impl RequestHandler for GetBucketInfoRequest {
 				.bucket_alias_table
 				.get(&EmptyKey, &ga)
 				.await?
-				.and_then(|x| *x.state.get())
+				.and_then(|x| x.state.get().into_inner())
 				.ok_or_else(|| HelperError::NoSuchBucket(ga.to_string()))?,
 			(None, None, Some(search)) => {
 				let helper = garage.bucket_helper();
@@ -168,7 +168,7 @@ impl RequestHandler for CreateBucketRequest {
 			}
 
 			if let Some(alias) = garage.bucket_alias_table.get(&EmptyKey, ga).await? {
-				if alias.state.get().is_some() {
+				if alias.state.get().inner().is_some() {
 					return Err(CommonError::BucketAlreadyExists.into());
 				}
 			}
@@ -297,7 +297,7 @@ impl RequestHandler for UpdateBucketRequest {
 				let redirect_all = state
 					.website_config
 					.get()
-					.as_ref()
+					.inner()
 					.and_then(|wc| wc.redirect_all.clone());
 
 				let routing_rules = if let Some(rr) = wa.routing_rules {
@@ -311,26 +311,29 @@ impl RequestHandler for UpdateBucketRequest {
 					state
 						.website_config
 						.get()
-						.as_ref()
+						.inner()
 						.map(|wc| wc.routing_rules.clone())
 						.unwrap_or_default()
 				};
 
-				state.website_config.update(Some(WebsiteConfig {
+				state.website_config.update(
-					index_document: wa.index_document.ok_or_bad_request(
+					Some(WebsiteConfig {
-						"Please specify indexDocument when enabling website access.",
+						index_document: wa.index_document.ok_or_bad_request(
-					)?,
+							"Please specify indexDocument when enabling website access.",
-					error_document: wa.error_document,
+						)?,
-					redirect_all,
+						error_document: wa.error_document,
-					routing_rules,
+						redirect_all,
-				}));
+						routing_rules,
+					})
+					.into(),
+				);
 			} else {
 				if wa.index_document.is_some() || wa.error_document.is_some() {
 					return Err(Error::bad_request(
                         "Cannot specify indexDocument or errorDocument when disabling website access.",
                     ));
 				}
-				state.website_config.update(None);
+				state.website_config.update(None.into());
 			}
 		}
 
@@ -353,7 +356,7 @@ impl RequestHandler for UpdateBucketRequest {
 				Some(cc.into_garage_cors_config()?)
 			};
 
-			state.cors_config.update(cors_config);
+			state.cors_config.update(cors_config.into());
 		}
 
 		if let Some(lr) = self.body.lifecycle_rules {
@@ -370,7 +373,7 @@ impl RequestHandler for UpdateBucketRequest {
 				)
 			};
 
-			state.lifecycle_config.update(lifecycle_config);
+			state.lifecycle_config.update(lifecycle_config.into());
 		}
 
 		garage.bucket_table.insert(&bucket).await?;
@@ -687,45 +690,36 @@ async fn bucket_info_results(
 		.map(|x| x.filtered_values(&garage.system.cluster_layout()))
 		.unwrap_or_default();
 
-	let mut relevant_keys = HashMap::new();
+	let state = bucket.state.as_option().unwrap();
-	for (k, _) in bucket
+
-		.state
+	let keys1 = state
-		.as_option()
-		.unwrap()
 		.authorized_keys
 		.items()
 		.iter()
-	{
+		.filter(|(_, p)| p.is_any())
-		if let Some(key) = garage
+		.map(|(k, _)| k);
-			.key_table
+	let keys2 = state
-			.get(&EmptyKey, k)
-			.await?
-			.filter(|k| !k.is_deleted())
-		{
-			if !key.state.is_deleted() {
-				relevant_keys.insert(k.clone(), key);
-			}
-		}
-	}
-	for ((k, _), _, _) in bucket
-		.state
-		.as_option()
-		.unwrap()
 		.local_aliases
 		.items()
 		.iter()
-	{
+		.filter(|(_, _, p)| *p)
-		if relevant_keys.contains_key(k) {
+		.map(|((k, _), _, _)| k);
+
+	let mut relevant_keys = HashMap::new();
+	for key_id in keys1.chain(keys2) {
+		if relevant_keys.contains_key(key_id) {
 			continue;
 		}
-		if let Some(key) = garage.key_table.get(&EmptyKey, k).await? {
+		if let Some(key) = garage.key_table.get(&EmptyKey, key_id).await? {
-			if !key.state.is_deleted() {
+			relevant_keys.insert(key_id.clone(), key);
-				relevant_keys.insert(k.clone(), key);
+		} else {
-			}
+			warn!(
+				"Bucket {:?} references non-existent key {}",
+				bucket.id, key_id
+			);
 		}
 	}
-
+	relevant_keys.retain(|_, k| !k.is_deleted());
-	let state = bucket.state.as_option().unwrap();
 
 	let quotas = state.quotas.get();
 	let res = GetBucketInfoResponse {
@@ -739,8 +733,8 @@ async fn bucket_info_results(
 			.filter(|(_, _, a)| *a)
 			.map(|(n, _, _)| n.to_string())
 			.collect::<Vec<_>>(),
-		website_access: state.website_config.get().is_some(),
+		website_access: state.website_config.get().inner().is_some(),
-		website_config: state.website_config.get().clone().map(|wsc| {
+		website_config: state.website_config.get().inner().cloned().map(|wsc| {
 			GetBucketInfoWebsiteResponse {
 				index_document: wsc.index_document,
 				error_document: wsc.error_document,
@@ -752,42 +746,43 @@ async fn bucket_info_results(
 				),
 			}
 		}),
-		cors_rules: state.cors_config.get().as_ref().map(|rules| {
+		cors_rules: state.cors_config.get().inner().map(|rules| {
 			rules
 				.iter()
 				.map(xml::cors::CorsRule::from_garage_cors_rule)
 				.collect::<Vec<_>>()
 		}),
-		lifecycle_rules: state.lifecycle_config.get().as_ref().map(|lc| {
+		lifecycle_rules: state.lifecycle_config.get().inner().map(|lc| {
 			lc.iter()
 				.map(xml::lifecycle::LifecycleRule::from_garage_lifecycle_rule)
 				.collect::<Vec<_>>()
 		}),
 		keys: relevant_keys
 			.into_values()
-			.filter_map(|key| {
+			.map(|key| {
-				let p = key.state.as_option().unwrap();
+				let st = key.state.as_option().unwrap();
-				let permissions = p
+				let permissions = st
 					.authorized_buckets
 					.get(&bucket.id)
-					.filter(|p| p.is_any())
 					.map(|p| ApiBucketKeyPerm {
 						read: p.allow_read,
 						write: p.allow_write,
 						owner: p.allow_owner,
-					})?;
+					})
-				Some(GetBucketInfoKey {
+					.unwrap_or_default();
+				let bucket_local_aliases = st
+					.local_aliases
+					.items()
+					.iter()
+					.filter(|(_, _, b)| b.into_inner() == Some(bucket.id))
+					.map(|(n, _, _)| n.to_string())
+					.collect::<Vec<_>>();
+				GetBucketInfoKey {
 					access_key_id: key.key_id,
-					name: p.name.get().to_string(),
+					name: st.name.get().to_string(),
 					permissions,
-					bucket_local_aliases: p
+					bucket_local_aliases,
-						.local_aliases
+				}
-						.items()
-						.iter()
-						.filter(|(_, _, b)| *b == Some(bucket.id))
-						.map(|(n, _, _)| n.to_string())
-						.collect::<Vec<_>>(),
-				})
 			})
 			.collect::<Vec<_>>(),
 		objects: *counters.get(OBJECTS).unwrap_or(&0),

src/api/admin/key.rs

@@ -8,6 +8,7 @@ use garage_util::time::now_msec;
 
 use garage_model::garage::Garage;
 use garage_model::key_table::*;
+use garage_model::permission::ExpirationTime;
 
 use crate::api::*;
 use crate::error::*;
@@ -40,8 +41,8 @@ impl RequestHandler for ListKeysRequest {
 						DateTime::from_timestamp_millis(x as i64)
 							.expect("invalid timestamp stored in db")
 					}),
-					expiration: p.expiration.get().map(|x| {
+					expiration: p.expiration.get().inner().map(|x| {
-						DateTime::from_timestamp_millis(x as i64)
+						DateTime::from_timestamp_millis(x.0 as i64)
 							.expect("invalid timestamp stored in db")
 					}),
 					expired: p.is_expired(now),
@@ -187,38 +188,42 @@ async fn key_info_results(
 	key: Key,
 	show_secret: bool,
 ) -> Result<GetKeyInfoResponse, Error> {
-	let mut relevant_buckets = HashMap::new();
-
 	let key_state = key.state.as_option().unwrap();
 
-	for id in key_state
+	let buckets1 = key_state
 		.authorized_buckets
 		.items()
 		.iter()
-		.map(|(id, _)| id)
+		.filter(|(_, p)| p.is_any())
-		.chain(
+		.map(|(id, _)| id);
-			key_state
+	let buckets2 = key_state
-				.local_aliases
+		.local_aliases
-				.items()
+		.items()
-				.iter()
+		.iter()
-				.filter_map(|(_, _, v)| v.as_ref()),
+		.filter_map(|(_, _, v)| v.inner());
-		) {
+
-		if !relevant_buckets.contains_key(id) {
+	let mut relevant_buckets = HashMap::new();
-			if let Some(b) = garage.bucket_table.get(&EmptyKey, id).await? {
+	for bucket_id in buckets1.chain(buckets2) {
-				if b.state.as_option().is_some() {
+		if !relevant_buckets.contains_key(bucket_id) {
-					relevant_buckets.insert(*id, b);
+			if let Some(b) = garage.bucket_table.get(&EmptyKey, bucket_id).await? {
-				}
+				relevant_buckets.insert(*bucket_id, b);
+			} else {
+				warn!(
+					"Key {} references non-existent bucket {:?}",
+					key.key_id, bucket_id
+				);
 			}
 		}
 	}
+	relevant_buckets.retain(|_, b| !b.is_deleted());
 
 	let res = GetKeyInfoResponse {
 		name: key_state.name.get().clone(),
 		created: key_state.created.map(|x| {
 			DateTime::from_timestamp_millis(x as i64).expect("invalid timestamp stored in db")
 		}),
-		expiration: key_state.expiration.get().map(|x| {
+		expiration: key_state.expiration.get().inner().map(|x| {
-			DateTime::from_timestamp_millis(x as i64).expect("invalid timestamp stored in db")
+			DateTime::from_timestamp_millis(x.0 as i64).expect("invalid timestamp stored in db")
 		}),
 		expired: key_state.is_expired(now_msec()),
 		access_key_id: key.key_id.clone(),
@@ -232,7 +237,7 @@ async fn key_info_results(
 		},
 		buckets: relevant_buckets
 			.into_values()
-			.filter_map(|bucket| {
+			.map(|bucket| {
 				let state = bucket.state.as_option().unwrap();
 				let permissions = key_state
 					.authorized_buckets
@@ -242,8 +247,9 @@ async fn key_info_results(
 						read: p.allow_read,
 						write: p.allow_write,
 						owner: p.allow_owner,
-					})?;
+					})
-				Some(KeyInfoBucketResponse {
+					.unwrap_or_default();
+				KeyInfoBucketResponse {
 					id: hex::encode(bucket.id),
 					global_aliases: state
 						.aliases
@@ -260,7 +266,7 @@ async fn key_info_results(
 						.map(|((_, n), _, _)| n.to_string())
 						.collect::<Vec<_>>(),
 					permissions,
-				})
+				}
 			})
 			.collect::<Vec<_>>(),
 	};
@@ -283,10 +289,10 @@ fn apply_key_updates(key: &mut Key, updates: UpdateKeyRequestBody) -> Result<(),
 	if let Some(expiration) = updates.expiration {
 		key_state
 			.expiration
-			.update(Some(expiration.timestamp_millis() as u64));
+			.update(Some(ExpirationTime(expiration.timestamp_millis() as u64)).into());
 	}
 	if updates.never_expires {
-		key_state.expiration.update(None);
+		key_state.expiration.update(None.into());
 	}
 	if let Some(allow) = updates.allow {
 		if allow.create_bucket {

src/api/admin/layout.rs

@@ -53,7 +53,7 @@ fn format_cluster_layout(layout: &layout::LayoutHistory) -> GetClusterLayoutResp
 		.roles
 		.items()
 		.iter()
-		.filter(|(k, _, v)| current.roles.get(k) != Some(v))
+		.filter(|(k, _, v)| current.roles.get(k).and_then(|vv| vv.0.as_ref()) != v.0.as_ref())
 		.map(|(k, _, v)| match &v.0 {
 			None => NodeRoleChange {
 				id: hex::encode(k),
@@ -255,10 +255,14 @@ impl RequestHandler for PreviewClusterLayoutChangesRequest {
 				Ok(PreviewClusterLayoutChangesResponse::Error { error })
 			}
 			Err(e) => Err(e.into()),
-			Ok((new_layout, msg)) => Ok(PreviewClusterLayoutChangesResponse::Success {
+			Ok((new_layout, stat)) => {
-				message: msg,
+				let message = stat.to_message();
-				new_layout: format_cluster_layout(&new_layout),
+				Ok(PreviewClusterLayoutChangesResponse::Success {
-			}),
+					message,
+					statistics: Some(Box::new(stat)),
+					new_layout: format_cluster_layout(&new_layout),
+				})
+			}
 		}
 	}
 }
@@ -272,7 +276,8 @@ impl RequestHandler for ApplyClusterLayoutRequest {
 		_admin: &Admin,
 	) -> Result<ApplyClusterLayoutResponse, Error> {
 		let layout = garage.system.cluster_layout().inner().clone();
-		let (layout, msg) = layout.apply_staged_changes(self.version)?;
+		let (layout, stat) = layout.apply_staged_changes(self.version)?;
+		let message = stat.to_message();
 
 		garage
 			.system
@@ -281,7 +286,8 @@ impl RequestHandler for ApplyClusterLayoutRequest {
 			.await?;
 
 		Ok(ApplyClusterLayoutResponse {
-			message: msg,
+			message,
+			statistics: Some(stat),
 			layout: format_cluster_layout(&layout),
 		})
 	}

src/api/admin/node.rs

@@ -25,6 +25,9 @@ impl RequestHandler for LocalGetNodeInfoRequest {
 		let sys_status = garage.system.local_status();
 		let hostname = sys_status.hostname.unwrap_or_default().to_string();
 
+		let layout = garage.system.cluster_layout();
+		let current_layout = layout.inner().current();
+
 		Ok(LocalGetNodeInfoResponse {
 			node_id: hex::encode(garage.system.id),
 			hostname: Some(hostname),
@@ -33,6 +36,41 @@ impl RequestHandler for LocalGetNodeInfoRequest {
 				.map(|features| features.iter().map(ToString::to_string).collect()),
 			rust_version: garage_util::version::rust_version().to_string(),
 			db_engine: garage.db.engine(),
+			is_up: Some(true),
+			addr: garage
+				.system
+				.get_known_nodes()
+				.iter()
+				.find(|x| x.id == garage.system.id)
+				.and_then(|x| x.addr),
+			draining: Some(
+				current_layout.node_role(&garage.system.id).is_none()
+					&& layout
+						.inner()
+						.versions
+						.iter()
+						.filter(|x| x.version != current_layout.version)
+						.any(|x| x.node_role(&garage.system.id).is_some()),
+			),
+			role: current_layout
+				.node_role(&garage.system.id)
+				.map(|v| NodeAssignedRole {
+					zone: v.zone.clone(),
+					capacity: v.capacity,
+					tags: v.tags.clone(),
+				}),
+			data_partition: sys_status
+				.data_disk_avail
+				.map(|(avail, total)| FreeSpaceResp {
+					available: avail,
+					total,
+				}),
+			metadata_partition: sys_status
+				.meta_disk_avail
+				.map(|(avail, total)| FreeSpaceResp {
+					available: avail,
+					total,
+				}),
 		})
 	}
 }

src/api/admin/repair.rs

@@ -360,14 +360,7 @@ impl Worker for BlockRcRepair {
 		_must_exit: &mut watch::Receiver<bool>,
 	) -> Result<WorkerState, GarageError> {
 		for _i in 0..RC_REPAIR_ITER_COUNT {
-			let next1 = self
+			let next1 = self.block_manager.rc.get_first_hash_from(self.cursor)?;
-				.block_manager
-				.rc
-				.rc_table
-				.range(self.cursor.as_slice()..)?
-				.next()
-				.transpose()?
-				.map(|(k, _)| Hash::try_from(k.as_slice()).unwrap());
 			let next2 = self
 				.block_ref_table
 				.data

src/api/admin/special.rs

@@ -164,7 +164,7 @@ async fn check_domain(garage: &Arc<Garage>, domain: &str) -> Result<bool, Error>
 	}
 
 	let bucket_state = bucket.state.as_option().unwrap();
-	let bucket_website_config = bucket_state.website_config.get();
+	let bucket_website_config = bucket_state.website_config.get().inner();
 
 	match bucket_website_config {
 		Some(_v) => Ok(true),

src/api/common/cors.rs

@@ -1,8 +1,9 @@
 use std::sync::Arc;
 
 use http::header::{
-	ACCESS_CONTROL_ALLOW_HEADERS, ACCESS_CONTROL_ALLOW_METHODS, ACCESS_CONTROL_ALLOW_ORIGIN,
+	HeaderValue, ACCESS_CONTROL_ALLOW_HEADERS, ACCESS_CONTROL_ALLOW_METHODS,
-	ACCESS_CONTROL_EXPOSE_HEADERS, ACCESS_CONTROL_REQUEST_HEADERS, ACCESS_CONTROL_REQUEST_METHOD,
+	ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_EXPOSE_HEADERS, ACCESS_CONTROL_REQUEST_HEADERS,
+	ACCESS_CONTROL_REQUEST_METHOD, VARY,
 };
 use hyper::{body::Body, body::Incoming as IncomingBody, Request, Response, StatusCode};
 
@@ -12,20 +13,25 @@ use garage_model::garage::Garage;
 use crate::common_error::{CommonError, OkOrBadRequest, OkOrInternalError};
 use crate::helpers::*;
 
+// Return both the matching rule and the parsed Origin header so callers that
+// apply CORS headers don't have to repeat Origin lookup and validation.
 pub fn find_matching_cors_rule<'a, B>(
 	bucket_params: &'a BucketParams,
-	req: &Request<B>,
+	req: &'a Request<B>,
-) -> Result<Option<&'a GarageCorsRule>, CommonError> {
+) -> Result<Option<(&'a GarageCorsRule, &'a str)>, CommonError> {
-	if let Some(cors_config) = bucket_params.cors_config.get() {
+	if let Some(cors_config) = bucket_params.cors_config.get().inner() {
 		if let Some(origin) = req.headers().get("Origin") {
 			let origin = origin.to_str()?;
 			let request_headers = match req.headers().get(ACCESS_CONTROL_REQUEST_HEADERS) {
 				Some(h) => h.to_str()?.split(',').map(|h| h.trim()).collect::<Vec<_>>(),
 				None => vec![],
 			};
-			return Ok(cors_config.iter().find(|rule| {
+			return Ok(cors_config
-				cors_rule_matches(rule, origin, req.method().as_ref(), request_headers.iter())
+				.iter()
-			}));
+				.find(|rule| {
+					cors_rule_matches(rule, origin, req.method().as_ref(), request_headers.iter())
+				})
+				.map(|rule| (rule, origin)));
 		}
 	}
 	Ok(None)
@@ -53,12 +59,16 @@ where
 pub fn add_cors_headers(
 	resp: &mut Response<impl Body>,
 	rule: &GarageCorsRule,
+	request_origin: &str,
 ) -> Result<(), http::header::InvalidHeaderValue> {
 	let h = resp.headers_mut();
-	h.insert(
+	let is_wildcard_origin = rule.allow_origins.iter().any(|origin| origin == "*");
-		ACCESS_CONTROL_ALLOW_ORIGIN,
+	let allow_origin = if is_wildcard_origin {
-		rule.allow_origins.join(", ").parse()?,
+		"*"
-	);
+	} else {
+		request_origin
+	};
+	h.insert(ACCESS_CONTROL_ALLOW_ORIGIN, allow_origin.parse()?);
 	h.insert(
 		ACCESS_CONTROL_ALLOW_METHODS,
 		rule.allow_methods.join(", ").parse()?,
@@ -71,6 +81,12 @@ pub fn add_cors_headers(
 		ACCESS_CONTROL_EXPOSE_HEADERS,
 		rule.expose_headers.join(", ").parse()?,
 	);
+	// When ACAO reflects the request origin instead of returning "*",
+	// caches must vary on the Origin request header to avoid reusing
+	// a response generated for one origin when serving another origin.
+	if !is_wildcard_origin {
+		h.insert(VARY, HeaderValue::from_static("Origin"));
+	}
 	Ok(())
 }
 
@@ -107,6 +123,7 @@ pub fn handle_options_api(
 			Ok(Response::builder()
 				.header(ACCESS_CONTROL_ALLOW_ORIGIN, "*")
 				.header(ACCESS_CONTROL_ALLOW_METHODS, "*")
+				.header(ACCESS_CONTROL_ALLOW_HEADERS, "*")
 				.status(StatusCode::OK)
 				.body(EmptyBody::new())?)
 		}
@@ -141,7 +158,7 @@ pub fn handle_options_for_bucket<B>(
 		None => vec![],
 	};
 
-	if let Some(cors_config) = bucket_params.cors_config.get() {
+	if let Some(cors_config) = bucket_params.cors_config.get().inner() {
 		let matching_rule = cors_config
 			.iter()
 			.find(|rule| cors_rule_matches(rule, origin, request_method, request_headers.iter()));
@@ -149,7 +166,17 @@ pub fn handle_options_for_bucket<B>(
 			let mut resp = Response::builder()
 				.status(StatusCode::OK)
 				.body(EmptyBody::new())?;
-			add_cors_headers(&mut resp, rule).ok_or_internal_error("Invalid CORS configuration")?;
+			add_cors_headers(&mut resp, rule, origin)
+				.ok_or_internal_error("Invalid CORS configuration")?;
+			// Preflight responses vary not only on Origin but also on the
+			// requested method and requested headers, so caches must not
+			// reuse one preflight decision for a different preflight input.
+			resp.headers_mut().insert(
+				VARY,
+				"Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+					.parse()
+					.expect("static vary header"),
+			);
 			return Ok(resp);
 		}
 	}
@@ -158,3 +185,101 @@ pub fn handle_options_for_bucket<B>(
 		"This CORS request is not allowed.".into(),
 	))
 }
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	fn bucket_params_with_rule(allow_origins: Vec<&str>) -> BucketParams {
+		let mut bucket_params = BucketParams::default();
+		bucket_params.cors_config.update(
+			Some(vec![GarageCorsRule {
+				id: Some("cors-test".into()),
+				max_age_seconds: None,
+				allow_origins: allow_origins.into_iter().map(str::to_string).collect(),
+				allow_methods: vec!["GET".into(), "PUT".into()],
+				allow_headers: vec!["*".into()],
+				expose_headers: vec![],
+			}])
+			.into(),
+		);
+		bucket_params
+	}
+
+	fn preflight_request(origin: &str) -> Request<()> {
+		Request::builder()
+			.method("OPTIONS")
+			.uri("http://example.test/bucket")
+			.header("Origin", origin)
+			.header(ACCESS_CONTROL_REQUEST_METHOD, "PUT")
+			.body(())
+			.unwrap()
+	}
+
+	#[test]
+	fn preflight_with_single_allowed_origin_returns_request_origin() {
+		let bucket_params = bucket_params_with_rule(vec!["https://app.example.test"]);
+		let req = preflight_request("https://app.example.test");
+
+		let resp = handle_options_for_bucket(&req, &bucket_params).unwrap();
+
+		assert_eq!(
+			resp.headers().get(ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(),
+			"https://app.example.test"
+		);
+		let vary_values: Vec<_> = resp
+			.headers()
+			.get_all(VARY)
+			.iter()
+			.map(|value| value.to_str().unwrap())
+			.collect();
+		assert_eq!(
+			vary_values,
+			vec!["Origin, Access-Control-Request-Method, Access-Control-Request-Headers",]
+		);
+	}
+
+	#[test]
+	fn preflight_with_multiple_allowed_origins_reflects_request_origin() {
+		let bucket_params = bucket_params_with_rule(vec![
+			"https://app.example.test",
+			"https://admin.example.test",
+		]);
+		let req = preflight_request("https://app.example.test");
+
+		let resp = handle_options_for_bucket(&req, &bucket_params).unwrap();
+
+		// This assertion documents the behavior browsers expect:
+		// even if multiple origins are allowed by configuration, the
+		// response should reflect the request origin rather than emit
+		// a comma-separated list. It currently fails and is meant to
+		// turn green once header generation is corrected.
+		assert_eq!(
+			resp.headers().get(ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(),
+			"https://app.example.test"
+		);
+	}
+
+	#[test]
+	fn preflight_with_wildcard_allowed_origin_returns_wildcard() {
+		let bucket_params = bucket_params_with_rule(vec!["*"]);
+		let req = preflight_request("https://app.example.test");
+
+		let resp = handle_options_for_bucket(&req, &bucket_params).unwrap();
+
+		assert_eq!(
+			resp.headers().get(ACCESS_CONTROL_ALLOW_ORIGIN).unwrap(),
+			"*"
+		);
+		let vary_values: Vec<_> = resp
+			.headers()
+			.get_all(VARY)
+			.iter()
+			.map(|value| value.to_str().unwrap())
+			.collect();
+		assert_eq!(
+			vary_values,
+			vec!["Origin, Access-Control-Request-Method, Access-Control-Request-Headers",]
+		);
+	}
+}

src/api/common/signature/payload.rs

@@ -357,7 +357,13 @@ pub fn canonical_request(
 		items.join("&")
 	};
 
-	// Canonical header string calculated from signed headers
+	// Canonical header string calculated from signed headers.
+	//
+	// Per the SigV4 spec, signed header values must have sequential
+	// internal whitespace collapsed to a single space, in addition to
+	// being trimmed. AWS SDKs do this before computing the signature
+	// but transmit the raw value on the wire, so we must match.
+	// -> https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html
 	let canonical_header_string = signed_headers
 		.iter()
 		.map(|name| {
@@ -372,7 +378,11 @@ pub fn canonical_request(
 				built_string.push(',');
 				built_string.push_str(extend_string);
 			}
-			Ok(format!("{}:{}", name.as_str(), built_string.trim()))
+			let normalized = built_string
+				.split_whitespace()
+				.collect::<Vec<_>>()
+				.join(" ");
+			Ok(format!("{}:{}", name.as_str(), normalized))
 		})
 		.collect::<Result<Vec<String>, Error>>()?
 		.join("\n");

src/api/k2v/api_server.rs

@@ -111,7 +111,7 @@ impl ApiHandler for K2VApiServer {
 			Method::GET | Method::HEAD | Method::POST => {
 				find_matching_cors_rule(&bucket_params, &req)
 					.ok_or_internal_error("Error looking up CORS rule")?
-					.cloned()
+					.map(|(rule, origin)| (rule.clone(), origin.to_string()))
 			}
 			_ => None,
 		};
@@ -164,8 +164,8 @@ impl ApiHandler for K2VApiServer {
 		// If request was a success and we have a CORS rule that applies to it,
 		// add the corresponding CORS headers to the response
 		let mut resp_ok = resp?;
-		if let Some(rule) = matching_cors_rule {
+		if let Some((rule, origin)) = matching_cors_rule {
-			add_cors_headers(&mut resp_ok, &rule)
+			add_cors_headers(&mut resp_ok, &rule, &origin)
 				.ok_or_internal_error("Invalid bucket CORS configuration")?;
 		}
 

src/api/k2v/batch.rs

@@ -5,12 +5,13 @@ use serde::{Deserialize, Serialize};
 use garage_table::{EnumerationOrder, TableSchema};
 
 use garage_model::k2v::item_table::*;
+use garage_model::k2v::rpc::K2VMonotonicRead;
 
 use garage_api_common::helpers::*;
 
 use crate::api_server::{ReqBody, ResBody};
 use crate::error::*;
-use crate::item::parse_causality_token;
+use crate::item::{is_monotonic_read, parse_causality_token};
 use crate::range::read_range;
 
 pub async fn handle_insert_batch(
@@ -47,12 +48,13 @@ pub async fn handle_read_batch(
 	ctx: ReqCtx,
 	req: Request<ReqBody>,
 ) -> Result<Response<ResBody>, Error> {
+	let monotonic_read = is_monotonic_read(&req)?;
 	let queries = req.into_body().json::<Vec<ReadBatchQuery>>().await?;
 
 	let resp_results = futures::future::join_all(
 		queries
 			.into_iter()
-			.map(|q| handle_read_batch_query(&ctx, q)),
+			.map(|q| handle_read_batch_query(&ctx, q, monotonic_read)),
 	)
 	.await;
 
@@ -67,6 +69,7 @@ pub async fn handle_read_batch(
 async fn handle_read_batch_query(
 	ctx: &ReqCtx,
 	query: ReadBatchQuery,
+	monotonic_read: K2VMonotonicRead,
 ) -> Result<ReadBatchResponse, Error> {
 	let ReqCtx {
 		garage, bucket_id, ..
@@ -90,12 +93,13 @@ async fn handle_read_batch_query(
 			.start
 			.as_ref()
 			.ok_or_bad_request("start should be specified if single_item is set")?;
-		let item = garage
+		let item = match monotonic_read {
-			.k2v
+			K2VMonotonicRead::Monotonic => {
-			.item_table
+				garage.k2v.item_table.get_monotonic(&partition, sk).await?
-			.get(&partition, sk)
+			}
-			.await?
+			K2VMonotonicRead::NonMonotonic => garage.k2v.item_table.get(&partition, sk).await?,
-			.filter(|e| K2VItemTable::matches_filter(e, &filter));
+		}
+		.filter(|e| K2VItemTable::matches_filter(e, &filter));
 		match item {
 			Some(i) => (vec![ReadBatchResponseItem::from(i)], false, None),
 			None => (vec![], false, None),
@@ -110,6 +114,7 @@ async fn handle_read_batch_query(
 			query.limit,
 			Some(filter),
 			EnumerationOrder::from_reverse(query.reverse),
+			monotonic_read,
 		)
 		.await?;
 
@@ -218,6 +223,7 @@ async fn handle_delete_batch_query(
 			None,
 			Some(filter),
 			EnumerationOrder::Forward,
+			K2VMonotonicRead::NonMonotonic,
 		)
 		.await?;
 		assert!(!more);
@@ -260,6 +266,7 @@ pub(crate) async fn handle_poll_range(
 	let ReqCtx {
 		garage, bucket_id, ..
 	} = ctx;
+	let monotonic_read = is_monotonic_read(&req)?;
 	use garage_model::k2v::sub::PollRange;
 
 	let query = req.into_body().json::<PollRangeQuery>().await?;
@@ -281,6 +288,7 @@ pub(crate) async fn handle_poll_range(
 			},
 			query.seen_marker,
 			timeout_msec,
+			monotonic_read,
 		)
 		.await
 		.map_err(pass_helper_error)?;

src/api/k2v/error.rs

@@ -44,6 +44,10 @@ pub enum Error {
 	#[error("Invalid causality token")]
 	InvalidCausalityToken,
 
+	/// Invalid parameter for x-garage-non-monotonic-read
+	#[error("Invalid X-Garage-Non-Monotonic-Read value: {0}")]
+	InvalidNonMonotonicRead(String),
+
 	/// The client asked for an invalid return format (invalid Accept header)
 	#[error("Not acceptable: {0}")]
 	NotAcceptable(String),
@@ -85,6 +89,7 @@ impl Error {
 			Error::InvalidBase64(_) => "InvalidBase64",
 			Error::InvalidUtf8Str(_) => "InvalidUtf8String",
 			Error::InvalidCausalityToken => "CausalityToken",
+			Error::InvalidNonMonotonicRead(_) => "InvalidNonMonotonicRead",
 			Error::InvalidDigest(_) => "InvalidDigest",
 		}
 	}
@@ -101,7 +106,8 @@ impl ApiError for Error {
 			| Error::InvalidBase64(_)
 			| Error::InvalidUtf8Str(_)
 			| Error::InvalidDigest(_)
-			| Error::InvalidCausalityToken => StatusCode::BAD_REQUEST,
+			| Error::InvalidCausalityToken
+			| Error::InvalidNonMonotonicRead(_) => StatusCode::BAD_REQUEST,
 		}
 	}
 

src/api/k2v/index.rs

@@ -4,6 +4,7 @@ use serde::Serialize;
 use garage_table::util::*;
 
 use garage_model::k2v::item_table::{BYTES, CONFLICTS, ENTRIES, VALUES};
+use garage_model::k2v::rpc::K2VMonotonicRead;
 
 use garage_api_common::helpers::*;
 
@@ -40,6 +41,7 @@ pub async fn handle_read_index(
 		limit,
 		Some((DeletedFilter::NotDeleted, node_id_vec)),
 		EnumerationOrder::from_reverse(reverse),
+		K2VMonotonicRead::NonMonotonic,
 	)
 	.await?;
 

src/api/k2v/item.rs

@@ -5,6 +5,7 @@ use hyper::{Request, Response, StatusCode};
 
 use garage_model::k2v::causality::*;
 use garage_model::k2v::item_table::*;
+use garage_model::k2v::rpc::K2VMonotonicRead;
 
 use garage_api_common::helpers::*;
 
@@ -12,6 +13,7 @@ use crate::api_server::{ReqBody, ResBody};
 use crate::error::*;
 
 pub const X_GARAGE_CAUSALITY_TOKEN: &str = "X-Garage-Causality-Token";
+pub const X_GARAGE_NON_MONOTONIC_READ: &str = "X-Garage-Non-Monotonic-Read";
 
 pub enum ReturnFormat {
 	Json,
@@ -23,6 +25,21 @@ pub(crate) fn parse_causality_token(s: &str) -> Result<CausalContext, Error> {
 	CausalContext::parse(s).ok_or(Error::InvalidCausalityToken)
 }
 
+pub(crate) fn is_monotonic_read(req: &Request<ReqBody>) -> Result<K2VMonotonicRead, Error> {
+	let v_opt = req
+		.headers()
+		.get(X_GARAGE_NON_MONOTONIC_READ)
+		.map(|s| s.to_str())
+		.transpose()?;
+
+	match v_opt {
+		Some("true") => Ok(K2VMonotonicRead::NonMonotonic),
+		// Reads are monotonic by default
+		Some("false") | None => Ok(K2VMonotonicRead::Monotonic),
+		Some(s) => Err(Error::InvalidNonMonotonicRead(s.to_string())),
+	}
+}
+
 impl ReturnFormat {
 	pub fn from(req: &Request<ReqBody>) -> Result<Self, Error> {
 		let accept = match req.headers().get(header::ACCEPT) {
@@ -108,21 +125,26 @@ pub async fn handle_read_item(
 	let ReqCtx {
 		garage, bucket_id, ..
 	} = &ctx;
-
+	let monotonic_read = is_monotonic_read(req)?;
 	let format = ReturnFormat::from(req)?;
+	let partition_key = K2VItemPartition {
+		bucket_id: *bucket_id,
+		partition_key: partition_key.to_string(),
+	};
 
-	let item = garage
+	let item = match monotonic_read {
-		.k2v
+		K2VMonotonicRead::Monotonic => {
-		.item_table
+			garage
-		.get(
+				.k2v
-			&K2VItemPartition {
+				.item_table
-				bucket_id: *bucket_id,
+				.get_monotonic(&partition_key, sort_key)
-				partition_key: partition_key.to_string(),
+				.await?
-			},
+		}
-			sort_key,
+		K2VMonotonicRead::NonMonotonic => {
-		)
+			garage.k2v.item_table.get(&partition_key, sort_key).await?
-		.await?
+		}
-		.ok_or(Error::NoSuchKey)?;
+	}
+	.ok_or(Error::NoSuchKey)?;
 
 	format.make_response(&item)
 }
@@ -214,6 +236,7 @@ pub async fn handle_poll_item(
 	let ReqCtx {
 		garage, bucket_id, ..
 	} = &ctx;
+	let monotonic_read = is_monotonic_read(req)?;
 	let format = ReturnFormat::from(req)?;
 
 	let causal_context =
@@ -230,6 +253,7 @@ pub async fn handle_poll_item(
 			sort_key,
 			causal_context,
 			timeout_msec,
+			monotonic_read,
 		)
 		.await?;
 

src/api/k2v/range.rs

@@ -4,6 +4,8 @@
 
 use std::sync::Arc;
 
+use garage_model::k2v::rpc::K2VMonotonicRead;
+
 use garage_table::replication::TableShardedReplication;
 use garage_table::*;
 
@@ -23,6 +25,7 @@ pub(crate) async fn read_range<F>(
 	limit: Option<u64>,
 	filter: Option<F::Filter>,
 	enumeration_order: EnumerationOrder,
+	monotonic_read: K2VMonotonicRead,
 ) -> Result<(Vec<F::E>, bool, Option<String>), Error>
 where
 	F: TableSchema<S = String> + 'static,
@@ -53,15 +56,30 @@ where
 			1000,
 			limit.map(|x| x as usize).unwrap_or(usize::MAX - 10) - entries.len() + 2,
 		);
-		let get_ret = table
+		let get_ret = match monotonic_read {
-			.get_range(
+			K2VMonotonicRead::Monotonic => {
-				partition_key,
+				table
-				start.clone(),
+					.get_range_monotonic(
-				filter.clone(),
+						partition_key,
-				n_get,
+						start.clone(),
-				enumeration_order,
+						filter.clone(),
-			)
+						n_get,
-			.await?;
+						enumeration_order,
+					)
+					.await?
+			}
+			K2VMonotonicRead::NonMonotonic => {
+				table
+					.get_range(
+						partition_key,
+						start.clone(),
+						filter.clone(),
+						n_get,
+						enumeration_order,
+					)
+					.await?
+			}
+		};
 
 		let get_ret_len = get_ret.len();
 

src/api/s3/api_server.rs

@@ -159,7 +159,8 @@ impl ApiHandler for S3ApiServer {
 			return Err(Error::forbidden("Operation is not allowed for this key."));
 		}
 
-		let matching_cors_rule = find_matching_cors_rule(&bucket_params, &req)?.cloned();
+		let matching_cors = find_matching_cors_rule(&bucket_params, &req)?
+			.map(|(rule, origin)| (rule.clone(), origin.to_string()));
 
 		let ctx = ReqCtx {
 			garage,
@@ -334,8 +335,8 @@ impl ApiHandler for S3ApiServer {
 		// If request was a success and we have a CORS rule that applies to it,
 		// add the corresponding CORS headers to the response
 		let mut resp_ok = resp?;
-		if let Some(rule) = matching_cors_rule {
+		if let Some((rule, origin)) = matching_cors {
-			add_cors_headers(&mut resp_ok, &rule)
+			add_cors_headers(&mut resp_ok, &rule, &origin)
 				.ok_or_internal_error("Invalid bucket CORS configuration")?;
 		}
 

src/api/s3/bucket.rs

@@ -122,7 +122,7 @@ pub async fn handle_list_buckets(
 			for (alias, _, _active) in bucket.aliases().iter().filter(|(_, _, active)| *active) {
 				let alias_opt = garage.bucket_alias_table.get(&EmptyKey, alias).await?;
 				if let Some(alias_ent) = alias_opt {
-					if *alias_ent.state.get() == Some(*bucket_id) {
+					if alias_ent.state.get().inner() == Some(bucket_id) {
 						aliases.insert(alias_ent.name().to_string(), *bucket_id);
 					}
 				}
@@ -134,7 +134,7 @@ pub async fn handle_list_buckets(
 	}
 
 	for (alias, _, id_opt) in key_p.local_aliases.items() {
-		if let Some(id) = id_opt {
+		if let Some(id) = id_opt.inner() {
 			aliases.insert(alias.clone(), *id);
 		}
 	}
@@ -256,7 +256,10 @@ pub async fn handle_delete_bucket(ctx: ReqCtx) -> Result<Response<ResBody>, Erro
 
 	let key_params = api_key.params().unwrap();
 
-	let is_local_alias = matches!(key_params.local_aliases.get(bucket_name), Some(Some(_)));
+	let is_local_alias = matches!(
+		key_params.local_aliases.get(bucket_name).map(|x| x.inner()),
+		Some(Some(_))
+	);
 
 	// If the bucket has no other aliases, this is a true deletion.
 	// Otherwise, it is just an alias removal.

src/api/s3/cors.rs

@@ -13,7 +13,7 @@ use crate::xml::to_xml_with_header;
 
 pub async fn handle_get_cors(ctx: ReqCtx) -> Result<Response<ResBody>, Error> {
 	let ReqCtx { bucket_params, .. } = ctx;
-	if let Some(cors) = bucket_params.cors_config.get() {
+	if let Some(cors) = bucket_params.cors_config.get().inner() {
 		let wc = CorsConfiguration {
 			xmlns: (),
 			cors_rules: cors
@@ -38,7 +38,7 @@ pub async fn handle_delete_cors(ctx: ReqCtx) -> Result<Response<ResBody>, Error>
 		mut bucket_params,
 		..
 	} = ctx;
-	bucket_params.cors_config.update(None);
+	bucket_params.cors_config.update(None.into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))
@@ -67,7 +67,7 @@ pub async fn handle_put_cors(
 
 	bucket_params
 		.cors_config
-		.update(Some(conf.into_garage_cors_config()?));
+		.update(Some(conf.into_garage_cors_config()?).into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))

src/api/s3/delete.rs

@@ -83,8 +83,21 @@ pub async fn handle_delete_objects(
 				}
 				ret_deleted.push(s3_xml::Deleted {
 					key: s3_xml::Value(obj.key.clone()),
-					version_id: s3_xml::Value(hex::encode(deleted_version)),
+					version_id: Some(s3_xml::Value(hex::encode(deleted_version))),
-					delete_marker_version_id: s3_xml::Value(hex::encode(delete_marker_version)),
+					delete_marker_version_id: Some(s3_xml::Value(hex::encode(
+						delete_marker_version,
+					))),
+				});
+			}
+			Err(Error::NoSuchKey) => {
+				if cmd.quiet {
+					continue;
+				}
+				// Deleting a non-existent key is a success in S3
+				ret_deleted.push(s3_xml::Deleted {
+					key: s3_xml::Value(obj.key.clone()),
+					version_id: None,
+					delete_marker_version_id: None,
 				});
 			}
 			Err(e) => {

src/api/s3/lifecycle.rs

@@ -14,7 +14,7 @@ use garage_model::bucket_table::Bucket;
 pub async fn handle_get_lifecycle(ctx: ReqCtx) -> Result<Response<ResBody>, Error> {
 	let ReqCtx { bucket_params, .. } = ctx;
 
-	if let Some(lifecycle) = bucket_params.lifecycle_config.get() {
+	if let Some(lifecycle) = bucket_params.lifecycle_config.get().inner() {
 		let wc = LifecycleConfiguration::from_garage_lifecycle_config(lifecycle);
 		let xml = to_xml_with_header(&wc)?;
 		Ok(Response::builder()
@@ -33,7 +33,7 @@ pub async fn handle_delete_lifecycle(ctx: ReqCtx) -> Result<Response<ResBody>, E
 		mut bucket_params,
 		..
 	} = ctx;
-	bucket_params.lifecycle_config.update(None);
+	bucket_params.lifecycle_config.update(None.into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))
@@ -62,7 +62,7 @@ pub async fn handle_put_lifecycle(
 		.validate_into_garage_lifecycle_config()
 		.ok_or_bad_request("Invalid lifecycle configuration")?;
 
-	bucket_params.lifecycle_config.update(Some(config));
+	bucket_params.lifecycle_config.update(Some(config).into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))

src/api/s3/post_object.rs

@@ -83,10 +83,12 @@ pub async fn handle_post_object(
 	};
 
 	// Current part is file. Do some checks before handling to PutObject code
-	let key = params
+	let key = std::str::from_utf8(
-		.get("key")
+		params
-		.ok_or_bad_request("No key was provided")?
+			.get("key")
-		.to_str()?;
+			.ok_or_bad_request("No key was provided")?
+			.as_bytes(),
+	)?;
 	let policy = params
 		.get("policy")
 		.ok_or_bad_request("No policy was provided")?
@@ -121,7 +123,7 @@ pub async fn handle_post_object(
 		&bucket_params,
 		&Request::from_parts(head.clone(), empty_body::<Infallible>()),
 	)?
-	.cloned();
+	.map(|(rule, origin)| (rule.clone(), origin.to_string()));
 
 	let decoded_policy = BASE64_STANDARD
 		.decode(policy)
@@ -351,8 +353,8 @@ pub async fn handle_post_object(
 		}
 	};
 
-	if let Some(rule) = matching_cors_rule {
+	if let Some((rule, origin)) = matching_cors_rule {
-		add_cors_headers(&mut resp, &rule)
+		add_cors_headers(&mut resp, &rule, &origin)
 			.ok_or_internal_error("Invalid bucket CORS configuration")?;
 	}
 
@@ -473,12 +475,10 @@ where
 					))));
 				}
 			}
-			Poll::Ready(None) => {
+			Poll::Ready(None) if !self.length.contains(&self.read) => {
-				if !self.length.contains(&self.read) {
+				return Poll::Ready(Some(Err(Error::bad_request(
-					return Poll::Ready(Some(Err(Error::bad_request(
+					"File size does not match policy",
-						"File size does not match policy",
+				))));
-					))));
-				}
 			}
 			_ => {}
 		}

src/api/s3/put.rs

@@ -679,7 +679,10 @@ pub(crate) fn extract_metadata_headers(
 	];
 	for name in standard_header.iter() {
 		if let Some(value) = headers.get(name) {
-			ret.push((name.to_string(), value.to_str()?.to_string()));
+			ret.push((
+				name.to_string(),
+				std::str::from_utf8(value.as_bytes())?.to_string(),
+			));
 		}
 	}
 

src/api/s3/website.rs

@@ -16,7 +16,7 @@ pub const X_AMZ_WEBSITE_REDIRECT_LOCATION: HeaderName =
 
 pub async fn handle_get_website(ctx: ReqCtx) -> Result<Response<ResBody>, Error> {
 	let ReqCtx { bucket_params, .. } = ctx;
-	if let Some(website) = bucket_params.website_config.get() {
+	if let Some(website) = bucket_params.website_config.get().inner() {
 		let wc = WebsiteConfiguration {
 			xmlns: (),
 			error_document: website.error_document.as_ref().map(|v| Key {
@@ -54,7 +54,7 @@ pub async fn handle_delete_website(ctx: ReqCtx) -> Result<Response<ResBody>, Err
 		mut bucket_params,
 		..
 	} = ctx;
-	bucket_params.website_config.update(None);
+	bucket_params.website_config.update(None.into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))
@@ -83,7 +83,7 @@ pub async fn handle_put_website(
 
 	bucket_params
 		.website_config
-		.update(Some(conf.into_garage_website_config()?));
+		.update(Some(conf.into_garage_website_config()?).into());
 	garage
 		.bucket_table
 		.insert(&Bucket::present(bucket_id, bucket_params))

src/api/s3/xml.rs

@@ -44,10 +44,13 @@ pub struct LocationConstraint {
 pub struct Deleted {
 	#[serde(rename = "Key")]
 	pub key: Value,
-	#[serde(rename = "VersionId")]
+	#[serde(rename = "VersionId", skip_serializing_if = "Option::is_none")]
-	pub version_id: Value,
+	pub version_id: Option<Value>,
-	#[serde(rename = "DeleteMarkerVersionId")]
+	#[serde(
-	pub delete_marker_version_id: Value,
+		rename = "DeleteMarkerVersionId",
+		skip_serializing_if = "Option::is_none"
+	)]
+	pub delete_marker_version_id: Option<Value>,
 }
 
 #[derive(Debug, Serialize, PartialEq, Eq)]
@@ -497,13 +500,13 @@ mod tests {
 			deleted: vec![
 				Deleted {
 					key: Value("a/plop".to_string()),
-					version_id: Value("qsdfjklm".to_string()),
+					version_id: Some(Value("qsdfjklm".to_string())),
-					delete_marker_version_id: Value("wxcvbn".to_string()),
+					delete_marker_version_id: Some(Value("wxcvbn".to_string())),
 				},
 				Deleted {
 					key: Value("b/plip".to_string()),
-					version_id: Value("1234".to_string()),
+					version_id: Some(Value("1234".to_string())),
-					delete_marker_version_id: Value("4321".to_string()),
+					delete_marker_version_id: Some(Value("4321".to_string())),
 				},
 			],
 			errors: vec![

src/block/manager.rs

@@ -144,7 +144,7 @@ impl BlockManager {
 
 		// Open metadata tables
 		let rc = db
-			.open_tree("block_local_rc")
+			.open_typed_tree("block_local_rc")
 			.expect("Unable to open block_local_rc tree");
 		let rc = BlockRc::new(rc);
 
@@ -158,9 +158,9 @@ impl BlockManager {
 
 		let metrics = BlockManagerMetrics::new(
 			config.compression_level,
-			rc.rc_table.clone(),
+			rc.rc_table.untyped().clone(),
-			resync.queue.clone(),
+			resync.queue.untyped().clone(),
-			resync.errors.clone(),
+			resync.errors.untyped().clone(),
 			buffer_kb_semaphore.clone(),
 		);
 
@@ -224,7 +224,13 @@ impl BlockManager {
 				|p, tranquility| p.set_with(|x| x.tranquility = tranquility),
 			);
 			vars.register_ro(&self.scrub_persister, "scrub-last-completed", |p| {
-				p.get_with(|x| msec_to_rfc3339(x.time_last_complete_scrub))
+				p.get_with(|x| {
+					if x.time_last_complete_scrub == 0 {
+						"never".to_string()
+					} else {
+						msec_to_rfc3339(x.time_last_complete_scrub)
+					}
+				})
 			});
 			vars.register_ro(&self.scrub_persister, "scrub-next-run", |p| {
 				p.get_with(|x| msec_to_rfc3339(x.time_next_run_scrub))
@@ -443,9 +449,8 @@ impl BlockManager {
 		let mut blocks = Vec::with_capacity(self.resync.errors.approximate_len()?);
 		for ent in self.resync.errors.iter()? {
 			let (hash, cnt) = ent?;
-			let cnt = ErrorCounter::decode(&cnt);
 			blocks.push(BlockResyncErrorInfo {
-				hash: Hash::try_from(&hash).unwrap(),
+				hash,
 				refcount: 0,
 				error_count: cnt.errors,
 				last_try: cnt.last_try,

src/block/rc.rs

@@ -1,4 +1,5 @@
 use std::convert::TryInto;
+use std::num::NonZeroU64;
 
 use arc_swap::ArcSwapOption;
 
@@ -14,12 +15,12 @@ pub type CalculateRefcount =
 	Box<dyn Fn(&db::Transaction, &Hash) -> db::TxResult<usize, Error> + Send + Sync>;
 
 pub struct BlockRc {
-	pub rc_table: db::Tree,
+	pub(crate) rc_table: db::TypedTree<Hash, RcEntry>,
 	pub(crate) recalc_rc: ArcSwapOption<Vec<CalculateRefcount>>,
 }
 
 impl BlockRc {
-	pub(crate) fn new(rc: db::Tree) -> Self {
+	pub(crate) fn new(rc: db::TypedTree<Hash, RcEntry>) -> Self {
 		Self {
 			rc_table: rc,
 			recalc_rc: ArcSwapOption::new(None),
@@ -33,11 +34,8 @@ impl BlockRc {
 		tx: &mut db::Transaction,
 		hash: &Hash,
 	) -> db::TxOpResult<bool> {
-		let old_rc = RcEntry::parse_opt(tx.get(&self.rc_table, hash)?);
+		let old_rc = RcState(self.rc_table.tx_get(tx, hash)?);
-		match old_rc.increment().serialize() {
+		self.rc_table.tx_insert(tx, hash, &old_rc.increment())?;
-			Some(x) => tx.insert(&self.rc_table, hash, x)?,
-			None => unreachable!(),
-		}
 		Ok(old_rc.is_zero())
 	}
 
@@ -48,17 +46,27 @@ impl BlockRc {
 		tx: &mut db::Transaction,
 		hash: &Hash,
 	) -> db::TxOpResult<bool> {
-		let new_rc = RcEntry::parse_opt(tx.get(&self.rc_table, hash)?).decrement();
+		let new_rc = RcState(self.rc_table.tx_get(tx, hash)?).decrement();
-		match new_rc.serialize() {
+		match &new_rc.0 {
-			Some(x) => tx.insert(&self.rc_table, hash, x)?,
+			None => self.rc_table.tx_remove(tx, hash)?,
-			None => tx.remove(&self.rc_table, hash)?,
+			Some(rc) => self.rc_table.tx_insert(tx, hash, rc)?,
 		}
-		Ok(matches!(new_rc, RcEntry::Deletable { .. }))
+		Ok(matches!(new_rc.0, Some(RcEntry::Deletable { .. })))
 	}
 
-	/// Read a block's reference count
+	/// Read a block's reference counting state
-	pub(crate) fn get_block_rc(&self, hash: &Hash) -> Result<RcEntry, Error> {
+	pub(crate) fn get_block_rc(&self, hash: &Hash) -> Result<RcState, Error> {
-		Ok(RcEntry::parse_opt(self.rc_table.get(hash.as_ref())?))
+		Ok(RcState(self.rc_table.get(hash)?))
+	}
+
+	/// Return the first hash stored in the RC table at or after `cursor`
+	pub fn get_first_hash_from(&self, cursor: Hash) -> Result<Option<Hash>, Error> {
+		Ok(self
+			.rc_table
+			.range(cursor..)?
+			.next()
+			.transpose()?
+			.map(|(k, _)| k))
 	}
 
 	/// Delete an entry in the RC table if it is deletable and the
@@ -66,12 +74,11 @@ impl BlockRc {
 	pub(crate) fn clear_deleted_block_rc(&self, hash: &Hash) -> Result<(), Error> {
 		let now = now_msec();
 		self.rc_table.db().transaction(|tx| {
-			let rcval = RcEntry::parse_opt(tx.get(&self.rc_table, hash)?);
+			let rcval = self.rc_table.tx_get(tx, hash)?;
-			match rcval {
+			if let Some(RcEntry::Deletable { at_time }) = rcval {
-				RcEntry::Deletable { at_time } if now > at_time => {
+				if now > at_time {
-					tx.remove(&self.rc_table, hash)?;
+					self.rc_table.tx_remove(tx, hash)?;
 				}
-				_ => (),
 			}
 			Ok(())
 		})?;
@@ -91,28 +98,25 @@ impl BlockRc {
 					for f in recalc_fns.iter() {
 						cnt += f(tx, hash)?;
 					}
-					let old_rc = RcEntry::parse_opt(tx.get(&self.rc_table, hash)?);
+					let old_count = RcState(self.rc_table.tx_get(tx, hash)?).as_u64();
 					trace!(
 						"Block RC for {:?}: stored={}, calculated={}",
 						hash,
-						old_rc.as_u64(),
+						old_count,
 						cnt
 					);
-					if cnt as u64 != old_rc.as_u64() {
+					if cnt as u64 != old_count {
 						warn!(
 							"Fixing inconsistent block RC for {:?}: was {}, should be {}",
-							hash,
+							hash, old_count, cnt
-							old_rc.as_u64(),
-							cnt
 						);
-						let new_rc = if cnt > 0 {
+						let new_rc = match NonZeroU64::new(cnt as u64) {
-							RcEntry::Present { count: cnt as u64 }
+							Some(count) => RcEntry::Present { count },
-						} else {
+							None => RcEntry::Deletable {
-							RcEntry::Deletable {
 								at_time: now_msec() + BLOCK_GC_DELAY.as_millis() as u64,
-							}
+							},
 						};
-						tx.insert(&self.rc_table, hash, new_rc.serialize().unwrap())?;
+						self.rc_table.tx_insert(tx, hash, &new_rc)?;
 						Ok((cnt, true))
 					} else {
 						Ok((cnt, false))
@@ -131,13 +135,47 @@ impl BlockRc {
 	}
 }
 
-/// Describes the state of the reference counter for a block
+impl db::DbBytes for RcEntry {
+	fn encode(&self) -> Vec<u8> {
+		match self {
+			RcEntry::Present { count } => u64::to_be_bytes(count.get()).to_vec(),
+			RcEntry::Deletable { at_time } => {
+				[u64::to_be_bytes(0), u64::to_be_bytes(*at_time)].concat()
+			}
+		}
+	}
+
+	fn decode(bytes: &[u8]) -> std::result::Result<Self, db::DecodeError> {
+		if bytes.len() == 8 {
+			let count = NonZeroU64::new(u64::from_be_bytes(bytes.try_into().unwrap()))
+				.ok_or(db::DecodeError("invalid RC entry: zero count".into()))?;
+			Ok(RcEntry::Present { count })
+		} else if bytes.len() == 16 {
+			Ok(RcEntry::Deletable {
+				at_time: u64::from_be_bytes(bytes[8..16].try_into().unwrap()),
+			})
+		} else {
+			Err(db::DecodeError(
+				format!(
+					"invalid RC entry: expected 8 or 16 bytes, got {}",
+					bytes.len()
+				)
+				.into(),
+			))
+		}
+	}
+}
+
+/// A block's entry in the RC table.
+///
+/// A block with zero references and no pending deletion has no entry
+/// in the RC table at all: see [`RcState`].
 #[derive(Clone, Copy, Debug)]
 pub(crate) enum RcEntry {
-	/// Present: the block has `count` references, with `count` > 0.
+	/// Present: the block has `count` references.
 	///
 	/// This is stored as `u64::to_be_bytes(count)`
-	Present { count: u64 },
+	Present { count: NonZeroU64 },
 
 	/// Deletable: the block has zero references, and can be deleted
 	/// once time (returned by `now_msec`) is larger than `at_time`
@@ -147,72 +185,39 @@ pub(crate) enum RcEntry {
 	/// (this allows for the data format to be backwards compatible with
 	/// previous Garage versions that didn't have this intermediate state)
 	Deletable { at_time: u64 },
-
-	/// Absent: the block has zero references, and can be deleted
-	/// immediately
-	Absent,
 }
 
-impl RcEntry {
+/// Describes the state of the reference counter for a block: the block's
-	fn parse(bytes: &[u8]) -> Self {
+/// entry in the RC table, or `None` if it has none, meaning the block has
-		if bytes.len() == 8 {
+/// zero references and can be deleted immediately.
-			RcEntry::Present {
+#[derive(Clone, Copy, Debug)]
-				count: u64::from_be_bytes(bytes.try_into().unwrap()),
+pub(crate) struct RcState(Option<RcEntry>);
-			}
-		} else if bytes.len() == 16 {
-			RcEntry::Deletable {
-				at_time: u64::from_be_bytes(bytes[8..16].try_into().unwrap()),
-			}
-		} else {
-			panic!("Invalid RC entry: {:?}, database is corrupted. This is an error Garage is currently unable to recover from. Sorry, and also please report a bug.",
-				bytes
-			)
-		}
-	}
 
-	fn parse_opt<V: AsRef<[u8]>>(bytes: Option<V>) -> Self {
+impl RcState {
-		bytes
+	/// The new RC table entry after a reference is taken on the block
-			.map(|b| Self::parse(b.as_ref()))
+	fn increment(&self) -> RcEntry {
-			.unwrap_or(Self::Absent)
+		let count = match self.0 {
-	}
+			Some(RcEntry::Present { count }) => count.saturating_add(1),
-
+			_ => NonZeroU64::new(1).unwrap(),
-	fn serialize(self) -> Option<Vec<u8>> {
-		match self {
-			RcEntry::Present { count } => Some(u64::to_be_bytes(count).to_vec()),
-			RcEntry::Deletable { at_time } => {
-				Some([u64::to_be_bytes(0), u64::to_be_bytes(at_time)].concat())
-			}
-			RcEntry::Absent => None,
-		}
-	}
-
-	fn increment(self) -> Self {
-		let old_count = match self {
-			RcEntry::Present { count } => count,
-			_ => 0,
 		};
-		RcEntry::Present {
+		RcEntry::Present { count }
-			count: old_count + 1,
-		}
 	}
 
-	fn decrement(self) -> Self {
+	/// The new state after a reference to the block is dropped
-		match self {
+	fn decrement(&self) -> Self {
-			RcEntry::Present { count } => {
+		RcState(match self.0 {
-				if count > 1 {
+			Some(RcEntry::Present { count }) => Some(match NonZeroU64::new(count.get() - 1) {
-					RcEntry::Present { count: count - 1 }
+				Some(count) => RcEntry::Present { count },
-				} else {
+				None => RcEntry::Deletable {
-					RcEntry::Deletable {
+					at_time: now_msec() + BLOCK_GC_DELAY.as_millis() as u64,
-						at_time: now_msec() + BLOCK_GC_DELAY.as_millis() as u64,
+				},
-					}
+			}),
-				}
+			unchanged => unchanged,
-			}
+		})
-			del => del,
-		}
 	}
 
 	pub(crate) fn is_zero(&self) -> bool {
-		matches!(self, RcEntry::Deletable { .. } | RcEntry::Absent)
+		matches!(self.0, None | Some(RcEntry::Deletable { .. }))
 	}
 
 	pub(crate) fn is_nonzero(&self) -> bool {
@@ -220,10 +225,10 @@ impl RcEntry {
 	}
 
 	pub(crate) fn is_deletable(&self) -> bool {
-		match self {
+		match self.0 {
-			RcEntry::Present { .. } => false,
+			Some(RcEntry::Present { .. }) => false,
-			RcEntry::Deletable { at_time } => now_msec() > *at_time,
+			Some(RcEntry::Deletable { at_time }) => now_msec() > at_time,
-			RcEntry::Absent => true,
+			None => true,
 		}
 	}
 
@@ -232,8 +237,8 @@ impl RcEntry {
 	}
 
 	pub(crate) fn as_u64(&self) -> u64 {
-		match self {
+		match self.0 {
-			RcEntry::Present { count } => *count,
+			Some(RcEntry::Present { count }) => count.get(),
 			_ => 0,
 		}
 	}

src/block/repair.rs

@@ -102,16 +102,15 @@ impl Worker for RepairWorker {
 				let mut batch_of_hashes = vec![];
 				let start_bound = match self.next_start.as_ref() {
 					None => Bound::Unbounded,
-					Some(x) => Bound::Excluded(x.as_slice()),
+					Some(x) => Bound::Excluded(*x),
 				};
 				for entry in self
 					.manager
 					.rc
 					.rc_table
-					.range::<&[u8], _>((start_bound, Bound::Unbounded))?
+					.range((start_bound, Bound::Unbounded))?
 				{
 					let (hash, _) = entry?;
-					let hash = Hash::try_from(&hash[..]).unwrap();
 					batch_of_hashes.push(hash);
 					if batch_of_hashes.len() >= 1000 {
 						break;
@@ -648,7 +647,7 @@ impl BlockStoreIterator {
 
 		let mut cum_cap = 0;
 		let mut todo = vec![];
-		for (dir, cap) in data_layout.data_dirs.iter().zip(dir_cap.into_iter()) {
+		for (dir, cap) in data_layout.data_dirs.iter().zip(dir_cap) {
 			let progress_min = (cum_cap * PROGRESS_FP) / sum_cap;
 			let progress_max = ((cum_cap + cap as u64) * PROGRESS_FP) / sum_cap;
 			cum_cap += cap as u64;

src/block/resync.rs

@@ -44,15 +44,58 @@ pub(crate) const MAX_RESYNC_WORKERS: usize = 8;
 const INITIAL_RESYNC_TRANQUILITY: u32 = 2;
 
 pub struct BlockResyncManager {
-	pub(crate) queue: db::Tree,
+	pub(crate) queue: db::TypedTree<ResyncQueueKey, Hash>,
 	pub(crate) notify: Arc<Notify>,
-	pub(crate) errors: db::Tree,
+	pub(crate) errors: db::TypedTree<Hash, ErrorCounter>,
 
 	busy_set: BusySet,
 
 	persister: PersisterShared<ResyncPersistedConfig>,
 }
 
+/// Key of the resync queue tree: blocks are resynced in order of increasing
+/// `when` (msec timestamp of the next try), with the block hash as tie-breaker.
+///
+// CAREFUL: this type implements `DbOrdKey`, so its byte encoding must be
+// order-preserving.
+// The derived `Ord` compares fields in declaration order, which must match
+// the order in which `encode()` writes them; and `when` must remain an
+// *unsigned* integer, as the big-endian encoding is only order-preserving
+// for unsigned types.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub(crate) struct ResyncQueueKey {
+	pub(crate) when: u64,
+	pub(crate) hash: Hash,
+}
+
+impl db::DbBytes for ResyncQueueKey {
+	fn encode(&self) -> Vec<u8> {
+		let mut v = Vec::with_capacity(40);
+		v.extend_from_slice(&u64::to_be_bytes(self.when));
+		v.extend_from_slice(self.hash.as_slice());
+		v
+	}
+
+	fn decode(bytes: &[u8]) -> std::result::Result<Self, db::DecodeError> {
+		if bytes.len() != 40 {
+			return Err(db::DecodeError(
+				format!(
+					"invalid resync queue key: expected 40 bytes, got {}",
+					bytes.len()
+				)
+				.into(),
+			));
+		}
+		Ok(ResyncQueueKey {
+			when: u64::from_be_bytes(bytes[..8].try_into().unwrap()),
+			hash: Hash::try_from(&bytes[8..])
+				.ok_or_else(|| db::DecodeError("invalid resync queue key: bad hash".into()))?,
+		})
+	}
+}
+
+impl db::DbOrdKey for ResyncQueueKey {}
+
 #[derive(Serialize, Deserialize, Clone, Copy)]
 struct ResyncPersistedConfig {
 	n_workers: usize,
@@ -74,22 +117,21 @@ enum ResyncIterResult {
 	IdleFor(Duration),
 }
 
-type BusySet = Arc<Mutex<HashSet<Vec<u8>>>>;
+type BusySet = Arc<Mutex<HashSet<ResyncQueueKey>>>;
 
 struct BusyBlock {
-	time_bytes: Vec<u8>,
+	key: ResyncQueueKey,
-	hash_bytes: Vec<u8>,
 	busy_set: BusySet,
 }
 
 impl BlockResyncManager {
 	pub(crate) fn new(db: &db::Db, system: &System) -> Self {
 		let queue = db
-			.open_tree("block_local_resync_queue")
+			.open_typed_tree("block_local_resync_queue")
 			.expect("Unable to open block_local_resync_queue tree");
 
 		let errors = db
-			.open_tree("block_local_resync_errors")
+			.open_typed_tree("block_local_resync_errors")
 			.expect("Unable to open block_local_resync_errors tree");
 
 		let persister = PersisterShared::new(&system.metadata_dir, "resync_cfg");
@@ -116,11 +158,10 @@ impl BlockResyncManager {
 	/// Clear the error counter for a block and put it in queue immediately
 	pub fn clear_backoff(&self, hash: &Hash) -> Result<(), Error> {
 		let now = now_msec();
-		if let Some(ec) = self.errors.get(hash)? {
+		if let Some(mut ec) = self.errors.get(hash)? {
-			let mut ec = ErrorCounter::decode(&ec);
 			if ec.errors > 0 {
 				ec.last_try = now - ec.delay_msec();
-				self.errors.insert(hash, ec.encode())?;
+				self.errors.insert(hash, &ec)?;
 				self.put_to_resync_at(hash, now)?;
 				return Ok(());
 			}
@@ -251,23 +292,21 @@ impl BlockResyncManager {
 
 	pub(crate) fn put_to_resync_at(&self, hash: &Hash, when: u64) -> db::Result<()> {
 		trace!("Put resync_queue: {} {:?}", when, hash);
-		let mut key = u64::to_be_bytes(when).to_vec();
+		let qkey = ResyncQueueKey { when, hash: *hash };
-		key.extend(hash.as_ref());
+		self.queue.insert(&qkey, hash)?;
-		self.queue.insert(key, hash.as_ref())?;
 		self.notify.notify_waiters();
 		Ok(())
 	}
 
 	async fn resync_iter(&self, manager: &BlockManager) -> Result<ResyncIterResult, db::Error> {
 		if let Some(block) = self.get_block_to_resync()? {
-			let time_msec = u64::from_be_bytes(block.time_bytes[0..8].try_into().unwrap());
+			let time_msec = block.key.when;
 			let now = now_msec();
 
 			if now >= time_msec {
-				let hash = Hash::try_from(&block.hash_bytes[..]).unwrap();
+				let hash = block.key.hash;
 
-				if let Some(ec) = self.errors.get(hash.as_slice())? {
+				if let Some(ec) = self.errors.get(&hash)? {
-					let ec = ErrorCounter::decode(&ec);
 					if now < ec.next_try() {
 						// if next retry after an error is not yet,
 						// don't do resync and return early, but still
@@ -277,7 +316,7 @@ impl BlockResyncManager {
 						// is not removing the one we added just above
 						// (we want to do the remove after the insert to ensure
 						// that the item is not lost if we crash in-between)
-						self.queue.remove(&block.time_bytes)?;
+						self.queue.remove(&block.key)?;
 						return Ok(ResyncIterResult::BusyDidNothing);
 					}
 				}
@@ -307,21 +346,21 @@ impl BlockResyncManager {
 					manager.metrics.resync_error_counter.add(1);
 					error!("Error when resyncing {:?}: {}", hash, e);
 
-					let err_counter = match self.errors.get(hash.as_slice())? {
+					let err_counter = match self.errors.get(&hash)? {
-						Some(ec) => ErrorCounter::decode(&ec).add1(now + 1),
+						Some(ec) => ec.add1(now + 1),
 						None => ErrorCounter::new(now + 1),
 					};
 
-					self.errors.insert(hash.as_slice(), err_counter.encode())?;
+					self.errors.insert(&hash, &err_counter)?;
 
 					self.put_to_resync_at(&hash, err_counter.next_try())?;
 					// err_counter.next_try() >= now + 1 > now,
 					// the entry we remove from the queue is not
 					// the entry we inserted with put_to_resync_at
-					self.queue.remove(&block.time_bytes)?;
+					self.queue.remove(&block.key)?;
 				} else {
-					self.errors.remove(hash.as_slice())?;
+					self.errors.remove(&hash)?;
-					self.queue.remove(&block.time_bytes)?;
+					self.queue.remove(&block.key)?;
 				}
 
 				Ok(ResyncIterResult::BusyDidSomething)
@@ -344,12 +383,11 @@ impl BlockResyncManager {
 	fn get_block_to_resync(&self) -> Result<Option<BusyBlock>, db::Error> {
 		let mut busy = self.busy_set.lock().unwrap();
 		for it in self.queue.iter()? {
-			let (time_bytes, hash_bytes) = it?;
+			let (key, _) = it?;
-			if !busy.contains(&time_bytes) {
+			if !busy.contains(&key) {
-				busy.insert(time_bytes.clone());
+				busy.insert(key);
 				return Ok(Some(BusyBlock {
-					time_bytes,
+					key,
-					hash_bytes,
 					busy_set: self.busy_set.clone(),
 				}));
 			}
@@ -506,7 +544,7 @@ impl BlockResyncManager {
 impl Drop for BusyBlock {
 	fn drop(&mut self) {
 		let mut busy = self.busy_set.lock().unwrap();
-		busy.remove(&self.time_bytes);
+		busy.remove(&self.key);
 	}
 }
 
@@ -516,6 +554,7 @@ pub(crate) struct ResyncWorker {
 	tranquilizer: Tranquilizer,
 	next_delay: Duration,
 	persister: PersisterShared<ResyncPersistedConfig>,
+	had_decode_error: bool,
 }
 
 impl ResyncWorker {
@@ -527,6 +566,7 @@ impl ResyncWorker {
 			tranquilizer: Tranquilizer::new(30),
 			next_delay: Duration::from_secs(10),
 			persister,
+			had_decode_error: false,
 		}
 	}
 }
@@ -574,6 +614,15 @@ impl Worker for ResyncWorker {
 				self.next_delay = delay;
 				Ok(WorkerState::Idle)
 			}
+			Err(db::Error::Decode(e)) => {
+				// We give it one second chance in the very unlikely case that the bytes would somehow
+				// have been corrupted during read and that a new read would lead to a correct decoding.
+				if self.had_decode_error {
+					panic!("An error has happened when decoding something stored in the local k/v store: {}.", e);
+				}
+				self.had_decode_error = true;
+				Ok(WorkerState::Busy)
+			}
 			Err(e) => {
 				// The errors that we have here are only db errors
 				// We don't really know how to handle them so just ¯\_(ツ)_/¯
@@ -581,6 +630,7 @@ impl Worker for ResyncWorker {
 				// if it does there is not much we can do -- TODO should we just panic?)
 				// Here we just give the error to the worker manager,
 				// it will print it to the logs and increment a counter
+				self.had_decode_error = false;
 				Err(e.into())
 			}
 		}
@@ -602,6 +652,7 @@ impl Worker for ResyncWorker {
 
 /// Counts the number of errors when resyncing a block,
 /// and the time of the last try.
+///
 /// Used to implement exponential backoff.
 #[derive(Clone, Copy, Debug)]
 pub(crate) struct ErrorCounter {
@@ -609,6 +660,31 @@ pub(crate) struct ErrorCounter {
 	pub(crate) last_try: u64,
 }
 
+impl db::DbBytes for ErrorCounter {
+	fn encode(&self) -> Vec<u8> {
+		let mut v = Vec::with_capacity(16);
+		v.extend_from_slice(&u64::to_be_bytes(self.errors));
+		v.extend_from_slice(&u64::to_be_bytes(self.last_try));
+		v
+	}
+
+	fn decode(bytes: &[u8]) -> std::result::Result<Self, db::DecodeError> {
+		if bytes.len() != 16 {
+			return Err(db::DecodeError(
+				format!(
+					"invalid error counter: expected 16 bytes, got {}",
+					bytes.len()
+				)
+				.into(),
+			));
+		}
+		Ok(Self {
+			errors: u64::from_be_bytes(bytes[..8].try_into().unwrap()),
+			last_try: u64::from_be_bytes(bytes[8..].try_into().unwrap()),
+		})
+	}
+}
+
 impl ErrorCounter {
 	fn new(now: u64) -> Self {
 		Self {
@@ -617,21 +693,6 @@ impl ErrorCounter {
 		}
 	}
 
-	pub(crate) fn decode(data: &[u8]) -> Self {
-		Self {
-			errors: u64::from_be_bytes(data[0..8].try_into().unwrap()),
-			last_try: u64::from_be_bytes(data[8..16].try_into().unwrap()),
-		}
-	}
-
-	fn encode(&self) -> Vec<u8> {
-		[
-			u64::to_be_bytes(self.errors),
-			u64::to_be_bytes(self.last_try),
-		]
-		.concat()
-	}
-
 	fn add1(self, now: u64) -> Self {
 		Self {
 			errors: self.errors + 1,

src/db/fjall_adapter.rs

@@ -12,7 +12,7 @@ use fjall::{
 
 use crate::{
 	open::{Engine, OpenOpt},
-	Db, Error, IDb, ITx, ITxFn, OnCommit, Result, TxError, TxFnResult, TxOpError, TxOpResult,
+	Db, DbError, DbResult, Error, IDb, ITx, ITxFn, OnCommit, TxError, TxFnResult, TxOpError,
 	TxResult, TxValueIter, Value, ValueIter,
 };
 
@@ -20,10 +20,10 @@ pub use fjall;
 
 // --
 
-pub(crate) fn open_db(path: &Path, opt: &OpenOpt) -> Result<Db> {
+pub(crate) fn open_db(path: &Path, opt: &OpenOpt) -> DbResult<Db> {
 	info!("Opening Fjall database at: {}", path.display());
 	if opt.fsync {
-		return Err(Error(
+		return Err(DbError(
 			"metadata_fsync is not supported with the Fjall database engine".into(),
 		));
 	}
@@ -37,21 +37,27 @@ pub(crate) fn open_db(path: &Path, opt: &OpenOpt) -> Result<Db> {
 
 // -- err
 
-impl From<fjall::Error> for Error {
+impl From<fjall::Error> for DbError {
-	fn from(e: fjall::Error) -> Error {
+	fn from(e: fjall::Error) -> DbError {
-		Error(format!("fjall: {}", e).into())
+		DbError(format!("fjall: {}", e).into())
 	}
 }
 
-impl From<fjall::LsmError> for Error {
+impl From<fjall::LsmError> for DbError {
-	fn from(e: fjall::LsmError) -> Error {
+	fn from(e: fjall::LsmError) -> DbError {
-		Error(format!("fjall lsm_tree: {}", e).into())
+		DbError(format!("fjall lsm_tree: {}", e).into())
+	}
+}
+
+impl From<fjall::Error> for Error {
+	fn from(e: fjall::Error) -> Error {
+		Error::Db(DbError::from(e))
 	}
 }
 
 impl From<fjall::Error> for TxOpError {
 	fn from(e: fjall::Error) -> TxOpError {
-		TxOpError(e.into())
+		DbError::from(e).into()
 	}
 }
 
@@ -76,11 +82,11 @@ impl FjallDb {
 	fn get_tree(
 		&self,
 		i: usize,
-	) -> Result<MappedRwLockReadGuard<'_, TransactionalPartitionHandle>> {
+	) -> DbResult<MappedRwLockReadGuard<'_, TransactionalPartitionHandle>> {
 		RwLockReadGuard::try_map(self.trees.read(), |trees: &Vec<_>| {
 			trees.get(i).map(|tup| &tup.1)
 		})
-		.map_err(|_| Error("invalid tree id".into()))
+		.map_err(|_| DbError("invalid tree id".into()))
 	}
 }
 
@@ -89,7 +95,7 @@ impl IDb for FjallDb {
 		"Fjall (EXPERIMENTAL!)".into()
 	}
 
-	fn open_tree(&self, name: &str) -> Result<usize> {
+	fn open_tree(&self, name: &str) -> DbResult<usize> {
 		let mut trees = self.trees.write();
 		let safe_name = encode_name(name)?;
 		if let Some(i) = trees.iter().position(|(name, _)| *name == safe_name) {
@@ -104,15 +110,15 @@ impl IDb for FjallDb {
 		}
 	}
 
-	fn list_trees(&self) -> Result<Vec<String>> {
+	fn list_trees(&self) -> DbResult<Vec<String>> {
 		self.keyspace
 			.list_partitions()
 			.iter()
 			.map(|n| decode_name(n))
-			.collect::<Result<Vec<_>>>()
+			.collect::<DbResult<Vec<_>>>()
 	}
 
-	fn snapshot(&self, base_path: &Path) -> Result<()> {
+	fn snapshot(&self, base_path: &Path) -> DbResult<()> {
 		std::fs::create_dir_all(base_path)?;
 		let path = Engine::Fjall.db_path(base_path);
 
@@ -138,7 +144,7 @@ impl IDb for FjallDb {
 
 	// ----
 
-	fn get(&self, tree_idx: usize, key: &[u8]) -> Result<Option<Value>> {
+	fn get(&self, tree_idx: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		let val = tx.get(&tree, key)?;
@@ -148,17 +154,17 @@ impl IDb for FjallDb {
 		}
 	}
 
-	fn approximate_len(&self, tree_idx: usize) -> Result<usize> {
+	fn approximate_len(&self, tree_idx: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree_idx)?;
 		Ok(tree.approximate_len())
 	}
-	fn is_empty(&self, tree_idx: usize) -> Result<bool> {
+	fn is_empty(&self, tree_idx: usize) -> DbResult<bool> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		Ok(tx.is_empty(&tree)?)
 	}
 
-	fn insert(&self, tree_idx: usize, key: &[u8], value: &[u8]) -> Result<()> {
+	fn insert(&self, tree_idx: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree_idx)?;
 		let mut tx = self.keyspace.write_tx();
 		tx.insert(&tree, key, value);
@@ -166,7 +172,7 @@ impl IDb for FjallDb {
 		Ok(())
 	}
 
-	fn remove(&self, tree_idx: usize, key: &[u8]) -> Result<()> {
+	fn remove(&self, tree_idx: usize, key: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree_idx)?;
 		let mut tx = self.keyspace.write_tx();
 		tx.remove(&tree, key);
@@ -174,11 +180,11 @@ impl IDb for FjallDb {
 		Ok(())
 	}
 
-	fn clear(&self, tree_idx: usize) -> Result<()> {
+	fn clear(&self, tree_idx: usize) -> DbResult<()> {
 		let mut trees = self.trees.write();
 
 		if tree_idx >= trees.len() {
-			return Err(Error("invalid tree id".into()));
+			return Err(DbError("invalid tree id".into()));
 		}
 		let (name, tree) = trees.remove(tree_idx);
 
@@ -191,13 +197,13 @@ impl IDb for FjallDb {
 		Ok(())
 	}
 
-	fn iter(&self, tree_idx: usize) -> Result<ValueIter<'_>> {
+	fn iter(&self, tree_idx: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		Ok(Box::new(tx.iter(&tree).map(iterator_remap)))
 	}
 
-	fn iter_rev(&self, tree_idx: usize) -> Result<ValueIter<'_>> {
+	fn iter_rev(&self, tree_idx: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		Ok(Box::new(tx.iter(&tree).rev().map(iterator_remap)))
@@ -208,7 +214,7 @@ impl IDb for FjallDb {
 		tree_idx: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		Ok(Box::new(
@@ -221,7 +227,7 @@ impl IDb for FjallDb {
 		tree_idx: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let tx = self.keyspace.read_tx();
 		Ok(Box::new(
@@ -252,9 +258,9 @@ impl IDb for FjallDb {
 			}
 			TxFnResult::DbErr => {
 				tx.tx.rollback();
-				Err(TxError::Db(Error(
+				Err(TxError::Db(
-					"(this message will be discarded)".into(),
+					DbError("(this message will be discarded)".into()).into(),
-				)))
+				))
 			}
 		}
 	}
@@ -268,47 +274,47 @@ struct FjallTx<'a> {
 }
 
 impl<'a> FjallTx<'a> {
-	fn get_tree(&self, i: usize) -> TxOpResult<&TransactionalPartitionHandle> {
+	fn get_tree(&self, i: usize) -> DbResult<&TransactionalPartitionHandle> {
 		self.trees.get(i).map(|tup| &tup.1).ok_or_else(|| {
-			TxOpError(Error(
+			DbError(
 				"invalid tree id (it might have been opened after the transaction started)".into(),
-			))
+			)
 		})
 	}
 }
 
 impl<'a> ITx for FjallTx<'a> {
-	fn get(&self, tree_idx: usize, key: &[u8]) -> TxOpResult<Option<Value>> {
+	fn get(&self, tree_idx: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree_idx)?;
 		match self.tx.get(tree, key)? {
 			Some(v) => Ok(Some(v.to_vec())),
 			None => Ok(None),
 		}
 	}
-	fn len(&self, tree_idx: usize) -> TxOpResult<usize> {
+	fn len(&self, tree_idx: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree_idx)?;
 		Ok(self.tx.len(tree)?)
 	}
 
-	fn insert(&mut self, tree_idx: usize, key: &[u8], value: &[u8]) -> TxOpResult<()> {
+	fn insert(&mut self, tree_idx: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree_idx)?.clone();
 		self.tx.insert(&tree, key, value);
 		Ok(())
 	}
-	fn remove(&mut self, tree_idx: usize, key: &[u8]) -> TxOpResult<()> {
+	fn remove(&mut self, tree_idx: usize, key: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree_idx)?.clone();
 		self.tx.remove(&tree, key);
 		Ok(())
 	}
-	fn clear(&mut self, _tree_idx: usize) -> TxOpResult<()> {
+	fn clear(&mut self, _tree_idx: usize) -> DbResult<()> {
 		unimplemented!("LSM tree clearing in cross-partition transaction is not supported")
 	}
 
-	fn iter(&self, tree_idx: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter(&self, tree_idx: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?.clone();
 		Ok(Box::new(self.tx.iter(&tree).map(iterator_remap_tx)))
 	}
-	fn iter_rev(&self, tree_idx: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter_rev(&self, tree_idx: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?.clone();
 		Ok(Box::new(self.tx.iter(&tree).rev().map(iterator_remap_tx)))
 	}
@@ -318,7 +324,7 @@ impl<'a> ITx for FjallTx<'a> {
 		tree_idx: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let low = clone_bound(low);
 		let high = clone_bound(high);
@@ -333,7 +339,7 @@ impl<'a> ITx for FjallTx<'a> {
 		tree_idx: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree_idx)?;
 		let low = clone_bound(low);
 		let high = clone_bound(high);
@@ -348,14 +354,14 @@ impl<'a> ITx for FjallTx<'a> {
 
 // -- maps fjall's (k, v) to ours
 
-fn iterator_remap(r: fjall::Result<(fjall::Slice, fjall::Slice)>) -> Result<(Value, Value)> {
+fn iterator_remap(r: fjall::Result<(fjall::Slice, fjall::Slice)>) -> DbResult<(Value, Value)> {
 	r.map(|(k, v)| (k.to_vec(), v.to_vec()))
-		.map_err(|e| e.into())
+		.map_err(DbError::from)
 }
 
-fn iterator_remap_tx(r: fjall::Result<(fjall::Slice, fjall::Slice)>) -> TxOpResult<(Value, Value)> {
+fn iterator_remap_tx(r: fjall::Result<(fjall::Slice, fjall::Slice)>) -> DbResult<(Value, Value)> {
 	r.map(|(k, v)| (k.to_vec(), v.to_vec()))
-		.map_err(|e| e.into())
+		.map_err(DbError::from)
 }
 
 // -- utils to deal with Garage's tightness on Bound lifetimes
@@ -378,7 +384,7 @@ fn clone_bound(bound: Bound<&[u8]>) -> ByteVecBound {
 
 // -- utils to encode table names --
 
-fn encode_name(s: &str) -> Result<String> {
+fn encode_name(s: &str) -> DbResult<String> {
 	let base = 'A' as u32;
 
 	let mut ret = String::with_capacity(s.len() + 10);
@@ -392,7 +398,7 @@ fn encode_name(s: &str) -> Result<String> {
 			ret.push(char::from_u32(base + c_hi).unwrap());
 			ret.push(char::from_u32(base + c_lo).unwrap());
 		} else {
-			return Err(Error(
+			return Err(DbError(
 				format!("table name {} could not be safely encoded", s).into(),
 			));
 		}
@@ -400,10 +406,10 @@ fn encode_name(s: &str) -> Result<String> {
 	Ok(ret)
 }
 
-fn decode_name(s: &str) -> Result<String> {
+fn decode_name(s: &str) -> DbResult<String> {
 	use std::convert::TryFrom;
 
-	let errfn = || Error(format!("encoded table name {} is invalid", s).into());
+	let errfn = || DbError(format!("encoded table name {} is invalid", s).into());
 	let c_map = |c: char| {
 		let c = c as u32;
 		let base = 'A' as u32;

src/db/lib.rs

@@ -9,6 +9,7 @@ pub mod lmdb_adapter;
 pub mod sqlite_adapter;
 
 pub mod open;
+pub mod typed;
 
 #[cfg(test)]
 pub mod test;
@@ -23,6 +24,7 @@ use std::sync::Arc;
 use thiserror::Error;
 
 pub use open::*;
+pub use typed::{DbBytes, DbOrdKey, TypedIter, TypedTree, TypedTxIter};
 
 pub(crate) type OnCommit = Vec<Box<dyn FnOnce()>>;
 
@@ -38,21 +40,34 @@ pub struct Transaction<'a> {
 pub struct Tree(Arc<dyn IDb>, usize);
 
 pub type Value = Vec<u8>;
-pub type ValueIter<'a> = Box<dyn std::iter::Iterator<Item = Result<(Value, Value)>> + 'a>;
+pub type ValueIter<'a> = Box<dyn std::iter::Iterator<Item = DbResult<(Value, Value)>> + 'a>;
-pub type TxValueIter<'a> = Box<dyn std::iter::Iterator<Item = TxOpResult<(Value, Value)>> + 'a>;
+pub type TxValueIter<'a> = Box<dyn std::iter::Iterator<Item = DbResult<(Value, Value)>> + 'a>;
 
 // ----
 
 #[derive(Debug, Error)]
-#[error("{0}")]
+#[error("database error: {0}")]
-pub struct Error(pub Cow<'static, str>);
+pub struct DbError(pub Cow<'static, str>);
 
-impl From<std::io::Error> for Error {
+#[derive(Debug, Error)]
-	fn from(e: std::io::Error) -> Error {
+#[error("decode error: {0}")]
-		Error(format!("IO: {}", e).into())
+pub struct DecodeError(pub Cow<'static, str>);
+
+#[derive(Debug, Error)]
+pub enum Error {
+	#[error(transparent)]
+	Db(#[from] DbError),
+	#[error(transparent)]
+	Decode(#[from] DecodeError),
+}
+
+impl From<std::io::Error> for DbError {
+	fn from(e: std::io::Error) -> DbError {
+		DbError(format!("IO: {}", e).into())
 	}
 }
 
+pub type DbResult<T> = std::result::Result<T, DbError>;
 pub type Result<T> = std::result::Result<T, Error>;
 
 #[derive(Debug, Error)]
@@ -60,6 +75,18 @@ pub type Result<T> = std::result::Result<T, Error>;
 pub struct TxOpError(pub(crate) Error);
 pub type TxOpResult<T> = std::result::Result<T, TxOpError>;
 
+impl From<DbError> for TxOpError {
+	fn from(e: DbError) -> TxOpError {
+		TxOpError(e.into())
+	}
+}
+
+impl From<DecodeError> for TxOpError {
+	fn from(e: DecodeError) -> TxOpError {
+		TxOpError(e.into())
+	}
+}
+
 #[derive(Debug)]
 pub enum TxError<E> {
 	Abort(E),
@@ -73,6 +100,12 @@ impl<E> From<TxOpError> for TxError<E> {
 	}
 }
 
+impl<E> From<DbError> for TxError<E> {
+	fn from(e: DbError) -> TxError<E> {
+		TxError::Db(e.into())
+	}
+}
+
 pub fn unabort<R, E>(res: TxResult<R, E>) -> TxOpResult<std::result::Result<R, E>> {
 	match res {
 		Ok(v) => Ok(Ok(v)),
@@ -88,12 +121,12 @@ impl Db {
 		self.0.engine()
 	}
 
-	pub fn open_tree<S: AsRef<str>>(&self, name: S) -> Result<Tree> {
+	pub fn open_tree<S: AsRef<str>>(&self, name: S) -> DbResult<Tree> {
 		let tree_id = self.0.open_tree(name.as_ref())?;
 		Ok(Tree(self.0.clone(), tree_id))
 	}
 
-	pub fn list_trees(&self) -> Result<Vec<String>> {
+	pub fn list_trees(&self) -> DbResult<Vec<String>> {
 		self.0.list_trees()
 	}
 
@@ -147,27 +180,28 @@ impl Db {
 		}
 	}
 
-	pub fn snapshot(&self, path: &Path) -> Result<()> {
+	pub fn snapshot(&self, path: &Path) -> DbResult<()> {
 		self.0.snapshot(path)
 	}
 
 	pub fn import(&self, other: &Db) -> Result<()> {
 		let existing_trees = self.list_trees()?;
 		if !existing_trees.is_empty() {
-			return Err(Error(
+			return Err(DbError(
 				format!(
 					"destination database already contains data: {:?}",
 					existing_trees
 				)
 				.into(),
-			));
+			)
+			.into());
 		}
 
 		let tree_names = other.list_trees()?;
 		for name in tree_names {
 			let tree = self.open_tree(&name)?;
 			if !tree.is_empty()? {
-				return Err(Error(format!("tree {} already contains data", name).into()));
+				return Err(DbError(format!("tree {} already contains data", name).into()).into());
 			}
 
 			let ex_tree = other.open_tree(&name)?;
@@ -186,7 +220,7 @@ impl Db {
 			});
 			let total = match tx_res {
 				Err(TxError::Db(e)) => return Err(e),
-				Err(TxError::Abort(e)) => return Err(e),
+				Err(TxError::Abort(e)) => return Err(e.into()),
 				Ok(x) => x,
 			};
 
@@ -204,24 +238,24 @@ impl Tree {
 	}
 
 	#[inline]
-	pub fn get<T: AsRef<[u8]>>(&self, key: T) -> Result<Option<Value>> {
+	pub fn get<T: AsRef<[u8]>>(&self, key: T) -> DbResult<Option<Value>> {
 		self.0.get(self.1, key.as_ref())
 	}
 	#[inline]
-	pub fn approximate_len(&self) -> Result<usize> {
+	pub fn approximate_len(&self) -> DbResult<usize> {
 		self.0.approximate_len(self.1)
 	}
 	#[inline]
-	pub fn is_empty(&self) -> Result<bool> {
+	pub fn is_empty(&self) -> DbResult<bool> {
 		self.0.is_empty(self.1)
 	}
 
 	#[inline]
-	pub fn first(&self) -> Result<Option<(Value, Value)>> {
+	pub fn first(&self) -> DbResult<Option<(Value, Value)>> {
 		self.iter()?.next().transpose()
 	}
 	#[inline]
-	pub fn get_gt<T: AsRef<[u8]>>(&self, from: T) -> Result<Option<(Value, Value)>> {
+	pub fn get_gt<T: AsRef<[u8]>>(&self, from: T) -> DbResult<Option<(Value, Value)>> {
 		if from.as_ref().is_empty() {
 			self.iter()?.next().transpose()
 		} else {
@@ -233,31 +267,31 @@ impl Tree {
 
 	/// Returns the old value if there was one
 	#[inline]
-	pub fn insert<T: AsRef<[u8]>, U: AsRef<[u8]>>(&self, key: T, value: U) -> Result<()> {
+	pub fn insert<T: AsRef<[u8]>, U: AsRef<[u8]>>(&self, key: T, value: U) -> DbResult<()> {
 		self.0.insert(self.1, key.as_ref(), value.as_ref())
 	}
 	/// Returns the old value if there was one
 	#[inline]
-	pub fn remove<T: AsRef<[u8]>>(&self, key: T) -> Result<()> {
+	pub fn remove<T: AsRef<[u8]>>(&self, key: T) -> DbResult<()> {
 		self.0.remove(self.1, key.as_ref())
 	}
 	/// Clears all values from the tree
 	#[inline]
-	pub fn clear(&self) -> Result<()> {
+	pub fn clear(&self) -> DbResult<()> {
 		self.0.clear(self.1)
 	}
 
 	#[inline]
-	pub fn iter(&self) -> Result<ValueIter<'_>> {
+	pub fn iter(&self) -> DbResult<ValueIter<'_>> {
 		self.0.iter(self.1)
 	}
 	#[inline]
-	pub fn iter_rev(&self) -> Result<ValueIter<'_>> {
+	pub fn iter_rev(&self) -> DbResult<ValueIter<'_>> {
 		self.0.iter_rev(self.1)
 	}
 
 	#[inline]
-	pub fn range<K, R>(&self, range: R) -> Result<ValueIter<'_>>
+	pub fn range<K, R>(&self, range: R) -> DbResult<ValueIter<'_>>
 	where
 		K: AsRef<[u8]>,
 		R: RangeBounds<K>,
@@ -267,7 +301,7 @@ impl Tree {
 		self.0.range(self.1, get_bound(sb), get_bound(eb))
 	}
 	#[inline]
-	pub fn range_rev<K, R>(&self, range: R) -> Result<ValueIter<'_>>
+	pub fn range_rev<K, R>(&self, range: R) -> DbResult<ValueIter<'_>>
 	where
 		K: AsRef<[u8]>,
 		R: RangeBounds<K>,
@@ -282,11 +316,11 @@ impl Tree {
 impl<'a> Transaction<'a> {
 	#[inline]
 	pub fn get<T: AsRef<[u8]>>(&self, tree: &Tree, key: T) -> TxOpResult<Option<Value>> {
-		self.tx.get(tree.1, key.as_ref())
+		self.tx.get(tree.1, key.as_ref()).map_err(Into::into)
 	}
 	#[inline]
 	pub fn len(&self, tree: &Tree) -> TxOpResult<usize> {
-		self.tx.len(tree.1)
+		self.tx.len(tree.1).map_err(Into::into)
 	}
 
 	/// Returns the old value if there was one
@@ -297,26 +331,28 @@ impl<'a> Transaction<'a> {
 		key: T,
 		value: U,
 	) -> TxOpResult<()> {
-		self.tx.insert(tree.1, key.as_ref(), value.as_ref())
+		self.tx
+			.insert(tree.1, key.as_ref(), value.as_ref())
+			.map_err(Into::into)
 	}
 	/// Returns the old value if there was one
 	#[inline]
 	pub fn remove<T: AsRef<[u8]>>(&mut self, tree: &Tree, key: T) -> TxOpResult<()> {
-		self.tx.remove(tree.1, key.as_ref())
+		self.tx.remove(tree.1, key.as_ref()).map_err(Into::into)
 	}
 	/// Clears all values in a tree
 	#[inline]
 	pub fn clear(&mut self, tree: &Tree) -> TxOpResult<()> {
-		self.tx.clear(tree.1)
+		self.tx.clear(tree.1).map_err(Into::into)
 	}
 
 	#[inline]
 	pub fn iter(&self, tree: &Tree) -> TxOpResult<TxValueIter<'_>> {
-		self.tx.iter(tree.1)
+		self.tx.iter(tree.1).map_err(Into::into)
 	}
 	#[inline]
 	pub fn iter_rev(&self, tree: &Tree) -> TxOpResult<TxValueIter<'_>> {
-		self.tx.iter_rev(tree.1)
+		self.tx.iter_rev(tree.1).map_err(Into::into)
 	}
 
 	#[inline]
@@ -327,7 +363,9 @@ impl<'a> Transaction<'a> {
 	{
 		let sb = range.start_bound();
 		let eb = range.end_bound();
-		self.tx.range(tree.1, get_bound(sb), get_bound(eb))
+		self.tx
+			.range(tree.1, get_bound(sb), get_bound(eb))
+			.map_err(Into::into)
 	}
 	#[inline]
 	pub fn range_rev<K, R>(&self, tree: &Tree, range: R) -> TxOpResult<TxValueIter<'_>>
@@ -337,7 +375,9 @@ impl<'a> Transaction<'a> {
 	{
 		let sb = range.start_bound();
 		let eb = range.end_bound();
-		self.tx.range_rev(tree.1, get_bound(sb), get_bound(eb))
+		self.tx
+			.range_rev(tree.1, get_bound(sb), get_bound(eb))
+			.map_err(Into::into)
 	}
 
 	#[inline]
@@ -350,60 +390,60 @@ impl<'a> Transaction<'a> {
 
 pub(crate) trait IDb: Send + Sync {
 	fn engine(&self) -> String;
-	fn open_tree(&self, name: &str) -> Result<usize>;
+	fn open_tree(&self, name: &str) -> DbResult<usize>;
-	fn list_trees(&self) -> Result<Vec<String>>;
+	fn list_trees(&self) -> DbResult<Vec<String>>;
-	fn snapshot(&self, path: &Path) -> Result<()>;
+	fn snapshot(&self, path: &Path) -> DbResult<()>;
 
-	fn get(&self, tree: usize, key: &[u8]) -> Result<Option<Value>>;
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>>;
-	fn approximate_len(&self, tree: usize) -> Result<usize>;
+	fn approximate_len(&self, tree: usize) -> DbResult<usize>;
-	fn is_empty(&self, tree: usize) -> Result<bool>;
+	fn is_empty(&self, tree: usize) -> DbResult<bool>;
 
-	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> Result<()>;
+	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()>;
-	fn remove(&self, tree: usize, key: &[u8]) -> Result<()>;
+	fn remove(&self, tree: usize, key: &[u8]) -> DbResult<()>;
-	fn clear(&self, tree: usize) -> Result<()>;
+	fn clear(&self, tree: usize) -> DbResult<()>;
 
-	fn iter(&self, tree: usize) -> Result<ValueIter<'_>>;
+	fn iter(&self, tree: usize) -> DbResult<ValueIter<'_>>;
-	fn iter_rev(&self, tree: usize) -> Result<ValueIter<'_>>;
+	fn iter_rev(&self, tree: usize) -> DbResult<ValueIter<'_>>;
 
 	fn range<'r>(
 		&self,
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>>;
+	) -> DbResult<ValueIter<'_>>;
 	fn range_rev<'r>(
 		&self,
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>>;
+	) -> DbResult<ValueIter<'_>>;
 
 	fn transaction(&self, f: &dyn ITxFn) -> TxResult<OnCommit, ()>;
 }
 
 pub(crate) trait ITx {
-	fn get(&self, tree: usize, key: &[u8]) -> TxOpResult<Option<Value>>;
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>>;
-	fn len(&self, tree: usize) -> TxOpResult<usize>;
+	fn len(&self, tree: usize) -> DbResult<usize>;
 
-	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> TxOpResult<()>;
+	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()>;
-	fn remove(&mut self, tree: usize, key: &[u8]) -> TxOpResult<()>;
+	fn remove(&mut self, tree: usize, key: &[u8]) -> DbResult<()>;
-	fn clear(&mut self, tree: usize) -> TxOpResult<()>;
+	fn clear(&mut self, tree: usize) -> DbResult<()>;
 
-	fn iter(&self, tree: usize) -> TxOpResult<TxValueIter<'_>>;
+	fn iter(&self, tree: usize) -> DbResult<TxValueIter<'_>>;
-	fn iter_rev(&self, tree: usize) -> TxOpResult<TxValueIter<'_>>;
+	fn iter_rev(&self, tree: usize) -> DbResult<TxValueIter<'_>>;
 
 	fn range<'r>(
 		&self,
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>>;
+	) -> DbResult<TxValueIter<'_>>;
 	fn range_rev<'r>(
 		&self,
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>>;
+	) -> DbResult<TxValueIter<'_>>;
 }
 
 pub(crate) trait ITxFn {

src/db/lmdb_adapter.rs

@@ -14,7 +14,7 @@ type Database = heed::Database<Bytes, Bytes>;
 
 use crate::{
 	open::{Engine, OpenOpt},
-	Db, Error, IDb, ITx, ITxFn, OnCommit, Result, TxError, TxFnResult, TxOpError, TxOpResult,
+	Db, DbError, DbResult, Error, IDb, ITx, ITxFn, OnCommit, TxError, TxFnResult, TxOpError,
 	TxResult, TxValueIter, Value, ValueIter,
 };
 
@@ -22,10 +22,10 @@ pub use heed;
 
 // ---- top-level open function
 
-pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> Result<Db> {
+pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> DbResult<Db> {
 	info!("Opening LMDB database at: {}", path.display());
 	if let Err(e) = std::fs::create_dir_all(path) {
-		return Err(Error(
+		return Err(DbError(
 			format!("Unable to create LMDB data directory: {}", e).into(),
 		));
 	}
@@ -48,7 +48,7 @@ pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> Result<Db> {
 		env_builder.open(path)
 	};
 	match open_res {
-		Err(heed::Error::Io(e)) if e.kind() == std::io::ErrorKind::OutOfMemory => Err(Error(
+		Err(heed::Error::Io(e)) if e.kind() == std::io::ErrorKind::OutOfMemory => Err(DbError(
 			"OutOfMemory error while trying to open LMDB database. This can happen \
                 if your operating system is not allowing you to use sufficient virtual \
                 memory address space. Please check that no limit is set (ulimit -v). \
@@ -56,22 +56,28 @@ pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> Result<Db> {
                 On 32-bit machines, you should probably switch to another database engine."
 				.into(),
 		)),
-		Err(e) => Err(Error(format!("Cannot open LMDB database: {}", e).into())),
+		Err(e) => Err(DbError(format!("Cannot open LMDB database: {}", e).into())),
 		Ok(db) => Ok(LmdbDb::init(db)),
 	}
 }
 
 // -- err
 
+impl From<heed::Error> for DbError {
+	fn from(e: heed::Error) -> DbError {
+		DbError(format!("LMDB: {}", e).into())
+	}
+}
+
 impl From<heed::Error> for Error {
 	fn from(e: heed::Error) -> Error {
-		Error(format!("LMDB: {}", e).into())
+		DbError::from(e).into()
 	}
 }
 
 impl From<heed::Error> for TxOpError {
 	fn from(e: heed::Error) -> TxOpError {
-		TxOpError(e.into())
+		DbError::from(e).into()
 	}
 }
 
@@ -91,14 +97,14 @@ impl LmdbDb {
 		Db(Arc::new(s))
 	}
 
-	fn get_tree(&self, i: usize) -> Result<Database> {
+	fn get_tree(&self, i: usize) -> DbResult<Database> {
 		self.trees
 			.read()
 			.unwrap()
 			.0
 			.get(i)
 			.cloned()
-			.ok_or_else(|| Error("invalid tree id".into()))
+			.ok_or_else(|| DbError("invalid tree id".into()))
 	}
 }
 
@@ -107,7 +113,7 @@ impl IDb for LmdbDb {
 		"LMDB (using Heed crate)".into()
 	}
 
-	fn open_tree(&self, name: &str) -> Result<usize> {
+	fn open_tree(&self, name: &str) -> DbResult<usize> {
 		let mut trees = self.trees.write().unwrap();
 		if let Some(i) = trees.1.get(name) {
 			Ok(*i)
@@ -122,7 +128,7 @@ impl IDb for LmdbDb {
 		}
 	}
 
-	fn list_trees(&self) -> Result<Vec<String>> {
+	fn list_trees(&self) -> DbResult<Vec<String>> {
 		let rtxn = self.db.read_txn()?;
 		let tree0 = match self
 			.db
@@ -153,7 +159,7 @@ impl IDb for LmdbDb {
 		Ok(ret2)
 	}
 
-	fn snapshot(&self, base_path: &Path) -> Result<()> {
+	fn snapshot(&self, base_path: &Path) -> DbResult<()> {
 		std::fs::create_dir_all(base_path)?;
 		let path = Engine::Lmdb.db_path(base_path);
 		self.db
@@ -163,7 +169,7 @@ impl IDb for LmdbDb {
 
 	// ----
 
-	fn get(&self, tree: usize, key: &[u8]) -> Result<Option<Value>> {
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree)?;
 
 		let tx = self.db.read_txn()?;
@@ -174,18 +180,18 @@ impl IDb for LmdbDb {
 		}
 	}
 
-	fn approximate_len(&self, tree: usize) -> Result<usize> {
+	fn approximate_len(&self, tree: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		Ok(tree.len(&tx)?.try_into().unwrap())
 	}
-	fn is_empty(&self, tree: usize) -> Result<bool> {
+	fn is_empty(&self, tree: usize) -> DbResult<bool> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		Ok(tree.is_empty(&tx)?)
 	}
 
-	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> Result<()> {
+	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let mut tx = self.db.write_txn()?;
 		tree.put(&mut tx, key, value)?;
@@ -193,7 +199,7 @@ impl IDb for LmdbDb {
 		Ok(())
 	}
 
-	fn remove(&self, tree: usize, key: &[u8]) -> Result<()> {
+	fn remove(&self, tree: usize, key: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let mut tx = self.db.write_txn()?;
 		tree.delete(&mut tx, key)?;
@@ -201,7 +207,7 @@ impl IDb for LmdbDb {
 		Ok(())
 	}
 
-	fn clear(&self, tree: usize) -> Result<()> {
+	fn clear(&self, tree: usize) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let mut tx = self.db.write_txn()?;
 		tree.clear(&mut tx)?;
@@ -209,14 +215,14 @@ impl IDb for LmdbDb {
 		Ok(())
 	}
 
-	fn iter(&self, tree: usize) -> Result<ValueIter<'_>> {
+	fn iter(&self, tree: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		// Safety: the cloture does not store its argument anywhere,
 		unsafe { TxAndIterator::make(tx, |tx| Ok(tree.iter(tx)?)) }
 	}
 
-	fn iter_rev(&self, tree: usize) -> Result<ValueIter<'_>> {
+	fn iter_rev(&self, tree: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		// Safety: the cloture does not store its argument anywhere,
@@ -228,7 +234,7 @@ impl IDb for LmdbDb {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		// Safety: the cloture does not store its argument anywhere,
@@ -239,7 +245,7 @@ impl IDb for LmdbDb {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let tx = self.db.read_txn()?;
 		// Safety: the cloture does not store its argument anywhere,
@@ -271,9 +277,9 @@ impl IDb for LmdbDb {
 			}
 			TxFnResult::DbErr => {
 				tx.tx.abort();
-				Err(TxError::Db(Error(
+				Err(TxError::Db(
-					"(this message will be discarded)".into(),
+					DbError("(this message will be discarded)".into()).into(),
-				)))
+				))
 			}
 		}
 	}
@@ -287,49 +293,49 @@ struct LmdbTx<'a> {
 }
 
 impl<'a> LmdbTx<'a> {
-	fn get_tree(&self, i: usize) -> TxOpResult<&Database> {
+	fn get_tree(&self, i: usize) -> DbResult<&Database> {
 		self.trees.get(i).ok_or_else(|| {
-			TxOpError(Error(
+			DbError(
 				"invalid tree id (it might have been opened after the transaction started)".into(),
-			))
+			)
 		})
 	}
 }
 
 impl<'a> ITx for LmdbTx<'a> {
-	fn get(&self, tree: usize, key: &[u8]) -> TxOpResult<Option<Value>> {
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree)?;
 		match tree.get(&self.tx, key)? {
 			Some(v) => Ok(Some(v.to_vec())),
 			None => Ok(None),
 		}
 	}
-	fn len(&self, tree: usize) -> TxOpResult<usize> {
+	fn len(&self, tree: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree)?;
 		Ok(tree.len(&self.tx)? as usize)
 	}
 
-	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> TxOpResult<()> {
+	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = *self.get_tree(tree)?;
 		tree.put(&mut self.tx, key, value)?;
 		Ok(())
 	}
-	fn remove(&mut self, tree: usize, key: &[u8]) -> TxOpResult<()> {
+	fn remove(&mut self, tree: usize, key: &[u8]) -> DbResult<()> {
 		let tree = *self.get_tree(tree)?;
 		tree.delete(&mut self.tx, key)?;
 		Ok(())
 	}
-	fn clear(&mut self, tree: usize) -> TxOpResult<()> {
+	fn clear(&mut self, tree: usize) -> DbResult<()> {
 		let tree = *self.get_tree(tree)?;
 		tree.clear(&mut self.tx)?;
 		Ok(())
 	}
 
-	fn iter(&self, tree: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter(&self, tree: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = *self.get_tree(tree)?;
 		Ok(Box::new(tree.iter(&self.tx)?.map(tx_iter_item)))
 	}
-	fn iter_rev(&self, tree: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter_rev(&self, tree: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = *self.get_tree(tree)?;
 		Ok(Box::new(tree.rev_iter(&self.tx)?.map(tx_iter_item)))
 	}
@@ -339,7 +345,7 @@ impl<'a> ITx for LmdbTx<'a> {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = *self.get_tree(tree)?;
 		Ok(Box::new(
 			tree.range(&self.tx, &(low, high))?.map(tx_iter_item),
@@ -350,7 +356,7 @@ impl<'a> ITx for LmdbTx<'a> {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = *self.get_tree(tree)?;
 		Ok(Box::new(
 			tree.rev_range(&self.tx, &(low, high))?.map(tx_iter_item),
@@ -386,9 +392,9 @@ where
 	}
 
 	/// Safety: iterfun must not store its argument anywhere but in its result.
-	unsafe fn make<F>(tx: RoTxn<'a, WithTls>, iterfun: F) -> Result<ValueIter<'a>>
+	unsafe fn make<F>(tx: RoTxn<'a, WithTls>, iterfun: F) -> DbResult<ValueIter<'a>>
 	where
-		F: FnOnce(&'a RoTxn<'a>) -> Result<I>,
+		F: FnOnce(&'a RoTxn<'a>) -> DbResult<I>,
 	{
 		let res = TxAndIterator {
 			tx,
@@ -436,13 +442,13 @@ impl<'a, I> Iterator for TxAndIteratorPin<'a, I>
 where
 	I: Iterator<Item = IteratorItem<'a>> + 'a,
 {
-	type Item = Result<(Value, Value)>;
+	type Item = DbResult<(Value, Value)>;
 
 	fn next(&mut self) -> Option<Self::Item> {
 		let mut_ref = Pin::as_mut(&mut self.0);
 		let next = mut_ref.iter().as_mut()?.next()?;
 		let res = match next {
-			Err(e) => Err(e.into()),
+			Err(e) => Err(DbError::from(e)),
 			Ok((k, v)) => Ok((k.to_vec(), v.to_vec())),
 		};
 		Some(res)
@@ -453,9 +459,9 @@ where
 
 fn tx_iter_item<'a>(
 	item: std::result::Result<(&'a [u8], &'a [u8]), heed::Error>,
-) -> TxOpResult<(Vec<u8>, Vec<u8>)> {
+) -> DbResult<(Vec<u8>, Vec<u8>)> {
 	item.map(|(k, v)| (k.to_vec(), v.to_vec()))
-		.map_err(|e| TxOpError(Error::from(e)))
+		.map_err(DbError::from)
 }
 
 // ---- utility ----

src/db/open.rs

@@ -1,6 +1,6 @@
 use std::path::{Path, PathBuf};
 
-use crate::{Db, Error, Result};
+use crate::{Db, DbError, Error, Result};
 
 /// List of supported database engine types
 ///
@@ -49,14 +49,14 @@ impl std::str::FromStr for Engine {
 			"lmdb" | "heed" => Ok(Self::Lmdb),
 			"sqlite" | "sqlite3" | "rusqlite" => Ok(Self::Sqlite),
             "fjall" => Ok(Self::Fjall),
-			"sled" => Err(Error("Sled is no longer supported as a database engine. Converting your old metadata db can be done using an older Garage binary (e.g. v0.9.4).".into())),
+			"sled" => Err(DbError("Sled is no longer supported as a database engine. Converting your old metadata db can be done using an older Garage binary (e.g. v0.9.4).".into()).into()),
-			kind => Err(Error(
+			kind => Err(DbError(
 				format!(
 					"Invalid DB engine: {} (options are: lmdb, sqlite, fjall)",
 					kind
 				)
 				.into(),
-			)),
+			).into()),
 		}
 	}
 }
@@ -72,22 +72,23 @@ pub fn open_db(path: &PathBuf, engine: Engine, opt: &OpenOpt) -> Result<Db> {
 	match engine {
 		// ---- Sqlite DB ----
 		#[cfg(feature = "sqlite")]
-		Engine::Sqlite => crate::sqlite_adapter::open_db(path, opt),
+		Engine::Sqlite => Ok(crate::sqlite_adapter::open_db(path, opt)?),
 
 		// ---- LMDB DB ----
 		#[cfg(feature = "lmdb")]
-		Engine::Lmdb => crate::lmdb_adapter::open_db(path, opt),
+		Engine::Lmdb => Ok(crate::lmdb_adapter::open_db(path, opt)?),
 
 		// ---- Fjall DB ----
 		#[cfg(feature = "fjall")]
-		Engine::Fjall => crate::fjall_adapter::open_db(path, opt),
+		Engine::Fjall => Ok(crate::fjall_adapter::open_db(path, opt)?),
 
 		// Pattern is unreachable when all supported DB engines are compiled into binary. The allow
 		// attribute is added so that we won't have to change this match in case stop building
 		// support for one or more engines by default.
 		#[allow(unreachable_patterns)]
-		engine => Err(Error(
+		engine => Err(DbError(
 			format!("DB engine support not available in this build: {}", engine).into(),
-		)),
+		)
+		.into()),
 	}
 }

src/db/sqlite_adapter.rs

@@ -12,7 +12,7 @@ use rusqlite::{params, Rows, Statement, Transaction};
 
 use crate::{
 	open::{Engine, OpenOpt},
-	Db, Error, IDb, ITx, ITxFn, OnCommit, Result, TxError, TxFnResult, TxOpError, TxOpResult,
+	Db, DbError, DbResult, Error, IDb, ITx, ITxFn, OnCommit, TxError, TxFnResult, TxOpError,
 	TxResult, TxValueIter, Value, ValueIter,
 };
 
@@ -20,7 +20,7 @@ pub use rusqlite;
 
 // ---- top-level open function
 
-pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> Result<Db> {
+pub(crate) fn open_db(path: &PathBuf, opt: &OpenOpt) -> DbResult<Db> {
 	info!("Opening Sqlite database at: {}", path.display());
 	let manager = r2d2_sqlite::SqliteConnectionManager::file(path);
 	SqliteDb::open(manager, opt.fsync)
@@ -32,21 +32,33 @@ type Connection = r2d2::PooledConnection<SqliteConnectionManager>;
 
 // --- err
 
+impl From<rusqlite::Error> for DbError {
+	fn from(e: rusqlite::Error) -> DbError {
+		DbError(format!("Sqlite: {}", e).into())
+	}
+}
+
 impl From<rusqlite::Error> for Error {
 	fn from(e: rusqlite::Error) -> Error {
-		Error(format!("Sqlite: {}", e).into())
+		DbError::from(e).into()
+	}
+}
+
+impl From<r2d2::Error> for DbError {
+	fn from(e: r2d2::Error) -> DbError {
+		DbError(format!("Sqlite: {}", e).into())
 	}
 }
 
 impl From<r2d2::Error> for Error {
 	fn from(e: r2d2::Error) -> Error {
-		Error(format!("Sqlite: {}", e).into())
+		DbError::from(e).into()
 	}
 }
 
 impl From<rusqlite::Error> for TxOpError {
 	fn from(e: rusqlite::Error) -> TxOpError {
-		TxOpError(e.into())
+		DbError::from(e).into()
 	}
 }
 
@@ -62,7 +74,7 @@ pub struct SqliteDb {
 }
 
 impl SqliteDb {
-	pub fn open(manager: SqliteConnectionManager, sync_mode: bool) -> Result<Db> {
+	pub fn open(manager: SqliteConnectionManager, sync_mode: bool) -> DbResult<Db> {
 		let manager = manager.with_init(move |db| {
 			db.pragma_update(None, "journal_mode", "WAL")?;
 			if sync_mode {
@@ -82,16 +94,16 @@ impl SqliteDb {
 }
 
 impl SqliteDb {
-	fn get_tree(&self, i: usize) -> Result<Arc<str>> {
+	fn get_tree(&self, i: usize) -> DbResult<Arc<str>> {
 		self.trees
 			.read()
 			.unwrap()
 			.get(i)
 			.cloned()
-			.ok_or_else(|| Error("invalid tree id".into()))
+			.ok_or_else(|| DbError("invalid tree id".into()))
 	}
 
-	fn internal_get(&self, db: &Connection, tree: &str, key: &[u8]) -> Result<Option<Value>> {
+	fn internal_get(&self, db: &Connection, tree: &str, key: &[u8]) -> DbResult<Option<Value>> {
 		let mut stmt = db.prepare(&format!("SELECT v FROM {} WHERE k = ?1", tree))?;
 		let mut res_iter = stmt.query([key])?;
 		match res_iter.next()? {
@@ -106,7 +118,7 @@ impl IDb for SqliteDb {
 		format!("sqlite3 v{} (using rusqlite crate)", rusqlite::version())
 	}
 
-	fn open_tree(&self, name: &str) -> Result<usize> {
+	fn open_tree(&self, name: &str) -> DbResult<usize> {
 		let name = format!("tree_{}", name.replace(':', "_COLON_"));
 		let mut trees = self.trees.write().unwrap();
 
@@ -133,7 +145,7 @@ impl IDb for SqliteDb {
 		}
 	}
 
-	fn list_trees(&self) -> Result<Vec<String>> {
+	fn list_trees(&self) -> DbResult<Vec<String>> {
 		let mut trees = vec![];
 
 		let db = self.db.get()?;
@@ -150,13 +162,13 @@ impl IDb for SqliteDb {
 		Ok(trees)
 	}
 
-	fn snapshot(&self, base_path: &Path) -> Result<()> {
+	fn snapshot(&self, base_path: &Path) -> DbResult<()> {
 		std::fs::create_dir_all(base_path)?;
 		let path = Engine::Sqlite
 			.db_path(base_path)
 			.into_os_string()
 			.into_string()
-			.map_err(|_| Error("invalid sqlite path string".into()))?;
+			.map_err(|_| DbError("invalid sqlite path string".into()))?;
 
 		info!("Start sqlite VACUUM INTO `{}`", path);
 		self.db.get()?.execute("VACUUM INTO ?1", params![path])?;
@@ -167,12 +179,12 @@ impl IDb for SqliteDb {
 
 	// ----
 
-	fn get(&self, tree: usize, key: &[u8]) -> Result<Option<Value>> {
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree)?;
 		self.internal_get(&self.db.get()?, &tree, key)
 	}
 
-	fn approximate_len(&self, tree: usize) -> Result<usize> {
+	fn approximate_len(&self, tree: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree)?;
 		let db = self.db.get()?;
 
@@ -184,11 +196,11 @@ impl IDb for SqliteDb {
 		}
 	}
 
-	fn is_empty(&self, tree: usize) -> Result<bool> {
+	fn is_empty(&self, tree: usize) -> DbResult<bool> {
 		Ok(self.approximate_len(tree)? == 0)
 	}
 
-	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> Result<()> {
+	fn insert(&self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let db = self.db.get()?;
 		let lock = self.write_lock.lock();
@@ -206,7 +218,7 @@ impl IDb for SqliteDb {
 		Ok(())
 	}
 
-	fn remove(&self, tree: usize, key: &[u8]) -> Result<()> {
+	fn remove(&self, tree: usize, key: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let db = self.db.get()?;
 		let lock = self.write_lock.lock();
@@ -217,7 +229,7 @@ impl IDb for SqliteDb {
 		Ok(())
 	}
 
-	fn clear(&self, tree: usize) -> Result<()> {
+	fn clear(&self, tree: usize) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let db = self.db.get()?;
 		let lock = self.write_lock.lock();
@@ -228,13 +240,13 @@ impl IDb for SqliteDb {
 		Ok(())
 	}
 
-	fn iter(&self, tree: usize) -> Result<ValueIter<'_>> {
+	fn iter(&self, tree: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let sql = format!("SELECT k, v FROM {} ORDER BY k ASC", tree);
 		DbValueIterator::make(self.db.get()?, &sql, [])
 	}
 
-	fn iter_rev(&self, tree: usize) -> Result<ValueIter<'_>> {
+	fn iter_rev(&self, tree: usize) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let sql = format!("SELECT k, v FROM {} ORDER BY k DESC", tree);
 		DbValueIterator::make(self.db.get()?, &sql, [])
@@ -245,7 +257,7 @@ impl IDb for SqliteDb {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 
 		let (bounds_sql, params) = bounds_sql(low, high);
@@ -263,7 +275,7 @@ impl IDb for SqliteDb {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> Result<ValueIter<'_>> {
+	) -> DbResult<ValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 
 		let (bounds_sql, params) = bounds_sql(low, high);
@@ -300,9 +312,9 @@ impl IDb for SqliteDb {
 			}
 			TxFnResult::DbErr => {
 				tx.tx.rollback().map_err(Error::from).map_err(TxError::Db)?;
-				Err(TxError::Db(Error(
+				Err(TxError::Db(
-					"(this message will be discarded)".into(),
+					DbError("(this message will be discarded)".into()).into(),
-				)))
+				))
 			}
 		};
 
@@ -320,15 +332,15 @@ struct SqliteTx<'a> {
 }
 
 impl<'a> SqliteTx<'a> {
-	fn get_tree(&self, i: usize) -> TxOpResult<&'_ str> {
+	fn get_tree(&self, i: usize) -> DbResult<&'_ str> {
 		self.trees.get(i).map(Arc::as_ref).ok_or_else(|| {
-			TxOpError(Error(
+			DbError(
 				"invalid tree id (it might have been opened after the transaction started)".into(),
-			))
+			)
 		})
 	}
 
-	fn internal_get(&self, tree: &str, key: &[u8]) -> TxOpResult<Option<Value>> {
+	fn internal_get(&self, tree: &str, key: &[u8]) -> DbResult<Option<Value>> {
 		let mut stmt = self
 			.tx
 			.prepare(&format!("SELECT v FROM {} WHERE k = ?1", tree))?;
@@ -341,11 +353,11 @@ impl<'a> SqliteTx<'a> {
 }
 
 impl<'a> ITx for SqliteTx<'a> {
-	fn get(&self, tree: usize, key: &[u8]) -> TxOpResult<Option<Value>> {
+	fn get(&self, tree: usize, key: &[u8]) -> DbResult<Option<Value>> {
 		let tree = self.get_tree(tree)?;
 		self.internal_get(tree, key)
 	}
-	fn len(&self, tree: usize) -> TxOpResult<usize> {
+	fn len(&self, tree: usize) -> DbResult<usize> {
 		let tree = self.get_tree(tree)?;
 		let mut stmt = self.tx.prepare(&format!("SELECT COUNT(*) FROM {}", tree))?;
 		let mut res_iter = stmt.query([])?;
@@ -355,30 +367,30 @@ impl<'a> ITx for SqliteTx<'a> {
 		}
 	}
 
-	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> TxOpResult<()> {
+	fn insert(&mut self, tree: usize, key: &[u8], value: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		let sql = format!("INSERT OR REPLACE INTO {} (k, v) VALUES (?1, ?2)", tree);
 		self.tx.execute(&sql, params![key, value])?;
 		Ok(())
 	}
-	fn remove(&mut self, tree: usize, key: &[u8]) -> TxOpResult<()> {
+	fn remove(&mut self, tree: usize, key: &[u8]) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		self.tx
 			.execute(&format!("DELETE FROM {} WHERE k = ?1", tree), params![key])?;
 		Ok(())
 	}
-	fn clear(&mut self, tree: usize) -> TxOpResult<()> {
+	fn clear(&mut self, tree: usize) -> DbResult<()> {
 		let tree = self.get_tree(tree)?;
 		self.tx.execute(&format!("DELETE FROM {}", tree), [])?;
 		Ok(())
 	}
 
-	fn iter(&self, tree: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter(&self, tree: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let sql = format!("SELECT k, v FROM {} ORDER BY k ASC", tree);
 		TxValueIterator::make(self, &sql, [])
 	}
-	fn iter_rev(&self, tree: usize) -> TxOpResult<TxValueIter<'_>> {
+	fn iter_rev(&self, tree: usize) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 		let sql = format!("SELECT k, v FROM {} ORDER BY k DESC", tree);
 		TxValueIterator::make(self, &sql, [])
@@ -389,7 +401,7 @@ impl<'a> ITx for SqliteTx<'a> {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 
 		let (bounds_sql, params) = bounds_sql(low, high);
@@ -407,7 +419,7 @@ impl<'a> ITx for SqliteTx<'a> {
 		tree: usize,
 		low: Bound<&'r [u8]>,
 		high: Bound<&'r [u8]>,
-	) -> TxOpResult<TxValueIter<'_>> {
+	) -> DbResult<TxValueIter<'_>> {
 		let tree = self.get_tree(tree)?;
 
 		let (bounds_sql, params) = bounds_sql(low, high);
@@ -426,15 +438,20 @@ impl<'a> ITx for SqliteTx<'a> {
 // complicated, they must hold the Statement and Row objects
 // therefore quite some unsafe code (it is a self-referential struct)
 
-struct DbValueIterator<'a> {
+struct DbValueIterator {
 	db: Connection,
-	stmt: Option<Statement<'a>>,
+	// These two are not really static (they are actually self referential :o)
-	iter: Option<Rows<'a>>,
+	stmt: Option<Statement<'static>>,
+	iter: Option<Rows<'static>>,
 	_pin: PhantomPinned,
 }
 
-impl<'a> DbValueIterator<'a> {
+impl DbValueIterator {
-	fn make<P: rusqlite::Params>(db: Connection, sql: &str, args: P) -> Result<ValueIter<'a>> {
+	fn make<'res, P: rusqlite::Params>(
+		db: Connection,
+		sql: &str,
+		args: P,
+	) -> DbResult<ValueIter<'res>> {
 		let res = DbValueIterator {
 			db,
 			stmt: None,
@@ -468,7 +485,7 @@ impl<'a> DbValueIterator<'a> {
 	}
 }
 
-impl<'a> Drop for DbValueIterator<'a> {
+impl Drop for DbValueIterator {
 	fn drop(&mut self) {
 		trace!("drop iter");
 		drop(self.iter.take());
@@ -476,10 +493,10 @@ impl<'a> Drop for DbValueIterator<'a> {
 	}
 }
 
-struct DbValueIteratorPin<'a>(Pin<Box<DbValueIterator<'a>>>);
+struct DbValueIteratorPin(Pin<Box<DbValueIterator>>);
 
-impl<'a> Iterator for DbValueIteratorPin<'a> {
+impl Iterator for DbValueIteratorPin {
-	type Item = Result<(Value, Value)>;
+	type Item = DbResult<(Value, Value)>;
 
 	fn next(&mut self) -> Option<Self::Item> {
 		let mut_ref = Pin::as_mut(&mut self.0);
@@ -504,7 +521,7 @@ impl<'a> TxValueIterator<'a> {
 		tx: &'a SqliteTx<'a>,
 		sql: &str,
 		args: P,
-	) -> TxOpResult<TxValueIter<'a>> {
+	) -> DbResult<TxValueIter<'a>> {
 		let stmt = tx.tx.prepare(sql)?;
 		let res = TxValueIterator {
 			stmt,
@@ -538,7 +555,7 @@ impl<'a> Drop for TxValueIterator<'a> {
 struct TxValueIteratorPin<'a>(Pin<Box<TxValueIterator<'a>>>);
 
 impl<'a> Iterator for TxValueIteratorPin<'a> {
-	type Item = TxOpResult<(Value, Value)>;
+	type Item = DbResult<(Value, Value)>;
 
 	fn next(&mut self) -> Option<Self::Item> {
 		let mut_ref = Pin::as_mut(&mut self.0);

src/db/typed.rs

@@ -0,0 +1,241 @@
+use std::marker::PhantomData;
+use std::ops::{Bound, RangeBounds};
+
+// Todo: some parts of this code, notably around ranges are never used but are here to prepare
+// the migration of the parts of the codebase that still use untyped trees. At one point, this
+// migration should be done or these functions deleted.
+
+use super::{
+	DbResult, DecodeError, Error, Result, Transaction, Tree, TxOpError, TxOpResult, TxValueIter,
+	ValueIter,
+};
+
+pub use super::Db;
+
+pub trait DbBytes: Sized {
+	fn encode(&self) -> Vec<u8>;
+	fn decode(bytes: &[u8]) -> std::result::Result<Self, DecodeError>;
+}
+
+/// Subtrait of [`DbBytes`] for types used as tree keys with operations where order matters
+/// (`get_gt`, range, etc...).
+///
+/// Implementors must guarantee that the byte encoding is order-preserving:
+/// for any `a, b: Self`, `a.cmp(&b) == a.encode().cmp(&b.encode())`.
+pub trait DbOrdKey: DbBytes + Ord {}
+
+#[derive(Clone)]
+pub struct TypedTree<K, V> {
+	inner: Tree,
+	_phantom: PhantomData<[(K, V)]>,
+}
+
+impl<K: DbBytes, V: DbBytes> TypedTree<K, V> {
+	pub fn new(tree: Tree) -> Self {
+		Self {
+			inner: tree,
+			_phantom: PhantomData,
+		}
+	}
+
+	pub fn db(&self) -> Db {
+		self.inner.db()
+	}
+
+	pub fn untyped(&self) -> &Tree {
+		&self.inner
+	}
+
+	pub fn get(&self, key: &K) -> Result<Option<V>> {
+		self.inner
+			.get(key.encode())?
+			.map(|v| V::decode(&v).map_err(Error::from))
+			.transpose()
+	}
+
+	pub fn approximate_len(&self) -> DbResult<usize> {
+		self.inner.approximate_len()
+	}
+
+	pub fn is_empty(&self) -> DbResult<bool> {
+		self.inner.is_empty()
+	}
+
+	pub fn insert(&self, key: &K, value: &V) -> DbResult<()> {
+		self.inner.insert(key.encode(), value.encode())
+	}
+
+	pub fn remove(&self, key: &K) -> DbResult<()> {
+		self.inner.remove(key.encode())
+	}
+
+	pub fn clear(&self) -> DbResult<()> {
+		self.inner.clear()
+	}
+
+	pub fn tx_get(&self, tx: &Transaction<'_>, key: &K) -> TxOpResult<Option<V>> {
+		tx.get(&self.inner, key.encode())?
+			.map(|v| V::decode(&v).map_err(TxOpError::from))
+			.transpose()
+	}
+
+	pub fn tx_insert(&self, tx: &mut Transaction<'_>, key: &K, value: &V) -> TxOpResult<()> {
+		tx.insert(&self.inner, key.encode(), value.encode())
+	}
+
+	pub fn tx_remove(&self, tx: &mut Transaction<'_>, key: &K) -> TxOpResult<()> {
+		tx.remove(&self.inner, key.encode())
+	}
+
+	pub fn tx_clear(&self, tx: &mut Transaction<'_>) -> TxOpResult<()> {
+		tx.clear(&self.inner)
+	}
+}
+
+impl<K: DbOrdKey, V: DbBytes> TypedTree<K, V> {
+	pub fn first(&self) -> Result<Option<(K, V)>> {
+		self.iter()?.next().transpose()
+	}
+
+	pub fn get_gt(&self, from: &K) -> Result<Option<(K, V)>> {
+		self.inner
+			.get_gt(from.encode())?
+			.map(|(k, v)| {
+				Ok((
+					K::decode(&k).map_err(Error::from)?,
+					V::decode(&v).map_err(Error::from)?,
+				))
+			})
+			.transpose()
+	}
+
+	pub fn iter(&self) -> Result<TypedIter<'_, K, V>> {
+		Ok(TypedIter::new(self.inner.iter()?))
+	}
+
+	pub fn iter_rev(&self) -> Result<TypedIter<'_, K, V>> {
+		Ok(TypedIter::new(self.inner.iter_rev()?))
+	}
+
+	pub fn range<R: RangeBounds<K>>(&self, range: R) -> Result<TypedIter<'_, K, V>> {
+		Ok(TypedIter::new(self.inner.range(encode_range(range))?))
+	}
+
+	pub fn range_rev<R: RangeBounds<K>>(&self, range: R) -> Result<TypedIter<'_, K, V>> {
+		Ok(TypedIter::new(self.inner.range_rev(encode_range(range))?))
+	}
+
+	pub fn tx_iter<'t>(&self, tx: &'t Transaction<'_>) -> TxOpResult<TypedTxIter<'t, K, V>> {
+		Ok(TypedTxIter::new(tx.iter(&self.inner)?))
+	}
+
+	pub fn tx_iter_rev<'t>(&self, tx: &'t Transaction<'_>) -> TxOpResult<TypedTxIter<'t, K, V>> {
+		Ok(TypedTxIter::new(tx.iter_rev(&self.inner)?))
+	}
+
+	pub fn tx_range<'t, R: RangeBounds<K>>(
+		&self,
+		tx: &'t Transaction<'_>,
+		range: R,
+	) -> TxOpResult<TypedTxIter<'t, K, V>> {
+		Ok(TypedTxIter::new(
+			tx.range(&self.inner, encode_range(range))?,
+		))
+	}
+
+	pub fn tx_range_rev<'t, R: RangeBounds<K>>(
+		&self,
+		tx: &'t Transaction<'_>,
+		range: R,
+	) -> TxOpResult<TypedTxIter<'t, K, V>> {
+		Ok(TypedTxIter::new(
+			tx.range_rev(&self.inner, encode_range(range))?,
+		))
+	}
+}
+
+impl<K: DbBytes, V: DbBytes> From<Tree> for TypedTree<K, V> {
+	fn from(tree: Tree) -> Self {
+		Self::new(tree)
+	}
+}
+
+impl Db {
+	pub fn open_typed_tree<K: DbBytes, V: DbBytes, S: AsRef<str>>(
+		&self,
+		name: S,
+	) -> DbResult<TypedTree<K, V>> {
+		Ok(TypedTree::new(self.open_tree(name)?))
+	}
+}
+
+pub struct TypedIter<'a, K, V> {
+	inner: ValueIter<'a>,
+	_phantom: PhantomData<(K, V)>,
+}
+
+impl<'a, K, V> TypedIter<'a, K, V> {
+	fn new(inner: ValueIter<'a>) -> Self {
+		Self {
+			inner,
+			_phantom: PhantomData,
+		}
+	}
+}
+
+impl<K: DbOrdKey, V: DbBytes> Iterator for TypedIter<'_, K, V> {
+	type Item = Result<(K, V)>;
+
+	fn next(&mut self) -> Option<Self::Item> {
+		self.inner.next().map(|res| {
+			let (k, v) = res?;
+			Ok((
+				K::decode(&k).map_err(Error::from)?,
+				V::decode(&v).map_err(Error::from)?,
+			))
+		})
+	}
+}
+
+pub struct TypedTxIter<'a, K, V> {
+	inner: TxValueIter<'a>,
+	_phantom: PhantomData<(K, V)>,
+}
+
+impl<'a, K, V> TypedTxIter<'a, K, V> {
+	fn new(inner: TxValueIter<'a>) -> Self {
+		Self {
+			inner,
+			_phantom: PhantomData,
+		}
+	}
+}
+
+impl<K: DbOrdKey, V: DbBytes> Iterator for TypedTxIter<'_, K, V> {
+	type Item = TxOpResult<(K, V)>;
+
+	fn next(&mut self) -> Option<Self::Item> {
+		self.inner.next().map(|res| {
+			let (k, v) = res?;
+			Ok((
+				K::decode(&k).map_err(TxOpError::from)?,
+				V::decode(&v).map_err(TxOpError::from)?,
+			))
+		})
+	}
+}
+
+fn encode_range<K: DbOrdKey, R: RangeBounds<K>>(range: R) -> (Bound<Vec<u8>>, Bound<Vec<u8>>) {
+	(
+		encode_bound(range.start_bound()),
+		encode_bound(range.end_bound()),
+	)
+}
+
+fn encode_bound<K: DbOrdKey>(bound: Bound<&K>) -> Bound<Vec<u8>> {
+	match bound {
+		Bound::Included(k) => Bound::Included(k.encode()),
+		Bound::Excluded(k) => Bound::Excluded(k.encode()),
+		Bound::Unbounded => Bound::Unbounded,
+	}
+}

src/garage/Cargo.toml

@@ -39,8 +39,8 @@ backtrace.workspace = true
 bytes.workspace = true
 bytesize.workspace = true
 chrono.workspace = true
+fundu-systemd.workspace = true
 timeago.workspace = true
-parse_duration.workspace = true
 hex.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true

src/garage/cli/local/convert_db.rs

@@ -49,7 +49,7 @@ pub struct OpenLmdbOpt {
 
 pub(crate) fn do_conversion(args: ConvertDbOpt) -> Result<()> {
 	if args.input_engine == args.output_engine {
-		return Err(Error("input and output database engine must differ".into()));
+		return Err(DbError("input and output database engine must differ".into()).into());
 	}
 
 	let opt = OpenOpt {

src/garage/cli/remote/bucket.rs

@@ -393,7 +393,7 @@ impl Cli {
 		&self,
 		opt: CleanupIncompleteUploadsOpt,
 	) -> Result<(), Error> {
-		let older_than = parse_duration::parse::parse(&opt.older_than)
+		let older_than = garage_util::time::parse_duration(&opt.older_than)
 			.ok_or_message("Invalid duration passed for --older-than parameter")?;
 
 		for b in opt.buckets.iter() {

src/garage/cli/remote/cluster.rs

@@ -9,6 +9,31 @@ use crate::cli::remote::*;
 use crate::cli::structs::*;
 
 impl Cli {
+	pub async fn cmd_health(&self, quiet: bool) -> Result<(), Error> {
+		let health = self.api_request(GetClusterHealthRequest).await?;
+
+		if !quiet {
+			let table = vec![
+				format!("Cluster health:\t{}", health.status.to_uppercase()),
+				format!("Known nodes:\t{}", health.known_nodes),
+				format!("Connected nodes:\t{}", health.connected_nodes),
+				format!("Storage nodes:\t{}", health.storage_nodes),
+				format!("Storage nodes up:\t{}", health.storage_nodes_up),
+				format!("Partitions:\t{}", health.partitions),
+				format!("Partitions with quorum:\t{}", health.partitions_quorum),
+				format!("Fully healthy partitions:\t{}", health.partitions_all_ok),
+			];
+			format_table(table);
+		}
+
+		match health.status.as_str() {
+			"unavailable" => Err(Error::Message(
+				"Cluster is currently unavailable".to_string(),
+			)),
+			_ => Ok(()),
+		}
+	}
+
 	pub async fn cmd_status(&self) -> Result<(), Error> {
 		let status = self.api_request(GetClusterStatusRequest).await?;
 		let layout = self.api_request(GetClusterLayoutRequest).await?;

src/garage/cli/remote/key.rs

@@ -226,7 +226,7 @@ impl Cli {
 
 	pub async fn cmd_import_key(&self, opt: KeyImportOpt) -> Result<(), Error> {
 		if !opt.yes {
-			return Err(Error::Message("This command is intended to re-import keys that were previously generated by Garage. If you want to create a new key, use `garage key new` instead. Add the --yes flag if you really want to re-import a key.".to_string()));
+			return Err(Error::Message("This command is intended to re-import keys that were previously generated by Garage. If you want to create a new key, use `garage key create` instead. Add the --yes flag if you really want to re-import a key.".to_string()));
 		}
 
 		let new_key = self

src/garage/cli/remote/layout.rs

@@ -40,6 +40,7 @@ impl Cli {
 				PreviewClusterLayoutChangesResponse::Success {
 					message,
 					new_layout,
+					..
 				} => {
 					println!();
 					println!("==== NEW CLUSTER LAYOUT AFTER APPLYING CHANGES ====");

src/garage/cli/remote/mod.rs

@@ -33,6 +33,7 @@ impl Cli {
 	pub async fn handle(&self, cmd: Command) -> Result<(), Error> {
 		match cmd {
 			Command::Status => self.cmd_status().await,
+			Command::Health(opt) => self.cmd_health(opt.quiet).await,
 			Command::Node(NodeOperation::Connect(connect_opt)) => {
 				self.cmd_connect(connect_opt).await
 			}
@@ -168,7 +169,7 @@ pub fn table_list_abbr<T: IntoIterator<Item = S>, S: AsRef<str>>(values: T) -> S
 pub fn parse_expires_in(expires_in: &Option<String>) -> Result<Option<DateTime<Utc>>, Error> {
 	expires_in
 		.as_ref()
-		.map(|x| parse_duration::parse::parse(x).map(|dur| Utc::now() + dur))
+		.map(|x| garage_util::time::parse_duration(x).map(|dur| Utc::now() + dur))
 		.transpose()
 		.ok_or_message("Invalid duration passed for --expires-in parameter")
 }

src/garage/cli/structs.rs

@@ -10,6 +10,10 @@ pub enum Command {
 	#[structopt(name = "server", version = garage_version())]
 	Server(ServerOpt),
 
+	/// Check the cluster health and set the exit code to 1 if it is unavailable
+	#[structopt(name = "health", version = garage_version())]
+	Health(HealthOpt),
+
 	/// Get network status
 	#[structopt(name = "status", version = garage_version())]
 	Status,
@@ -103,6 +107,17 @@ pub struct ServerOpt {
 	pub(crate) default_bucket: bool,
 }
 
+// -------------------------
+// ---- garage health ----
+// -------------------------
+
+#[derive(StructOpt, Debug)]
+pub struct HealthOpt {
+	/// Do not print healthyness to stdout
+	#[structopt(short = "q", long = "quiet")]
+	pub(crate) quiet: bool,
+}
+
 // -------------------------
 // ---- garage node ... ----
 // -------------------------
@@ -479,7 +494,7 @@ pub struct KeyNewOpt {
 	#[structopt(default_value = "Unnamed key")]
 	pub name: String,
 	/// Set an expiration time for the access key
-	/// (see `docs.rs/parse_duration` for date format)
+	/// (see `docs.rs/fundu-systemd` for date format)
 	#[structopt(long = "expires-in")]
 	pub expires_in: Option<String>,
 }
@@ -490,7 +505,7 @@ pub struct KeySetOpt {
 	pub key_pattern: String,
 
 	/// Set an expiration time for the access key
-	/// (see `docs.rs/parse_duration` for date format)
+	/// (see `docs.rs/fundu-systemd` for date format)
 	#[structopt(long = "expires-in")]
 	pub expires_in: Option<String>,
 	/// Set the access key to never expire
@@ -601,7 +616,7 @@ pub enum AdminTokenOperation {
 pub struct AdminTokenCreateOp {
 	/// Set a name for the token
 	pub name: Option<String>,
-	/// Set an expiration time for the token (see `docs.rs/parse_duration` for date
+	/// Set an expiration time for the token (see `docs.rs/fundu-systemd` for date
 	/// format)
 	#[structopt(long = "expires-in")]
 	pub expires_in: Option<String>,
@@ -623,7 +638,7 @@ pub struct AdminTokenSetOp {
 	/// Name or prefix of the ID of the token to modify
 	pub api_token: String,
 
-	/// Set an expiration time for the token (see `docs.rs/parse_duration` for date
+	/// Set an expiration time for the token (see `docs.rs/fundu-systemd` for date
 	/// format)
 	#[structopt(long = "expires-in")]
 	pub expires_in: Option<String>,

src/garage/secrets.rs

@@ -19,7 +19,12 @@ pub struct Secrets {
 
 	/// RPC secret network key, used to replace `rpc_secret` in config.toml when running the
 	/// daemon or doing admin operations
-	#[structopt(short = "s", long = "rpc-secret", env = "GARAGE_RPC_SECRET")]
+	#[structopt(
+		short = "s",
+		long = "rpc-secret",
+		env = "GARAGE_RPC_SECRET",
+		hide_env_values = true
+	)]
 	pub rpc_secret: Option<String>,
 
 	/// RPC secret network key, used to replace `rpc_secret` in config.toml and rpc-secret
@@ -29,7 +34,11 @@ pub struct Secrets {
 
 	/// Admin API authentication token, replaces `admin.admin_token` in config.toml when
 	/// running the Garage daemon
-	#[structopt(long = "admin-token", env = "GARAGE_ADMIN_TOKEN")]
+	#[structopt(
+		long = "admin-token",
+		env = "GARAGE_ADMIN_TOKEN",
+		hide_env_values = true
+	)]
 	pub admin_token: Option<String>,
 
 	/// Admin API authentication token file path, replaces `admin.admin_token` in config.toml
@@ -39,7 +48,11 @@ pub struct Secrets {
 
 	/// Metrics API authentication token, replaces `admin.metrics_token` in config.toml when
 	/// running the Garage daemon
-	#[structopt(long = "metrics-token", env = "GARAGE_METRICS_TOKEN")]
+	#[structopt(
+		long = "metrics-token",
+		env = "GARAGE_METRICS_TOKEN",
+		hide_env_values = true
+	)]
 	pub metrics_token: Option<String>,
 
 	/// Metrics API authentication token file path, replaces `admin.metrics_token` in config.toml
@@ -124,14 +137,18 @@ fn read_secret_file(file_path: &PathBuf, allow_world_readable: bool) -> Result<S
 		#[cfg(unix)]
 		{
 			use std::os::unix::fs::MetadataExt;
-			let metadata = std::fs::metadata(file_path)?;
+			let metadata = std::fs::metadata(file_path).map_err(|e| {
+				format!("Failed to read secret file {}: {}", file_path.display(), e)
+			})?;
+
 			if metadata.mode() & 0o077 != 0 {
 				return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path.display(), metadata.mode()).into());
 			}
 		}
 	}
 
-	let secret_buf = std::fs::read_to_string(file_path)?;
+	let secret_buf = std::fs::read_to_string(file_path)
+		.map_err(|e| format!("Failed to read secret file {}: {}", file_path.display(), e))?;
 
 	// trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
 	//           also editors sometimes add a trailing newline

src/garage/server.rs

@@ -228,10 +228,10 @@ async fn initial_config(garage: &Arc<Garage>, opt: ServerOpt) -> Result<(), Erro
 				})),
 			);
 
-			let (layout, msg) = layout.apply_staged_changes(1)?;
+			let (layout, stat) = layout.apply_staged_changes(1)?;
 			info!(
 				"Created initial layout for single-node configuration:\n{}",
-				msg.join("\n")
+				stat.to_message().join("\n")
 			);
 
 			garage

src/garage/tests/k2v/item.rs

@@ -11,6 +11,7 @@ use http_body_util::BodyExt;
 use hyper::{Method, StatusCode};
 
 #[tokio::test]
+#[ignore = "flaky"]
 async fn test_items_and_indices() {
 	let ctx = common::context();
 	let bucket = ctx.create_bucket("test-k2v-item-and-index");

src/garage/tests/s3/cors.rs

@@ -0,0 +1,121 @@
+use aws_sdk_s3::types::{CorsConfiguration, CorsRule};
+use hyper::{Method, StatusCode};
+
+use crate::common;
+
+const REQUEST_ORIGIN: &str = "https://app.example.test";
+const SECOND_ALLOWED_ORIGIN: &str = "https://admin.example.test";
+const OBJECT_KEY: &str = "probe.txt";
+const BODY: &[u8] = b"hello from integration repro\n";
+
+async fn send_preflight(
+	ctx: &common::Context,
+	bucket: &str,
+	origin: &str,
+) -> hyper::Response<common::custom_requester::Body> {
+	ctx.custom_request
+		.builder(bucket.to_string())
+		.method(Method::OPTIONS)
+		.path(OBJECT_KEY)
+		.unsigned_header("origin", origin)
+		.unsigned_header("access-control-request-method", "PUT")
+		.unsigned_header(
+			"access-control-request-headers",
+			"content-type,x-amz-meta-demo",
+		)
+		.body(vec![])
+		.send()
+		.await
+		.unwrap()
+}
+
+async fn send_put(
+	ctx: &common::Context,
+	bucket: &str,
+	origin: &str,
+) -> hyper::Response<common::custom_requester::Body> {
+	ctx.custom_request
+		.builder(bucket.to_string())
+		.method(Method::PUT)
+		.path(OBJECT_KEY)
+		.signed_header("content-type", "text/plain")
+		.signed_header("x-amz-meta-demo", "1")
+		.unsigned_header("origin", origin)
+		.body(BODY.to_vec())
+		.send()
+		.await
+		.unwrap()
+}
+
+async fn apply_bucket_cors(ctx: &common::Context, bucket: &str, allowed_origins: &[&str]) {
+	let rule = allowed_origins.iter().fold(
+		CorsRule::builder()
+			.allowed_headers("*")
+			.allowed_methods("PUT")
+			.expose_headers("ETag"),
+		|rule, origin| rule.allowed_origins(*origin),
+	);
+
+	let cors = CorsConfiguration::builder()
+		.cors_rules(rule.build().unwrap())
+		.build()
+		.unwrap();
+
+	ctx.client
+		.put_bucket_cors()
+		.bucket(bucket)
+		.cors_configuration(cors)
+		.send()
+		.await
+		.unwrap();
+}
+
+#[tokio::test]
+async fn test_s3_api_cors_reflects_request_origin() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("s3-cors-direct");
+
+	apply_bucket_cors(&ctx, &bucket, &[REQUEST_ORIGIN]).await;
+
+	let control_preflight = send_preflight(&ctx, &bucket, REQUEST_ORIGIN).await;
+	assert_eq!(control_preflight.status(), StatusCode::OK);
+	assert_eq!(
+		control_preflight
+			.headers()
+			.get("access-control-allow-origin")
+			.unwrap(),
+		REQUEST_ORIGIN
+	);
+
+	let control_put = send_put(&ctx, &bucket, REQUEST_ORIGIN).await;
+	assert_eq!(control_put.status(), StatusCode::OK);
+	assert_eq!(
+		control_put
+			.headers()
+			.get("access-control-allow-origin")
+			.unwrap(),
+		REQUEST_ORIGIN
+	);
+
+	apply_bucket_cors(&ctx, &bucket, &[REQUEST_ORIGIN, SECOND_ALLOWED_ORIGIN]).await;
+
+	let repro_preflight = send_preflight(&ctx, &bucket, REQUEST_ORIGIN).await;
+	assert_eq!(repro_preflight.status(), StatusCode::OK);
+	assert_eq!(
+		repro_preflight
+			.headers()
+			.get("access-control-allow-origin")
+			.unwrap(),
+		REQUEST_ORIGIN
+	);
+
+	let repro_put = send_put(&ctx, &bucket, REQUEST_ORIGIN).await;
+	assert_eq!(repro_put.status(), StatusCode::OK);
+	assert_eq!(
+		repro_put
+			.headers()
+			.get("access-control-allow-origin")
+			.unwrap(),
+		REQUEST_ORIGIN
+	);
+}

src/garage/tests/s3/mod.rs

@@ -1,6 +1,8 @@
+mod cors;
 mod list;
 mod multipart;
 mod objects;
+mod postobject;
 mod presigned;
 mod signature_encoding;
 mod simple;

src/garage/tests/s3/objects.rs

@@ -554,7 +554,7 @@ async fn test_deleteobject() {
 
 	assert!(l.contents.is_none());
 
-	// Deleting a non-existing object shouldn't be a problem
+	// Deleting a non-existing object shouldn't be a problem...
 	ctx.client
 		.delete_object()
 		.bucket(&bucket)
@@ -562,4 +562,27 @@ async fn test_deleteobject() {
 		.send()
 		.await
 		.unwrap();
+
+	// ...and bulk-deleting a non-existing object shouldn't be either
+	let r = ctx
+		.client
+		.delete_objects()
+		.bucket(&bucket)
+		.delete(
+			Delete::builder()
+				.objects(
+					ObjectIdentifier::builder()
+						.key("does-not-exist")
+						.build()
+						.unwrap(),
+				)
+				.build()
+				.unwrap(),
+		)
+		.send()
+		.await
+		.unwrap();
+
+	assert_eq!(r.deleted.unwrap().len(), 1); // reported as deleted...
+	assert!(r.errors.unwrap_or_default().is_empty()); // ...not as an error
 }

src/garage/tests/s3/postobject.rs

@@ -0,0 +1,166 @@
+use base64::prelude::*;
+use bytes::Bytes;
+use chrono::{Duration, Utc};
+use hmac::Mac;
+use http_body_util::Full;
+use hyper::body::Incoming;
+use hyper::{header, Method, Request, Response, StatusCode};
+
+use garage_api_common::signature;
+
+use crate::common;
+
+const UTF8_KEY: &str = "uploads/test/копия файла.jpg";
+const UTF8_FILENAME: &str = "café-日本語.txt";
+const UTF8_CONTENT_DISPOSITION: &str = "attachment; filename=\"копия файла.jpg\"";
+const REGION: &str = "garage-integ-test";
+const BOUNDARY: &str = "boundary-garage-integ-test";
+
+async fn send_post_object(
+	ctx: &common::Context,
+	bucket: &str,
+	key_field: &str,
+	filename: &str,
+	extra_fields: &[(&str, &str)],
+	file_body: &str,
+) -> Response<Incoming> {
+	let now = Utc::now();
+	let scope = signature::compute_scope(&now, REGION, "s3");
+	let credential = format!("{}/{}", ctx.key.id, scope);
+	let date = now.format(signature::LONG_DATETIME).to_string();
+	let expiration = (now + Duration::hours(1)).to_rfc3339();
+
+	let mut conditions = vec![
+		serde_json::json!({ "bucket": bucket }),
+		serde_json::json!(["starts-with", "$key", ""]),
+		serde_json::json!({ "x-amz-algorithm": "AWS4-HMAC-SHA256" }),
+		serde_json::json!({ "x-amz-credential": &credential }),
+		serde_json::json!({ "x-amz-date": &date }),
+	];
+	for (name, value) in extra_fields {
+		conditions.push(serde_json::json!(["eq", format!("${}", name), value]));
+	}
+	let policy = serde_json::json!({
+		"expiration": expiration,
+		"conditions": conditions,
+	})
+	.to_string();
+
+	let policy_b64 = BASE64_STANDARD.encode(policy.as_bytes());
+
+	let mut signer = signature::signing_hmac(&now, &ctx.key.secret, REGION, "s3").unwrap();
+	signer.update(policy_b64.as_bytes());
+	let x_amz_signature = hex::encode(signer.finalize().into_bytes());
+
+	let mut fields = vec![
+		("key".to_string(), key_field.to_string()),
+		("x-amz-algorithm".into(), "AWS4-HMAC-SHA256".into()),
+		("x-amz-credential".into(), credential),
+		("x-amz-date".into(), date),
+		("policy".into(), policy_b64),
+		("x-amz-signature".into(), x_amz_signature),
+	];
+	for (name, value) in extra_fields {
+		fields.push((name.to_string(), value.to_string()));
+	}
+
+	let mut body = String::new();
+	for (name, value) in &fields {
+		body.push_str(&format!(
+			"--{BOUNDARY}\r\nContent-Disposition: form-data; name=\"{name}\"\r\n\r\n{value}\r\n"
+		));
+	}
+
+	body.push_str(&format!(
+		"--{BOUNDARY}\r\nContent-Disposition: form-data; name=\"file\"; filename=\"{filename}\"\r\nContent-Type: text/plain\r\n\r\n{file_body}\r\n--{BOUNDARY}--\r\n"
+	));
+
+	let req = Request::builder()
+		.method(Method::POST)
+		.uri(format!("{}{}", ctx.garage.s3_uri(), bucket))
+		.header(header::HOST, "s3.garage")
+		.header(
+			header::CONTENT_TYPE,
+			format!("multipart/form-data; boundary={BOUNDARY}"),
+		)
+		.body(Full::new(Bytes::from(body.into_bytes())))
+		.unwrap();
+
+	ctx.custom_request.client().request(req).await.unwrap()
+}
+
+#[tokio::test]
+async fn test_post_object_utf8_key() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("post-object-utf8-key");
+
+	let res = send_post_object(&ctx, &bucket, UTF8_KEY, "копия файла.jpg", &[], "hello").await;
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	let obj = ctx
+		.client
+		.get_object()
+		.bucket(&bucket)
+		.key(UTF8_KEY)
+		.send()
+		.await
+		.unwrap();
+	assert_bytes_eq!(obj.body, b"hello");
+}
+
+#[tokio::test]
+async fn test_post_object_utf8_filename_substitution() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("post-object-utf8-filename");
+
+	let res = send_post_object(
+		&ctx,
+		&bucket,
+		"uploads/${filename}",
+		UTF8_FILENAME,
+		&[],
+		"bonjour",
+	)
+	.await;
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	let obj = ctx
+		.client
+		.get_object()
+		.bucket(&bucket)
+		.key(format!("uploads/{}", UTF8_FILENAME))
+		.send()
+		.await
+		.unwrap();
+	assert_bytes_eq!(obj.body, b"bonjour");
+}
+
+#[tokio::test]
+async fn test_post_object_utf8_content_disposition_metadata() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("post-object-utf8-contdisp");
+
+	let res = send_post_object(
+		&ctx,
+		&bucket,
+		"ascii-key.jpg",
+		"file.jpg",
+		&[("content-disposition", UTF8_CONTENT_DISPOSITION)],
+		"data",
+	)
+	.await;
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	let obj = ctx
+		.client
+		.get_object()
+		.bucket(&bucket)
+		.key("ascii-key.jpg")
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(
+		obj.content_disposition.as_deref(),
+		Some(UTF8_CONTENT_DISPOSITION)
+	);
+}

src/garage/tests/s3/presigned.rs

@@ -70,3 +70,43 @@ async fn test_presigned_url() {
 		assert_eq!(body, body2);
 	}
 }
+
+// Presigned PUT with a user-metadata header whose value contains
+// internal sequential whitespace. SigV4 requires collapsing such
+// whitespace in canonical header values; missing that normalization
+// produces an `Invalid signature` 403 on otherwise-valid requests.
+#[tokio::test]
+async fn test_presigned_put_with_user_metadata() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("presigned-metadata");
+
+	let key = "cache-archive";
+	let metadata_value = "cache-key  --protected";
+	let body = Bytes::from_static(b"presigned PUT with user metadata");
+
+	let psc = PresigningConfig::builder()
+		.start_time(SystemTime::now() - Duration::from_secs(60))
+		.expires_in(Duration::from_secs(3600))
+		.build()
+		.unwrap();
+
+	let presigned = ctx
+		.client
+		.put_object()
+		.bucket(&bucket)
+		.key(key)
+		.metadata("cachekey", metadata_value)
+		.presigned(psc)
+		.await
+		.unwrap();
+
+	let req_builder = Request::builder().method("PUT").uri(presigned.uri());
+	let req = presigned
+		.headers()
+		.fold(req_builder, |b, (k, v)| b.header(k, v))
+		.body(Full::new(body))
+		.unwrap();
+
+	let res = ctx.custom_request.client().request(req).await.unwrap();
+	assert_eq!(res.status(), 200);
+}

src/k2v-client/Cargo.toml

@@ -24,7 +24,7 @@ percent-encoding.workspace = true
 hyper = { workspace = true, default-features = false, features = ["http1", "http2"] }
 hyper-util.workspace = true
 hyper-rustls.workspace = true
-serde.workspace = true
+serde = { workspace = true, default-features = false, features = ["derive", "std"] }
 serde_json.workspace = true
 thiserror.workspace = true
 tokio.workspace = true

src/k2v-client/lib.rs

@@ -26,6 +26,10 @@ mod error;
 
 pub use error::Error;
 
+// Re-export these crates: values from these are passed to K2vClient::new_with_client
+pub use hyper_rustls;
+pub use hyper_util;
+
 pub type Body = FullBody<Bytes>;
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(5);
@@ -46,6 +50,7 @@ const PATH_ENCODE_SET: AsciiSet = NON_ALPHANUMERIC
 	.remove(b'.')
 	.remove(b'~');
 
+#[derive(Debug, Clone)]
 pub struct K2vClientConfig {
 	pub endpoint: String,
 	pub region: String,
@@ -56,6 +61,7 @@ pub struct K2vClientConfig {
 }
 
 /// Client used to query a K2V server.
+#[derive(Debug, Clone)]
 pub struct K2vClient {
 	config: K2vClientConfig,
 	user_agent: HeaderValue,

src/model/Cargo.toml

@@ -21,6 +21,7 @@ garage_block.workspace = true
 garage_util.workspace = true
 garage_net.workspace = true
 
+arbitrary = { optional = true, workspace = true }
 argon2.workspace = true
 async-trait.workspace = true
 blake2.workspace = true
@@ -29,7 +30,6 @@ thiserror.workspace = true
 hex.workspace = true
 http.workspace = true
 base64.workspace = true
-parse_duration.workspace = true
 tracing.workspace = true
 rand.workspace = true
 zstd.workspace = true
@@ -46,6 +46,7 @@ k2v = ["garage_util/k2v"]
 lmdb = ["garage_db/lmdb"]
 sqlite = ["garage_db/sqlite"]
 fjall = ["garage_db/fjall"]
+arbitrary = ["dep:arbitrary","garage_util/arbitrary"]
 
 [lints]
 workspace = true

src/model/admin_token_table.rs

@@ -8,6 +8,7 @@ use garage_table::{EmptyKey, Entry, TableSchema};
 pub use crate::key_table::KeyFilter;
 
 mod v2 {
+	use crate::permission::ExpirationTime;
 	use garage_util::crdt;
 	use serde::{Deserialize, Serialize};
 
@@ -35,7 +36,7 @@ mod v2 {
 		pub name: crdt::Lww<String>,
 
 		/// The optional time of expiration of the token
-		pub expiration: crdt::Lww<Option<u64>>,
+		pub expiration: crdt::Lww<crdt::MergingOption<ExpirationTime>>,
 
 		/// The scope of the token, i.e. list of authorized admin API calls
 		pub scope: crdt::Lww<AdminApiTokenScope>,
@@ -51,6 +52,14 @@ mod v2 {
 
 pub use v2::*;
 
+#[cfg(feature = "arbitrary")]
+impl<'a> arbitrary::Arbitrary<'a> for AdminApiTokenScope {
+	fn arbitrary(u: &mut arbitrary::Unstructured<'a>) -> arbitrary::Result<Self> {
+		let set: std::collections::BTreeSet<String> = arbitrary::Arbitrary::arbitrary(u)?;
+		Ok(AdminApiTokenScope(set.into_iter().collect()))
+	}
+}
+
 impl Crdt for AdminApiTokenParams {
 	fn merge(&mut self, o: &Self) {
 		self.name.merge(&o.name);
@@ -98,7 +107,7 @@ impl AdminApiToken {
 				created: now_msec(),
 				token_hash: hashed_token,
 				name: crdt::Lww::new(name.to_string()),
-				expiration: crdt::Lww::new(None),
+				expiration: crdt::Lww::new(None.into()),
 				scope: crdt::Lww::new(AdminApiTokenScope(vec!["*".to_string()])),
 			}),
 		};
@@ -139,9 +148,9 @@ impl AdminApiToken {
 
 impl AdminApiTokenParams {
 	pub fn is_expired(&self, ts_now: u64) -> bool {
-		match *self.expiration.get() {
+		match self.expiration.get().inner() {
 			None => false,
-			Some(exp) => ts_now >= exp,
+			Some(exp) => ts_now >= exp.0,
 		}
 	}
 

src/model/bucket_alias_table.rs

@@ -13,7 +13,7 @@ mod v08 {
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
 	pub struct BucketAlias {
 		pub(super) name: String,
-		pub state: crdt::Lww<Option<Uuid>>,
+		pub state: crdt::Lww<crdt::CancelingOption<Uuid>>,
 	}
 
 	impl garage_util::migrate::InitialFormat for BucketAlias {}
@@ -25,12 +25,12 @@ impl BucketAlias {
 	pub fn new(name: String, ts: u64, bucket_id: Option<Uuid>) -> Self {
 		BucketAlias {
 			name,
-			state: crdt::Lww::raw(ts, bucket_id),
+			state: crdt::Lww::raw(ts, CancelingOption(bucket_id)),
 		}
 	}
 
 	pub fn is_deleted(&self) -> bool {
-		self.state.get().is_none()
+		self.state.get().inner().is_none()
 	}
 	pub fn name(&self) -> &str {
 		&self.name

src/model/bucket_table.rs

@@ -45,12 +45,12 @@ mod v08 {
 		/// Whether this bucket is allowed for website access
 		/// (under all of its global alias names),
 		/// and if so, the website configuration XML document
-		pub website_config: crdt::Lww<Option<WebsiteConfig>>,
+		pub website_config: crdt::Lww<crdt::CancelingOption<WebsiteConfig>>,
 		/// CORS rules
-		pub cors_config: crdt::Lww<Option<Vec<CorsRule>>>,
+		pub cors_config: crdt::Lww<crdt::CancelingOption<Vec<CorsRule>>>,
 		/// Lifecycle configuration
 		#[serde(default)]
-		pub lifecycle_config: crdt::Lww<Option<Vec<LifecycleRule>>>,
+		pub lifecycle_config: crdt::Lww<crdt::CancelingOption<Vec<LifecycleRule>>>,
 		/// Bucket quotas
 		#[serde(default)]
 		pub quotas: crdt::Lww<BucketQuotas>,
@@ -63,6 +63,7 @@ mod v08 {
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct CorsRule {
 		pub id: Option<String>,
 		pub max_age_seconds: Option<u64>,
@@ -74,6 +75,7 @@ mod v08 {
 
 	/// Lifecycle configuration rule
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct LifecycleRule {
 		/// The ID of the rule
 		pub id: Option<String>,
@@ -91,6 +93,7 @@ mod v08 {
 	/// For each condition, if it is None, it is not verified (always true),
 	/// and if it is Some(x), then it is verified for value x
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize, Default)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct LifecycleFilter {
 		/// If Some(x), object key has to start with prefix x
 		pub prefix: Option<String>,
@@ -101,6 +104,7 @@ mod v08 {
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub enum LifecycleExpiration {
 		/// Objects expire x days after they were created
 		AfterDays(usize),
@@ -109,6 +113,7 @@ mod v08 {
 	}
 
 	#[derive(Default, PartialEq, Eq, PartialOrd, Ord, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct BucketQuotas {
 		/// Maximum size in bytes (bucket size = sum of sizes of objects in the bucket)
 		pub max_size: Option<u64>,
@@ -139,6 +144,7 @@ mod v2 {
 
 	/// Configuration for a bucket
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct BucketParams {
 		/// Bucket's creation date
 		pub creation_date: u64,
@@ -158,16 +164,17 @@ mod v2 {
 		/// Whether this bucket is allowed for website access
 		/// (under all of its global alias names),
 		/// and if so, the website configuration XML document
-		pub website_config: crdt::Lww<Option<WebsiteConfig>>,
+		pub website_config: crdt::Lww<crdt::CancelingOption<WebsiteConfig>>,
 		/// CORS rules
-		pub cors_config: crdt::Lww<Option<Vec<CorsRule>>>,
+		pub cors_config: crdt::Lww<crdt::CancelingOption<Vec<CorsRule>>>,
 		/// Lifecycle configuration
-		pub lifecycle_config: crdt::Lww<Option<Vec<LifecycleRule>>>,
+		pub lifecycle_config: crdt::Lww<crdt::CancelingOption<Vec<LifecycleRule>>>,
 		/// Bucket quotas
 		pub quotas: crdt::Lww<BucketQuotas>,
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct WebsiteConfig {
 		pub index_document: String,
 		pub error_document: Option<String>,
@@ -178,24 +185,28 @@ mod v2 {
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct RedirectAll {
 		pub hostname: String,
 		pub protocol: String,
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct RoutingRule {
 		pub condition: Option<RedirectCondition>,
 		pub redirect: Redirect,
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct RedirectCondition {
 		pub http_error_code: Option<u16>,
 		pub prefix: Option<String>,
 	}
 
 	#[derive(PartialEq, Eq, Clone, Debug, Serialize, Deserialize)]
+	#[cfg_attr(feature = "arbitrary", derive(arbitrary::Arbitrary))]
 	pub struct Redirect {
 		pub hostname: Option<String>,
 		pub http_redirect_code: u16,
@@ -248,9 +259,9 @@ impl BucketParams {
 			authorized_keys: crdt::Map::new(),
 			aliases: crdt::LwwMap::new(),
 			local_aliases: crdt::LwwMap::new(),
-			website_config: crdt::Lww::new(None),
+			website_config: crdt::Lww::new(None.into()),
-			cors_config: crdt::Lww::new(None),
+			cors_config: crdt::Lww::new(None.into()),
-			lifecycle_config: crdt::Lww::new(None),
+			lifecycle_config: crdt::Lww::new(None.into()),
 			quotas: crdt::Lww::new(BucketQuotas::default()),
 		}
 	}

src/model/garage.rs

@@ -304,7 +304,7 @@ impl Garage {
 		self.k2v.spawn_workers(bg);
 
 		if let Some(itv) = self.config.metadata_auto_snapshot_interval.as_deref() {
-			let interval = parse_duration::parse(itv)
+			let interval = garage_util::time::parse_duration(itv)
 				.ok_or_message("Invalid `metadata_auto_snapshot_interval`")?;
 			if interval < std::time::Duration::from_secs(600) {
 				return Err(Error::Message(

src/model/helper/bucket.rs

@@ -52,7 +52,7 @@ impl<'a> BucketHelper<'a> {
 					.0
 					.bucket_alias_table
 					.get_local(&EmptyKey, bucket_name)?
-					.and_then(|x| *x.state.get());
+					.and_then(|x| x.state.get().into_inner());
 				match alias {
 					Some(id) => id,
 					None => return Ok(None),
@@ -91,15 +91,18 @@ impl<'a> BucketHelper<'a> {
 			.as_option()
 			.ok_or_message("Key should not be deleted at this point")?;
 
-		let bucket_opt =
+		let bucket_opt = if let Some(bucket_id) = api_key_params
-			if let Some(Some(bucket_id)) = api_key_params.local_aliases.get(bucket_name) {
+			.local_aliases
-				self.0
+			.get(bucket_name)
-					.bucket_table
+			.and_then(|x| x.inner())
-					.get_local(&EmptyKey, bucket_id)?
+		{
-					.filter(|x| !x.state.is_deleted())
+			self.0
-			} else {
+				.bucket_table
-				self.resolve_global_bucket_fast(bucket_name)?
+				.get_local(&EmptyKey, bucket_id)?
-			};
+				.filter(|x| !x.state.is_deleted())
+		} else {
+			self.resolve_global_bucket_fast(bucket_name)?
+		};
 		bucket_opt.ok_or_else(|| Error::NoSuchBucket(bucket_name.to_string()))
 	}
 
@@ -125,7 +128,7 @@ impl<'a> BucketHelper<'a> {
 					.bucket_alias_table
 					.get(&EmptyKey, bucket_name)
 					.await?
-					.and_then(|x| *x.state.get());
+					.and_then(|x| x.state.get().into_inner());
 				match alias {
 					Some(id) => id,
 					None => return Ok(None),
@@ -163,8 +166,7 @@ impl<'a> BucketHelper<'a> {
 			.ok_or_else(|| GarageError::Message(format!("access key {} has been deleted", key_id)))?
 			.local_aliases
 			.get(bucket_name)
-			.copied()
+			.and_then(|x| x.inner().copied());
-			.flatten();
 
 		if let Some(bucket_id) = local_alias {
 			Ok(self

src/model/helper/locked.rs

@@ -74,8 +74,8 @@ impl<'a> LockedHelper<'a> {
 		let alias = self.0.bucket_alias_table.get(&EmptyKey, alias_name).await?;
 
 		if let Some(existing_alias) = alias.as_ref() {
-			if let Some(p_bucket) = existing_alias.state.get() {
+			if let Some(p_bucket) = existing_alias.state.get().into_inner() {
-				if *p_bucket != bucket_id {
+				if p_bucket != bucket_id {
 					return Err(Error::BadRequest(format!(
 						"Alias {} already exists and points to different bucket: {:?}",
 						alias_name, p_bucket
@@ -98,7 +98,7 @@ impl<'a> LockedHelper<'a> {
 		let alias = match alias {
 			None => BucketAlias::new(alias_name.clone(), alias_ts, Some(bucket_id)),
 			Some(mut a) => {
-				a.state = Lww::raw(alias_ts, Some(bucket_id));
+				a.state = Lww::raw(alias_ts, Some(bucket_id).into());
 				a
 			}
 		};
@@ -128,7 +128,13 @@ impl<'a> LockedHelper<'a> {
 			.bucket_alias_table
 			.get(&EmptyKey, alias_name)
 			.await?
-			.filter(|a| a.state.get().map(|x| x == bucket_id).unwrap_or(false))
+			.filter(|a| {
+				a.state
+					.get()
+					.into_inner()
+					.map(|x| x == bucket_id)
+					.unwrap_or(false)
+			})
 			.ok_or_message(format!(
 				"Internal error: alias not found or does not point to bucket {:?}",
 				bucket_id
@@ -157,7 +163,7 @@ impl<'a> LockedHelper<'a> {
 		// ---- timestamp-ensured causality barrier ----
 		// writes are now done and all writes use timestamp alias_ts
 
-		alias.state = Lww::raw(alias_ts, None);
+		alias.state = Lww::raw(alias_ts, None.into());
 		self.0.bucket_alias_table.insert(&alias).await?;
 
 		bucket_state.aliases = LwwMap::raw_item(alias_name.clone(), alias_ts, false);
@@ -199,8 +205,8 @@ impl<'a> LockedHelper<'a> {
 		// ---- timestamp-ensured causality barrier ----
 		// writes are now done and all writes use timestamp alias_ts
 
-		if alias.state.get() == &Some(bucket_id) {
+		if alias.state.get().inner() == Some(&bucket_id) {
-			alias.state = Lww::raw(alias_ts, None);
+			alias.state = Lww::raw(alias_ts, None.into());
 			self.0.bucket_alias_table.insert(&alias).await?;
 		}
 
@@ -237,7 +243,11 @@ impl<'a> LockedHelper<'a> {
 
 		let key_param = key.state.as_option_mut().unwrap();
 
-		if let Some(Some(existing_alias)) = key_param.local_aliases.get(alias_name) {
+		if let Some(Some(existing_alias)) = key_param
+			.local_aliases
+			.get(alias_name)
+			.map(CancelingOption::inner)
+		{
 			if *existing_alias != bucket_id {
 				return Err(Error::BadRequest(format!("Alias {} already exists in namespace of key {} and points to different bucket: {:?}", alias_name,  key.key_id, existing_alias)));
 			}
@@ -261,7 +271,8 @@ impl<'a> LockedHelper<'a> {
 		// ---- timestamp-ensured causality barrier ----
 		// writes are now done and all writes use timestamp alias_ts
 
-		key_param.local_aliases = LwwMap::raw_item(alias_name.clone(), alias_ts, Some(bucket_id));
+		key_param.local_aliases =
+			LwwMap::raw_item(alias_name.clone(), alias_ts, Some(bucket_id).into());
 		self.0.key_table.insert(&key).await?;
 
 		bucket_p.local_aliases = LwwMap::raw_item(bucket_p_local_alias_key, alias_ts, true);
@@ -288,7 +299,12 @@ impl<'a> LockedHelper<'a> {
 		let key_p = key.state.as_option().unwrap();
 		let bucket_p = bucket.state.as_option_mut().unwrap();
 
-		if key_p.local_aliases.get(alias_name).cloned().flatten() != Some(bucket_id) {
+		if key_p
+			.local_aliases
+			.get(alias_name)
+			.and_then(CancelingOption::inner)
+			!= Some(&bucket_id)
+		{
 			return Err(GarageError::Message(format!(
 				"Bucket {:?} does not have alias {} in namespace of key {}",
 				bucket_id, alias_name, key_id
@@ -325,7 +341,7 @@ impl<'a> LockedHelper<'a> {
 		// writes are now done and all writes use timestamp alias_ts
 
 		key.state.as_option_mut().unwrap().local_aliases =
-			LwwMap::raw_item(alias_name.clone(), alias_ts, None);
+			LwwMap::raw_item(alias_name.clone(), alias_ts, None.into());
 		self.0.key_table.insert(&key).await?;
 
 		bucket_p.local_aliases = LwwMap::raw_item(bucket_p_local_alias_key, alias_ts, false);
@@ -367,7 +383,7 @@ impl<'a> LockedHelper<'a> {
 		// writes are now done and all writes use timestamp alias_ts
 
 		if let Some(kp) = key.state.as_option_mut() {
-			kp.local_aliases = LwwMap::raw_item(alias_name.clone(), alias_ts, None);
+			kp.local_aliases = LwwMap::raw_item(alias_name.clone(), alias_ts, None.into());
 			self.0.key_table.insert(&key).await?;
 		}
 
@@ -444,8 +460,8 @@ impl<'a> LockedHelper<'a> {
 
 		// 1. Delete local aliases
 		for (alias, _, to) in state.local_aliases.items().iter() {
-			if let Some(bucket_id) = to {
+			if let Some(bucket_id) = to.into_inner() {
-				self.purge_local_bucket_alias(*bucket_id, &key.key_id, alias)
+				self.purge_local_bucket_alias(bucket_id, &key.key_id, alias)
 					.await?;
 			}
 		}
@@ -501,7 +517,7 @@ impl<'a> LockedHelper<'a> {
 						.data
 						.decode_entry(&(item?.1))
 						.map_err(db::TxError::Abort)?;
-					if let Some(id) = alias.state.get() {
+					if let Some(id) = alias.state.get().inner() {
 						if all_buckets.contains(id) {
 							// keep aliases
 							global_aliases.insert(alias.name().to_string(), *id);
@@ -512,7 +528,7 @@ impl<'a> LockedHelper<'a> {
 								alias.name(),
 								id
 							);
-							alias.state.update(None);
+							alias.state.update(None.into());
 							delete_global.push(alias);
 						}
 					}
@@ -544,7 +560,7 @@ impl<'a> LockedHelper<'a> {
 					};
 					let mut has_changes = false;
 					for (name, _, to) in p.local_aliases.items().to_vec() {
-						if let Some(id) = to {
+						if let Some(id) = to.into_inner() {
 							if all_buckets.contains(&id) {
 								local_aliases.insert((key.key_id.clone(), name), id);
 							} else {
@@ -552,7 +568,7 @@ impl<'a> LockedHelper<'a> {
 									"local alias: remove ({}, {}) -> {:?} (bucket is deleted)",
 									key.key_id, name, id
 								);
-								p.local_aliases.update_in_place(name, None);
+								p.local_aliases.update_in_place(name, None.into());
 								has_changes = true;
 							}
 						}