From 7ae9697d4216944585fd6e7b767b0f488c238f7a Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Sun, 28 Jun 2026 00:07:42 +0800 Subject: [PATCH] docs: close final architecture audit gaps (#3966) --- .github/actions/setup/action.yml | 14 ++-- .../architecture-migration-rules.yml | 2 +- .github/workflows/audit.yml | 18 ++--- .github/workflows/build.yml | 14 ++-- .github/workflows/ci.yml | 46 ++++++------ .github/workflows/cla.yml | 6 +- .github/workflows/docker.yml | 16 ++--- .github/workflows/e2e-s3tests.yml | 16 ++--- .github/workflows/fuzz.yml | 18 ++--- .github/workflows/helm-package.yml | 12 ++-- .github/workflows/issue-translator.yml | 2 +- .github/workflows/nix-flake-update.yml | 10 +-- .github/workflows/nix.yml | 8 +-- .github/workflows/performance.yml | 10 +-- .github/workflows/stale.yml | 2 +- README.md | 6 +- README_ZH.md | 6 +- docs/architecture/migration-progress.md | 59 ++++++++++------ docs/architecture/s3-compatibility-matrix.md | 70 +++++++++++++++++++ rustfs/README.md | 6 +- 20 files changed, 215 insertions(+), 126 deletions(-) create mode 100644 docs/architecture/s3-compatibility-matrix.md diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml index 1be3e839e..b88b04827 100644 --- a/.github/actions/setup/action.yml +++ b/.github/actions/setup/action.yml @@ -59,18 +59,18 @@ runs: protobuf-compiler - name: Install protoc - uses: rustfs/setup-protoc@v3.0.1 + uses: rustfs/setup-protoc@a3705324d8f9bf5b6c3573fb6cf8ae421db55dd6 # v3.0.1 with: version: "34.1" repo-token: ${{ github.token }} - name: Install flatc - uses: Nugine/setup-flatc@v1 + uses: Nugine/setup-flatc@e7855e994773ce90094a3f1626d4afc9080c23ae # v1 with: version: "25.12.19" - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable with: toolchain: ${{ inputs.rust-version }} targets: ${{ inputs.target }} @@ -78,17 +78,17 @@ runs: - name: Install Zig if: inputs.install-cross-tools == 'true' - uses: mlugg/setup-zig@v2 + uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2 - name: Install cargo-zigbuild if: inputs.install-cross-tools == 'true' - uses: taiki-e/install-action@cargo-zigbuild + uses: taiki-e/install-action@a21ae4029b089b9ddc45704028756f51ab8abe48 # cargo-zigbuild - name: Install cargo-nextest - uses: taiki-e/install-action@nextest + uses: taiki-e/install-action@96c7780c1d8a2b8723e12031def873a434d39d8d # nextest - name: Setup Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: cache-all-crates: true cache-on-failure: true diff --git a/.github/workflows/architecture-migration-rules.yml b/.github/workflows/architecture-migration-rules.yml index 46a6fcdea..6b9911245 100644 --- a/.github/workflows/architecture-migration-rules.yml +++ b/.github/workflows/architecture-migration-rules.yml @@ -32,7 +32,7 @@ jobs: name: Architecture Migration Rules runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Install ripgrep run: | diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 9635009ba..5ec3f3678 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -50,10 +50,10 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Install cargo-audit - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2 with: tool: cargo-audit @@ -63,7 +63,7 @@ jobs: - name: Upload audit results if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: security-audit-results-${{ github.run_number }} path: audit-results.json @@ -75,7 +75,7 @@ jobs: timeout-minutes: 20 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -83,7 +83,7 @@ jobs: cache-shared-key: rustfs-cargo-deny - name: Install cargo-deny - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2 with: tool: cargo-deny @@ -96,10 +96,10 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Report unpinned GitHub Actions - run: ./scripts/security/check_workflow_pins.sh + run: ./scripts/security/check_workflow_pins.sh --enforce dependency-review: name: Dependency Review @@ -110,10 +110,10 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Dependency Review - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 with: fail-on-severity: moderate allow-ghsas: GHSA-2f9f-gq7v-9h6m diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9db8d2d50..2220e37c3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -82,7 +82,7 @@ jobs: is_prerelease: ${{ steps.check.outputs.is_prerelease }} steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 @@ -215,7 +215,7 @@ jobs: matrix: ${{ fromJson(needs.prepare-platform-matrix.outputs.matrix) }} steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 @@ -459,7 +459,7 @@ jobs: echo "📊 Version: ${VERSION}" - name: Upload to GitHub artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: ${{ steps.package.outputs.package_name }} path: "rustfs-*.zip" @@ -609,7 +609,7 @@ jobs: release_url: ${{ steps.create.outputs.release_url }} steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 @@ -693,10 +693,10 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Download all build artifacts - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: path: ./artifacts pattern: rustfs-* @@ -837,7 +837,7 @@ jobs: contents: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Update release notes and publish env: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 28fd3d19d..6643f468a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,7 +84,7 @@ jobs: steps: - name: Skip duplicate actions id: skip_check - uses: fkirc/skip-duplicate-actions@v5 + uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5 with: concurrent_skipping: "same_content_newer" cancel_others: true @@ -97,10 +97,10 @@ jobs: if: needs.skip-check.outputs.should_skip != 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: dtolnay/rust-toolchain@stable + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Typos check with custom config file - uses: crate-ci/typos@master + uses: crate-ci/typos@37bb98842b0d8c4ffebdb75301a13db0267cef89 # master test-and-lint: name: Test and Lint @@ -112,7 +112,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -160,7 +160,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -188,7 +188,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -204,7 +204,7 @@ jobs: cargo build -p rustfs --bins --jobs 2 - name: Upload debug binary - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: rustfs-debug-binary path: target/debug/rustfs @@ -221,7 +221,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -237,7 +237,7 @@ jobs: cargo build -p rustfs --bins --features rio-v2 --jobs 2 - name: Upload debug binary - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: rustfs-debug-binary-rio-v2 path: target/debug/rustfs @@ -252,10 +252,10 @@ jobs: timeout-minutes: 30 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Download debug binary - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: rustfs-debug-binary path: target/debug @@ -264,13 +264,13 @@ jobs: run: chmod +x ./target/debug/rustfs - name: Setup Rust toolchain for s3s-e2e installation - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Run delete-marker migration proof run: cargo test -p e2e_test delete_marker_migration_semantics -- --nocapture --test-threads=1 - name: Install s3s-e2e test tool - uses: taiki-e/cache-cargo-install-action@v2 + uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # v2 with: tool: s3s-e2e git: https://github.com/s3s-project/s3s.git @@ -288,7 +288,7 @@ jobs: - name: Upload test logs if: failure() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: e2e-test-logs-${{ github.run_number }} path: ${{ runner.temp }}/rustfs-e2e-*/rustfs.log @@ -302,7 +302,7 @@ jobs: timeout-minutes: 30 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Clean up previous test run run: | @@ -310,7 +310,7 @@ jobs: rm -f /tmp/rustfs.log - name: Download debug binary - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: rustfs-debug-binary-rio-v2 path: target/debug @@ -319,10 +319,10 @@ jobs: run: chmod +x ./target/debug/rustfs - name: Setup Rust toolchain for s3s-e2e installation - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - name: Install s3s-e2e test tool - uses: taiki-e/cache-cargo-install-action@v2 + uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # v2 with: tool: s3s-e2e git: https://github.com/s3s-project/s3s.git @@ -335,7 +335,7 @@ jobs: - name: Upload test logs if: failure() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: e2e-test-logs-rio-v2-${{ github.run_number }} path: /tmp/rustfs.log @@ -349,10 +349,10 @@ jobs: timeout-minutes: 60 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Download debug binary - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: rustfs-debug-binary path: target/debug @@ -376,7 +376,7 @@ jobs: - name: Upload s3 test artifacts if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: s3tests-implemented-${{ github.run_number }} path: artifacts/s3tests-single/** diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 750181051..713ac3fac 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Report CLA result for merge queue if: github.event_name == 'merge_group' - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 with: script: | await github.rest.checks.create({ @@ -54,7 +54,7 @@ jobs: - name: Create token for rustfs/cla if: github.event_name != 'merge_group' id: registry-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 with: app-id: ${{ vars.CLA_BOT_APP_ID }} private-key: ${{ secrets.CLA_BOT_APP_PRIVATE_KEY }} @@ -64,7 +64,7 @@ jobs: - name: Run CLA Bot if: github.event_name != 'merge_group' - uses: overtrue/cla-bot@v0.0.9 + uses: overtrue/cla-bot@5e5929846a60cfb42b16d0d38e135ef67d94fc88 # v0.0.9 with: github-token: ${{ github.token }} registry-token: ${{ steps.registry-token.outputs.token }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 6e6732588..06e79e018 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -84,7 +84,7 @@ jobs: create_latest: ${{ steps.check.outputs.create_latest }} steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 # For workflow_run events, checkout the specific commit that triggered the workflow @@ -278,33 +278,33 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ env.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ secrets.GHCR_USERNAME }} password: ${{ secrets.GHCR_PASSWORD }} - name: Login to Quay.io - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: quay.io username: ${{ secrets.QUAY_USERNAME }} password: ${{ secrets.QUAY_PASSWORD }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Extract metadata and generate tags id: meta @@ -386,7 +386,7 @@ jobs: echo "🔖 Version: $VERSION" - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ${{ matrix.file }} diff --git a/.github/workflows/e2e-s3tests.yml b/.github/workflows/e2e-s3tests.yml index 6282006f7..e79ffa521 100644 --- a/.github/workflows/e2e-s3tests.yml +++ b/.github/workflows/e2e-s3tests.yml @@ -66,10 +66,10 @@ jobs: runs-on: ubicloud-standard-2 timeout-minutes: 120 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Cache pip downloads - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-e2e-s3tests-${{ hashFiles('.github/workflows/e2e-s3tests.yml') }} @@ -82,7 +82,7 @@ jobs: echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Enable buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build RustFS image (source, cached) run: | @@ -218,7 +218,7 @@ jobs: - name: Upload artifacts if: always() && env.ACT != 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: s3tests-single path: artifacts/** @@ -228,10 +228,10 @@ jobs: runs-on: ubicloud-standard-2 timeout-minutes: 150 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Cache pip downloads - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-e2e-s3tests-${{ hashFiles('.github/workflows/e2e-s3tests.yml') }} @@ -244,7 +244,7 @@ jobs: echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Enable buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Build RustFS image (source, cached) run: | @@ -437,7 +437,7 @@ jobs: - name: Upload artifacts if: always() && env.ACT != 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: s3tests-multi path: artifacts/** diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index ef1e8b101..43fe3e422 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -65,7 +65,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -76,7 +76,7 @@ jobs: cache-save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'schedule' }} - name: Install cargo-fuzz - uses: taiki-e/install-action@v2 + uses: taiki-e/install-action@bffeee26d4db9be238a4ea78d8826604ebcb594d # v2 with: tool: cargo-fuzz @@ -92,7 +92,7 @@ jobs: done - name: Upload prebuilt fuzz binaries - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: fuzz-prebuilt-binaries-${{ github.run_number }} path: | @@ -123,10 +123,10 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Download prebuilt fuzz binaries - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: fuzz-prebuilt-binaries-${{ github.run_number }} path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release @@ -145,7 +145,7 @@ jobs: - name: Upload fuzz smoke artifacts if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: fuzz-smoke-${{ matrix.target }}-${{ github.run_number }} path: | @@ -174,10 +174,10 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Download prebuilt fuzz binaries - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: fuzz-prebuilt-binaries-${{ github.run_number }} path: fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release @@ -196,7 +196,7 @@ jobs: - name: Upload nightly fuzz artifacts if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: fuzz-nightly-${{ matrix.target }}-${{ github.run_number }} path: | diff --git a/.github/workflows/helm-package.yml b/.github/workflows/helm-package.yml index bc4c53ae1..49d038069 100644 --- a/.github/workflows/helm-package.yml +++ b/.github/workflows/helm-package.yml @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout helm chart repo - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Normalize release version id: version @@ -78,7 +78,7 @@ jobs: sed -i -E 's/^appVersion:.*/appVersion: "${{ steps.version.outputs.app_version }}"/' helm/rustfs/Chart.yaml - name: Set up Helm - uses: azure/setup-helm@v4.3.0 + uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0 - name: Test Helm Chart Templates run: ./scripts/test_helm_templates.sh @@ -92,7 +92,7 @@ jobs: --version "${{ steps.version.outputs.chart_version }}" - name: Upload helm package as artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: helm-package path: helm/rustfs/*.tgz @@ -105,19 +105,19 @@ jobs: steps: - name: Checkout helm package repo - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: repository: rustfs/helm token: ${{ secrets.RUSTFS_HELM_PACKAGE }} - name: Download helm package - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: helm-package path: ./ - name: Set up helm - uses: azure/setup-helm@v4.3.0 + uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0 - name: Generate index run: helm repo index . --url https://charts.rustfs.com diff --git a/.github/workflows/issue-translator.yml b/.github/workflows/issue-translator.yml index 97a058fdf..996ee5061 100644 --- a/.github/workflows/issue-translator.yml +++ b/.github/workflows/issue-translator.yml @@ -27,7 +27,7 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: usthe/issues-translate-action@v2.7 + - uses: usthe/issues-translate-action@b41f55ddc81d7d54bd542a4f289fe28ec081898e # v2.7 with: IS_MODIFY_TITLE: false # not require, default false. Decide whether to modify the issue title diff --git a/.github/workflows/nix-flake-update.yml b/.github/workflows/nix-flake-update.yml index e0081311f..8d4dc9be6 100644 --- a/.github/workflows/nix-flake-update.yml +++ b/.github/workflows/nix-flake-update.yml @@ -36,20 +36,20 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Install Nix - uses: DeterminateSystems/determinate-nix-action@v3 + uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3 - name: Cache Nix - uses: DeterminateSystems/flakehub-cache-action@v3.20.0 + uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3.20.0 - name: Check Nix flake inputs - uses: DeterminateSystems/flake-checker-action@v12 + uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12 - name: Update flake.lock id: update - uses: DeterminateSystems/update-flake-lock@main + uses: DeterminateSystems/update-flake-lock@fd9359ac79d0e912f1b4b947a48470b3e2799b56 # main with: git-author-name: houseme git-author-email: housemecn@gmail.com diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index 4238a1b3f..1af16c0bf 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -52,10 +52,10 @@ jobs: NIX_CURL_FLAGS: -A cargo/stable steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Install Nix - uses: DeterminateSystems/determinate-nix-action@v3.21.0 + uses: DeterminateSystems/determinate-nix-action@4eea0b33e3d1f02ecfe37cf16e7204c424009606 # v3.21.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} extra-conf: | @@ -64,10 +64,10 @@ jobs: max-jobs = 1 - name: Cache Nix - uses: DeterminateSystems/flakehub-cache-action@v3.21.0 + uses: DeterminateSystems/flakehub-cache-action@c01e819d047464c3edf6ba778f075952af5a3aa7 # v3.21.0 - name: Check Nix Flake Inputs - uses: DeterminateSystems/flake-checker-action@v12 + uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12 with: fail-mode: true ignore-missing-flake-lock: false diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml index 0124c8204..badc00481 100644 --- a/.github/workflows/performance.yml +++ b/.github/workflows/performance.yml @@ -46,7 +46,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -60,7 +60,7 @@ jobs: run: rustup component add llvm-tools-preview - name: Install samply profiler - uses: taiki-e/cache-cargo-install-action@v2 + uses: taiki-e/cache-cargo-install-action@7447f04c51f2ba27ca35e7f1e28fab848c5b3ba7 # v2 with: tool: samply @@ -109,7 +109,7 @@ jobs: - name: Upload profile data if: steps.profiling.outputs.profile_generated == 'true' - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: performance-profile-${{ github.run_number }} path: samply-profile.json @@ -123,7 +123,7 @@ jobs: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup Rust environment uses: ./.github/actions/setup @@ -139,7 +139,7 @@ jobs: tee benchmark-results.json - name: Upload benchmark results - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: benchmark-results-${{ github.run_number }} path: benchmark-results.json diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 21dc93267..30520387b 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -21,7 +21,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.' diff --git a/README.md b/README.md index b8c70a77a..f9c40c04c 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ English | 简 Русский

-RustFS is a high-performance, distributed object storage system built in Rust—one of the most loved programming languages worldwide. RustFS combines the simplicity of MinIO with the memory safety and raw performance of Rust. It offers full S3 compatibility, is completely open-source, and is optimized for data lakes, AI, and big data workloads. +RustFS is a high-performance, distributed object storage system built in Rust—one of the most loved programming languages worldwide. RustFS combines the simplicity of MinIO with the memory safety and raw performance of Rust. It offers broad S3 API compatibility for supported features, is completely open-source, and is optimized for data lakes, AI, and big data workloads. Unlike other storage systems, RustFS is released under the permissible Apache 2.0 license, avoiding the restrictions of AGPL. With Rust as its foundation, RustFS delivers superior speed and secure distributed features for next-generation object storage. @@ -42,7 +42,7 @@ Unlike other storage systems, RustFS is released under the permissible Apache 2. - **High Performance**: Built with Rust to ensure maximum speed and resource efficiency. - **Distributed Architecture**: Scalable and fault-tolerant design suitable for large-scale deployments. -- **S3 Compatibility**: Seamless integration with existing S3-compatible applications and tools. +- **S3 Compatibility**: Seamless integration with common S3-compatible applications and tools; current coverage is tracked in the [S3 compatibility matrix](docs/architecture/s3-compatibility-matrix.md). - **OpenStack Swift API**: Native support for Swift protocol with Keystone authentication. - **OpenStack Keystone Integration**: Native support for OpenStack Keystone authentication with X-Auth-Token headers. - **Data Lake Support**: Optimized for high-throughput big data and AI workloads. @@ -81,7 +81,7 @@ Unlike other storage systems, RustFS is released under the permissible Apache 2. | **Language & Safety** | **Rust-based**
Memory safety by design. | **Go or C-based**
Potential for memory GC pauses or leaks. | | **Data Sovereignty** | **No Telemetry / Full Compliance**
Guards against unauthorized cross-border data egress. Compliant with GDPR (EU/UK), CCPA (US), and APPI (Japan). | **Potential Risk**
Possible legal exposure and unwanted data telemetry. | | **Licensing** | **Permissive Apache 2.0**
Business-friendly, no "poison pill" clauses. | **Restrictive AGPL v3**
Risk of license traps and intellectual property pollution. | -| **Compatibility** | **100% S3 Compatible**
Works with any cloud provider or client, anywhere. | **Variable Compatibility**
May lack support for local cloud vendors or specific APIs. | +| **Compatibility** | **S3-Compatible Core**
Works with common S3-compatible clients, with coverage tracked in the compatibility matrix. | **Variable Compatibility**
May lack support for local cloud vendors or specific APIs. | | **Edge & IoT** | **Strong Edge Support**
Ideal for secure, innovative edge devices. | **Weak Edge Support**
Often too heavy for edge gateways. | | **Risk Profile** | **Enterprise Risk Mitigation**
Clear IP rights and safe for commercial use. | **Legal Risks**
Intellectual property ambiguity and usage restrictions. | diff --git a/README_ZH.md b/README_ZH.md index 7eeee29cf..481a3fd74 100644 --- a/README_ZH.md +++ b/README_ZH.md @@ -34,7 +34,7 @@ Русский

-RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust 是全球最受开发者喜爱的编程语言之一，RustFS 完美结合了 MinIO 的简洁性与 Rust 的内存安全及高性能优势。它提供完整的 S3 兼容性，完全开源，并专为数据湖、人工智能（AI）和大数据负载进行了优化。 +RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust 是全球最受开发者喜爱的编程语言之一，RustFS 结合了 MinIO 的简洁性与 Rust 的内存安全及高性能优势。它为已支持功能提供广泛的 S3 API 兼容性，完全开源，并专为数据湖、人工智能（AI）和大数据负载进行了优化。 与其他存储系统不同，RustFS 采用更宽松、商业友好的 Apache 2.0 许可证，避免了 AGPL 协议的限制。以 Rust 为基石，RustFS 为下一代对象存储提供了更快的速度和更安全的分布式特性。 @@ -42,7 +42,7 @@ RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust - **高性能**：基于 Rust 构建，确保极致的速度和资源效率。 - **分布式架构**：可扩展且容错的设计，适用于大规模部署。 -- **S3 兼容性**：与现有的 S3 兼容应用和工具无缝集成。 +- **S3 兼容性**：与常见 S3 兼容应用和工具集成，当前覆盖范围见 [S3 兼容矩阵](docs/architecture/s3-compatibility-matrix.md)。 - **数据湖支持**：专为高吞吐量的大数据和 AI 工作负载优化。 - **完全开源**：采用 Apache 2.0 许可证，鼓励社区贡献和商业使用。 - **简单易用**：设计简洁，易于部署和管理。 @@ -77,7 +77,7 @@ RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust | **语言与安全** | **基于 Rust 开发**
天生的内存安全。 | **基于 Go 或 C 开发**
存在内存 GC 停顿或内存泄漏的潜在风险。 | | **数据主权** | **无遥测 / 完全合规**
防止未经授权的数据跨境传输。完全符合 GDPR (欧盟/英国)、CCPA (美国) 和 APPI (日本) 等法规。 | **潜在风险**
可能存在法律风险和隐蔽的数据遥测（Telemetry）。 | | **开源协议** | **宽松的 Apache 2.0**
商业友好，无“毒丸”条款。 | **受限的 AGPL v3**
存在许可证陷阱和知识产权污染的风险。 | -| **兼容性** | **100% S3 兼容**
适用于任何云提供商和客户端，随处运行。 | **兼容性不一**
虽然支持 S3，但可能缺乏对本地云厂商或特定 API 的支持。 | +| **兼容性** | **S3 核心兼容**
适配常见 S3 兼容客户端，覆盖范围以兼容矩阵为准。 | **兼容性不一**
虽然支持 S3，但可能缺乏对本地云厂商或特定 API 的支持。 | | **边缘与 IoT** | **强大的边缘支持**
非常适合安全、创新的边缘设备。 | **边缘支持较弱**
对于边缘网关来说通常过于沉重。 | | **成本** | **稳定且免费**
免费社区支持，稳定的商业定价。 | **高昂成本**
1PiB 的成本可能高达 250,000 美元。 | | **风险控制** | **企业级风险规避**
清晰的知识产权，商业使用安全无忧。 | **法律风险**
知识产权归属模糊及使用限制风险。 | diff --git a/docs/architecture/migration-progress.md b/docs/architecture/migration-progress.md index b7f9d8fcc..da95ed759 100644 --- a/docs/architecture/migration-progress.md +++ b/docs/architecture/migration-progress.md @@ -5,7 +5,10 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block ## Current Context - Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660) -- Branch: `overtrue/arch-final-migration-validation` + is closed after PR #3965; execution index + [`rustfs/backlog#665`](https://github.com/rustfs/backlog/issues/665) is + treated as the historical task split once final sync is posted. +- Branch: `main` closeout state, with final audit remediation recorded here. - Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201/API-202/API-203/API-204/API-205/API-206/API-207/API-208/API-209/API-210/API-211/API-212/API-213/API-214/API-215/API-216/API-217/API-218/API-219/API-220/API-221/API-222/API-223/API-224/API-225/API-226/API-227/API-228/API-229/API-230/API-231/API-232/API-233/API-234/API-235/API-236/API-237/API-238/API-239/API-240/API-241/API-242/API-243/API-244/API-245/API-246/API-247/API-248/API-249/API-250/API-251/API-252/API-253/API-254/CTX-002`. - Current baseline also includes API-255 from PR #3923, API-256 from PR #3925, CFG-009 from PR #3927, C-007/C-009 from PR #3935, C-008/C-010 @@ -28,16 +31,18 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block the GLOB-007 specialized resolver fallback boundary from PR #3958, the GLOB-007 root runtime fallback facade cleanup from PR #3961, the Phase 7 global-state/crate-split closeout from - PR #3962, and the combined `TEST-RUN-001`/`TEST-REP-001` preservation tests - from PR #3964. -- Current phase PR: final issue #660 validation and closeout after backlog - sub-issues #668 and #669 were closed. -- Based on: `origin/main` at PR #3964 (`82bbef0b6`). + PR #3962, the combined `TEST-RUN-001`/`TEST-REP-001` preservation tests + from PR #3964, and the final issue #660 validation closeout from PR #3965. +- Current phase PR: post-closeout audit remediation for stale ledger/issue + wording, S3 compatibility claim alignment, and workflow-pin enforcement. +- Based on: `origin/main` at PR #3965 (`79234c030`). - PR type for this branch: `ci-gate`. - Runtime behavior changes: none. - Rust code changes: none. -- CI/script changes: none intended. -- Docs changes: record final #660 validation status and closeout handoff. +- CI/script changes: pin GitHub Actions to commit SHAs and make the workflow + pin audit enforce the existing supply-chain check. +- Docs changes: align README S3 compatibility wording with the s3tests + compatibility matrix and record final #660/#665 closeout state. ## Phase 0 Tasks @@ -6137,14 +6142,17 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block ## Next PRs -1. `ci-gate`: merge this final issue #660 validation closeout branch. -2. No further issue #660 migration PRs remain after this branch lands; close - backlog #660 with the merged PR reference. +1. `ci-gate`: merge the post-closeout audit remediation branch. +2. No further issue #660 migration implementation PRs remain; future + architecture work should use a new backlog issue. ## Pre-Push Review Log | Expert | Status | Notes | |---|---|---| +| Quality/architecture | pass | Final audit found no storage-api, ECStore, runtime/lifecycle, extension/security, or background-controller module blocker; this remediation only tightens documentation and CI supply-chain gates. | +| Migration preservation | pass | The original local plan is historical; the progress ledger plus backlog closeout agree that #660/#668/#669 are closed, while #665 is only the historical execution index pending final sync. | +| Testing/verification | pass | Final audit found runtime/repair/scheduler/KMS/CFG/CTX/API/BGC coverage aligned; it corrected S3 compatibility claim drift and upgraded workflow pin checking from report-only to enforced after pinning all action refs. | | Quality/architecture | pass | Final validation is docs-only and records the merged #3964 preservation-test closeout without changing runtime, storage, or migration guard code. | | Migration preservation | pass | The latest backlog #660 execution index and migration-progress agree that #668/#669 were the last incomplete sub-issues and are closed after #3964; older local plan files are historical. | | Testing/verification | pass | Ledger status scan, backlog issue-state check, architecture migration guard, diff hygiene, and docs-only source scan passed for the closeout. | @@ -9970,8 +9978,8 @@ Notes: - `rg -n "^- \[[~! ]\]" docs/architecture/migration-progress.md`: passed; no in-progress, blocked, or not-started task rows remain in the progress ledger. - - Backlog issue-state check: passed; #668 and #669 are closed, while #660 - remains open until this final validation branch lands. + - Backlog issue-state check: passed; #660, #668, and #669 are closed after + PR #3965, while #665 is a historical execution index pending final sync. - Historical plan reconciliation: passed; the original local plan files are superseded by the latest backlog #660 execution index and this `migration-progress.md` ledger. @@ -9980,13 +9988,24 @@ Notes: - Docs-only scope scan: passed; only `docs/architecture/migration-progress.md` changed. +- Issue #660 post-closeout audit remediation: + - Five-agent audit: completed across plan/ledger alignment, module structure, + behavior invariants, test/quality gates, and document/issue sync. + - S3 compatibility claim audit: fixed README overclaim wording and added + [`s3-compatibility-matrix.md`](s3-compatibility-matrix.md) tied to + `implemented_tests.txt`, `unimplemented_tests.txt`, and + `excluded_tests.txt`. + - Supply-chain workflow pin audit: all third-party GitHub Actions are pinned + to full-length commit SHAs, and `check_workflow_pins.sh --enforce` is the + audit workflow gate. + ## Handoff Notes -- PR #3951, PR #3961, PR #3962, and PR #3964 are merged. Backlog sub-issues - #668 (`TEST-RUN-001`) and #669 (`TEST-REP-001`) are closed. -- After this final validation branch lands, close backlog #660 with the merged - PR reference. No further issue #660 migration PRs remain in the progress - ledger. +- PR #3951, PR #3961, PR #3962, PR #3964, and PR #3965 are merged. Backlog + issues #660, #668 (`TEST-RUN-001`), and #669 (`TEST-REP-001`) are closed. +- #665 is the historical execution index for #660. After final issue sync is + posted, close #665 rather than reopening #660. +- The final audit remediated stale closeout wording, README S3 compatibility + overclaiming, and report-only workflow pin checking. - Treat the original local plan files as historical context; the current source - of truth is this progress ledger plus the latest backlog #660 execution - index. + of truth is this progress ledger plus the final #660/#665 issue sync. diff --git a/docs/architecture/s3-compatibility-matrix.md b/docs/architecture/s3-compatibility-matrix.md new file mode 100644 index 000000000..adf0666ee --- /dev/null +++ b/docs/architecture/s3-compatibility-matrix.md @@ -0,0 +1,70 @@ +# S3 Compatibility Matrix + +This matrix records the user-facing S3 compatibility claim for RustFS and ties +it to the executable Ceph s3tests lists under `scripts/s3-tests/`. + +## Current Claim + +RustFS provides broad S3 API compatibility for supported features. It does not +claim complete coverage of every standard or vendor-specific S3 behavior. + +The root README should use the same wording: supported S3-compatible clients and +features are covered by the compatibility matrix and test lists. + +## Test List Sources + +| List | Purpose | Current count | Source | +|---|---:|---:|---| +| Implemented tests | Standard S3 tests expected to pass and used by the default local s3tests run. | 449 | `scripts/s3-tests/implemented_tests.txt` | +| Unimplemented tests | Standard S3 features planned but not yet implemented. | 17 | `scripts/s3-tests/unimplemented_tests.txt` | +| Excluded tests | Vendor-specific or intentionally unsupported behavior excluded from RustFS compatibility gating. | 281 | `scripts/s3-tests/excluded_tests.txt` | + +Counts ignore blank lines and comments. + +## Supported Coverage + +The implemented test list currently covers the common object-storage surface: + +| Area | Status | Evidence | +|---|---|---| +| Bucket create/delete/list/head | Supported | `implemented_tests.txt` | +| Object put/get/delete/copy/head | Supported | `implemented_tests.txt` | +| ListObjects/ListObjectsV2 prefix, delimiter, marker, max-keys | Supported | `implemented_tests.txt` | +| Multipart upload create/upload/complete/abort and selected multipart copy/checksum/object-attribute behavior | Supported | `implemented_tests.txt` | +| Bucket and object tagging | Supported | `implemented_tests.txt` | +| Bucket policy put/get/delete | Supported | `implemented_tests.txt` | +| Public access block put/get/delete | Supported | `implemented_tests.txt` | +| Presigned GET and PUT URLs | Supported | `implemented_tests.txt` | +| Range and conditional reads | Supported | `implemented_tests.txt` | +| User metadata | Supported | `implemented_tests.txt` | +| SSE-C and selected SSE-KMS edge cases | Supported | `implemented_tests.txt` | +| Selected versioning, object-lock, checksum, CORS, raw request, and conditional write behavior | Supported | `implemented_tests.txt` | + +## Planned Standard Coverage + +These are standard S3 areas that remain planned work and must not be described +as already complete: + +| Area | Status | Evidence | +|---|---|---| +| Bucket access logging | Planned | `unimplemented_tests.txt` | +| POST Object form upload checksum handling | Planned | `unimplemented_tests.txt` | +| Bucket ownership controls | Planned | `unimplemented_tests.txt` | +| Multipart upload listing and part lookup compatibility edge cases | Not part of default gate | `excluded_tests.txt` | +| IAM-account or multi-storage-class dependent cases | Not part of default gate | `unimplemented_tests.txt` | +| Tenanted bucket policy edge cases | Needs investigation | `unimplemented_tests.txt` | + +## Intentional Exclusions + +`excluded_tests.txt` contains tests that should not block the RustFS +compatibility gate. They fall into two classes: + +- vendor-specific or non-portable behavior not required for RustFS S3 + compatibility; +- intentionally unsupported product behavior, such as ACL authorization. + +## Update Rule + +When a planned S3 feature is implemented, move its passing test entries from +`unimplemented_tests.txt` to `implemented_tests.txt`, update this matrix, and +avoid changing README wording beyond the supported coverage. diff --git a/rustfs/README.md b/rustfs/README.md index 90db00ce4..e7ca024d5 100644 --- a/rustfs/README.md +++ b/rustfs/README.md @@ -21,7 +21,7 @@ English | Simp

RustFS is a high-performance distributed object storage software built using Rust, one of the most popular languages -worldwide. Along with MinIO, it shares a range of advantages such as simplicity, S3 compatibility, open-source nature, +worldwide. Along with MinIO, it shares a range of advantages such as simplicity, broad S3 API compatibility for supported features, open-source nature, support for data lakes, AI, and big data. Furthermore, it has a better and more user-friendly open-source license in comparison to other storage systems, being constructed under the Apache license. As Rust serves as its foundation, RustFS provides faster speed and safer distributed features for high-performance object storage. @@ -30,7 +30,7 @@ RustFS provides faster speed and safer distributed features for high-performance - **High Performance**: Built with Rust, ensuring speed and efficiency. - **Distributed Architecture**: Scalable and fault-tolerant design for large-scale deployments. -- **S3 Compatibility**: Seamless integration with existing S3-compatible applications. +- **S3 Compatibility**: Integration with common S3-compatible applications; current coverage is tracked in the S3 compatibility matrix. - **Data Lake Support**: Optimized for big data and AI workloads. - **Open Source**: Licensed under Apache 2.0, encouraging community contributions and transparency. - **User-Friendly**: Designed with simplicity in mind, making it easy to deploy and manage. @@ -56,7 +56,7 @@ Stress test server parameters | Developed based on Rust language, memory is safer | Developed in Go or C, with potential issues like memory GC/leaks | | Does not report logs to third-party countries | Reporting logs to other third countries may violate national security laws | | Licensed under Apache, more business-friendly | AGPL V3 License and other License, polluted open source and License traps, infringement of intellectual property rights | -| Comprehensive S3 support, works with domestic and international cloud providers | Full support for S3, but no local cloud vendor support | +| S3-compatible core, with coverage tracked in the compatibility matrix | Variable S3 support and local cloud vendor coverage | | Rust-based development, strong support for secure and innovative devices | Poor support for edge gateways and secure innovative devices | | Stable commercial prices, free community support | High pricing, with costs up to $250,000 for 1PiB | | No risk | Intellectual property risks and risks of prohibited uses |