fix: when the error returned by make_bucket is BucketExists, replace … (#735 )

* fix: when the error returned by make_bucket is BucketExists, replace BucketAlreadyExists with BucketAlreadyOwnedByYou (#719) * test: In the test_api_error_from_storage_error_mappings test method, modify the corresponding mapping relationships --------- Co-authored-by: weisd <im@weisd.in>
fix: scandir object (#733 )
2026-08-01 02:52:15 +00:00 · 2025-10-28 15:26:34 +08:00 · 2025-10-28 15:02:43 +08:00 · 2025-10-27 20:23:50 +08:00 · 2025-10-26 21:44:54 +08:00 · 2025-10-26 12:00:13 +08:00
137 changed files with 10418 additions and 3781 deletions
@@ -93,8 +93,15 @@
            "name": "Debug executable target/debug/test",
            "type":  "lldb",
            "request": "launch",
-            "program": "${workspaceFolder}/target/debug/deps/lifecycle_integration_test-5eb7590b8f3bea55",
-            "args": [],
+            "program": "${workspaceFolder}/target/debug/deps/lifecycle_integration_test-5915cbfcab491b3b",
+            "args": [
+              "--skip",
+              "test_lifecycle_expiry_basic",
+              "--skip",
+              "test_lifecycle_expiry_deletemarker",
+              //"--skip",
+              //"test_lifecycle_transition_basic",
+            ],
            "cwd": "${workspaceFolder}",
            //"stopAtEntry": false,
            //"preLaunchTask": "cargo build",
@@ -63,94 +63,134 @@ unsafe_code = "deny"
 all = "warn"

 [workspace.dependencies]
+# RustFS Internal Crates
+rustfs = { path = "./rustfs", version = "0.0.5" }
 rustfs-ahm = { path = "crates/ahm", version = "0.0.5" }
-rustfs-s3select-api = { path = "crates/s3select-api", version = "0.0.5" }
 rustfs-appauth = { path = "crates/appauth", version = "0.0.5" }
 rustfs-audit = { path = "crates/audit", version = "0.0.5" }
+rustfs-checksums = { path = "crates/checksums", version = "0.0.5" }
 rustfs-common = { path = "crates/common", version = "0.0.5" }
+rustfs-config = { path = "./crates/config", version = "0.0.5" }
 rustfs-crypto = { path = "crates/crypto", version = "0.0.5" }
 rustfs-ecstore = { path = "crates/ecstore", version = "0.0.5" }
+rustfs-filemeta = { path = "crates/filemeta", version = "0.0.5" }
 rustfs-iam = { path = "crates/iam", version = "0.0.5" }
+rustfs-kms = { path = "crates/kms", version = "0.0.5" }
 rustfs-lock = { path = "crates/lock", version = "0.0.5" }
 rustfs-madmin = { path = "crates/madmin", version = "0.0.5" }
+rustfs-mcp = { path = "crates/mcp", version = "0.0.5" }
+rustfs-notify = { path = "crates/notify", version = "0.0.5" }
+rustfs-obs = { path = "crates/obs", version = "0.0.5" }
 rustfs-policy = { path = "crates/policy", version = "0.0.5" }
 rustfs-protos = { path = "crates/protos", version = "0.0.5" }
-rustfs-s3select-query = { path = "crates/s3select-query", version = "0.0.5" }
-rustfs = { path = "./rustfs", version = "0.0.5" }
-rustfs-zip = { path = "./crates/zip", version = "0.0.5" }
-rustfs-config = { path = "./crates/config", version = "0.0.5" }
-rustfs-obs = { path = "crates/obs", version = "0.0.5" }
-rustfs-notify = { path = "crates/notify", version = "0.0.5" }
-rustfs-utils = { path = "crates/utils", version = "0.0.5" }
 rustfs-rio = { path = "crates/rio", version = "0.0.5" }
-rustfs-filemeta = { path = "crates/filemeta", version = "0.0.5" }
+rustfs-s3select-api = { path = "crates/s3select-api", version = "0.0.5" }
+rustfs-s3select-query = { path = "crates/s3select-query", version = "0.0.5" }
 rustfs-signer = { path = "crates/signer", version = "0.0.5" }
-rustfs-checksums = { path = "crates/checksums", version = "0.0.5" }
-rustfs-workers = { path = "crates/workers", version = "0.0.5" }
-rustfs-mcp = { path = "crates/mcp", version = "0.0.5" }
 rustfs-targets = { path = "crates/targets", version = "0.0.5" }
-rustfs-kms = { path = "crates/kms", version = "0.0.5" }
-aes-gcm = { version = "0.10.3", features = ["std"] }
-anyhow = "1.0.100"
-arc-swap = "1.7.1"
-argon2 = { version = "0.5.3", features = ["std"] }
-atoi = "2.0.0"
+rustfs-utils = { path = "crates/utils", version = "0.0.5" }
+rustfs-workers = { path = "crates/workers", version = "0.0.5" }
+rustfs-zip = { path = "./crates/zip", version = "0.0.5" }
+
+# Async Runtime and Networking
 async-channel = "2.5.0"
+async-compression = { version = "0.4.19" }
 async-recursion = "1.1.1"
 async-trait = "0.1.89"
-async-compression = { version = "0.4.19" }
-atomic_enum = "0.3.0"
-aws-config = { version = "1.8.8" }
-aws-credential-types = { version = "1.2.8" }
-aws-smithy-types = { version = "1.3.3" }
-aws-sdk-s3 = { version = "1.108.0", default-features = false, features = ["sigv4a", "rustls", "rt-tokio"] }
 axum = "0.8.6"
 axum-extra = "0.10.3"
 axum-server = { version = "0.7.2", features = ["tls-rustls-no-provider"], default-features = false }
-base64-simd = "0.8.0"
-base64 = "0.22.1"
-brotli = "8.0.2"
+futures = "0.3.31"
+futures-core = "0.3.31"
+futures-util = "0.3.31"
+hyper = "1.7.0"
+hyper-rustls = { version = "0.27.7", default-features = false, features = ["native-tokio", "http1", "tls12", "logging", "http2", "ring", "webpki-roots"] }
+hyper-util = { version = "0.1.17", features = ["tokio", "server-auto", "server-graceful"] }
+http = "1.3.1"
+http-body = "1.0.1"
+reqwest = { version = "0.12.24", default-features = false, features = ["rustls-tls-webpki-roots", "charset", "http2", "system-proxy", "stream", "json", "blocking"] }
+socket2 = "0.6.1"
+tokio = { version = "1.48.0", features = ["fs", "rt-multi-thread"] }
+tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "tls12", "ring"] }
+tokio-stream = { version = "0.1.17" }
+tokio-test = "0.4.4"
+tokio-util = { version = "0.7.16", features = ["io", "compat"] }
+tonic = { version = "0.14.2", features = ["gzip"] }
+tonic-prost = { version = "0.14.2" }
+tonic-prost-build = { version = "0.14.2" }
+tower = { version = "0.5.2", features = ["timeout"] }
+tower-http = { version = "0.6.6", features = ["cors"] }
+
+# Serialization and Data Formats
 bytes = { version = "1.10.1", features = ["serde"] }
 bytesize = "2.1.0"
 byteorder = "1.5.0"
-cfg-if = "1.0.4"
-convert_case = "0.8.0"
-crc-fast = "1.3.0"
+flatbuffers = "25.9.23"
+form_urlencoded = "1.2.2"
+prost = "0.14.1"
+quick-xml = "0.38.3"
+rmcp = { version = "0.8.3" }
+rmp = { version = "0.8.14" }
+rmp-serde = { version = "1.3.0" }
+serde = { version = "1.0.228", features = ["derive"] }
+serde_json = { version = "1.0.145", features = ["raw_value"] }
+serde_urlencoded = "0.7.1"
+schemars = "1.0.4"
+
+# Cryptography and Security
+aes-gcm = { version = "0.10.3", features = ["std"] }
+argon2 = { version = "0.5.3", features = ["std"] }
+blake3 = { version = "1.8.2" }
 chacha20poly1305 = { version = "0.10.1" }
-chrono = { version = "0.4.42", features = ["serde"] }
-clap = { version = "4.5.49", features = ["derive", "env"] }
-const-str = { version = "0.7.0", features = ["std", "proc"] }
+crc-fast = "1.3.0"
+crc32c = "0.6.8"
 crc32fast = "1.5.0"
+crc64fast-nvme = "1.2.0"
+hmac = "0.12.1"
+jsonwebtoken = { version = "10.1.0", features = ["rust_crypto"] }
+pbkdf2 = "0.12.2"
+rsa = { version = "0.9.8" }
+rustls = { version = "0.23.34", features = ["ring", "logging", "std", "tls12"], default-features = false }
+rustls-pemfile = "2.2.0"
+rustls-pki-types = "1.12.0"
+sha1 = "0.10.6"
+sha2 = "0.10.9"
+zeroize = { version = "1.8.2", features = ["derive"] }
+
+# Time and Date
+chrono = { version = "0.4.42", features = ["serde"] }
+humantime = "2.3.0"
+time = { version = "0.3.44", features = ["std", "parsing", "formatting", "macros", "serde"] }
+
+# Utilities and Tools
+anyhow = "1.0.100"
+arc-swap = "1.7.1"
+astral-tokio-tar = "0.5.6"
+atoi = "2.0.0"
+atomic_enum = "0.3.0"
+aws-config = { version = "1.8.8" }
+aws-credential-types = { version = "1.2.8" }
+aws-sdk-s3 = { version = "1.108.0", default-features = false, features = ["sigv4a", "rustls", "rt-tokio"] }
+aws-smithy-types = { version = "1.3.3" }
+base64 = "0.22.1"
+base64-simd = "0.8.0"
+brotli = "8.0.2"
+cfg-if = "1.0.4"
+clap = { version = "4.5.50", features = ["derive", "env"] }
+const-str = { version = "0.7.0", features = ["std", "proc"] }
+convert_case = "0.8.0"
 criterion = { version = "0.7", features = ["html_reports"] }
 crossbeam-queue = "0.3.12"
 datafusion = "50.2.0"
 derive_builder = "0.20.2"
 enumset = "1.1.10"
-flatbuffers = "25.9.23"
 flate2 = "1.1.4"
 flexi_logger = { version = "0.31.7", features = ["trc", "dont_minimize_extra_stacks", "compress", "kv"] }
-form_urlencoded = "1.2.2"
-futures = "0.3.31"
-futures-core = "0.3.31"
-futures-util = "0.3.31"
 glob = "0.3.3"
 hashbrown = { version = "0.16.0", features = ["serde", "rayon"] }
 hex-simd = "0.8.0"
 highway = { version = "1.3.0" }
-hickory-resolver = { version = "0.25.2", features = ["tls-ring"] }
-hmac = "0.12.1"
-hyper = "1.7.0"
-hyper-util = { version = "0.1.17", features = [
-    "tokio",
-    "server-auto",
-    "server-graceful",
-] }
-hyper-rustls = { version = "0.27.7", default-features = false, features = ["native-tokio", "http1", "tls12", "logging", "http2", "ring", "webpki-roots"] }
-http = "1.3.1"
-http-body = "1.0.1"
-humantime = "2.3.0"
 ipnetwork = { version = "0.21.1", features = ["serde"] }
-jsonwebtoken = { version = "10.0.0", features = ["rust_crypto"] }
 lazy_static = "1.5.0"
 libc = "0.2.177"
 libsystemd = { version = "0.7.2" }
@@ -159,6 +199,8 @@ lz4 = "1.28.1"
 matchit = "0.8.4"
 md-5 = "0.10.6"
 md5 = "0.8.0"
+metrics = "0.24.2"
+metrics-exporter-opentelemetry = "0.1.2"
 mime_guess = "2.0.5"
 moka = { version = "0.12.11", features = ["future"] }
 netif = "0.1.6"
@@ -168,128 +210,62 @@ num_cpus = { version = "1.17.0" }
 nvml-wrapper = "0.11.0"
 object_store = "0.12.4"
 once_cell = "1.21.3"
-opentelemetry = { version = "0.31.0" }
-opentelemetry-appender-tracing = { version = "0.31.1", features = [
-    "experimental_use_tracing_span_context",
-    "experimental_metadata_attributes",
-    "spec_unstable_logs_enabled"
-] }
-opentelemetry_sdk = { version = "0.31.0" }
-opentelemetry-stdout = { version = "0.31.0" }
-opentelemetry-otlp = { version = "0.31.0", default-features = false, features = [
-    "grpc-tonic", "gzip-tonic", "trace", "metrics", "logs", "internal-logs"
-] }
-opentelemetry-semantic-conventions = { version = "0.31.0", features = [
-    "semconv_experimental",
-] }
 parking_lot = "0.12.5"
 path-absolutize = "3.1.1"
 path-clean = "1.0.1"
-blake3 = { version = "1.8.2" }
-pbkdf2 = "0.12.2"
 pin-project-lite = "0.2.16"
-prost = "0.14.1"
 pretty_assertions = "1.4.1"
-quick-xml = "0.38.3"
 rand = "0.9.2"
 rayon = "1.11.0"
 reed-solomon-simd = { version = "3.1.0" }
 regex = { version = "1.12.2" }
-reqwest = { version = "0.12.24", default-features = false, features = [
-    "rustls-tls-webpki-roots",
-    "charset",
-    "http2",
-    "system-proxy",
-    "stream",
-    "json",
-    "blocking",
-] }
-rmcp = { version = "0.8.1" }
-rmp = { version = "0.8.14" }
-rmp-serde = { version = "1.3.0" }
-rsa = { version = "0.9.8" }
 rumqttc = { version = "0.25.0" }
-rust-embed = { version = "8.7.2" }
+rust-embed = { version = "8.8.0" }
 rustc-hash = { version = "2.1.1" }
-rustls = { version = "0.23.32", features = ["ring", "logging", "std", "tls12"], default-features = false }
-rustls-pki-types = "1.12.0"
-rustls-pemfile = "2.2.0"
 s3s = { version = "0.12.0-rc.3", features = ["minio"] }
-schemars = "1.0.4"
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = { version = "1.0.145", features = ["raw_value"] }
-serde_urlencoded = "0.7.1"
 serial_test = "3.2.0"
-sha1 = "0.10.6"
-sha2 = "0.10.9"
 shadow-rs = { version = "1.4.0", default-features = false }
 siphasher = "1.0.1"
 smallvec = { version = "1.15.1", features = ["serde"] }
 smartstring = "1.0.1"
 snafu = "0.8.9"
 snap = "1.1.1"
-socket2 = "0.6.1"
 starshard = { version = "0.5.0", features = ["rayon", "async", "serde"] }
 strum = { version = "0.27.2", features = ["derive"] }
-sysinfo = "0.37.1"
 sysctl = "0.7.1"
-tempfile = "3.23.0"
+sysinfo = "0.37.1"
 temp-env = "0.3.6"
+tempfile = "3.23.0"
 test-case = "3.3.1"
 thiserror = "2.0.17"
-time = { version = "0.3.44", features = [
-    "std",
-    "parsing",
-    "formatting",
-    "macros",
-    "serde",
-] }
-tokio = { version = "1.48.0", features = ["fs", "rt-multi-thread"] }
-tokio-rustls = { version = "0.26.4", default-features = false, features = ["logging", "tls12", "ring"] }
-tokio-stream = { version = "0.1.17" }
-tokio-tar = "0.3.1"
-tokio-test = "0.4.4"
-tokio-util = { version = "0.7.16", features = ["io", "compat"] }
-tonic = { version = "0.14.2", features = ["gzip"] }
-tonic-prost = { version = "0.14.2" }
-tonic-prost-build = { version = "0.14.2" }
-tower = { version = "0.5.2", features = ["timeout"] }
-tower-http = { version = "0.6.6", features = ["cors"] }
 tracing = { version = "0.1.41" }
-tracing-core = "0.1.34"
 tracing-error = "0.2.1"
 tracing-opentelemetry = "0.32.0"
 tracing-subscriber = { version = "0.3.20", features = ["env-filter", "time"] }
 transform-stream = "0.3.1"
 url = "2.5.7"
 urlencoding = "2.1.3"
-uuid = { version = "1.18.1", features = [
-    "v4",
-    "fast-rng",
-    "macro-diagnostics",
-] }
+uuid = { version = "1.18.1", features = ["v4", "fast-rng", "macro-diagnostics"] }
 vaultrs = { version = "0.7.4" }
 walkdir = "2.5.0"
 wildmatch = { version = "2.5.0", features = ["serde"] }
-zeroize = { version = "1.8.2", features = ["derive"] }
 winapi = { version = "0.3.9" }
 xxhash-rust = { version = "0.8.15", features = ["xxh64", "xxh3"] }
 zip = "6.0.0"
 zstd = "0.13.3"

+# Observability and Metrics
+opentelemetry = { version = "0.31.0" }
+opentelemetry-appender-tracing = { version = "0.31.1", features = ["experimental_use_tracing_span_context", "experimental_metadata_attributes", "spec_unstable_logs_enabled"] }
+opentelemetry-otlp = { version = "0.31.0", default-features = false, features = ["grpc-tonic", "gzip-tonic", "trace", "metrics", "logs", "internal-logs"] }
+opentelemetry_sdk = { version = "0.31.0" }
+opentelemetry-semantic-conventions = { version = "0.31.0", features = ["semconv_experimental"] }
+opentelemetry-stdout = { version = "0.31.0" }
+
+

 [workspace.metadata.cargo-shear]
-ignored = ["rustfs", "rust-i18n", "rustfs-mcp", "tokio-test", "rustfs-audit"]
-
-[profile.wasm-dev]
-inherits = "dev"
-opt-level = 1
-
-[profile.server-dev]
-inherits = "dev"
-
-[profile.android-dev]
-inherits = "dev"
+ignored = ["rustfs", "rustfs-mcp", "tokio-test"]

 [profile.release]
 opt-level = 3
@@ -58,7 +58,7 @@ LABEL name="RustFS" \
      url="https://rustfs.com" \
      license="Apache-2.0"

-RUN apk add --no-cache ca-certificates coreutils
+RUN apk add --no-cache ca-certificates coreutils curl

 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=build /build/rustfs /usr/bin/rustfs
@@ -194,6 +194,10 @@ top charts.

 <a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://raw.githubusercontent.com/rustfs/rustfs/refs/heads/main/docs/rustfs-trending.jpg" alt="rustfs%2Frustfs | Trendshift" /></a>

+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
+
 ## License

 [Apache 2.0](https://opensource.org/licenses/Apache-2.0)
@@ -136,6 +136,10 @@ RustFS 变得更好的杰出人员。

 <a href="https://trendshift.io/repositories/14181" target="_blank"><img src="https://raw.githubusercontent.com/rustfs/rustfs/refs/heads/main/docs/rustfs-trending.jpg" alt="rustfs%2Frustfs | Trendshift" /></a>

+## Star 历史图
+
+[![Star 历史图](https://api.star-history.com/svg?repos=rustfs/rustfs&type=date&legend=top-left)](https://www.star-history.com/#rustfs/rustfs&type=date&legend=top-left)
+
 ## 许可证

 [Apache 2.0](https://opensource.org/licenses/Apache-2.0)
@@ -40,3 +40,4 @@ serde_json = { workspace = true }
 serial_test = { workspace = true }
 tracing-subscriber = { workspace = true }
 tempfile = { workspace = true }
+heed = "0.22.0"
@@ -0,0 +1,508 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use heed::byteorder::BigEndian;
+use heed::types::*;
+use heed::{BoxedError, BytesDecode, BytesEncode, Database, DatabaseFlags, Env, EnvOpenOptions};
+use rustfs_ahm::scanner::local_scan::{self, LocalObjectRecord, LocalScanOutcome};
+use rustfs_ecstore::{
+    disk::endpoint::Endpoint,
+    endpoints::{EndpointServerPools, Endpoints, PoolEndpoints},
+    store::ECStore,
+    store_api::{MakeBucketOptions, ObjectIO, ObjectInfo, ObjectOptions, PutObjReader, StorageAPI},
+};
+use serial_test::serial;
+use std::borrow::Cow;
+use std::sync::Once;
+use std::sync::OnceLock;
+use std::{path::PathBuf, sync::Arc};
+use tokio::fs;
+use tokio_util::sync::CancellationToken;
+use tracing::warn;
+use tracing::{debug, info};
+//use heed_traits::Comparator;
+use time::OffsetDateTime;
+use uuid::Uuid;
+
+static GLOBAL_ENV: OnceLock<(Vec<PathBuf>, Arc<ECStore>)> = OnceLock::new();
+static INIT: Once = Once::new();
+
+static _LIFECYCLE_EXPIRY_CURRENT_DAYS: i32 = 1;
+static _LIFECYCLE_EXPIRY_NONCURRENT_DAYS: i32 = 1;
+static _LIFECYCLE_TRANSITION_CURRENT_DAYS: i32 = 1;
+static _LIFECYCLE_TRANSITION_NONCURRENT_DAYS: i32 = 1;
+static GLOBAL_LMDB_ENV: OnceLock<Env> = OnceLock::new();
+static GLOBAL_LMDB_DB: OnceLock<Database<I64<BigEndian>, LifecycleContentCodec>> = OnceLock::new();
+
+fn init_tracing() {
+    INIT.call_once(|| {
+        let _ = tracing_subscriber::fmt::try_init();
+    });
+}
+
+/// Test helper: Create test environment with ECStore
+async fn setup_test_env() -> (Vec<PathBuf>, Arc<ECStore>) {
+    init_tracing();
+
+    // Fast path: already initialized, just clone and return
+    if let Some((paths, ecstore)) = GLOBAL_ENV.get() {
+        return (paths.clone(), ecstore.clone());
+    }
+
+    // create temp dir as 4 disks with unique base dir
+    let test_base_dir = format!("/tmp/rustfs_ahm_lifecyclecache_test_{}", uuid::Uuid::new_v4());
+    let temp_dir = std::path::PathBuf::from(&test_base_dir);
+    if temp_dir.exists() {
+        fs::remove_dir_all(&temp_dir).await.ok();
+    }
+    fs::create_dir_all(&temp_dir).await.unwrap();
+
+    // create 4 disk dirs
+    let disk_paths = vec![
+        temp_dir.join("disk1"),
+        temp_dir.join("disk2"),
+        temp_dir.join("disk3"),
+        temp_dir.join("disk4"),
+    ];
+
+    for disk_path in &disk_paths {
+        fs::create_dir_all(disk_path).await.unwrap();
+    }
+
+    // create EndpointServerPools
+    let mut endpoints = Vec::new();
+    for (i, disk_path) in disk_paths.iter().enumerate() {
+        let mut endpoint = Endpoint::try_from(disk_path.to_str().unwrap()).unwrap();
+        // set correct index
+        endpoint.set_pool_index(0);
+        endpoint.set_set_index(0);
+        endpoint.set_disk_index(i);
+        endpoints.push(endpoint);
+    }
+
+    let pool_endpoints = PoolEndpoints {
+        legacy: false,
+        set_count: 1,
+        drives_per_set: 4,
+        endpoints: Endpoints::from(endpoints),
+        cmd_line: "test".to_string(),
+        platform: format!("OS: {} | Arch: {}", std::env::consts::OS, std::env::consts::ARCH),
+    };
+
+    let endpoint_pools = EndpointServerPools(vec![pool_endpoints]);
+
+    // format disks (only first time)
+    rustfs_ecstore::store::init_local_disks(endpoint_pools.clone()).await.unwrap();
+
+    // create ECStore with dynamic port 0 (let OS assign) or fixed 9002 if free
+    let port = 9002; // for simplicity
+    let server_addr: std::net::SocketAddr = format!("127.0.0.1:{port}").parse().unwrap();
+    let ecstore = ECStore::new(server_addr, endpoint_pools, CancellationToken::new())
+        .await
+        .unwrap();
+
+    // init bucket metadata system
+    let buckets_list = ecstore
+        .list_bucket(&rustfs_ecstore::store_api::BucketOptions {
+            no_metadata: true,
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let buckets = buckets_list.into_iter().map(|v| v.name).collect();
+    rustfs_ecstore::bucket::metadata_sys::init_bucket_metadata_sys(ecstore.clone(), buckets).await;
+
+    //lmdb env
+    // User home directory
+    /*if let Ok(home_dir) = env::var("HOME").or_else(|_| env::var("USERPROFILE")) {
+        let mut path = PathBuf::from(home_dir);
+        path.push(format!(".{DEFAULT_LOG_FILENAME}"));
+        path.push(DEFAULT_LOG_DIR);
+        if ensure_directory_writable(&path) {
+            //return path;
+        }
+    }*/
+    let test_lmdb_lifecycle_dir = "/tmp/lmdb_lifecycle".to_string();
+    let temp_dir = std::path::PathBuf::from(&test_lmdb_lifecycle_dir);
+    if temp_dir.exists() {
+        fs::remove_dir_all(&temp_dir).await.ok();
+    }
+    fs::create_dir_all(&temp_dir).await.unwrap();
+    let lmdb_env = unsafe { EnvOpenOptions::new().max_dbs(100).open(&test_lmdb_lifecycle_dir).unwrap() };
+    let bucket_name = format!("test-lc-cache-{}", "00000");
+    let mut wtxn = lmdb_env.write_txn().unwrap();
+    let db = match lmdb_env
+        .database_options()
+        .name(&format!("bucket_{}", bucket_name))
+        .types::<I64<BigEndian>, LifecycleContentCodec>()
+        .flags(DatabaseFlags::DUP_SORT)
+        //.dup_sort_comparator::<>()
+        .create(&mut wtxn)
+    {
+        Ok(db) => db,
+        Err(err) => {
+            panic!("lmdb error: {}", err);
+        }
+    };
+    let _ = wtxn.commit();
+    let _ = GLOBAL_LMDB_ENV.set(lmdb_env);
+    let _ = GLOBAL_LMDB_DB.set(db);
+
+    // Store in global once lock
+    let _ = GLOBAL_ENV.set((disk_paths.clone(), ecstore.clone()));
+
+    (disk_paths, ecstore)
+}
+
+/// Test helper: Create a test bucket
+#[allow(dead_code)]
+async fn create_test_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
+    (**ecstore)
+        .make_bucket(bucket_name, &Default::default())
+        .await
+        .expect("Failed to create test bucket");
+    info!("Created test bucket: {}", bucket_name);
+}
+
+/// Test helper: Create a test lock bucket
+async fn create_test_lock_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
+    (**ecstore)
+        .make_bucket(
+            bucket_name,
+            &MakeBucketOptions {
+                lock_enabled: true,
+                versioning_enabled: true,
+                ..Default::default()
+            },
+        )
+        .await
+        .expect("Failed to create test bucket");
+    info!("Created test bucket: {}", bucket_name);
+}
+
+/// Test helper: Upload test object
+async fn upload_test_object(ecstore: &Arc<ECStore>, bucket: &str, object: &str, data: &[u8]) {
+    let mut reader = PutObjReader::from_vec(data.to_vec());
+    let object_info = (**ecstore)
+        .put_object(bucket, object, &mut reader, &ObjectOptions::default())
+        .await
+        .expect("Failed to upload test object");
+
+    println!("object_info1: {:?}", object_info);
+
+    info!("Uploaded test object: {}/{} ({} bytes)", bucket, object, object_info.size);
+}
+
+/// Test helper: Check if object exists
+async fn object_exists(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
+    match (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
+        Ok(info) => !info.delete_marker,
+        Err(_) => false,
+    }
+}
+
+fn ns_to_offset_datetime(ns: i128) -> Option<OffsetDateTime> {
+    OffsetDateTime::from_unix_timestamp_nanos(ns).ok()
+}
+
+fn convert_record_to_object_info(record: &LocalObjectRecord) -> ObjectInfo {
+    let usage = &record.usage;
+
+    ObjectInfo {
+        bucket: usage.bucket.clone(),
+        name: usage.object.clone(),
+        size: usage.total_size as i64,
+        delete_marker: !usage.has_live_object && usage.delete_markers_count > 0,
+        mod_time: usage.last_modified_ns.and_then(ns_to_offset_datetime),
+        ..Default::default()
+    }
+}
+
+#[allow(dead_code)]
+fn to_object_info(
+    bucket: &str,
+    object: &str,
+    total_size: i64,
+    delete_marker: bool,
+    mod_time: OffsetDateTime,
+    version_id: &str,
+) -> ObjectInfo {
+    ObjectInfo {
+        bucket: bucket.to_string(),
+        name: object.to_string(),
+        size: total_size,
+        delete_marker,
+        mod_time: Some(mod_time),
+        version_id: Some(Uuid::parse_str(version_id).unwrap()),
+        ..Default::default()
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum LifecycleType {
+    ExpiryCurrent,
+    ExpiryNoncurrent,
+    TransitionCurrent,
+    TransitionNoncurrent,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct LifecycleContent {
+    ver_no: u8,
+    ver_id: String,
+    mod_time: OffsetDateTime,
+    type_: LifecycleType,
+    object_name: String,
+}
+
+pub struct LifecycleContentCodec;
+
+impl BytesEncode<'_> for LifecycleContentCodec {
+    type EItem = LifecycleContent;
+
+    fn bytes_encode(lcc: &Self::EItem) -> Result<Cow<'_, [u8]>, BoxedError> {
+        let (ver_no_byte, ver_id_bytes, mod_timestamp_bytes, type_byte, object_name_bytes) = match lcc {
+            LifecycleContent {
+                ver_no,
+                ver_id,
+                mod_time,
+                type_: LifecycleType::ExpiryCurrent,
+                object_name,
+            } => (
+                ver_no,
+                ver_id.clone().into_bytes(),
+                mod_time.unix_timestamp().to_be_bytes(),
+                0,
+                object_name.clone().into_bytes(),
+            ),
+            LifecycleContent {
+                ver_no,
+                ver_id,
+                mod_time,
+                type_: LifecycleType::ExpiryNoncurrent,
+                object_name,
+            } => (
+                ver_no,
+                ver_id.clone().into_bytes(),
+                mod_time.unix_timestamp().to_be_bytes(),
+                1,
+                object_name.clone().into_bytes(),
+            ),
+            LifecycleContent {
+                ver_no,
+                ver_id,
+                mod_time,
+                type_: LifecycleType::TransitionCurrent,
+                object_name,
+            } => (
+                ver_no,
+                ver_id.clone().into_bytes(),
+                mod_time.unix_timestamp().to_be_bytes(),
+                2,
+                object_name.clone().into_bytes(),
+            ),
+            LifecycleContent {
+                ver_no,
+                ver_id,
+                mod_time,
+                type_: LifecycleType::TransitionNoncurrent,
+                object_name,
+            } => (
+                ver_no,
+                ver_id.clone().into_bytes(),
+                mod_time.unix_timestamp().to_be_bytes(),
+                3,
+                object_name.clone().into_bytes(),
+            ),
+        };
+
+        let mut output = Vec::<u8>::new();
+        output.push(*ver_no_byte);
+        output.extend_from_slice(&ver_id_bytes);
+        output.extend_from_slice(&mod_timestamp_bytes);
+        output.push(type_byte);
+        output.extend_from_slice(&object_name_bytes);
+        Ok(Cow::Owned(output))
+    }
+}
+
+impl<'a> BytesDecode<'a> for LifecycleContentCodec {
+    type DItem = LifecycleContent;
+
+    fn bytes_decode(bytes: &'a [u8]) -> Result<Self::DItem, BoxedError> {
+        use std::mem::size_of;
+
+        let ver_no = match bytes.get(..size_of::<u8>()) {
+            Some(bytes) => bytes.try_into().map(u8::from_be_bytes).unwrap(),
+            None => return Err("invalid LifecycleContent: cannot extract ver_no".into()),
+        };
+
+        let ver_id = match bytes.get(size_of::<u8>()..(36 + 1)) {
+            Some(bytes) => unsafe { std::str::from_utf8_unchecked(bytes).to_string() },
+            None => return Err("invalid LifecycleContent: cannot extract ver_id".into()),
+        };
+
+        let mod_timestamp = match bytes.get((36 + 1)..(size_of::<i64>() + 36 + 1)) {
+            Some(bytes) => bytes.try_into().map(i64::from_be_bytes).unwrap(),
+            None => return Err("invalid LifecycleContent: cannot extract mod_time timestamp".into()),
+        };
+
+        let type_ = match bytes.get(size_of::<i64>() + 36 + 1) {
+            Some(&0) => LifecycleType::ExpiryCurrent,
+            Some(&1) => LifecycleType::ExpiryNoncurrent,
+            Some(&2) => LifecycleType::TransitionCurrent,
+            Some(&3) => LifecycleType::TransitionNoncurrent,
+            Some(_) => return Err("invalid LifecycleContent: invalid LifecycleType".into()),
+            None => return Err("invalid LifecycleContent: cannot extract LifecycleType".into()),
+        };
+
+        let object_name = match bytes.get((size_of::<i64>() + 36 + 1 + 1)..) {
+            Some(bytes) => unsafe { std::str::from_utf8_unchecked(bytes).to_string() },
+            None => return Err("invalid LifecycleContent: cannot extract object_name".into()),
+        };
+
+        Ok(LifecycleContent {
+            ver_no,
+            ver_id,
+            mod_time: OffsetDateTime::from_unix_timestamp(mod_timestamp).unwrap(),
+            type_,
+            object_name,
+        })
+    }
+}
+
+mod serial_tests {
+    use super::*;
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    #[serial]
+    //#[ignore]
+    async fn test_lifecycle_chche_build() {
+        let (_disk_paths, ecstore) = setup_test_env().await;
+
+        // Create test bucket and object
+        let suffix = uuid::Uuid::new_v4().simple().to_string();
+        let bucket_name = format!("test-lc-cache-{}", &suffix[..8]);
+        let object_name = "test/object.txt"; // Match the lifecycle rule prefix "test/"
+        let test_data = b"Hello, this is test data for lifecycle expiry!";
+
+        create_test_lock_bucket(&ecstore, bucket_name.as_str()).await;
+        upload_test_object(&ecstore, bucket_name.as_str(), object_name, test_data).await;
+
+        // Verify object exists initially
+        assert!(object_exists(&ecstore, bucket_name.as_str(), object_name).await);
+        println!("✅ Object exists before lifecycle processing");
+
+        let scan_outcome = match local_scan::scan_and_persist_local_usage(ecstore.clone()).await {
+            Ok(outcome) => outcome,
+            Err(err) => {
+                warn!("Local usage scan failed: {}", err);
+                LocalScanOutcome::default()
+            }
+        };
+        let bucket_objects_map = &scan_outcome.bucket_objects;
+
+        let records = match bucket_objects_map.get(&bucket_name) {
+            Some(records) => records,
+            None => {
+                debug!("No local snapshot entries found for bucket {}; skipping lifecycle/integrity", bucket_name);
+                &vec![]
+            }
+        };
+
+        if let Some(lmdb_env) = GLOBAL_LMDB_ENV.get() {
+            if let Some(lmdb) = GLOBAL_LMDB_DB.get() {
+                let mut wtxn = lmdb_env.write_txn().unwrap();
+
+                /*if let Ok((lc_config, _)) = rustfs_ecstore::bucket::metadata_sys::get_lifecycle_config(bucket_name.as_str()).await {
+                    if let Ok(object_info) = ecstore
+                        .get_object_info(bucket_name.as_str(), object_name, &rustfs_ecstore::store_api::ObjectOptions::default())
+                        .await
+                    {
+                        let event = rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_ops::eval_action_from_lifecycle(
+                            &lc_config,
+                            None,
+                            None,
+                            &object_info,
+                        )
+                        .await;
+
+                        rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_ops::apply_expiry_on_non_transitioned_objects(
+                            ecstore.clone(),
+                            &object_info,
+                            &event,
+                            &rustfs_ecstore::bucket::lifecycle::bucket_lifecycle_audit::LcEventSrc::Scanner,
+                        )
+                        .await;
+
+                        expired = wait_for_object_absence(&ecstore, bucket_name.as_str(), object_name, Duration::from_secs(2)).await;
+                    }
+                }*/
+
+                for record in records {
+                    if !record.usage.has_live_object {
+                        continue;
+                    }
+
+                    let object_info = convert_record_to_object_info(record);
+                    println!("object_info2: {:?}", object_info);
+                    let mod_time = object_info.mod_time.unwrap_or(OffsetDateTime::now_utc());
+                    let expiry_time = rustfs_ecstore::bucket::lifecycle::lifecycle::expected_expiry_time(mod_time, 1);
+
+                    let version_id = if let Some(version_id) = object_info.version_id {
+                        version_id.to_string()
+                    } else {
+                        "zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz".to_string()
+                    };
+
+                    lmdb.put(
+                        &mut wtxn,
+                        &expiry_time.unix_timestamp(),
+                        &LifecycleContent {
+                            ver_no: 0,
+                            ver_id: version_id,
+                            mod_time,
+                            type_: LifecycleType::TransitionNoncurrent,
+                            object_name: object_info.name,
+                        },
+                    )
+                    .unwrap();
+                }
+
+                wtxn.commit().unwrap();
+
+                let mut wtxn = lmdb_env.write_txn().unwrap();
+                let iter = lmdb.iter_mut(&mut wtxn).unwrap();
+                //let _ = unsafe { iter.del_current().unwrap() };
+                for row in iter {
+                    if let Ok(ref elm) = row {
+                        let LifecycleContent {
+                            ver_no,
+                            ver_id,
+                            mod_time,
+                            type_,
+                            object_name,
+                        } = &elm.1;
+                        println!("cache row:{} {} {} {:?} {}", ver_no, ver_id, mod_time, type_, object_name);
+                    }
+                    println!("row:{:?}", row);
+                }
+                //drop(iter);
+                wtxn.commit().unwrap();
+            }
+        }
+
+        println!("Lifecycle cache test completed");
+    }
+}
@@ -18,9 +18,9 @@ use rustfs_ecstore::{
    bucket::metadata_sys,
    disk::endpoint::Endpoint,
    endpoints::{EndpointServerPools, Endpoints, PoolEndpoints},
+    global::GLOBAL_TierConfigMgr,
    store::ECStore,
    store_api::{MakeBucketOptions, ObjectIO, ObjectOptions, PutObjReader, StorageAPI},
-    tier::tier::TierConfigMgr,
    tier::tier_config::{TierConfig, TierMinIO, TierType},
 };
 use serial_test::serial;
@@ -28,14 +28,11 @@ use std::sync::Once;
 use std::sync::OnceLock;
 use std::{path::PathBuf, sync::Arc, time::Duration};
 use tokio::fs;
-use tokio::sync::RwLock;
 use tokio_util::sync::CancellationToken;
-use tracing::warn;
-use tracing::{debug, info};
+use tracing::info;

 static GLOBAL_ENV: OnceLock<(Vec<PathBuf>, Arc<ECStore>)> = OnceLock::new();
 static INIT: Once = Once::new();
-static GLOBAL_TIER_CONFIG_MGR: OnceLock<Arc<RwLock<TierConfigMgr>>> = OnceLock::new();

 fn init_tracing() {
    INIT.call_once(|| {
@@ -121,13 +118,11 @@ async fn setup_test_env() -> (Vec<PathBuf>, Arc<ECStore>) {
    // Store in global once lock
    let _ = GLOBAL_ENV.set((disk_paths.clone(), ecstore.clone()));

-    let _ = GLOBAL_TIER_CONFIG_MGR.set(TierConfigMgr::new());
-
    (disk_paths, ecstore)
 }

 /// Test helper: Create a test bucket
-async fn _create_test_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
+async fn create_test_bucket(ecstore: &Arc<ECStore>, bucket_name: &str) {
    (**ecstore)
        .make_bucket(bucket_name, &Default::default())
        .await
@@ -220,7 +215,7 @@ async fn set_bucket_lifecycle_transition(bucket_name: &str) -> Result<(), Box<dy
        </Filter>
        <Transition>
          <Days>0</Days>
-          <StorageClass>COLDTIER</StorageClass>
+          <StorageClass>COLDTIER44</StorageClass>
        </Transition>
    </Rule>
    <Rule>
@@ -231,7 +226,7 @@ async fn set_bucket_lifecycle_transition(bucket_name: &str) -> Result<(), Box<dy
        </Filter>
        <NoncurrentVersionTransition>
          <NoncurrentDays>0</NoncurrentDays>
-          <StorageClass>COLDTIER</StorageClass>
+          <StorageClass>COLDTIER44</StorageClass>
        </NoncurrentVersionTransition>
    </Rule>
 </LifecycleConfiguration>"#;
@@ -243,33 +238,51 @@ async fn set_bucket_lifecycle_transition(bucket_name: &str) -> Result<(), Box<dy

 /// Test helper: Create a test tier
 #[allow(dead_code)]
-async fn create_test_tier() {
+async fn create_test_tier(server: u32) {
    let args = TierConfig {
        version: "v1".to_string(),
        tier_type: TierType::MinIO,
-        name: "COLDTIER".to_string(),
+        name: "COLDTIER44".to_string(),
        s3: None,
+        aliyun: None,
+        tencent: None,
+        huaweicloud: None,
+        azure: None,
+        gcs: None,
+        r2: None,
        rustfs: None,
-        minio: Some(TierMinIO {
-            access_key: "minioadmin".to_string(),
-            secret_key: "minioadmin".to_string(),
-            bucket: "mblock2".to_string(),
-            endpoint: "http://127.0.0.1:9020".to_string(),
-            prefix: "mypre3/".to_string(),
-            region: "".to_string(),
-            ..Default::default()
-        }),
+        minio: if server == 1 {
+            Some(TierMinIO {
+                access_key: "minioadmin".to_string(),
+                secret_key: "minioadmin".to_string(),
+                bucket: "hello".to_string(),
+                endpoint: "http://39.105.198.204:9000".to_string(),
+                prefix: format!("mypre{}/", uuid::Uuid::new_v4()),
+                region: "".to_string(),
+                ..Default::default()
+            })
+        } else {
+            Some(TierMinIO {
+                access_key: "minioadmin".to_string(),
+                secret_key: "minioadmin".to_string(),
+                bucket: "mblock2".to_string(),
+                endpoint: "http://127.0.0.1:9020".to_string(),
+                prefix: format!("mypre{}/", uuid::Uuid::new_v4()),
+                region: "".to_string(),
+                ..Default::default()
+            })
+        },
    };
-    let mut tier_config_mgr = GLOBAL_TIER_CONFIG_MGR.get().unwrap().write().await;
+    let mut tier_config_mgr = GLOBAL_TierConfigMgr.write().await;
    if let Err(err) = tier_config_mgr.add(args, false).await {
-        warn!("tier_config_mgr add failed, e: {:?}", err);
+        println!("tier_config_mgr add failed, e: {:?}", err);
        panic!("tier add failed. {err}");
    }
    if let Err(e) = tier_config_mgr.save().await {
-        warn!("tier_config_mgr save failed, e: {:?}", e);
+        println!("tier_config_mgr save failed, e: {:?}", e);
        panic!("tier save failed");
    }
-    info!("Created test tier: {}", "COLDTIER");
+    println!("Created test tier: COLDTIER44");
 }

 /// Test helper: Check if object exists
@@ -284,9 +297,10 @@ async fn object_exists(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bo
 #[allow(dead_code)]
 async fn object_is_delete_marker(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
    if let Ok(oi) = (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
-        debug!("oi: {:?}", oi);
+        println!("oi: {:?}", oi);
        oi.delete_marker
    } else {
+        println!("object_is_delete_marker is error");
        panic!("object_is_delete_marker is error");
    }
 }
@@ -295,9 +309,10 @@ async fn object_is_delete_marker(ecstore: &Arc<ECStore>, bucket: &str, object: &
 #[allow(dead_code)]
 async fn object_is_transitioned(ecstore: &Arc<ECStore>, bucket: &str, object: &str) -> bool {
    if let Ok(oi) = (**ecstore).get_object_info(bucket, object, &ObjectOptions::default()).await {
-        info!("oi: {:?}", oi);
+        println!("oi: {:?}", oi);
        !oi.transitioned_object.status.is_empty()
    } else {
+        println!("object_is_transitioned is error");
        panic!("object_is_transitioned is error");
    }
 }
@@ -343,7 +358,7 @@ mod serial_tests {
        set_bucket_lifecycle(bucket_name.as_str())
            .await
            .expect("Failed to set lifecycle configuration");
-        println!("✅ Lifecycle configuration set for bucket: {}", bucket_name);
+        println!("✅ Lifecycle configuration set for bucket: {bucket_name}");

        // Verify lifecycle configuration was set
        match rustfs_ecstore::bucket::metadata_sys::get(bucket_name.as_str()).await {
@@ -455,8 +470,9 @@ mod serial_tests {
        println!("Lifecycle expiry basic test completed");
    }

-    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
    #[serial]
+    //#[ignore]
    async fn test_lifecycle_expiry_deletemarker() {
        let (_disk_paths, ecstore) = setup_test_env().await;

@@ -477,7 +493,7 @@ mod serial_tests {
        set_bucket_lifecycle_deletemarker(bucket_name.as_str())
            .await
            .expect("Failed to set lifecycle configuration");
-        println!("✅ Lifecycle configuration set for bucket: {}", bucket_name);
+        println!("✅ Lifecycle configuration set for bucket: {bucket_name}");

        // Verify lifecycle configuration was set
        match rustfs_ecstore::bucket::metadata_sys::get(bucket_name.as_str()).await {
@@ -578,12 +594,13 @@ mod serial_tests {
        println!("Lifecycle expiry basic test completed");
    }

-    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
    #[serial]
+    #[ignore]
    async fn test_lifecycle_transition_basic() {
        let (_disk_paths, ecstore) = setup_test_env().await;

-        //create_test_tier().await;
+        create_test_tier(1).await;

        // Create test bucket and object
        let suffix = uuid::Uuid::new_v4().simple().to_string();
@@ -591,7 +608,8 @@ mod serial_tests {
        let object_name = "test/object.txt"; // Match the lifecycle rule prefix "test/"
        let test_data = b"Hello, this is test data for lifecycle expiry!";

-        create_test_lock_bucket(&ecstore, bucket_name.as_str()).await;
+        //create_test_lock_bucket(&ecstore, bucket_name.as_str()).await;
+        create_test_bucket(&ecstore, bucket_name.as_str()).await;
        upload_test_object(&ecstore, bucket_name.as_str(), object_name, test_data).await;

        // Verify object exists initially
@@ -599,13 +617,13 @@ mod serial_tests {
        println!("✅ Object exists before lifecycle processing");

        // Set lifecycle configuration with very short expiry (0 days = immediate expiry)
-        /*set_bucket_lifecycle_transition(bucket_name)
+        set_bucket_lifecycle_transition(bucket_name.as_str())
            .await
            .expect("Failed to set lifecycle configuration");
        println!("✅ Lifecycle configuration set for bucket: {bucket_name}");

        // Verify lifecycle configuration was set
-        match rustfs_ecstore::bucket::metadata_sys::get(bucket_name).await {
+        match rustfs_ecstore::bucket::metadata_sys::get(bucket_name.as_str()).await {
            Ok(bucket_meta) => {
                assert!(bucket_meta.lifecycle_config.is_some());
                println!("✅ Bucket metadata retrieved successfully");
@@ -613,7 +631,7 @@ mod serial_tests {
            Err(e) => {
                println!("❌ Error retrieving bucket metadata: {e:?}");
            }
-        }*/
+        }

        // Create scanner with very short intervals for testing
        let scanner_config = ScannerConfig {
@@ -640,12 +658,11 @@ mod serial_tests {
        tokio::time::sleep(Duration::from_secs(5)).await;

        // Check if object has been expired (deleted)
-        //let check_result = object_is_transitioned(&ecstore, bucket_name, object_name).await;
-        let check_result = object_exists(&ecstore, bucket_name.as_str(), object_name).await;
+        let check_result = object_is_transitioned(&ecstore, &bucket_name, object_name).await;
        println!("Object exists after lifecycle processing: {check_result}");

        if check_result {
-            println!("✅ Object was not deleted by lifecycle processing");
+            println!("✅ Object was transitioned by lifecycle processing");
            // Let's try to get object info to see its details
            match ecstore
                .get_object_info(bucket_name.as_str(), object_name, &rustfs_ecstore::store_api::ObjectOptions::default())
@@ -663,7 +680,7 @@ mod serial_tests {
                }
            }
        } else {
-            println!("❌ Object was deleted by lifecycle processing");
+            println!("❌ Object was not transitioned by lifecycle processing");
        }

        assert!(check_result);
@@ -81,8 +81,8 @@ fn test_config_section_names() {
 fn test_environment_variable_parsing() {
    // Test environment variable prefix patterns
    let env_prefix = "RUSTFS_";
-    let audit_webhook_prefix = format!("{}AUDIT_WEBHOOK_", env_prefix);
-    let audit_mqtt_prefix = format!("{}AUDIT_MQTT_", env_prefix);
+    let audit_webhook_prefix = format!("{env_prefix}AUDIT_WEBHOOK_");
+    let audit_mqtt_prefix = format!("{env_prefix}AUDIT_MQTT_");

    assert_eq!(audit_webhook_prefix, "RUSTFS_AUDIT_WEBHOOK_");
    assert_eq!(audit_mqtt_prefix, "RUSTFS_AUDIT_MQTT_");
@@ -141,13 +141,13 @@ fn test_duration_parsing_formats() {
        let result = parse_duration_test(input);
        match (result, expected_seconds) {
            (Some(duration), Some(expected)) => {
-                assert_eq!(duration.as_secs(), expected, "Failed for input: {}", input);
+                assert_eq!(duration.as_secs(), expected, "Failed for input: {input}");
            }
            (None, None) => {
                // Both None, test passes
            }
            _ => {
-                panic!("Mismatch for input: {}, got: {:?}, expected: {:?}", input, result, expected_seconds);
+                panic!("Mismatch for input: {input}, got: {result:?}, expected: {expected_seconds:?}");
            }
        }
    }
@@ -188,13 +188,13 @@ fn test_url_validation() {

    for url_str in valid_urls {
        let result = Url::parse(url_str);
-        assert!(result.is_ok(), "Valid URL should parse: {}", url_str);
+        assert!(result.is_ok(), "Valid URL should parse: {url_str}");
    }

    for url_str in &invalid_urls[..3] {
        // Skip the ftp one as it's technically valid
        let result = Url::parse(url_str);
-        assert!(result.is_err(), "Invalid URL should not parse: {}", url_str);
+        assert!(result.is_err(), "Invalid URL should not parse: {url_str}");
    }
 }

@@ -214,6 +214,6 @@ fn test_qos_parsing() {
            0..=2 => Some(q),
            _ => None,
        });
-        assert_eq!(result, expected, "Failed for QoS input: {}", input);
+        assert_eq!(result, expected, "Failed for QoS input: {input}");
    }
 }
@@ -57,7 +57,7 @@ async fn test_config_parsing_webhook() {
        }
        Err(e) => {
            // Other errors might indicate parsing issues
-            println!("Unexpected error: {}", e);
+            println!("Unexpected error: {e}");
        }
        Ok(_) => {
            // Unexpected success in test environment without server storage
@@ -103,6 +103,6 @@ fn test_enable_value_parsing() {

    for (input, expected) in test_cases {
        let result = matches!(input.to_lowercase().as_str(), "1" | "on" | "true" | "yes");
-        assert_eq!(result, expected, "Failed for input: {}", input);
+        assert_eq!(result, expected, "Failed for input: {input}");
    }
 }
@@ -32,10 +32,10 @@ async fn test_audit_system_startup_performance() {
    let _result = timeout(Duration::from_secs(5), system.start(config)).await;
    let elapsed = start.elapsed();

-    println!("Audit system startup took: {:?}", elapsed);
+    println!("Audit system startup took: {elapsed:?}");

    // Should complete within 5 seconds
-    assert!(elapsed < Duration::from_secs(5), "Startup took too long: {:?}", elapsed);
+    assert!(elapsed < Duration::from_secs(5), "Startup took too long: {elapsed:?}");

    // Clean up
    let _ = system.close().await;
@@ -54,8 +54,8 @@ async fn test_concurrent_target_creation() {
    for i in 1..=5 {
        let mut kvs = rustfs_ecstore::config::KVS::new();
        kvs.insert("enable".to_string(), "on".to_string());
-        kvs.insert("endpoint".to_string(), format!("http://localhost:302{}/webhook", i));
-        webhook_section.insert(format!("instance_{}", i), kvs);
+        kvs.insert("endpoint".to_string(), format!("http://localhost:302{i}/webhook"));
+        webhook_section.insert(format!("instance_{i}"), kvs);
    }

    config.0.insert("audit_webhook".to_string(), webhook_section);
@@ -66,10 +66,10 @@ async fn test_concurrent_target_creation() {
    let result = registry.create_targets_from_config(&config).await;
    let elapsed = start.elapsed();

-    println!("Concurrent target creation took: {:?}", elapsed);
+    println!("Concurrent target creation took: {elapsed:?}");

    // Should complete quickly even with multiple targets
-    assert!(elapsed < Duration::from_secs(10), "Target creation took too long: {:?}", elapsed);
+    assert!(elapsed < Duration::from_secs(10), "Target creation took too long: {elapsed:?}");

    // Verify it fails with expected error (server not initialized)
    match result {
@@ -77,7 +77,7 @@ async fn test_concurrent_target_creation() {
            // Expected in test environment
        }
        Err(e) => {
-            println!("Unexpected error during concurrent creation: {}", e);
+            println!("Unexpected error during concurrent creation: {e}");
        }
        Ok(_) => {
            println!("Unexpected success in test environment");
@@ -93,7 +93,7 @@ async fn test_audit_log_dispatch_performance() {
    let config = rustfs_ecstore::config::Config(HashMap::new());
    let start_result = system.start(config).await;
    if start_result.is_err() {
-        println!("AuditSystem failed to start: {:?}", start_result);
+        println!("AuditSystem failed to start: {start_result:?}");
        return; // 或 assert!(false, "AuditSystem failed to start");
    }

@@ -104,14 +104,14 @@ async fn test_audit_log_dispatch_performance() {
    let id = 1;

    let mut req_header = HashMap::new();
-    req_header.insert("authorization".to_string(), format!("Bearer test-token-{}", id));
+    req_header.insert("authorization".to_string(), format!("Bearer test-token-{id}"));
    req_header.insert("content-type".to_string(), "application/octet-stream".to_string());

    let mut resp_header = HashMap::new();
    resp_header.insert("x-response".to_string(), "ok".to_string());

    let mut tags = HashMap::new();
-    tags.insert(format!("tag-{}", id), json!("sample"));
+    tags.insert(format!("tag-{id}"), json!("sample"));

    let mut req_query = HashMap::new();
    req_query.insert("id".to_string(), id.to_string());
@@ -119,7 +119,7 @@ async fn test_audit_log_dispatch_performance() {
    let api_details = ApiDetails {
        name: Some("PutObject".to_string()),
        bucket: Some("test-bucket".to_string()),
-        object: Some(format!("test-object-{}", id)),
+        object: Some(format!("test-object-{id}")),
        status: Some("success".to_string()),
        status_code: Some(200),
        input_bytes: Some(1024),
@@ -134,7 +134,7 @@ async fn test_audit_log_dispatch_performance() {
    // Create sample audit log entry
    let audit_entry = AuditEntry {
        version: "1".to_string(),
-        deployment_id: Some(format!("test-deployment-{}", id)),
+        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
        time: Utc::now(),
        event: EventName::ObjectCreatedPut,
@@ -142,9 +142,9 @@ async fn test_audit_log_dispatch_performance() {
        trigger: "api".to_string(),
        api: api_details,
        remote_host: Some("127.0.0.1".to_string()),
-        request_id: Some(format!("test-request-{}", id)),
+        request_id: Some(format!("test-request-{id}")),
        user_agent: Some("test-agent".to_string()),
-        req_path: Some(format!("/test-bucket/test-object-{}", id)),
+        req_path: Some(format!("/test-bucket/test-object-{id}")),
        req_host: Some("test-host".to_string()),
        req_node: Some("node-1".to_string()),
        req_claims: None,
@@ -152,8 +152,8 @@ async fn test_audit_log_dispatch_performance() {
        req_header: Some(req_header),
        resp_header: Some(resp_header),
        tags: Some(tags),
-        access_key: Some(format!("AKIA{}", id)),
-        parent_user: Some(format!("parent-{}", id)),
+        access_key: Some(format!("AKIA{id}")),
+        parent_user: Some(format!("parent-{id}")),
        error: None,
    };

@@ -163,10 +163,10 @@ async fn test_audit_log_dispatch_performance() {
    let result = system.dispatch(Arc::new(audit_entry)).await;
    let elapsed = start.elapsed();

-    println!("Audit log dispatch took: {:?}", elapsed);
+    println!("Audit log dispatch took: {elapsed:?}");

    // Should be very fast (sub-millisecond for no targets)
-    assert!(elapsed < Duration::from_millis(100), "Dispatch took too long: {:?}", elapsed);
+    assert!(elapsed < Duration::from_millis(100), "Dispatch took too long: {elapsed:?}");

    // Should succeed even with no targets
    assert!(result.is_ok(), "Dispatch should succeed with no targets");
@@ -226,10 +226,10 @@ fn test_event_name_mask_performance() {
    }

    let elapsed = start.elapsed();
-    println!("Event mask calculation (5000 ops) took: {:?}", elapsed);
+    println!("Event mask calculation (5000 ops) took: {elapsed:?}");

    // Should be very fast
-    assert!(elapsed < Duration::from_millis(100), "Mask calculation too slow: {:?}", elapsed);
+    assert!(elapsed < Duration::from_millis(100), "Mask calculation too slow: {elapsed:?}");
 }

 #[test]
@@ -254,10 +254,10 @@ fn test_event_name_expansion_performance() {
    }

    let elapsed = start.elapsed();
-    println!("Event expansion (4000 ops) took: {:?}", elapsed);
+    println!("Event expansion (4000 ops) took: {elapsed:?}");

    // Should be very fast
-    assert!(elapsed < Duration::from_millis(100), "Expansion too slow: {:?}", elapsed);
+    assert!(elapsed < Duration::from_millis(100), "Expansion too slow: {elapsed:?}");
 }

 #[tokio::test]
@@ -274,10 +274,10 @@ async fn test_registry_operations_performance() {
    }

    let elapsed = start.elapsed();
-    println!("Registry operations (2000 ops) took: {:?}", elapsed);
+    println!("Registry operations (2000 ops) took: {elapsed:?}");

    // Should be very fast for empty registry
-    assert!(elapsed < Duration::from_millis(100), "Registry ops too slow: {:?}", elapsed);
+    assert!(elapsed < Duration::from_millis(100), "Registry ops too slow: {elapsed:?}");
 }

 // Performance requirements validation
@@ -294,7 +294,7 @@ fn test_performance_requirements() {
    // Simulate processing 3000 events worth of operations
    for i in 0..3000 {
        // Simulate event name parsing and processing
-        let _event_id = format!("s3:ObjectCreated:Put_{}", i);
+        let _event_id = format!("s3:ObjectCreated:Put_{i}");
        let _timestamp = chrono::Utc::now().to_rfc3339();

        // Simulate basic audit entry creation overhead
@@ -305,16 +305,16 @@ fn test_performance_requirements() {
    let elapsed = start.elapsed();
    let eps = 3000.0 / elapsed.as_secs_f64();

-    println!("Simulated 3000 events in {:?} ({:.0} EPS)", elapsed, eps);
+    println!("Simulated 3000 events in {elapsed:?} ({eps:.0} EPS)");

    // Our core processing should easily handle 3k EPS worth of CPU overhead
    // The actual EPS limit will be determined by network I/O to targets
-    assert!(eps > 10000.0, "Core processing too slow for 3k EPS target: {} EPS", eps);
+    assert!(eps > 10000.0, "Core processing too slow for 3k EPS target: {eps} EPS");

    // P99 latency requirement: < 30ms
    // For core processing, we should be much faster than this
    let avg_latency = elapsed / 3000;
-    println!("Average processing latency: {:?}", avg_latency);
+    println!("Average processing latency: {avg_latency:?}");

-    assert!(avg_latency < Duration::from_millis(1), "Processing latency too high: {:?}", avg_latency);
+    assert!(avg_latency < Duration::from_millis(1), "Processing latency too high: {avg_latency:?}");
 }
@@ -52,7 +52,7 @@ async fn test_complete_audit_system_lifecycle() {
            assert_eq!(system.get_state().await, system::AuditSystemState::Running);
        }
        Err(e) => {
-            panic!("Unexpected error: {}", e);
+            panic!("Unexpected error: {e}");
        }
    }

@@ -103,7 +103,7 @@ async fn test_audit_log_dispatch_with_no_targets() {
            // Also acceptable since system not running
        }
        Err(e) => {
-            panic!("Unexpected error: {}", e);
+            panic!("Unexpected error: {e}");
        }
    }
 }
@@ -172,7 +172,7 @@ async fn test_config_parsing_with_multiple_instances() {
            // Expected - parsing worked but save failed
        }
        Err(e) => {
-            println!("Config parsing error: {}", e);
+            println!("Config parsing error: {e}");
            // Other errors might indicate parsing issues, but not necessarily failures
        }
        Ok(_) => {
@@ -261,7 +261,7 @@ async fn test_concurrent_operations() {
        let (i, state, is_running) = task.await.expect("Task should complete");
        assert_eq!(state, system::AuditSystemState::Stopped);
        assert!(!is_running);
-        println!("Task {} completed successfully", i);
+        println!("Task {i} completed successfully");
    }
 }

@@ -295,8 +295,8 @@ async fn test_performance_under_load() {
    }

    let elapsed = start.elapsed();
-    println!("100 concurrent dispatches took: {:?}", elapsed);
-    println!("Successes: {}, Errors: {}", success_count, error_count);
+    println!("100 concurrent dispatches took: {elapsed:?}");
+    println!("Successes: {success_count}, Errors: {error_count}");

    // Should complete reasonably quickly
    assert!(elapsed < Duration::from_secs(5), "Concurrent operations took too long");
@@ -318,14 +318,14 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
    use std::collections::HashMap;

    let mut req_header = HashMap::new();
-    req_header.insert("authorization".to_string(), format!("Bearer test-token-{}", id));
+    req_header.insert("authorization".to_string(), format!("Bearer test-token-{id}"));
    req_header.insert("content-type".to_string(), "application/octet-stream".to_string());

    let mut resp_header = HashMap::new();
    resp_header.insert("x-response".to_string(), "ok".to_string());

    let mut tags = HashMap::new();
-    tags.insert(format!("tag-{}", id), json!("sample"));
+    tags.insert(format!("tag-{id}"), json!("sample"));

    let mut req_query = HashMap::new();
    req_query.insert("id".to_string(), id.to_string());
@@ -333,7 +333,7 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
    let api_details = ApiDetails {
        name: Some("PutObject".to_string()),
        bucket: Some("test-bucket".to_string()),
-        object: Some(format!("test-object-{}", id)),
+        object: Some(format!("test-object-{id}")),
        status: Some("success".to_string()),
        status_code: Some(200),
        input_bytes: Some(1024),
@@ -348,7 +348,7 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {

    AuditEntry {
        version: "1".to_string(),
-        deployment_id: Some(format!("test-deployment-{}", id)),
+        deployment_id: Some(format!("test-deployment-{id}")),
        site_name: Some("test-site".to_string()),
        time: Utc::now(),
        event: EventName::ObjectCreatedPut,
@@ -356,9 +356,9 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
        trigger: "api".to_string(),
        api: api_details,
        remote_host: Some("127.0.0.1".to_string()),
-        request_id: Some(format!("test-request-{}", id)),
+        request_id: Some(format!("test-request-{id}")),
        user_agent: Some("test-agent".to_string()),
-        req_path: Some(format!("/test-bucket/test-object-{}", id)),
+        req_path: Some(format!("/test-bucket/test-object-{id}")),
        req_host: Some("test-host".to_string()),
        req_node: Some("node-1".to_string()),
        req_claims: None,
@@ -366,8 +366,8 @@ fn create_sample_audit_entry_with_id(id: u32) -> AuditEntry {
        req_header: Some(req_header),
        resp_header: Some(resp_header),
        tags: Some(tags),
-        access_key: Some(format!("AKIA{}", id)),
-        parent_user: Some(format!("parent-{}", id)),
+        access_key: Some(format!("AKIA{id}")),
+        parent_user: Some(format!("parent-{id}")),
        error: None,
    }
 }
@@ -126,12 +126,6 @@ pub const DEFAULT_LOG_FILENAME: &str = "rustfs";
 /// Default value: rustfs.log
 pub const DEFAULT_OBS_LOG_FILENAME: &str = concat!(DEFAULT_LOG_FILENAME, "");

-/// Default sink file log file for rustfs
-/// This is the default sink file log file for rustfs.
-/// It is used to store the logs of the application.
-/// Default value: rustfs-sink.log
-pub const DEFAULT_SINK_FILE_LOG_FILE: &str = concat!(DEFAULT_LOG_FILENAME, "-sink.log");
-
 /// Default log directory for rustfs
 /// This is the default log directory for rustfs.
 /// It is used to store the logs of the application.
@@ -160,16 +154,6 @@ pub const DEFAULT_LOG_ROTATION_TIME: &str = "day";
 /// Environment variable: RUSTFS_OBS_LOG_KEEP_FILES
 pub const DEFAULT_LOG_KEEP_FILES: u16 = 30;

-/// This is the external address for rustfs to access endpoint (used in Docker deployments).
-/// This should match the mapped host port when using Docker port mapping.
-/// Example: ":9020" when mapping host port 9020 to container port 9000.
-/// Default value: DEFAULT_ADDRESS
-/// Environment variable: RUSTFS_EXTERNAL_ADDRESS
-/// Command line argument: --external-address
-/// Example: RUSTFS_EXTERNAL_ADDRESS=":9020"
-/// Example: --external-address ":9020"
-pub const ENV_EXTERNAL_ADDRESS: &str = "RUSTFS_EXTERNAL_ADDRESS";
-
 /// 1 KiB
 pub const KI_B: usize = 1024;
 /// 1 MiB
@@ -33,7 +33,7 @@ use tracing::info;
 #[serial]
 async fn test_comprehensive_kms_full_workflow() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🏁 开始KMS全功能综合测试");
+    info!("🏁 Start the KMS full-featured synthesis test");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -43,25 +43,25 @@ async fn test_comprehensive_kms_full_workflow() -> Result<(), Box<dyn std::error
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;

    // Phase 1: Test all single encryption types
-    info!("📋 阶段1: 测试所有单文件加密类型");
+    info!("📋 Phase 1: Test all single-file encryption types");
    test_sse_s3_encryption(&s3_client, TEST_BUCKET).await?;
    test_sse_kms_encryption(&s3_client, TEST_BUCKET).await?;
    test_sse_c_encryption(&s3_client, TEST_BUCKET).await?;

    // Phase 2: Test KMS key management APIs
-    info!("📋 阶段2: 测试KMS密钥管理API");
+    info!("📋 Phase 2: Test the KMS Key Management API");
    test_kms_key_management(&kms_env.base_env.url, &kms_env.base_env.access_key, &kms_env.base_env.secret_key).await?;

    // Phase 3: Test all multipart encryption types
-    info!("📋 阶段3: 测试所有分片上传加密类型");
+    info!("📋 Phase 3: Test all shard upload encryption types");
    test_all_multipart_encryption_types(&s3_client, TEST_BUCKET, "comprehensive-multipart-test").await?;

    // Phase 4: Mixed workload test
-    info!("📋 阶段4: 混合工作负载测试");
+    info!("📋 Phase 4: Mixed workload testing");
    test_mixed_encryption_workload(&s3_client, TEST_BUCKET).await?;

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ KMS全功能综合测试通过");
+    info!("✅ KMS fully functional comprehensive test passed");
    Ok(())
 }

@@ -70,7 +70,7 @@ async fn test_mixed_encryption_workload(
    s3_client: &aws_sdk_s3::Client,
    bucket: &str,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    info!("🔄 测试混合加密工作负载");
+    info!("🔄 Test hybrid crypto workloads");

    // Test configuration: different sizes and encryption types
    let test_configs = vec![
@@ -89,11 +89,11 @@ async fn test_mixed_encryption_workload(
    ];

    for (i, config) in test_configs.iter().enumerate() {
-        info!("🔄 执行混合测试 {}/{}: {:?}", i + 1, test_configs.len(), config.encryption_type);
+        info!("🔄 Perform hybrid testing {}/{}: {:?}", i + 1, test_configs.len(), config.encryption_type);
        test_multipart_upload_with_config(s3_client, bucket, config).await?;
    }

-    info!("✅ 混合加密工作负载测试通过");
+    info!("✅ Hybrid cryptographic workload tests pass");
    Ok(())
 }

@@ -102,7 +102,7 @@ async fn test_mixed_encryption_workload(
 #[serial]
 async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("💪 开始KMS压力测试");
+    info!("💪 Start the KMS stress test");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -120,7 +120,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro

    for config in stress_configs {
        info!(
-            "💪 执行压力测试: {:?}, 总大小: {}MB",
+            "💪 Perform stress test: {:?}, Total size: {}MB",
            config.encryption_type,
            config.total_size() / (1024 * 1024)
        );
@@ -128,7 +128,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro
    }

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ KMS压力测试通过");
+    info!("✅ KMS stress test passed");
    Ok(())
 }

@@ -137,7 +137,7 @@ async fn test_comprehensive_stress_test() -> Result<(), Box<dyn std::error::Erro
 #[serial]
 async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🔐 开始加密密钥隔离综合测试");
+    info!("🔐 Begin the comprehensive test of encryption key isolation");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -173,14 +173,14 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er
    );

    // Upload with different keys
-    info!("🔐 上传文件用密钥1");
+    info!("🔐 Key 1 for uploading files");
    test_multipart_upload_with_config(&s3_client, TEST_BUCKET, &config1).await?;

-    info!("🔐 上传文件用密钥2");
+    info!("🔐 Key 2 for uploading files");
    test_multipart_upload_with_config(&s3_client, TEST_BUCKET, &config2).await?;

    // Verify that files cannot be read with wrong keys
-    info!("🔒 验证密钥隔离");
+    info!("🔒 Verify key isolation");
    let wrong_key = "11111111111111111111111111111111";
    let wrong_key_b64 = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, wrong_key);
    let wrong_key_md5 = format!("{:x}", md5::compute(wrong_key));
@@ -196,11 +196,11 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er
        .send()
        .await;

-    assert!(wrong_read_result.is_err(), "应该无法用错误密钥读取加密文件");
-    info!("✅ 确认密钥隔离正常工作");
+    assert!(wrong_read_result.is_err(), "The encrypted file should not be readable with the wrong key");
+    info!("✅ Confirm that key isolation is working correctly");

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 加密密钥隔离综合测试通过");
+    info!("✅ Encryption key isolation comprehensive test passed");
    Ok(())
 }

@@ -209,7 +209,7 @@ async fn test_comprehensive_key_isolation() -> Result<(), Box<dyn std::error::Er
 #[serial]
 async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("⚡ 开始并发加密操作综合测试");
+    info!("⚡ Started comprehensive testing of concurrent encryption operations");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -228,7 +228,7 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e
    ];

    // Execute uploads concurrently
-    info!("⚡ 开始并发上传");
+    info!("⚡ Start concurrent uploads");
    let mut tasks = Vec::new();
    for config in concurrent_configs {
        let client = s3_client.clone();
@@ -243,10 +243,10 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e
        task.await??;
    }

-    info!("✅ 所有并发操作完成");
+    info!("✅ All concurrent operations are completed");

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 并发加密操作综合测试通过");
+    info!("✅ The comprehensive test of concurrent encryption operation has passed");
    Ok(())
 }

@@ -255,7 +255,7 @@ async fn test_comprehensive_concurrent_operations() -> Result<(), Box<dyn std::e
 #[serial]
 async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("📊 开始KMS性能基准测试");
+    info!("📊 Start KMS performance benchmarking");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -278,7 +278,7 @@ async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::e
    ];

    for (size_name, config) in perf_configs {
-        info!("📊 测试{}文件性能 ({}MB)", size_name, config.total_size() / (1024 * 1024));
+        info!("📊 Test {} file performance ({}MB)", size_name, config.total_size() / (1024 * 1024));

        let start_time = std::time::Instant::now();
        test_multipart_upload_with_config(&s3_client, TEST_BUCKET, &config).await?;
@@ -286,7 +286,7 @@ async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::e

        let throughput_mbps = (config.total_size() as f64 / (1024.0 * 1024.0)) / duration.as_secs_f64();
        info!(
-            "📊 {}文件测试完成: {:.2}秒, 吞吐量: {:.2} MB/s",
+            "📊 {} file test completed: {:.2} seconds, throughput: {:.2} MB/s",
            size_name,
            duration.as_secs_f64(),
            throughput_mbps
@@ -294,6 +294,6 @@ async fn test_comprehensive_performance_benchmark() -> Result<(), Box<dyn std::e
    }

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ KMS性能基准测试通过");
+    info!("✅ KMS performance benchmark passed");
    Ok(())
 }
@@ -25,6 +25,7 @@ use super::common::LocalKMSTestEnvironment;
 use crate::common::{TEST_BUCKET, init_logging};
 use aws_sdk_s3::types::ServerSideEncryption;
 use base64::Engine;
+use md5::compute;
 use serial_test::serial;
 use std::sync::Arc;
 use tokio::sync::Semaphore;
@@ -71,7 +72,7 @@ async fn test_kms_zero_byte_file_encryption() -> Result<(), Box<dyn std::error::
    info!("📤 Testing SSE-C with zero-byte file");
    let test_key = "01234567890123456789012345678901";
    let test_key_b64 = base64::engine::general_purpose::STANDARD.encode(test_key);
-    let test_key_md5 = format!("{:x}", md5::compute(test_key));
+    let test_key_md5 = format!("{:x}", compute(test_key));
    let object_key_c = "zero-byte-sse-c";

    let _put_response_c = s3_client
@@ -165,7 +166,7 @@ async fn test_kms_single_byte_file_encryption() -> Result<(), Box<dyn std::error
    info!("📤 Testing SSE-C with single-byte file");
    let test_key = "01234567890123456789012345678901";
    let test_key_b64 = base64::engine::general_purpose::STANDARD.encode(test_key);
-    let test_key_md5 = format!("{:x}", md5::compute(test_key));
+    let test_key_md5 = format!("{:x}", compute(test_key));
    let object_key_c = "single-byte-sse-c";

    s3_client
@@ -293,7 +294,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro
    info!("🔍 Testing invalid SSE-C key length");
    let invalid_short_key = "short"; // Too short
    let invalid_key_b64 = base64::engine::general_purpose::STANDARD.encode(invalid_short_key);
-    let invalid_key_md5 = format!("{:x}", md5::compute(invalid_short_key));
+    let invalid_key_md5 = format!("{:x}", compute(invalid_short_key));

    let invalid_key_result = s3_client
        .put_object()
@@ -333,7 +334,7 @@ async fn test_kms_invalid_key_scenarios() -> Result<(), Box<dyn std::error::Erro
    info!("🔍 Testing access to SSE-C object without key");

    // First upload a valid SSE-C object
-    let valid_key_md5 = format!("{:x}", md5::compute(valid_key));
+    let valid_key_md5 = format!("{:x}", compute(valid_key));
    s3_client
        .put_object()
        .bucket(TEST_BUCKET)
@@ -420,7 +421,7 @@ async fn test_kms_concurrent_encryption() -> Result<(), Box<dyn std::error::Erro
                    // SSE-C
                    let key = format!("testkey{i:026}"); // 32-byte key
                    let key_b64 = base64::engine::general_purpose::STANDARD.encode(&key);
-                    let key_md5 = format!("{:x}", md5::compute(&key));
+                    let key_md5 = format!("{:x}", compute(&key));

                    client
                        .put_object()
@@ -492,8 +493,8 @@ async fn test_kms_key_validation_security() -> Result<(), Box<dyn std::error::Er

    let key1_b64 = base64::engine::general_purpose::STANDARD.encode(key1);
    let key2_b64 = base64::engine::general_purpose::STANDARD.encode(key2);
-    let key1_md5 = format!("{:x}", md5::compute(key1));
-    let key2_md5 = format!("{:x}", md5::compute(key2));
+    let key1_md5 = format!("{:x}", compute(key1));
+    let key2_md5 = format!("{:x}", compute(key2));

    // Upload same data with different keys
    s3_client
@@ -19,6 +19,7 @@
 //! multipart upload behaviour.

 use crate::common::{TEST_BUCKET, init_logging};
+use md5::compute;
 use serial_test::serial;
 use tokio::time::{Duration, sleep};
 use tracing::{error, info};
@@ -132,8 +133,8 @@ async fn test_vault_kms_key_isolation() -> Result<(), Box<dyn std::error::Error
    let key2 = "98765432109876543210987654321098";
    let key1_b64 = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, key1);
    let key2_b64 = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, key2);
-    let key1_md5 = format!("{:x}", md5::compute(key1));
-    let key2_md5 = format!("{:x}", md5::compute(key2));
+    let key1_md5 = format!("{:x}", compute(key1));
+    let key2_md5 = format!("{:x}", compute(key2));

    let data1 = b"Vault data encrypted with key 1";
    let data2 = b"Vault data encrypted with key 2";
@@ -13,25 +13,25 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-//! 分片上传加密功能的分步测试用例
+//! Step-by-step test cases for sharded upload encryption
 //!
-//! 这个测试套件将验证分片上传加密功能的每一个步骤：
-//! 1. 测试基础的单分片加密（验证加密基础逻辑）
-//! 2. 测试多分片上传（验证分片拼接逻辑）
-//! 3. 测试加密元数据的保存和读取
-//! 4. 测试完整的分片上传加密流程
+//! This test suite will validate every step of the sharded upload encryption feature:
+//! 1. Test the underlying single-shard encryption (validate the encryption underlying logic)
+//! 2. Test multi-shard uploads (verify shard stitching logic)
+//! 3. Test the saving and reading of encrypted metadata
+//! 4. Test the complete sharded upload encryption process

 use super::common::LocalKMSTestEnvironment;
 use crate::common::{TEST_BUCKET, init_logging};
 use serial_test::serial;
 use tracing::{debug, info};

-/// 步骤1：测试基础单文件加密功能（确保SSE-S3在非分片场景下正常工作）
+/// Step 1: Test the basic single-file encryption function (ensure that SSE-S3 works properly in non-sharded scenarios)
 #[tokio::test]
 #[serial]
 async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🧪 步骤1：测试基础单文件加密功能");
+    info!("🧪 Step 1: Test the basic single-file encryption function");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -40,11 +40,11 @@ async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::er
    let s3_client = kms_env.base_env.create_s3_client();
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;

-    // 测试小文件加密（应该会内联存储）
+    // Test small file encryption (should be stored inline)
    let test_data = b"Hello, this is a small test file for SSE-S3!";
    let object_key = "test-single-file-encrypted";

-    info!("📤 上传小文件（{}字节），启用SSE-S3加密", test_data.len());
+    info!("📤 Upload a small file ({} bytes) with SSE-S3 encryption enabled", test_data.len());
    let put_response = s3_client
        .put_object()
        .bucket(TEST_BUCKET)
@@ -54,41 +54,41 @@ async fn test_step1_basic_single_file_encryption() -> Result<(), Box<dyn std::er
        .send()
        .await?;

-    debug!("PUT响应ETag: {:?}", put_response.e_tag());
-    debug!("PUT响应SSE: {:?}", put_response.server_side_encryption());
+    debug!("PUT responds to ETags: {:?}", put_response.e_tag());
+    debug!("PUT responds to SSE: {:?}", put_response.server_side_encryption());

-    // 验证PUT响应包含正确的加密头
+    // Verify that the PUT response contains the correct cipher header
    assert_eq!(
        put_response.server_side_encryption(),
        Some(&aws_sdk_s3::types::ServerSideEncryption::Aes256)
    );

-    info!("📥 下载文件并验证加密状态");
+    info!("📥 Download the file and verify the encryption status");
    let get_response = s3_client.get_object().bucket(TEST_BUCKET).key(object_key).send().await?;

-    debug!("GET响应SSE: {:?}", get_response.server_side_encryption());
+    debug!("GET responds to SSE: {:?}", get_response.server_side_encryption());

-    // 验证GET响应包含正确的加密头
+    // Verify that the GET response contains the correct cipher header
    assert_eq!(
        get_response.server_side_encryption(),
        Some(&aws_sdk_s3::types::ServerSideEncryption::Aes256)
    );

-    // 验证数据完整性
+    // Verify data integrity
    let downloaded_data = get_response.body.collect().await?.into_bytes();
    assert_eq!(&downloaded_data[..], test_data);

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 步骤1通过：基础单文件加密功能正常");
+    info!("✅ Step 1: The basic single file encryption function is normal");
    Ok(())
 }

-/// 步骤2：测试不加密的分片上传（确保分片上传基础功能正常）
+/// Step 2: Test the unencrypted shard upload (make sure the shard upload base is working properly)
 #[tokio::test]
 #[serial]
 async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🧪 步骤2：测试不加密的分片上传");
+    info!("🧪 Step 2: Test unencrypted shard uploads");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -102,12 +102,16 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
    let total_parts = 2;
    let total_size = part_size * total_parts;

-    // 生成测试数据（有明显的模式便于验证）
+    // Generate test data (with obvious patterns for easy verification)
    let test_data: Vec<u8> = (0..total_size).map(|i| (i % 256) as u8).collect();

-    info!("🚀 开始分片上传（无加密）：{} parts，每个 {}MB", total_parts, part_size / (1024 * 1024));
+    info!(
+        "🚀 Start sharded upload (unencrypted): {} parts, {}MB each",
+        total_parts,
+        part_size / (1024 * 1024)
+    );

-    // 步骤1：创建分片上传
+    // Step 1: Create a sharded upload
    let create_multipart_output = s3_client
        .create_multipart_upload()
        .bucket(TEST_BUCKET)
@@ -116,16 +120,16 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
        .await?;

    let upload_id = create_multipart_output.upload_id().unwrap();
-    info!("📋 创建分片上传，ID: {}", upload_id);
+    info!("📋 Create a shard upload with ID: {}", upload_id);

-    // 步骤2：上传各个分片
+    // Step 2: Upload individual shards
    let mut completed_parts = Vec::new();
    for part_number in 1..=total_parts {
        let start = (part_number - 1) * part_size;
        let end = std::cmp::min(start + part_size, total_size);
        let part_data = &test_data[start..end];

-        info!("📤 上传分片 {} ({} bytes)", part_number, part_data.len());
+        info!("📤 Upload the shard {} ({} bytes)", part_number, part_data.len());

        let upload_part_output = s3_client
            .upload_part()
@@ -145,15 +149,15 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
                .build(),
        );

-        debug!("分片 {} 上传完成，ETag: {}", part_number, etag);
+        debug!("Fragment {} upload complete,ETag: {}", part_number, etag);
    }

-    // 步骤3：完成分片上传
+    // Step 3: Complete the shard upload
    let completed_multipart_upload = aws_sdk_s3::types::CompletedMultipartUpload::builder()
        .set_parts(Some(completed_parts))
        .build();

-    info!("🔗 完成分片上传");
+    info!("🔗 Complete the shard upload");
    let complete_output = s3_client
        .complete_multipart_upload()
        .bucket(TEST_BUCKET)
@@ -163,10 +167,10 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
        .send()
        .await?;

-    debug!("完成分片上传，ETag: {:?}", complete_output.e_tag());
+    debug!("Complete the shard upload,ETag: {:?}", complete_output.e_tag());

-    // 步骤4：下载并验证
-    info!("📥 下载文件并验证数据完整性");
+    // Step 4: Download and verify
+    info!("📥 Download the file and verify data integrity");
    let get_response = s3_client.get_object().bucket(TEST_BUCKET).key(object_key).send().await?;

    let downloaded_data = get_response.body.collect().await?.into_bytes();
@@ -174,16 +178,16 @@ async fn test_step2_basic_multipart_upload_without_encryption() -> Result<(), Bo
    assert_eq!(&downloaded_data[..], &test_data[..]);

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 步骤2通过：不加密的分片上传功能正常");
+    info!("✅ Step 2: Unencrypted shard upload functions normally");
    Ok(())
 }

-/// 步骤3：测试分片上传 + SSE-S3加密（重点测试）
+/// Step 3: Test Shard Upload + SSE-S3 Encryption (Focus Test)
 #[tokio::test]
 #[serial]
 async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🧪 步骤3：测试分片上传 + SSE-S3加密");
+    info!("🧪 Step 3: Test Shard Upload + SSE-S3 Encryption");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -201,12 +205,12 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er
    let test_data: Vec<u8> = (0..total_size).map(|i| ((i / 1000) % 256) as u8).collect();

    info!(
-        "🔐 开始分片上传（SSE-S3加密）：{} parts，每个 {}MB",
+        "🔐 Start sharded upload (SSE-S3 encryption): {} parts, {}MB each",
        total_parts,
        part_size / (1024 * 1024)
    );

-    // 步骤1：创建分片上传并启用SSE-S3
+    // Step 1: Create a shard upload and enable SSE-S3
    let create_multipart_output = s3_client
        .create_multipart_upload()
        .bucket(TEST_BUCKET)
@@ -216,24 +220,24 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er
        .await?;

    let upload_id = create_multipart_output.upload_id().unwrap();
-    info!("📋 创建加密分片上传，ID: {}", upload_id);
+    info!("📋 Create an encrypted shard upload with ID: {}", upload_id);

-    // 验证CreateMultipartUpload响应（如果有SSE头的话）
+    // Verify the CreateMultipartUpload response (if there is an SSE header)
    if let Some(sse) = create_multipart_output.server_side_encryption() {
-        debug!("CreateMultipartUpload包含SSE响应: {:?}", sse);
+        debug!("CreateMultipartUpload Contains SSE responses: {:?}", sse);
        assert_eq!(sse, &aws_sdk_s3::types::ServerSideEncryption::Aes256);
    } else {
-        debug!("CreateMultipartUpload不包含SSE响应头（某些实现中正常）");
+        debug!("CreateMultipartUpload does not contain SSE response headers (normal in some implementations)");
    }

-    // 步骤2：上传各个分片
+    // Step 2: Upload individual shards
    let mut completed_parts = Vec::new();
    for part_number in 1..=total_parts {
        let start = (part_number - 1) * part_size;
        let end = std::cmp::min(start + part_size, total_size);
        let part_data = &test_data[start..end];

-        info!("🔐 上传加密分片 {} ({} bytes)", part_number, part_data.len());
+        info!("🔐 Upload encrypted shards {} ({} bytes)", part_number, part_data.len());

        let upload_part_output = s3_client
            .upload_part()
@@ -253,15 +257,15 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er
                .build(),
        );

-        debug!("加密分片 {} 上传完成，ETag: {}", part_number, etag);
+        debug!("Encrypted shard {} upload complete,ETag: {}", part_number, etag);
    }

-    // 步骤3：完成分片上传
+    // Step 3: Complete the shard upload
    let completed_multipart_upload = aws_sdk_s3::types::CompletedMultipartUpload::builder()
        .set_parts(Some(completed_parts))
        .build();

-    info!("🔗 完成加密分片上传");
+    info!("🔗 Complete the encrypted shard upload");
    let complete_output = s3_client
        .complete_multipart_upload()
        .bucket(TEST_BUCKET)
@@ -273,20 +277,20 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er

    debug!("完成加密分片上传，ETag: {:?}", complete_output.e_tag());

-    // 步骤4：HEAD请求检查元数据
+    // 步骤 4：HEAD 请求检查元数据
    info!("📋 检查对象元数据");
    let head_response = s3_client.head_object().bucket(TEST_BUCKET).key(object_key).send().await?;

-    debug!("HEAD响应 SSE: {:?}", head_response.server_side_encryption());
-    debug!("HEAD响应 元数据: {:?}", head_response.metadata());
+    debug!("HEAD 响应 SSE: {:?}", head_response.server_side_encryption());
+    debug!("HEAD 响应 元数据：{:?}", head_response.metadata());

-    // 步骤5：GET请求下载并验证
+    // 步骤 5：GET 请求下载并验证
    info!("📥 下载加密文件并验证");
    let get_response = s3_client.get_object().bucket(TEST_BUCKET).key(object_key).send().await?;

-    debug!("GET响应 SSE: {:?}", get_response.server_side_encryption());
+    debug!("GET 响应 SSE: {:?}", get_response.server_side_encryption());

-    // 🎯 关键验证：GET响应必须包含SSE-S3加密头
+    // 🎯 关键验证：GET 响应必须包含 SSE-S3 加密头
    assert_eq!(
        get_response.server_side_encryption(),
        Some(&aws_sdk_s3::types::ServerSideEncryption::Aes256)
@@ -298,16 +302,16 @@ async fn test_step3_multipart_upload_with_sse_s3() -> Result<(), Box<dyn std::er
    assert_eq!(&downloaded_data[..], &test_data[..]);

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 步骤3通过：分片上传 + SSE-S3加密功能正常");
+    info!("✅ 步骤 3 通过：分片上传 + SSE-S3 加密功能正常");
    Ok(())
 }

-/// 步骤4：测试更大的分片上传（测试流式加密）
+/// 步骤 4：测试更大的分片上传（测试流式加密）
 #[tokio::test]
 #[serial]
 async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🧪 步骤4：测试大文件分片上传加密");
+    info!("🧪 步骤 4：测试大文件分片上传加密");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -317,8 +321,8 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d
    kms_env.base_env.create_test_bucket(TEST_BUCKET).await?;

    let object_key = "test-large-multipart-encrypted";
-    let part_size = 6 * 1024 * 1024; // 6MB per part (大于1MB加密块大小)
-    let total_parts = 3; // 总共18MB
+    let part_size = 6 * 1024 * 1024; // 6MB per part (大于 1MB 加密块大小)
+    let total_parts = 3; // 总共 18MB
    let total_size = part_size * total_parts;

    info!(
@@ -337,7 +341,7 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d
        })
        .collect();

-    info!("🔐 开始大文件分片上传（SSE-S3加密）");
+    info!("🔐 开始大文件分片上传（SSE-S3 加密）");

    // 创建分片上传
    let create_multipart_output = s3_client
@@ -419,21 +423,21 @@ async fn test_step4_large_multipart_upload_with_encryption() -> Result<(), Box<d
    // 逐字节验证数据（对于大文件更严格）
    for (i, (&actual, &expected)) in downloaded_data.iter().zip(test_data.iter()).enumerate() {
        if actual != expected {
-            panic!("大文件数据在第{i}字节不匹配: 实际={actual}, 期待={expected}");
+            panic!("大文件数据在第{i}字节不匹配：实际={actual}, 期待={expected}");
        }
    }

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 步骤4通过：大文件分片上传加密功能正常");
+    info!("✅ 步骤 4 通过：大文件分片上传加密功能正常");
    Ok(())
 }

-/// 步骤5：测试所有加密类型的分片上传
+/// 步骤 5：测试所有加密类型的分片上传
 #[tokio::test]
 #[serial]
 async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
    init_logging();
-    info!("🧪 步骤5：测试所有加密类型的分片上传");
+    info!("🧪 步骤 5：测试所有加密类型的分片上传");

    let mut kms_env = LocalKMSTestEnvironment::new().await?;
    let _default_key_id = kms_env.start_rustfs_for_local_kms().await?;
@@ -446,7 +450,7 @@ async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::
    let total_parts = 2;
    let total_size = part_size * total_parts;

-    // 测试SSE-KMS
+    // 测试 SSE-KMS
    info!("🔐 测试 SSE-KMS 分片上传");
    test_multipart_encryption_type(
        &s3_client,
@@ -459,7 +463,7 @@ async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::
    )
    .await?;

-    // 测试SSE-C
+    // 测试 SSE-C
    info!("🔐 测试 SSE-C 分片上传");
    test_multipart_encryption_type(
        &s3_client,
@@ -473,7 +477,7 @@ async fn test_step5_all_encryption_types_multipart() -> Result<(), Box<dyn std::
    .await?;

    kms_env.base_env.delete_test_bucket(TEST_BUCKET).await?;
-    info!("✅ 步骤5通过：所有加密类型的分片上传功能正常");
+    info!("✅ 步骤 5 通过：所有加密类型的分片上传功能正常");
    Ok(())
 }

@@ -496,7 +500,7 @@ async fn test_multipart_encryption_type(
    // 生成测试数据
    let test_data: Vec<u8> = (0..total_size).map(|i| ((i * 7) % 256) as u8).collect();

-    // 准备SSE-C所需的密钥（如果需要）
+    // 准备 SSE-C 所需的密钥（如果需要）
    let (sse_c_key, sse_c_md5) = if matches!(encryption_type, EncryptionType::SSEC) {
        let key = "01234567890123456789012345678901";
        let key_b64 = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, key);
@@ -537,7 +541,7 @@ async fn test_multipart_encryption_type(
            .part_number(part_number as i32)
            .body(aws_sdk_s3::primitives::ByteStream::from(part_data.to_vec()));

-        // SSE-C需要在每个UploadPart请求中包含密钥
+        // SSE-C 需要在每个 UploadPart 请求中包含密钥
        if matches!(encryption_type, EncryptionType::SSEC) {
            upload_request = upload_request
                .sse_customer_algorithm("AES256")
@@ -574,7 +578,7 @@ async fn test_multipart_encryption_type(
    // 下载并验证
    let mut get_request = s3_client.get_object().bucket(bucket).key(object_key);

-    // SSE-C需要在GET请求中包含密钥
+    // SSE-C 需要在 GET 请求中包含密钥
    if matches!(encryption_type, EncryptionType::SSEC) {
        get_request = get_request
            .sse_customer_algorithm("AES256")
@@ -101,6 +101,11 @@ aws-credential-types = { workspace = true }
 aws-smithy-types = { workspace = true }
 parking_lot = { workspace = true }
 moka = { workspace = true }
+base64-simd.workspace = true
+serde_urlencoded.workspace = true
+google-cloud-storage = "1.1.0"
+google-cloud-auth = "1.0.1"
+aws-config = { workspace = true }

 [target.'cfg(not(windows))'.dependencies]
 nix = { workspace = true }
@@ -113,6 +118,7 @@ winapi = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
 criterion = { workspace = true, features = ["html_reports"] }
 temp-env = { workspace = true }
+heed = "0.22.0"

 [build-dependencies]
 shadow-rs = { workspace = true, features = ["build", "metadata"] }
@@ -18,14 +18,18 @@
 #![allow(unused_must_use)]
 #![allow(clippy::all)]

+use crate::error::StorageError;
 use async_channel::{Receiver as A_Receiver, Sender as A_Sender, bounded};
+use bytes::BytesMut;
 use futures::Future;
 use http::HeaderMap;
 use lazy_static::lazy_static;
 use rustfs_common::data_usage::TierStats;
 use rustfs_common::heal_channel::rep_has_active_rules;
 use rustfs_common::metrics::{IlmAction, Metrics};
+use rustfs_filemeta::fileinfo::{NULL_VERSION_ID, RestoreStatusOps, is_restored_object_on_disk};
 use rustfs_utils::path::encode_dir_object;
+use rustfs_utils::string::strings_has_prefix_fold;
 use s3s::Body;
 use sha2::{Digest, Sha256};
 use std::any::Any;
@@ -62,7 +66,11 @@ use crate::store::ECStore;
 use crate::store_api::StorageAPI;
 use crate::store_api::{GetObjectReader, HTTPRangeSpec, ObjectInfo, ObjectOptions, ObjectToDelete};
 use crate::tier::warm_backend::WarmBackendGetOpts;
-use s3s::dto::{BucketLifecycleConfiguration, DefaultRetention, ReplicationConfiguration};
+use s3s::dto::{
+    BucketLifecycleConfiguration, DefaultRetention, ReplicationConfiguration, RestoreRequest, RestoreRequestType, RestoreStatus,
+    ServerSideEncryption, Timestamp,
+};
+use s3s::header::{X_AMZ_RESTORE, X_AMZ_SERVER_SIDE_ENCRYPTION, X_AMZ_STORAGE_CLASS};

 pub type TimeFn = Arc<dyn Fn() -> Pin<Box<dyn Future<Output = ()> + Send>> + Send + Sync + 'static>;
 pub type TraceFn =
@@ -71,9 +79,12 @@ pub type ExpiryOpType = Box<dyn ExpiryOp + Send + Sync + 'static>;

 static XXHASH_SEED: u64 = 0;

-const _DISABLED: &str = "Disabled";
+pub const AMZ_OBJECT_TAGGING: &str = "X-Amz-Tagging";
+pub const AMZ_TAG_COUNT: &str = "x-amz-tagging-count";
+pub const AMZ_TAG_DIRECTIVE: &str = "X-Amz-Tagging-Directive";
+pub const AMZ_ENCRYPTION_AES: &str = "AES256";
+pub const AMZ_ENCRYPTION_KMS: &str = "aws:kms";

-//pub const ERR_INVALID_STORAGECLASS: &str = "invalid storage class.";
 pub const ERR_INVALID_STORAGECLASS: &str = "invalid tier.";

 lazy_static! {
@@ -762,11 +773,14 @@ pub fn gen_transition_objname(bucket: &str) -> Result<String, Error> {
 pub async fn transition_object(api: Arc<ECStore>, oi: &ObjectInfo, lae: LcAuditEvent) -> Result<(), Error> {
    let time_ilm = Metrics::time_ilm(lae.event.action);

+    let etag = if let Some(etag) = &oi.etag { etag } else { "" };
+    let etag = etag.to_string();
+
    let opts = ObjectOptions {
        transition: TransitionOptions {
            status: lifecycle::TRANSITION_PENDING.to_string(),
            tier: lae.event.storage_class,
-            etag: oi.etag.clone().expect("err").to_string(),
+            etag,
            ..Default::default()
        },
        //lifecycle_audit_event: lae,
@@ -787,9 +801,9 @@ pub fn audit_tier_actions(_api: ECStore, _tier: &str, _bytes: i64) -> TimeFn {
 pub async fn get_transitioned_object_reader(
    bucket: &str,
    object: &str,
-    rs: HTTPRangeSpec,
-    h: HeaderMap,
-    oi: ObjectInfo,
+    rs: &Option<HTTPRangeSpec>,
+    h: &HeaderMap,
+    oi: &ObjectInfo,
    opts: &ObjectOptions,
 ) -> Result<GetObjectReader, std::io::Error> {
    let mut tier_config_mgr = GLOBAL_TierConfigMgr.write().await;
@@ -815,19 +829,131 @@ pub async fn get_transitioned_object_reader(
    let reader = tgt_client
        .get(&oi.transitioned_object.name, &oi.transitioned_object.version_id, gopts)
        .await?;
-    Ok(get_fn(reader, h))
+    Ok(get_fn(reader, h.clone()))
 }

-pub fn post_restore_opts(_r: http::Request<Body>, _bucket: &str, _object: &str) -> Result<ObjectOptions, std::io::Error> {
-    todo!();
+pub async fn post_restore_opts(version_id: &str, bucket: &str, object: &str) -> Result<ObjectOptions, std::io::Error> {
+    let versioned = BucketVersioningSys::prefix_enabled(bucket, object).await;
+    let version_suspended = BucketVersioningSys::prefix_suspended(bucket, object).await;
+    let vid = version_id.trim();
+    if vid != "" && vid != NULL_VERSION_ID {
+        if let Err(err) = Uuid::parse_str(vid) {
+            return Err(std::io::Error::other(
+                StorageError::InvalidVersionID(bucket.to_string(), object.to_string(), vid.to_string()).to_string(),
+            ));
+        }
+        if !versioned && !version_suspended {
+            return Err(std::io::Error::other(
+                StorageError::InvalidArgument(
+                    bucket.to_string(),
+                    object.to_string(),
+                    format!("version-id specified {} but versioning is not enabled on {}", vid, bucket),
+                )
+                .to_string(),
+            ));
+        }
+    }
+    Ok(ObjectOptions {
+        versioned: versioned,
+        version_suspended: version_suspended,
+        version_id: Some(vid.to_string()),
+        ..Default::default()
+    })
 }

-pub fn put_restore_opts(_bucket: &str, _object: &str, _rreq: &RestoreObjectRequest, _oi: &ObjectInfo) -> ObjectOptions {
-    todo!();
+pub async fn put_restore_opts(
+    bucket: &str,
+    object: &str,
+    rreq: &RestoreRequest,
+    oi: &ObjectInfo,
+) -> Result<ObjectOptions, std::io::Error> {
+    let mut meta = HashMap::<String, String>::new();
+    /*let mut b = false;
+    let Some(Some(Some(mut sc))) = rreq.output_location.s3.storage_class else { b = true; };
+    if b || sc == "" {
+        //sc = oi.storage_class;
+        sc = oi.transitioned_object.tier;
+    }
+    meta.insert(X_AMZ_STORAGE_CLASS.as_str().to_lowercase(), sc);*/
+
+    if let Some(type_) = &rreq.type_
+        && type_.as_str() == RestoreRequestType::SELECT
+    {
+        for v in rreq
+            .output_location
+            .as_ref()
+            .unwrap()
+            .s3
+            .as_ref()
+            .unwrap()
+            .user_metadata
+            .as_ref()
+            .unwrap()
+        {
+            if !strings_has_prefix_fold(&v.name.clone().unwrap(), "x-amz-meta") {
+                meta.insert(
+                    format!("x-amz-meta-{}", v.name.as_ref().unwrap()),
+                    v.value.clone().unwrap_or("".to_string()),
+                );
+                continue;
+            }
+            meta.insert(v.name.clone().unwrap(), v.value.clone().unwrap_or("".to_string()));
+        }
+        if let Some(output_location) = rreq.output_location.as_ref() {
+            if let Some(s3) = &output_location.s3 {
+                if let Some(tags) = &s3.tagging {
+                    meta.insert(
+                        AMZ_OBJECT_TAGGING.to_string(),
+                        serde_urlencoded::to_string(tags.tag_set.clone()).unwrap_or("".to_string()),
+                    );
+                }
+            }
+        }
+        if let Some(output_location) = rreq.output_location.as_ref() {
+            if let Some(s3) = &output_location.s3 {
+                if let Some(encryption) = &s3.encryption {
+                    if encryption.encryption_type.as_str() != "" {
+                        meta.insert(X_AMZ_SERVER_SIDE_ENCRYPTION.as_str().to_string(), AMZ_ENCRYPTION_AES.to_string());
+                    }
+                }
+            }
+        }
+        return Ok(ObjectOptions {
+            versioned: BucketVersioningSys::prefix_enabled(bucket, object).await,
+            version_suspended: BucketVersioningSys::prefix_suspended(bucket, object).await,
+            user_defined: meta,
+            ..Default::default()
+        });
+    }
+    for (k, v) in &oi.user_defined {
+        meta.insert(k.to_string(), v.clone());
+    }
+    if oi.user_tags.len() != 0 {
+        meta.insert(AMZ_OBJECT_TAGGING.to_string(), oi.user_tags.clone());
+    }
+    let restore_expiry = lifecycle::expected_expiry_time(OffsetDateTime::now_utc(), rreq.days.unwrap_or(1));
+    meta.insert(
+        X_AMZ_RESTORE.as_str().to_string(),
+        RestoreStatus {
+            is_restore_in_progress: Some(false),
+            restore_expiry_date: Some(Timestamp::from(restore_expiry)),
+        }
+        .to_string(),
+    );
+    Ok(ObjectOptions {
+        versioned: BucketVersioningSys::prefix_enabled(bucket, object).await,
+        version_suspended: BucketVersioningSys::prefix_suspended(bucket, object).await,
+        user_defined: meta,
+        version_id: oi.version_id.map(|e| e.to_string()),
+        mod_time: oi.mod_time,
+        //expires:           oi.expires,
+        ..Default::default()
+    })
 }

 pub trait LifecycleOps {
    fn to_lifecycle_opts(&self) -> lifecycle::ObjectOpts;
+    fn is_remote(&self) -> bool;
 }

 impl LifecycleOps for ObjectInfo {
@@ -848,29 +974,54 @@ impl LifecycleOps for ObjectInfo {
            ..Default::default()
        }
    }
+
+    fn is_remote(&self) -> bool {
+        if self.transitioned_object.status != lifecycle::TRANSITION_COMPLETE {
+            return false;
+        }
+        !is_restored_object_on_disk(&self.user_defined)
+    }
 }

-#[derive(Debug, Default, Clone)]
-pub struct S3Location {
-    pub bucketname: String,
-    //pub encryption:    Encryption,
-    pub prefix: String,
-    pub storage_class: String,
-    //pub tagging:       Tags,
-    pub user_metadata: HashMap<String, String>,
+pub trait RestoreRequestOps {
+    fn validate(&self, api: Arc<ECStore>) -> Result<(), std::io::Error>;
 }

-#[derive(Debug, Default, Clone)]
-pub struct OutputLocation(pub S3Location);
+impl RestoreRequestOps for RestoreRequest {
+    fn validate(&self, api: Arc<ECStore>) -> Result<(), std::io::Error> {
+        /*if self.type_.is_none() && self.select_parameters.is_some() {
+            return Err(std::io::Error::other("Select parameters can only be specified with SELECT request type"));
+        }
+        if let Some(type_) = self.type_ && type_ == RestoreRequestType::SELECT && self.select_parameters.is_none() {
+            return Err(std::io::Error::other("SELECT restore request requires select parameters to be specified"));
+        }

-#[derive(Debug, Default, Clone)]
-pub struct RestoreObjectRequest {
-    pub days: i64,
-    pub ror_type: String,
-    pub tier: String,
-    pub description: String,
-    //pub select_parameters: SelectParameters,
-    pub output_location: OutputLocation,
+        if self.type_.is_none() && self.output_location.is_some() {
+            return Err(std::io::Error::other("OutputLocation required only for SELECT request type"));
+        }
+        if let Some(type_) = self.type_ && type_ == RestoreRequestType::SELECT && self.output_location.is_none() {
+            return Err(std::io::Error::other("OutputLocation required for SELECT requests"));
+        }
+
+        if let Some(type_) = self.type_ && type_ == RestoreRequestType::SELECT && self.days != 0 {
+            return Err(std::io::Error::other("Days cannot be specified with SELECT restore request"));
+        }
+        if self.days == 0 && self.type_.is_none() {
+            return Err(std::io::Error::other("restoration days should be at least 1"));
+        }
+        if self.output_location.is_some() {
+            if _, err := api.get_bucket_info(self.output_location.s3.bucket_name, BucketOptions{}); err != nil {
+                return err
+            }
+            if self.output_location.s3.prefix == "" {
+                return Err(std::io::Error::other("Prefix is a required parameter in OutputLocation"));
+            }
+            if self.output_location.s3.encryption.encryption_type.as_str() != ServerSideEncryption::AES256 {
+                return NotImplemented{}
+            }
+        }*/
+        Ok(())
+    }
 }

 const _MAX_RESTORE_OBJECT_REQUEST_SIZE: i64 = 2 << 20;
@@ -975,11 +1126,10 @@ pub async fn apply_expiry_on_non_transitioned_objects(
    //debug!("lc_event.action: {:?}", lc_event.action);
    //debug!("opts: {:?}", opts);
    let mut dobj = match api.delete_object(&oi.bucket, &encode_dir_object(&oi.name), opts).await {
-        Ok(obj) => obj,
+        Ok(dobj) => dobj,
        Err(e) => {
-            error!("Failed to delete object {}/{}: {:?}", oi.bucket, oi.name, e);
-            // Return the original object info if deletion fails
-            oi.clone()
+            error!("delete_object error: {:?}", e);
+            return false;
        }
    };
    //debug!("dobj: {:?}", dobj);
@@ -20,7 +20,7 @@

 use s3s::dto::{
    BucketLifecycleConfiguration, ExpirationStatus, LifecycleExpiration, LifecycleRule, NoncurrentVersionTransition,
-    ObjectLockConfiguration, ObjectLockEnabled, Transition,
+    ObjectLockConfiguration, ObjectLockEnabled, RestoreRequest, Transition,
 };
 use std::cmp::Ordering;
 use std::env;
@@ -32,8 +32,6 @@ use tracing::info;

 use crate::bucket::lifecycle::rule::TransitionOps;

-use super::bucket_lifecycle_ops::RestoreObjectRequest;
-
 pub const TRANSITION_COMPLETE: &str = "complete";
 pub const TRANSITION_PENDING: &str = "pending";

@@ -325,7 +323,7 @@ impl Lifecycle for BucketLifecycleConfiguration {
                        }

                        if let Some(days) = expiration.days {
-                            let expected_expiry = expected_expiry_time(obj.mod_time.expect("err!"), days /*, date*/);
+                            let expected_expiry = expected_expiry_time(obj.mod_time.unwrap(), days /*, date*/);
                            if now.unix_timestamp() >= expected_expiry.unix_timestamp() {
                                events.push(Event {
                                    action: IlmAction::DeleteVersionAction,
@@ -402,19 +400,21 @@ impl Lifecycle for BucketLifecycleConfiguration {
                            if storage_class.as_str() != "" && !obj.delete_marker && obj.transition_status != TRANSITION_COMPLETE
                            {
                                let due = rule.noncurrent_version_transitions.as_ref().unwrap()[0].next_due(obj);
-                                if due.is_some() && (now.unix_timestamp() >= due.unwrap().unix_timestamp()) {
-                                    events.push(Event {
-                                        action: IlmAction::TransitionVersionAction,
-                                        rule_id: rule.id.clone().expect("err!"),
-                                        due,
-                                        storage_class: rule.noncurrent_version_transitions.as_ref().unwrap()[0]
-                                            .storage_class
-                                            .clone()
-                                            .unwrap()
-                                            .as_str()
-                                            .to_string(),
-                                        ..Default::default()
-                                    });
+                                if let Some(due0) = due {
+                                    if now.unix_timestamp() == 0 || now.unix_timestamp() > due0.unix_timestamp() {
+                                        events.push(Event {
+                                            action: IlmAction::TransitionVersionAction,
+                                            rule_id: rule.id.clone().expect("err!"),
+                                            due,
+                                            storage_class: rule.noncurrent_version_transitions.as_ref().unwrap()[0]
+                                                .storage_class
+                                                .clone()
+                                                .unwrap()
+                                                .as_str()
+                                                .to_string(),
+                                            ..Default::default()
+                                        });
+                                    }
                                }
                            }
                        }
@@ -446,7 +446,7 @@ impl Lifecycle for BucketLifecycleConfiguration {
                                });
                            }
                        } else if let Some(days) = expiration.days {
-                            let expected_expiry: OffsetDateTime = expected_expiry_time(obj.mod_time.expect("err!"), days);
+                            let expected_expiry: OffsetDateTime = expected_expiry_time(obj.mod_time.unwrap(), days);
                            info!(
                                "eval_inner: expiration check - days={}, obj_time={:?}, expiry_time={:?}, now={:?}, should_expire={}",
                                days,
@@ -480,12 +480,12 @@ impl Lifecycle for BucketLifecycleConfiguration {
                    if obj.transition_status != TRANSITION_COMPLETE {
                        if let Some(ref transitions) = rule.transitions {
                            let due = transitions[0].next_due(obj);
-                            if let Some(due) = due {
-                                if due.unix_timestamp() > 0 && (now.unix_timestamp() >= due.unix_timestamp()) {
+                            if let Some(due0) = due {
+                                if now.unix_timestamp() == 0 || now.unix_timestamp() > due0.unix_timestamp() {
                                    events.push(Event {
                                        action: IlmAction::TransitionAction,
                                        rule_id: rule.id.clone().expect("err!"),
-                                        due: Some(due),
+                                        due,
                                        storage_class: transitions[0].storage_class.clone().expect("err!").as_str().to_string(),
                                        noncurrent_days: 0,
                                        newer_noncurrent_versions: 0,
@@ -580,8 +580,10 @@ impl LifecycleCalculate for LifecycleExpiration {
        if !obj.is_latest || !obj.delete_marker {
            return None;
        }
-
-        Some(expected_expiry_time(obj.mod_time.unwrap(), self.days.unwrap()))
+        match self.days {
+            Some(days) => Some(expected_expiry_time(obj.mod_time.unwrap(), days)),
+            None => None,
+        }
    }
 }

@@ -591,10 +593,16 @@ impl LifecycleCalculate for NoncurrentVersionTransition {
        if obj.is_latest || self.storage_class.is_none() {
            return None;
        }
-        if self.noncurrent_days.is_none() {
-            return obj.successor_mod_time;
+        match self.noncurrent_days {
+            Some(noncurrent_days) => {
+                if let Some(successor_mod_time) = obj.successor_mod_time {
+                    Some(expected_expiry_time(successor_mod_time, noncurrent_days))
+                } else {
+                    Some(expected_expiry_time(OffsetDateTime::now_utc(), noncurrent_days))
+                }
+            }
+            None => obj.successor_mod_time,
        }
-        Some(expected_expiry_time(obj.successor_mod_time.unwrap(), self.noncurrent_days.unwrap()))
    }
 }

@@ -609,10 +617,10 @@ impl LifecycleCalculate for Transition {
            return Some(date.into());
        }

-        if self.days.is_none() {
-            return obj.mod_time;
+        match self.days {
+            Some(days) => Some(expected_expiry_time(obj.mod_time.unwrap(), days)),
+            None => obj.mod_time,
        }
-        Some(expected_expiry_time(obj.mod_time.unwrap(), self.days.unwrap()))
    }
 }

@@ -692,7 +700,7 @@ pub struct TransitionOptions {
    pub status: String,
    pub tier: String,
    pub etag: String,
-    pub restore_request: RestoreObjectRequest,
+    pub restore_request: RestoreRequest,
    pub restore_expiry: OffsetDateTime,
    pub expire_restored: bool,
 }
@@ -17,12 +17,10 @@ pub mod datatypes;
 mod replication_pool;
 mod replication_resyncer;
 mod replication_state;
-mod replication_type;
 mod rule;

 pub use config::*;
 pub use datatypes::*;
 pub use replication_pool::*;
 pub use replication_resyncer::*;
-pub use replication_type::*;
 pub use rule::*;
@@ -1,9 +1,4 @@
 use crate::StorageAPI;
-use crate::bucket::replication::MrfReplicateEntry;
-use crate::bucket::replication::ReplicateDecision;
-use crate::bucket::replication::ReplicateObjectInfo;
-use crate::bucket::replication::ReplicationWorkerOperation;
-use crate::bucket::replication::ResyncDecision;
 use crate::bucket::replication::ResyncOpts;
 use crate::bucket::replication::ResyncStatusType;
 use crate::bucket::replication::replicate_delete;
@@ -18,16 +13,21 @@ use crate::bucket::replication::replication_resyncer::{
    BucketReplicationResyncStatus, DeletedObjectReplicationInfo, ReplicationResyncer,
 };
 use crate::bucket::replication::replication_state::ReplicationStats;
-use crate::bucket::replication::replication_statuses_map;
-use crate::bucket::replication::version_purge_statuses_map;
 use crate::config::com::read_config;
 use crate::error::Error as EcstoreError;
 use crate::store_api::ObjectInfo;

 use lazy_static::lazy_static;
+use rustfs_filemeta::MrfReplicateEntry;
+use rustfs_filemeta::ReplicateDecision;
+use rustfs_filemeta::ReplicateObjectInfo;
 use rustfs_filemeta::ReplicatedTargetInfo;
 use rustfs_filemeta::ReplicationStatusType;
 use rustfs_filemeta::ReplicationType;
+use rustfs_filemeta::ReplicationWorkerOperation;
+use rustfs_filemeta::ResyncDecision;
+use rustfs_filemeta::replication_statuses_map;
+use rustfs_filemeta::version_purge_statuses_map;
 use rustfs_utils::http::RESERVED_METADATA_PREFIX_LOWER;
 use time::OffsetDateTime;
 use time::format_description::well_known::Rfc3339;
@@ -996,7 +996,7 @@ pub async fn schedule_replication<S: StorageAPI>(oi: ObjectInfo, o: Arc<S>, dsc:
        target_purge_statuses: purge_statuses,
        replication_timestamp: tm,
        user_tags: oi.user_tags,
-        checksum: vec![],
+        checksum: None,
        retry_count: 0,
        event_type: "".to_string(),
        existing_obj_resync: ResyncDecision::default(),
@@ -2,12 +2,8 @@ use crate::bucket::bucket_target_sys::{
    AdvancedPutOptions, BucketTargetSys, PutObjectOptions, PutObjectPartOptions, RemoveObjectOptions, TargetClient,
 };
 use crate::bucket::metadata_sys;
-use crate::bucket::replication::{MrfReplicateEntry, ReplicationWorkerOperation, ResyncStatusType};
-use crate::bucket::replication::{
-    ObjectOpts, REPLICATE_EXISTING, REPLICATE_EXISTING_DELETE, REPLICATION_RESET, ReplicateObjectInfo,
-    ReplicationConfigurationExt as _, ResyncTargetDecision, get_replication_state, parse_replicate_decision,
-    replication_statuses_map, target_reset_header, version_purge_statuses_map,
-};
+use crate::bucket::replication::ResyncStatusType;
+use crate::bucket::replication::{ObjectOpts, ReplicationConfigurationExt as _};
 use crate::bucket::tagging::decode_tags_to_map;
 use crate::bucket::target::BucketTargets;
 use crate::bucket::versioning_sys::BucketVersioningSys;
@@ -29,14 +25,17 @@ use byteorder::ByteOrder;
 use futures::future::join_all;
 use http::HeaderMap;

+use regex::Regex;
 use rustfs_filemeta::{
-    ReplicatedInfos, ReplicatedTargetInfo, ReplicationAction, ReplicationState, ReplicationStatusType, ReplicationType,
-    VersionPurgeStatusType,
+    MrfReplicateEntry, REPLICATE_EXISTING, REPLICATE_EXISTING_DELETE, REPLICATION_RESET, ReplicateDecision, ReplicateObjectInfo,
+    ReplicateTargetDecision, ReplicatedInfos, ReplicatedTargetInfo, ReplicationAction, ReplicationState, ReplicationStatusType,
+    ReplicationType, ReplicationWorkerOperation, ResyncDecision, ResyncTargetDecision, VersionPurgeStatusType,
+    get_replication_state, parse_replicate_decision, replication_statuses_map, target_reset_header, version_purge_statuses_map,
 };
 use rustfs_utils::http::{
    AMZ_BUCKET_REPLICATION_STATUS, AMZ_OBJECT_TAGGING, AMZ_TAGGING_DIRECTIVE, CONTENT_ENCODING, HeaderExt as _,
-    RESERVED_METADATA_PREFIX, RESERVED_METADATA_PREFIX_LOWER, RUSTFS_REPLICATION_AUTUAL_OBJECT_SIZE, SSEC_ALGORITHM_HEADER,
-    SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER, headers,
+    RESERVED_METADATA_PREFIX, RESERVED_METADATA_PREFIX_LOWER, RUSTFS_REPLICATION_AUTUAL_OBJECT_SIZE,
+    RUSTFS_REPLICATION_RESET_STATUS, SSEC_ALGORITHM_HEADER, SSEC_KEY_HEADER, SSEC_KEY_MD5_HEADER, headers,
 };
 use rustfs_utils::path::path_join_buf;
 use rustfs_utils::string::strings_has_prefix_fold;
@@ -56,9 +55,6 @@ use tokio::time::Duration as TokioDuration;
 use tokio_util::sync::CancellationToken;
 use tracing::{error, info, warn};

-use super::replication_type::{ReplicateDecision, ReplicateTargetDecision, ResyncDecision};
-use regex::Regex;
-
 const REPLICATION_DIR: &str = ".replication";
 const RESYNC_FILE_NAME: &str = "resync.bin";
 const RESYNC_META_FORMAT: u16 = 1;
@@ -663,7 +659,7 @@ pub async fn get_heal_replicate_object_info(oi: &ObjectInfo, rcfg: &ReplicationC
        replication_timestamp: None,
        ssec: false, // TODO: add ssec support
        user_tags: oi.user_tags.clone(),
-        checksum: Vec::new(),
+        checksum: oi.checksum.clone(),
        retry_count: 0,
    }
 }
@@ -849,7 +845,7 @@ impl ReplicationConfig {
            {
                resync_decision.targets.insert(
                    decision.arn.clone(),
-                    ResyncTargetDecision::resync_target(
+                    resync_target(
                        &oi,
                        &target.arn,
                        &target.reset_id,
@@ -864,6 +860,59 @@ impl ReplicationConfig {
    }
 }

+pub fn resync_target(
+    oi: &ObjectInfo,
+    arn: &str,
+    reset_id: &str,
+    reset_before_date: Option<OffsetDateTime>,
+    status: ReplicationStatusType,
+) -> ResyncTargetDecision {
+    let rs = oi
+        .user_defined
+        .get(target_reset_header(arn).as_str())
+        .or(oi.user_defined.get(RUSTFS_REPLICATION_RESET_STATUS))
+        .map(|s| s.to_string());
+
+    let mut dec = ResyncTargetDecision::default();
+
+    let mod_time = oi.mod_time.unwrap_or(OffsetDateTime::UNIX_EPOCH);
+
+    if rs.is_none() {
+        let reset_before_date = reset_before_date.unwrap_or(OffsetDateTime::UNIX_EPOCH);
+        if !reset_id.is_empty() && mod_time < reset_before_date {
+            dec.replicate = true;
+            return dec;
+        }
+
+        dec.replicate = status == ReplicationStatusType::Empty;
+
+        return dec;
+    }
+
+    if reset_id.is_empty() || reset_before_date.is_none() {
+        return dec;
+    }
+
+    let rs = rs.unwrap();
+    let reset_before_date = reset_before_date.unwrap();
+
+    let parts: Vec<&str> = rs.splitn(2, ';').collect();
+
+    if parts.len() != 2 {
+        return dec;
+    }
+
+    let new_reset = parts[0] == reset_id;
+
+    if !new_reset && status == ReplicationStatusType::Completed {
+        return dec;
+    }
+
+    dec.replicate = new_reset && mod_time < reset_before_date;
+
+    dec
+}
+
 pub struct MustReplicateOptions {
    meta: HashMap<String, String>,
    status: ReplicationStatusType,
@@ -933,7 +982,7 @@ pub async fn check_replicate_delete(
    let rcfg = match get_replication_config(bucket).await {
        Ok(Some(config)) => config,
        Ok(None) => {
-            warn!("No replication config found for bucket: {}", bucket);
+            // warn!("No replication config found for bucket: {}", bucket);
            return ReplicateDecision::default();
        }
        Err(err) => {
@@ -1,470 +0,0 @@
-// Copyright 2024 RustFS Team
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use crate::error::{Error, Result};
-use crate::store_api::ObjectInfo;
-
-use regex::Regex;
-
-use rustfs_filemeta::VersionPurgeStatusType;
-use rustfs_filemeta::{ReplicatedInfos, ReplicationType};
-use rustfs_filemeta::{ReplicationState, ReplicationStatusType};
-use rustfs_utils::http::RESERVED_METADATA_PREFIX_LOWER;
-use rustfs_utils::http::RUSTFS_REPLICATION_RESET_STATUS;
-use serde::{Deserialize, Serialize};
-use std::any::Any;
-use std::collections::HashMap;
-use std::fmt;
-use time::OffsetDateTime;
-use uuid::Uuid;
-
-pub const REPLICATION_RESET: &str = "replication-reset";
-pub const REPLICATION_STATUS: &str = "replication-status";
-
-// ReplicateQueued - replication being queued trail
-pub const REPLICATE_QUEUED: &str = "replicate:queue";
-
-// ReplicateExisting - audit trail for existing objects replication
-pub const REPLICATE_EXISTING: &str = "replicate:existing";
-// ReplicateExistingDelete - audit trail for delete replication triggered for existing delete markers
-pub const REPLICATE_EXISTING_DELETE: &str = "replicate:existing:delete";
-
-// ReplicateMRF - audit trail for replication from Most Recent Failures (MRF) queue
-pub const REPLICATE_MRF: &str = "replicate:mrf";
-// ReplicateIncoming - audit trail of inline replication
-pub const REPLICATE_INCOMING: &str = "replicate:incoming";
-// ReplicateIncomingDelete - audit trail of inline replication of deletes.
-pub const REPLICATE_INCOMING_DELETE: &str = "replicate:incoming:delete";
-
-// ReplicateHeal - audit trail for healing of failed/pending replications
-pub const REPLICATE_HEAL: &str = "replicate:heal";
-// ReplicateHealDelete - audit trail of healing of failed/pending delete replications.
-pub const REPLICATE_HEAL_DELETE: &str = "replicate:heal:delete";
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct MrfReplicateEntry {
-    #[serde(rename = "bucket")]
-    pub bucket: String,
-
-    #[serde(rename = "object")]
-    pub object: String,
-
-    #[serde(skip_serializing, skip_deserializing)]
-    pub version_id: Option<Uuid>,
-
-    #[serde(rename = "retryCount")]
-    pub retry_count: i32,
-
-    #[serde(skip_serializing, skip_deserializing)]
-    pub size: i64,
-}
-
-pub trait ReplicationWorkerOperation: Any + Send + Sync {
-    fn to_mrf_entry(&self) -> MrfReplicateEntry;
-    fn as_any(&self) -> &dyn Any;
-    fn get_bucket(&self) -> &str;
-    fn get_object(&self) -> &str;
-    fn get_size(&self) -> i64;
-    fn is_delete_marker(&self) -> bool;
-    fn get_op_type(&self) -> ReplicationType;
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ReplicateTargetDecision {
-    pub replicate: bool,
-    pub synchronous: bool,
-    pub arn: String,
-    pub id: String,
-}
-
-impl ReplicateTargetDecision {
-    pub fn new(arn: String, replicate: bool, sync: bool) -> Self {
-        Self {
-            replicate,
-            synchronous: sync,
-            arn,
-            id: String::new(),
-        }
-    }
-}
-
-impl fmt::Display for ReplicateTargetDecision {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{};{};{};{}", self.replicate, self.synchronous, self.arn, self.id)
-    }
-}
-
-/// ReplicateDecision represents replication decision for each target
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ReplicateDecision {
-    pub targets_map: HashMap<String, ReplicateTargetDecision>,
-}
-
-impl ReplicateDecision {
-    pub fn new() -> Self {
-        Self {
-            targets_map: HashMap::new(),
-        }
-    }
-
-    /// Returns true if at least one target qualifies for replication
-    pub fn replicate_any(&self) -> bool {
-        self.targets_map.values().any(|t| t.replicate)
-    }
-
-    /// Returns true if at least one target qualifies for synchronous replication
-    pub fn is_synchronous(&self) -> bool {
-        self.targets_map.values().any(|t| t.synchronous)
-    }
-
-    /// Updates ReplicateDecision with target's replication decision
-    pub fn set(&mut self, target: ReplicateTargetDecision) {
-        self.targets_map.insert(target.arn.clone(), target);
-    }
-
-    /// Returns a stringified representation of internal replication status with all targets marked as `PENDING`
-    pub fn pending_status(&self) -> Option<String> {
-        let mut result = String::new();
-        for target in self.targets_map.values() {
-            if target.replicate {
-                result.push_str(&format!("{}={};", target.arn, ReplicationStatusType::Pending.as_str()));
-            }
-        }
-        if result.is_empty() { None } else { Some(result) }
-    }
-}
-
-impl fmt::Display for ReplicateDecision {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let mut result = String::new();
-        for (key, value) in &self.targets_map {
-            result.push_str(&format!("{key}={value},"));
-        }
-        write!(f, "{}", result.trim_end_matches(','))
-    }
-}
-
-impl Default for ReplicateDecision {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-// parse k-v pairs of target ARN to stringified ReplicateTargetDecision delimited by ',' into a
-// ReplicateDecision struct
-pub fn parse_replicate_decision(_bucket: &str, s: &str) -> Result<ReplicateDecision> {
-    let mut decision = ReplicateDecision::new();
-
-    if s.is_empty() {
-        return Ok(decision);
-    }
-
-    for p in s.split(',') {
-        if p.is_empty() {
-            continue;
-        }
-
-        let slc = p.split('=').collect::<Vec<&str>>();
-        if slc.len() != 2 {
-            return Err(Error::other(format!("invalid replicate decision format: {s}")));
-        }
-
-        let tgt_str = slc[1].trim_matches('"');
-        let tgt = tgt_str.split(';').collect::<Vec<&str>>();
-        if tgt.len() != 4 {
-            return Err(Error::other(format!("invalid replicate decision format: {s}")));
-        }
-
-        let tgt = ReplicateTargetDecision {
-            replicate: tgt[0] == "true",
-            synchronous: tgt[1] == "true",
-            arn: tgt[2].to_string(),
-            id: tgt[3].to_string(),
-        };
-        decision.targets_map.insert(slc[0].to_string(), tgt);
-    }
-
-    Ok(decision)
-
-    // r = ReplicateDecision{
-    // 	targetsMap: make(map[string]replicateTargetDecision),
-    // }
-    // if len(s) == 0 {
-    // 	return
-    // }
-    // for _, p := range strings.Split(s, ",") {
-    // 	if p == "" {
-    // 		continue
-    // 	}
-    // 	slc := strings.Split(p, "=")
-    // 	if len(slc) != 2 {
-    // 		return r, errInvalidReplicateDecisionFormat
-    // 	}
-    // 	tgtStr := strings.TrimSuffix(strings.TrimPrefix(slc[1], `"`), `"`)
-    // 	tgt := strings.Split(tgtStr, ";")
-    // 	if len(tgt) != 4 {
-    // 		return r, errInvalidReplicateDecisionFormat
-    // 	}
-    // 	r.targetsMap[slc[0]] = replicateTargetDecision{Replicate: tgt[0] == "true", Synchronous: tgt[1] == "true", Arn: tgt[2], ID: tgt[3]}
-    // }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ResyncTargetDecision {
-    pub replicate: bool,
-    pub reset_id: String,
-    pub reset_before_date: Option<OffsetDateTime>,
-}
-
-pub fn target_reset_header(arn: &str) -> String {
-    format!("{RESERVED_METADATA_PREFIX_LOWER}{REPLICATION_RESET}-{arn}")
-}
-
-impl ResyncTargetDecision {
-    pub fn resync_target(
-        oi: &ObjectInfo,
-        arn: &str,
-        reset_id: &str,
-        reset_before_date: Option<OffsetDateTime>,
-        status: ReplicationStatusType,
-    ) -> Self {
-        let rs = oi
-            .user_defined
-            .get(target_reset_header(arn).as_str())
-            .or(oi.user_defined.get(RUSTFS_REPLICATION_RESET_STATUS))
-            .map(|s| s.to_string());
-
-        let mut dec = Self::default();
-
-        let mod_time = oi.mod_time.unwrap_or(OffsetDateTime::UNIX_EPOCH);
-
-        if rs.is_none() {
-            let reset_before_date = reset_before_date.unwrap_or(OffsetDateTime::UNIX_EPOCH);
-            if !reset_id.is_empty() && mod_time < reset_before_date {
-                dec.replicate = true;
-                return dec;
-            }
-
-            dec.replicate = status == ReplicationStatusType::Empty;
-
-            return dec;
-        }
-
-        if reset_id.is_empty() || reset_before_date.is_none() {
-            return dec;
-        }
-
-        let rs = rs.unwrap();
-        let reset_before_date = reset_before_date.unwrap();
-
-        let parts: Vec<&str> = rs.splitn(2, ';').collect();
-
-        if parts.len() != 2 {
-            return dec;
-        }
-
-        let new_reset = parts[0] == reset_id;
-
-        if !new_reset && status == ReplicationStatusType::Completed {
-            return dec;
-        }
-
-        dec.replicate = new_reset && mod_time < reset_before_date;
-
-        dec
-    }
-}
-
-/// ResyncDecision is a struct representing a map with target's individual resync decisions
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ResyncDecision {
-    pub targets: HashMap<String, ResyncTargetDecision>,
-}
-
-impl ResyncDecision {
-    pub fn new() -> Self {
-        Self { targets: HashMap::new() }
-    }
-
-    /// Returns true if no targets with resync decision present
-    pub fn is_empty(&self) -> bool {
-        self.targets.is_empty()
-    }
-
-    pub fn must_resync(&self) -> bool {
-        self.targets.values().any(|v| v.replicate)
-    }
-
-    pub fn must_resync_target(&self, tgt_arn: &str) -> bool {
-        self.targets.get(tgt_arn).map(|v| v.replicate).unwrap_or(false)
-    }
-}
-
-impl Default for ResyncDecision {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ReplicateObjectInfo {
-    pub name: String,
-    pub size: i64,
-    pub actual_size: i64,
-    pub bucket: String,
-    pub version_id: Option<Uuid>,
-    pub etag: Option<String>,
-    pub mod_time: Option<OffsetDateTime>,
-    pub replication_status: ReplicationStatusType,
-    pub replication_status_internal: Option<String>,
-    pub delete_marker: bool,
-    pub version_purge_status_internal: Option<String>,
-    pub version_purge_status: VersionPurgeStatusType,
-    pub replication_state: Option<ReplicationState>,
-    pub op_type: ReplicationType,
-    pub event_type: String,
-    pub dsc: ReplicateDecision,
-    pub existing_obj_resync: ResyncDecision,
-    pub target_statuses: HashMap<String, ReplicationStatusType>,
-    pub target_purge_statuses: HashMap<String, VersionPurgeStatusType>,
-    pub replication_timestamp: Option<OffsetDateTime>,
-    pub ssec: bool,
-    pub user_tags: String,
-    pub checksum: Vec<u8>,
-    pub retry_count: u32,
-}
-
-impl ReplicationWorkerOperation for ReplicateObjectInfo {
-    fn as_any(&self) -> &dyn Any {
-        self
-    }
-
-    fn to_mrf_entry(&self) -> MrfReplicateEntry {
-        MrfReplicateEntry {
-            bucket: self.bucket.clone(),
-            object: self.name.clone(),
-            version_id: self.version_id,
-            retry_count: self.retry_count as i32,
-            size: self.size,
-        }
-    }
-
-    fn get_bucket(&self) -> &str {
-        &self.bucket
-    }
-
-    fn get_object(&self) -> &str {
-        &self.name
-    }
-
-    fn get_size(&self) -> i64 {
-        self.size
-    }
-
-    fn is_delete_marker(&self) -> bool {
-        self.delete_marker
-    }
-
-    fn get_op_type(&self) -> ReplicationType {
-        self.op_type
-    }
-}
-
-lazy_static::lazy_static! {
-    static ref REPL_STATUS_REGEX: Regex = Regex::new(r"([^=].*?)=([^,].*?);").unwrap();
-}
-
-impl ReplicateObjectInfo {
-    /// Returns replication status of a target
-    pub fn target_replication_status(&self, arn: &str) -> ReplicationStatusType {
-        let binding = self.replication_status_internal.clone().unwrap_or_default();
-        let captures = REPL_STATUS_REGEX.captures_iter(&binding);
-        for cap in captures {
-            if cap.len() == 3 && &cap[1] == arn {
-                return ReplicationStatusType::from(&cap[2]);
-            }
-        }
-        ReplicationStatusType::default()
-    }
-
-    /// Returns the relevant info needed by MRF
-    pub fn to_mrf_entry(&self) -> MrfReplicateEntry {
-        MrfReplicateEntry {
-            bucket: self.bucket.clone(),
-            object: self.name.clone(),
-            version_id: self.version_id,
-            retry_count: self.retry_count as i32,
-            size: self.size,
-        }
-    }
-}
-
-// constructs a replication status map from string representation
-pub fn replication_statuses_map(s: &str) -> HashMap<String, ReplicationStatusType> {
-    let mut targets = HashMap::new();
-    let rep_stat_matches = REPL_STATUS_REGEX.captures_iter(s).map(|c| c.extract());
-    for (_, [arn, status]) in rep_stat_matches {
-        if arn.is_empty() {
-            continue;
-        }
-        let status = ReplicationStatusType::from(status);
-        targets.insert(arn.to_string(), status);
-    }
-    targets
-}
-
-// constructs a version purge status map from string representation
-pub fn version_purge_statuses_map(s: &str) -> HashMap<String, VersionPurgeStatusType> {
-    let mut targets = HashMap::new();
-    let purge_status_matches = REPL_STATUS_REGEX.captures_iter(s).map(|c| c.extract());
-    for (_, [arn, status]) in purge_status_matches {
-        if arn.is_empty() {
-            continue;
-        }
-        let status = VersionPurgeStatusType::from(status);
-        targets.insert(arn.to_string(), status);
-    }
-    targets
-}
-
-pub fn get_replication_state(rinfos: &ReplicatedInfos, prev_state: &ReplicationState, _vid: Option<String>) -> ReplicationState {
-    let reset_status_map: Vec<(String, String)> = rinfos
-        .targets
-        .iter()
-        .filter(|v| !v.resync_timestamp.is_empty())
-        .map(|t| (target_reset_header(t.arn.as_str()), t.resync_timestamp.clone()))
-        .collect();
-
-    let repl_statuses = rinfos.replication_status_internal();
-    let vpurge_statuses = rinfos.version_purge_status_internal();
-
-    let mut reset_statuses_map = prev_state.reset_statuses_map.clone();
-    for (key, value) in reset_status_map {
-        reset_statuses_map.insert(key, value);
-    }
-
-    ReplicationState {
-        replicate_decision_str: prev_state.replicate_decision_str.clone(),
-        reset_statuses_map,
-        replica_timestamp: prev_state.replica_timestamp,
-        replica_status: prev_state.replica_status.clone(),
-        targets: replication_statuses_map(&repl_statuses.clone().unwrap_or_default()),
-        replication_status_internal: repl_statuses,
-        replication_timestamp: rinfos.replication_timestamp,
-        purge_targets: version_purge_statuses_map(&vpurge_statuses.clone().unwrap_or_default()),
-        version_purge_status_internal: vpurge_statuses,
-
-        ..Default::default()
-    }
-}
@@ -108,7 +108,7 @@ pub async fn list_path_raw(rx: CancellationToken, opts: ListPathRawOptions) -> d
            }

            if cancel_rx_clone.is_cancelled() {
-                // warn!("list_path_raw: cancel_rx_clone.try_recv().await.is_ok()");
+                // warn!("list_path_raw: cancel_rx_clone.is_cancelled()");
                return Ok(());
            }

@@ -30,7 +30,8 @@ use s3s::header::{
    X_AMZ_STORAGE_CLASS, X_AMZ_WEBSITE_REDIRECT_LOCATION,
 };
 //use crate::disk::{BufferReader, Reader};
-use crate::checksum::ChecksumMode;
+use crate::client::checksum::ChecksumMode;
+use crate::client::utils::base64_encode;
 use crate::client::{
    api_error_response::{err_entity_too_large, err_invalid_argument},
    api_put_object_common::optimal_part_info,
@@ -41,7 +42,6 @@ use crate::client::{
    transition_api::{ReaderImpl, TransitionClient, UploadInfo},
    utils::{is_amz_header, is_minio_header, is_rustfs_header, is_standard_header, is_storageclass_header},
 };
-use rustfs_utils::crypto::base64_encode;

 #[derive(Debug, Clone)]
 pub struct AdvancedPutOptions {
@@ -25,7 +25,8 @@ use time::OffsetDateTime;
 use tracing::warn;
 use uuid::Uuid;

-use crate::checksum::ChecksumMode;
+use crate::client::checksum::ChecksumMode;
+use crate::client::utils::base64_encode;
 use crate::client::{
    api_error_response::{
        err_entity_too_large, err_entity_too_small, err_invalid_argument, http_resp_to_error_response, to_error_response,
@@ -38,7 +39,7 @@ use crate::client::{
    constants::{ISO8601_DATEFORMAT, MAX_PART_SIZE, MAX_SINGLE_PUT_OBJECT_SIZE},
    transition_api::{ReaderImpl, RequestMetadata, TransitionClient, UploadInfo},
 };
-use rustfs_utils::{crypto::base64_encode, path::trim_etag};
+use rustfs_utils::path::trim_etag;
 use s3s::header::{X_AMZ_EXPIRATION, X_AMZ_VERSION_ID};

 impl TransitionClient {
@@ -29,7 +29,7 @@ use tokio_util::sync::CancellationToken;
 use tracing::warn;
 use uuid::Uuid;

-use crate::checksum::{ChecksumMode, add_auto_checksum_headers, apply_auto_checksum};
+use crate::client::checksum::{ChecksumMode, add_auto_checksum_headers, apply_auto_checksum};
 use crate::client::{
    api_error_response::{err_invalid_argument, err_unexpected_eof, http_resp_to_error_response},
    api_put_object::PutObjectOptions,
@@ -40,7 +40,8 @@ use crate::client::{
    transition_api::{ReaderImpl, RequestMetadata, TransitionClient, UploadInfo},
 };

-use rustfs_utils::{crypto::base64_encode, path::trim_etag};
+use crate::client::utils::base64_encode;
+use rustfs_utils::path::trim_etag;
 use s3s::header::{X_AMZ_EXPIRATION, X_AMZ_VERSION_ID};

 pub struct UploadedPartRes {
@@ -20,7 +20,7 @@

 use bytes::Bytes;
 use http::{HeaderMap, HeaderValue, Method, StatusCode};
-use rustfs_utils::{HashAlgorithm, crypto::base64_encode};
+use rustfs_utils::HashAlgorithm;
 use s3s::S3ErrorCode;
 use s3s::dto::ReplicationStatus;
 use s3s::header::X_AMZ_BYPASS_GOVERNANCE_RETENTION;
@@ -29,6 +29,7 @@ use std::{collections::HashMap, sync::Arc};
 use time::OffsetDateTime;
 use tokio::sync::mpsc::{self, Receiver, Sender};

+use crate::client::utils::base64_encode;
 use crate::client::{
    api_error_response::{ErrorResponse, http_resp_to_error_response, to_error_response},
    transition_api::{ReaderImpl, RequestMetadata, TransitionClient},
@@ -18,28 +18,23 @@
 #![allow(unused_must_use)]
 #![allow(clippy::all)]

-use bytes::Bytes;
-use http::HeaderMap;
-use std::collections::HashMap;
-use std::io::Cursor;
-use tokio::io::BufReader;
-
 use crate::client::{
    api_error_response::{err_invalid_argument, http_resp_to_error_response},
    api_get_object_acl::AccessControlList,
    api_get_options::GetObjectOptions,
    transition_api::{ObjectInfo, ReadCloser, ReaderImpl, RequestMetadata, TransitionClient, to_object_info},
 };
+use bytes::Bytes;
+use http::HeaderMap;
+use s3s::dto::RestoreRequest;
+use std::collections::HashMap;
+use std::io::Cursor;
+use tokio::io::BufReader;

 const TIER_STANDARD: &str = "Standard";
 const TIER_BULK: &str = "Bulk";
 const TIER_EXPEDITED: &str = "Expedited";

-#[derive(Debug, Default, serde::Serialize)]
-pub struct GlacierJobParameters {
-    pub tier: String,
-}
-
 #[derive(Debug, Default, serde::Serialize, serde::Deserialize)]
 pub struct Encryption {
    pub encryption_type: String,
@@ -65,58 +60,6 @@ pub struct S3 {
    pub user_metadata: MetadataEntry,
 }

-#[derive(Debug, Default, serde::Serialize)]
-pub struct SelectParameters {
-    pub expression_type: String,
-    pub expression: String,
-    //input_serialization:  SelectObjectInputSerialization,
-    //output_serialization: SelectObjectOutputSerialization,
-}
-
-#[derive(Debug, Default, serde::Serialize)]
-pub struct OutputLocation(pub S3);
-
-#[derive(Debug, Default, serde::Serialize)]
-pub struct RestoreRequest {
-    pub restore_type: String,
-    pub tier: String,
-    pub days: i64,
-    pub glacier_job_parameters: GlacierJobParameters,
-    pub description: String,
-    pub select_parameters: SelectParameters,
-    pub output_location: OutputLocation,
-}
-
-impl RestoreRequest {
-    fn set_days(&mut self, v: i64) {
-        self.days = v;
-    }
-
-    fn set_glacier_job_parameters(&mut self, v: GlacierJobParameters) {
-        self.glacier_job_parameters = v;
-    }
-
-    fn set_type(&mut self, v: &str) {
-        self.restore_type = v.to_string();
-    }
-
-    fn set_tier(&mut self, v: &str) {
-        self.tier = v.to_string();
-    }
-
-    fn set_description(&mut self, v: &str) {
-        self.description = v.to_string();
-    }
-
-    fn set_select_parameters(&mut self, v: SelectParameters) {
-        self.select_parameters = v;
-    }
-
-    fn set_output_location(&mut self, v: OutputLocation) {
-        self.output_location = v;
-    }
-}
-
 impl TransitionClient {
    pub async fn restore_object(
        &self,
@@ -125,12 +68,13 @@ impl TransitionClient {
        version_id: &str,
        restore_req: &RestoreRequest,
    ) -> Result<(), std::io::Error> {
-        let restore_request = match quick_xml::se::to_string(restore_req) {
+        /*let restore_request = match quick_xml::se::to_string(restore_req) {
            Ok(buf) => buf,
            Err(e) => {
                return Err(std::io::Error::other(e));
            }
-        };
+        };*/
+        let restore_request = "".to_string();
        let restore_request_bytes = restore_request.as_bytes().to_vec();

        let mut url_values = HashMap::new();
@@ -23,9 +23,9 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use time::OffsetDateTime;

-use crate::checksum::ChecksumMode;
+use crate::client::checksum::ChecksumMode;
 use crate::client::transition_api::ObjectMultipartInfo;
-use rustfs_utils::crypto::base64_decode;
+use crate::client::utils::base64_decode;

 use super::transition_api;

@@ -27,7 +27,7 @@ use tracing::{debug, error, info};

 use crate::client::{
    api_error_response::{http_resp_to_error_response, to_error_response},
-    transition_api::{Document, TransitionClient},
+    transition_api::{CreateBucketConfiguration, LocationConstraint, TransitionClient},
 };
 use rustfs_utils::hash::EMPTY_STRING_SHA256_HASH;
 use s3s::Body;
@@ -82,7 +82,7 @@ impl TransitionClient {
        let req = self.get_bucket_location_request(bucket_name)?;

        let mut resp = self.doit(req).await?;
-        location = process_bucket_location_response(resp, bucket_name).await?;
+        location = process_bucket_location_response(resp, bucket_name, &self.tier_type).await?;
        {
            let mut bucket_loc_cache = self.bucket_loc_cache.lock().unwrap();
            bucket_loc_cache.set(bucket_name, &location);
@@ -175,7 +175,11 @@ impl TransitionClient {
    }
 }

-async fn process_bucket_location_response(mut resp: http::Response<Body>, bucket_name: &str) -> Result<String, std::io::Error> {
+async fn process_bucket_location_response(
+    mut resp: http::Response<Body>,
+    bucket_name: &str,
+    tier_type: &str,
+) -> Result<String, std::io::Error> {
    //if resp != nil {
    if resp.status() != StatusCode::OK {
        let err_resp = http_resp_to_error_response(&resp, vec![], bucket_name, "");
@@ -209,9 +213,17 @@ async fn process_bucket_location_response(mut resp: http::Response<Body>, bucket
    //}

    let b = resp.body_mut().store_all_unlimited().await.unwrap().to_vec();
-    let Document(location_constraint) = quick_xml::de::from_str::<Document>(&String::from_utf8(b).unwrap()).unwrap();
+    let mut location = "".to_string();
+    if tier_type == "huaweicloud" {
+        let d = quick_xml::de::from_str::<CreateBucketConfiguration>(&String::from_utf8(b).unwrap()).unwrap();
+        location = d.location_constraint;
+    } else {
+        if let Ok(LocationConstraint { field }) = quick_xml::de::from_str::<LocationConstraint>(&String::from_utf8(b).unwrap()) {
+            location = field;
+        }
+    }
+    //debug!("location: {}", location);

-    let mut location = location_constraint;
    if location == "" {
        location = "us-east-1".to_string();
    }
@@ -0,0 +1,351 @@
+#![allow(clippy::map_entry)]
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use lazy_static::lazy_static;
+use rustfs_checksums::ChecksumAlgorithm;
+use std::collections::HashMap;
+
+use crate::client::utils::base64_decode;
+use crate::client::utils::base64_encode;
+use crate::client::{api_put_object::PutObjectOptions, api_s3_datatypes::ObjectPart};
+use crate::{disk::DiskAPI, store_api::GetObjectReader};
+use s3s::header::{
+    X_AMZ_CHECKSUM_ALGORITHM, X_AMZ_CHECKSUM_CRC32, X_AMZ_CHECKSUM_CRC32C, X_AMZ_CHECKSUM_SHA1, X_AMZ_CHECKSUM_SHA256,
+};
+
+use enumset::{EnumSet, EnumSetType, enum_set};
+
+#[derive(Debug, EnumSetType, Default)]
+#[enumset(repr = "u8")]
+pub enum ChecksumMode {
+    #[default]
+    ChecksumNone,
+    ChecksumSHA256,
+    ChecksumSHA1,
+    ChecksumCRC32,
+    ChecksumCRC32C,
+    ChecksumCRC64NVME,
+    ChecksumFullObject,
+}
+
+lazy_static! {
+    static ref C_ChecksumMask: EnumSet<ChecksumMode> = {
+        let mut s = EnumSet::all();
+        s.remove(ChecksumMode::ChecksumFullObject);
+        s
+    };
+    static ref C_ChecksumFullObjectCRC32: EnumSet<ChecksumMode> =
+        enum_set!(ChecksumMode::ChecksumCRC32 | ChecksumMode::ChecksumFullObject);
+    static ref C_ChecksumFullObjectCRC32C: EnumSet<ChecksumMode> =
+        enum_set!(ChecksumMode::ChecksumCRC32C | ChecksumMode::ChecksumFullObject);
+}
+const AMZ_CHECKSUM_CRC64NVME: &str = "x-amz-checksum-crc64nvme";
+
+impl ChecksumMode {
+    //pub const CRC64_NVME_POLYNOMIAL: i64 = 0xad93d23594c93659;
+
+    pub fn base(&self) -> ChecksumMode {
+        let s = EnumSet::from(*self).intersection(*C_ChecksumMask);
+        match s.as_u8() {
+            1_u8 => ChecksumMode::ChecksumNone,
+            2_u8 => ChecksumMode::ChecksumSHA256,
+            4_u8 => ChecksumMode::ChecksumSHA1,
+            8_u8 => ChecksumMode::ChecksumCRC32,
+            16_u8 => ChecksumMode::ChecksumCRC32C,
+            32_u8 => ChecksumMode::ChecksumCRC64NVME,
+            _ => panic!("enum err."),
+        }
+    }
+
+    pub fn is(&self, t: ChecksumMode) -> bool {
+        *self & t == t
+    }
+
+    pub fn key(&self) -> String {
+        //match c & checksumMask {
+        match self {
+            ChecksumMode::ChecksumCRC32 => {
+                return X_AMZ_CHECKSUM_CRC32.to_string();
+            }
+            ChecksumMode::ChecksumCRC32C => {
+                return X_AMZ_CHECKSUM_CRC32C.to_string();
+            }
+            ChecksumMode::ChecksumSHA1 => {
+                return X_AMZ_CHECKSUM_SHA1.to_string();
+            }
+            ChecksumMode::ChecksumSHA256 => {
+                return X_AMZ_CHECKSUM_SHA256.to_string();
+            }
+            ChecksumMode::ChecksumCRC64NVME => {
+                return AMZ_CHECKSUM_CRC64NVME.to_string();
+            }
+            _ => {
+                return "".to_string();
+            }
+        }
+    }
+
+    pub fn can_composite(&self) -> bool {
+        let s = EnumSet::from(*self).intersection(*C_ChecksumMask);
+        match s.as_u8() {
+            2_u8 => true,
+            4_u8 => true,
+            8_u8 => true,
+            16_u8 => true,
+            _ => false,
+        }
+    }
+
+    pub fn can_merge_crc(&self) -> bool {
+        let s = EnumSet::from(*self).intersection(*C_ChecksumMask);
+        match s.as_u8() {
+            8_u8 => true,
+            16_u8 => true,
+            32_u8 => true,
+            _ => false,
+        }
+    }
+
+    pub fn full_object_requested(&self) -> bool {
+        let s = EnumSet::from(*self).intersection(*C_ChecksumMask);
+        match s.as_u8() {
+            //C_ChecksumFullObjectCRC32 as u8 => true,
+            //C_ChecksumFullObjectCRC32C as u8 => true,
+            32_u8 => true,
+            _ => false,
+        }
+    }
+
+    pub fn key_capitalized(&self) -> String {
+        self.key()
+    }
+
+    pub fn raw_byte_len(&self) -> usize {
+        let u = EnumSet::from(*self).intersection(*C_ChecksumMask).as_u8();
+        if u == ChecksumMode::ChecksumCRC32 as u8 || u == ChecksumMode::ChecksumCRC32C as u8 {
+            4
+        } else if u == ChecksumMode::ChecksumSHA1 as u8 {
+            use sha1::Digest;
+            sha1::Sha1::output_size() as usize
+        } else if u == ChecksumMode::ChecksumSHA256 as u8 {
+            use sha2::Digest;
+            sha2::Sha256::output_size() as usize
+        } else if u == ChecksumMode::ChecksumCRC64NVME as u8 {
+            8
+        } else {
+            0
+        }
+    }
+
+    pub fn hasher(&self) -> Result<Box<dyn rustfs_checksums::http::HttpChecksum>, std::io::Error> {
+        match /*C_ChecksumMask & **/self {
+            ChecksumMode::ChecksumCRC32 => {
+                return Ok(ChecksumAlgorithm::Crc32.into_impl());
+            }
+            ChecksumMode::ChecksumCRC32C => {
+                return Ok(ChecksumAlgorithm::Crc32c.into_impl());
+            }
+            ChecksumMode::ChecksumSHA1 => {
+                return Ok(ChecksumAlgorithm::Sha1.into_impl());
+            }
+            ChecksumMode::ChecksumSHA256 => {
+                return Ok(ChecksumAlgorithm::Sha256.into_impl());
+            }
+            ChecksumMode::ChecksumCRC64NVME => {
+                return Ok(ChecksumAlgorithm::Crc64Nvme.into_impl());
+            }
+            _ => return Err(std::io::Error::other("unsupported checksum type")),
+        }
+    }
+
+    pub fn is_set(&self) -> bool {
+        let s = EnumSet::from(*self).intersection(*C_ChecksumMask);
+        s.len() == 1
+    }
+
+    pub fn set_default(&mut self, t: ChecksumMode) {
+        if !self.is_set() {
+            *self = t;
+        }
+    }
+
+    pub fn encode_to_string(&self, b: &[u8]) -> Result<String, std::io::Error> {
+        if !self.is_set() {
+            return Ok("".to_string());
+        }
+        let mut h = self.hasher()?;
+        h.update(b);
+        let hash = h.finalize();
+        Ok(base64_encode(hash.as_ref()))
+    }
+
+    pub fn to_string(&self) -> String {
+        //match c & checksumMask {
+        match self {
+            ChecksumMode::ChecksumCRC32 => {
+                return "CRC32".to_string();
+            }
+            ChecksumMode::ChecksumCRC32C => {
+                return "CRC32C".to_string();
+            }
+            ChecksumMode::ChecksumSHA1 => {
+                return "SHA1".to_string();
+            }
+            ChecksumMode::ChecksumSHA256 => {
+                return "SHA256".to_string();
+            }
+            ChecksumMode::ChecksumNone => {
+                return "".to_string();
+            }
+            ChecksumMode::ChecksumCRC64NVME => {
+                return "CRC64NVME".to_string();
+            }
+            _ => {
+                return "<invalid>".to_string();
+            }
+        }
+    }
+
+    // pub fn check_sum_reader(&self, r: GetObjectReader) -> Result<Checksum, std::io::Error> {
+    //     let mut h = self.hasher()?;
+    //     Ok(Checksum::new(self.clone(), h.sum().as_bytes()))
+    // }
+
+    // pub fn check_sum_bytes(&self, b: &[u8]) -> Result<Checksum, std::io::Error> {
+    //     let mut h = self.hasher()?;
+    //     Ok(Checksum::new(self.clone(), h.sum().as_bytes()))
+    // }
+
+    pub fn composite_checksum(&self, p: &mut [ObjectPart]) -> Result<Checksum, std::io::Error> {
+        if !self.can_composite() {
+            return Err(std::io::Error::other("cannot do composite checksum"));
+        }
+        p.sort_by(|i, j| {
+            if i.part_num < j.part_num {
+                std::cmp::Ordering::Less
+            } else if i.part_num > j.part_num {
+                std::cmp::Ordering::Greater
+            } else {
+                std::cmp::Ordering::Equal
+            }
+        });
+        let c = self.base();
+        let crc_bytes = Vec::<u8>::with_capacity(p.len() * self.raw_byte_len() as usize);
+        let mut h = self.hasher()?;
+        h.update(crc_bytes.as_ref());
+        let hash = h.finalize();
+        Ok(Checksum {
+            checksum_type: self.clone(),
+            r: hash.as_ref().to_vec(),
+            computed: false,
+        })
+    }
+
+    pub fn full_object_checksum(&self, p: &mut [ObjectPart]) -> Result<Checksum, std::io::Error> {
+        todo!();
+    }
+}
+
+#[derive(Default)]
+pub struct Checksum {
+    checksum_type: ChecksumMode,
+    r: Vec<u8>,
+    computed: bool,
+}
+
+#[allow(dead_code)]
+impl Checksum {
+    fn new(t: ChecksumMode, b: &[u8]) -> Checksum {
+        if t.is_set() && b.len() == t.raw_byte_len() {
+            return Checksum {
+                checksum_type: t,
+                r: b.to_vec(),
+                computed: false,
+            };
+        }
+        Checksum::default()
+    }
+
+    #[allow(dead_code)]
+    fn new_checksum_string(t: ChecksumMode, s: &str) -> Result<Checksum, std::io::Error> {
+        let b = match base64_decode(s.as_bytes()) {
+            Ok(b) => b,
+            Err(err) => return Err(std::io::Error::other(err.to_string())),
+        };
+        if t.is_set() && b.len() == t.raw_byte_len() {
+            return Ok(Checksum {
+                checksum_type: t,
+                r: b,
+                computed: false,
+            });
+        }
+        Ok(Checksum::default())
+    }
+
+    fn is_set(&self) -> bool {
+        self.checksum_type.is_set() && self.r.len() == self.checksum_type.raw_byte_len()
+    }
+
+    fn encoded(&self) -> String {
+        if !self.is_set() {
+            return "".to_string();
+        }
+        base64_encode(&self.r)
+    }
+
+    #[allow(dead_code)]
+    fn raw(&self) -> Option<Vec<u8>> {
+        if !self.is_set() {
+            return None;
+        }
+        Some(self.r.clone())
+    }
+}
+
+pub fn add_auto_checksum_headers(opts: &mut PutObjectOptions) {
+    opts.user_metadata
+        .insert("X-Amz-Checksum-Algorithm".to_string(), opts.auto_checksum.to_string());
+    if opts.auto_checksum.full_object_requested() {
+        opts.user_metadata
+            .insert("X-Amz-Checksum-Type".to_string(), "FULL_OBJECT".to_string());
+    }
+}
+
+pub fn apply_auto_checksum(opts: &mut PutObjectOptions, all_parts: &mut [ObjectPart]) -> Result<(), std::io::Error> {
+    if opts.auto_checksum.can_composite() && !opts.auto_checksum.is(ChecksumMode::ChecksumFullObject) {
+        let crc = opts.auto_checksum.composite_checksum(all_parts)?;
+        opts.user_metadata = {
+            let mut hm = HashMap::new();
+            hm.insert(opts.auto_checksum.key(), crc.encoded());
+            hm
+        }
+    } else if opts.auto_checksum.can_merge_crc() {
+        let crc = opts.auto_checksum.full_object_checksum(all_parts)?;
+        opts.user_metadata = {
+            let mut hm = HashMap::new();
+            hm.insert(opts.auto_checksum.key_capitalized(), crc.encoded());
+            hm.insert("X-Amz-Checksum-Type".to_string(), "FULL_OBJECT".to_string());
+            hm
+        }
+    }
+
+    Ok(())
+}
@@ -30,6 +30,7 @@ pub mod api_restore;
 pub mod api_s3_datatypes;
 pub mod api_stat;
 pub mod bucket_cache;
+pub mod checksum;
 pub mod constants;
 pub mod credentials;
 pub mod object_api_utils;
@@ -21,6 +21,7 @@

 use http::HeaderMap;
 use s3s::dto::ETag;
+use std::pin::Pin;
 use std::{collections::HashMap, io::Cursor, sync::Arc};
 use tokio::io::BufReader;

@@ -54,7 +55,7 @@ impl PutObjReader {
    }
 }

-pub type ObjReaderFn = Arc<dyn Fn(BufReader<Cursor<Vec<u8>>>, HeaderMap) -> GetObjectReader + 'static>;
+pub type ObjReaderFn<'a> = Arc<dyn Fn(BufReader<Cursor<Vec<u8>>>, HeaderMap) -> GetObjectReader + Send + Sync + 'a>;

 fn part_number_to_rangespec(oi: ObjectInfo, part_number: usize) -> Option<HTTPRangeSpec> {
    if oi.size == 0 || oi.parts.len() == 0 {
@@ -108,19 +109,24 @@ fn get_compressed_offsets(oi: ObjectInfo, offset: i64) -> (i64, i64, i64, i64, u
    (compressed_offset, part_skip, first_part_idx, decrypt_skip, seq_num)
 }

-pub fn new_getobjectreader(
-    rs: HTTPRangeSpec,
-    oi: &ObjectInfo,
+pub fn new_getobjectreader<'a>(
+    rs: &Option<HTTPRangeSpec>,
+    oi: &'a ObjectInfo,
    opts: &ObjectOptions,
-    h: &HeaderMap,
-) -> Result<(ObjReaderFn, i64, i64), ErrorResponse> {
+    _h: &HeaderMap,
+) -> Result<(ObjReaderFn<'a>, i64, i64), ErrorResponse> {
    //let (_, mut is_encrypted) = crypto.is_encrypted(oi.user_defined)?;
    let mut is_encrypted = false;
    let is_compressed = false; //oi.is_compressed_ok();

+    let mut rs_ = None;
+    if rs.is_none() && opts.part_number.is_some() && opts.part_number.unwrap() > 0 {
+        rs_ = part_number_to_rangespec(oi.clone(), opts.part_number.unwrap());
+    }
+
    let mut get_fn: ObjReaderFn;

-    let (off, length) = match rs.get_offset_length(oi.size) {
+    let (off, length) = match rs_.unwrap().get_offset_length(oi.size) {
        Ok(x) => x,
        Err(err) => {
            return Err(ErrorResponse {
@@ -136,12 +142,11 @@ pub fn new_getobjectreader(
    };
    get_fn = Arc::new(move |input_reader: BufReader<Cursor<Vec<u8>>>, _: HeaderMap| {
        //Box::pin({
-        /*let r = GetObjectReader {
+        let r = GetObjectReader {
            object_info: oi.clone(),
-            stream: StreamingBlob::new(HashReader::new(input_reader, 10, None, None, 10)),
+            stream: Box::new(input_reader),
        };
-        r*/
-        todo!();
+        r
        //})
    });

@@ -44,7 +44,7 @@ use std::{
 use time::Duration;
 use time::OffsetDateTime;
 use tokio::io::BufReader;
-use tracing::{debug, error};
+use tracing::{debug, error, warn};
 use url::{Url, form_urlencoded};
 use uuid::Uuid;

@@ -61,7 +61,7 @@ use crate::client::{
    constants::{UNSIGNED_PAYLOAD, UNSIGNED_PAYLOAD_TRAILER},
    credentials::{CredContext, Credentials, SignatureType, Static},
 };
-use crate::{checksum::ChecksumMode, store_api::GetObjectReader};
+use crate::{client::checksum::ChecksumMode, store_api::GetObjectReader};
 use rustfs_rio::HashReader;
 use rustfs_utils::{
    net::get_endpoint_url,
@@ -109,6 +109,7 @@ pub struct TransitionClient {
    pub health_status: AtomicI32,
    pub trailing_header_support: bool,
    pub max_retries: i64,
+    pub tier_type: String,
 }

 #[derive(Debug, Default)]
@@ -132,13 +133,13 @@ pub enum BucketLookupType {
 }

 impl TransitionClient {
-    pub async fn new(endpoint: &str, opts: Options) -> Result<TransitionClient, std::io::Error> {
-        let clnt = Self::private_new(endpoint, opts).await?;
+    pub async fn new(endpoint: &str, opts: Options, tier_type: &str) -> Result<TransitionClient, std::io::Error> {
+        let clnt = Self::private_new(endpoint, opts, tier_type).await?;

        Ok(clnt)
    }

-    async fn private_new(endpoint: &str, opts: Options) -> Result<TransitionClient, std::io::Error> {
+    async fn private_new(endpoint: &str, opts: Options, tier_type: &str) -> Result<TransitionClient, std::io::Error> {
        let endpoint_url = get_endpoint_url(endpoint, opts.secure)?;

        //#[cfg(feature = "ring")]
@@ -175,6 +176,7 @@ impl TransitionClient {
            health_status: AtomicI32::new(C_UNKNOWN),
            trailing_header_support: opts.trailing_headers,
            max_retries: opts.max_retries,
+            tier_type: tier_type.to_string(),
        };

        {
@@ -283,11 +285,14 @@ impl TransitionClient {
        let mut resp = resp.unwrap();
        debug!("http_resp: {:?}", resp);

+        //let b = resp.body_mut().store_all_unlimited().await.unwrap().to_vec();
+        //debug!("http_resp_body: {}", String::from_utf8(b).unwrap());
+
        //if self.is_trace_enabled && !(self.trace_errors_only && resp.status() == StatusCode::OK) {
        if resp.status() != StatusCode::OK {
            //self.dump_http(&cloned_req, &resp)?;
            let b = resp.body_mut().store_all_unlimited().await.unwrap().to_vec();
-            debug!("err_body: {}", String::from_utf8(b).unwrap());
+            warn!("err_body: {}", String::from_utf8(b).unwrap());
        }

        Ok(resp)
@@ -330,7 +335,8 @@ impl TransitionClient {
            }

            let b = resp.body_mut().store_all_unlimited().await.unwrap().to_vec();
-            let err_response = http_resp_to_error_response(&resp, b.clone(), &metadata.bucket_name, &metadata.object_name);
+            let mut err_response = http_resp_to_error_response(&resp, b.clone(), &metadata.bucket_name, &metadata.object_name);
+            err_response.message = format!("remote tier error: {}", err_response.message);

            if self.region == "" {
                match err_response.code {
@@ -380,9 +386,9 @@ impl TransitionClient {
        method: &http::Method,
        metadata: &mut RequestMetadata,
    ) -> Result<http::Request<Body>, std::io::Error> {
-        let location = metadata.bucket_location.clone();
+        let mut location = metadata.bucket_location.clone();
        if location == "" && metadata.bucket_name != "" {
-            let location = self.get_bucket_location(&metadata.bucket_name).await?;
+            location = self.get_bucket_location(&metadata.bucket_name).await?;
        }

        let is_makebucket = metadata.object_name == "" && method == http::Method::PUT && metadata.query_values.len() == 0;
@@ -624,7 +630,7 @@ pub struct TransitionCore(pub Arc<TransitionClient>);

 impl TransitionCore {
    pub async fn new(endpoint: &str, opts: Options) -> Result<Self, std::io::Error> {
-        let client = TransitionClient::new(endpoint, opts).await?;
+        let client = TransitionClient::new(endpoint, opts, "").await?;
        Ok(Self(Arc::new(client)))
    }

@@ -997,4 +1003,13 @@ impl tower::Service<Request<Body>> for SendRequest {
 }

 #[derive(Serialize, Deserialize)]
-pub struct Document(pub String);
+pub struct LocationConstraint {
+    #[serde(rename = "$value")]
+    pub field: String,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct CreateBucketConfiguration {
+    #[serde(rename = "LocationConstraint")]
+    pub location_constraint: String,
+}
@@ -90,3 +90,11 @@ pub fn is_rustfs_header(header_key: &str) -> bool {
 pub fn is_minio_header(header_key: &str) -> bool {
    header_key.to_lowercase().starts_with("x-minio-")
 }
+
+pub fn base64_encode(input: &[u8]) -> String {
+    base64_simd::URL_SAFE_NO_PAD.encode_to_string(input)
+}
+
+pub fn base64_decode(input: &[u8]) -> Result<Vec<u8>, base64_simd::Error> {
+    base64_simd::URL_SAFE_NO_PAD.decode_to_vec(input)
+}
@@ -40,7 +40,6 @@ pub const ENV_ACCESS_KEY: &str = "RUSTFS_ACCESS_KEY";
 pub const ENV_SECRET_KEY: &str = "RUSTFS_SECRET_KEY";
 pub const ENV_ROOT_USER: &str = "RUSTFS_ROOT_USER";
 pub const ENV_ROOT_PASSWORD: &str = "RUSTFS_ROOT_PASSWORD";
-
 pub static RUSTFS_CONFIG_PREFIX: &str = "config";

 pub struct ConfigSys {}
@@ -984,7 +984,8 @@ impl LocalDisk {
    #[async_recursion::async_recursion]
    async fn scan_dir<W>(
        &self,
-        current: &mut String,
+        mut current: String,
+        mut prefix: String,
        opts: &WalkDirOptions,
        out: &mut MetacacheWriter<W>,
        objs_returned: &mut i32,
@@ -1022,14 +1023,16 @@ impl LocalDisk {
            return Ok(());
        }

-        let mut entries = match self.list_dir("", &opts.bucket, current, -1).await {
+        // TODO: add lock
+
+        let mut entries = match self.list_dir("", &opts.bucket, &current, -1).await {
            Ok(res) => res,
            Err(e) => {
                if e != DiskError::VolumeNotFound && e != Error::FileNotFound {
-                    debug!("scan list_dir {}, err {:?}", &current, &e);
+                    error!("scan list_dir {}, err {:?}", &current, &e);
                }

-                if opts.report_notfound && e == Error::FileNotFound && current == &opts.base_dir {
+                if opts.report_notfound && e == Error::FileNotFound && current == opts.base_dir {
                    return Err(DiskError::FileNotFound);
                }

@@ -1041,8 +1044,7 @@ impl LocalDisk {
            return Ok(());
        }

-        let s = SLASH_SEPARATOR.chars().next().unwrap_or_default();
-        *current = current.trim_matches(s).to_owned();
+        current = current.trim_matches('/').to_owned();

        let bucket = opts.bucket.as_str();

@@ -1056,11 +1058,9 @@ impl LocalDisk {
                return Ok(());
            }
            // check prefix
-            if let Some(filter_prefix) = &opts.filter_prefix {
-                if !entry.starts_with(filter_prefix) {
-                    *item = "".to_owned();
-                    continue;
-                }
+            if !prefix.is_empty() && !entry.starts_with(prefix.as_str()) {
+                *item = "".to_owned();
+                continue;
            }

            if let Some(forward) = &forward {
@@ -1085,46 +1085,48 @@ impl LocalDisk {
            *item = "".to_owned();

            if entry.ends_with(STORAGE_FORMAT_FILE) {
-                //
                let metadata = self
                    .read_metadata(self.get_object_path(bucket, format!("{}/{}", &current, &entry).as_str())?)
                    .await?;

-                // 用 strip_suffix 只删除一次
                let entry = entry.strip_suffix(STORAGE_FORMAT_FILE).unwrap_or_default().to_owned();
                let name = entry.trim_end_matches(SLASH_SEPARATOR);
                let name = decode_dir_object(format!("{}/{}", &current, &name).as_str());

+                // if opts.limit > 0
+                //     && let Ok(meta) = FileMeta::load(&metadata)
+                //     && !meta.all_hidden(true)
+                // {
+                *objs_returned += 1;
+                // }
+
                out.write_obj(&MetaCacheEntry {
                    name: name.clone(),
                    metadata,
                    ..Default::default()
                })
                .await?;
-                *objs_returned += 1;

-                // warn!("scan list_dir {}, write_obj done, name: {:?}", &current, &name);
                return Ok(());
            }
        }

        entries.sort();

-        let mut entries = entries.as_slice();
        if let Some(forward) = &forward {
            for (i, entry) in entries.iter().enumerate() {
                if entry >= forward || forward.starts_with(entry.as_str()) {
-                    entries = &entries[i..];
+                    entries.drain(..i);
                    break;
                }
            }
        }

        let mut dir_stack: Vec<String> = Vec::with_capacity(5);
+        prefix = "".to_owned();

        for entry in entries.iter() {
            if opts.limit > 0 && *objs_returned >= opts.limit {
-                // warn!("scan list_dir {}, limit reached 2", &current);
                return Ok(());
            }

@@ -1132,7 +1134,7 @@ impl LocalDisk {
                continue;
            }

-            let name = path_join_buf(&[current, entry]);
+            let name = path_join_buf(&[current.as_str(), entry.as_str()]);

            if !dir_stack.is_empty() {
                if let Some(pop) = dir_stack.last().cloned() {
@@ -1144,9 +1146,7 @@ impl LocalDisk {
                        .await?;

                        if opts.recursive {
-                            let mut opts = opts.clone();
-                            opts.filter_prefix = None;
-                            if let Err(er) = Box::pin(self.scan_dir(&mut pop.clone(), &opts, out, objs_returned)).await {
+                            if let Err(er) = Box::pin(self.scan_dir(pop, prefix.clone(), opts, out, objs_returned)).await {
                                error!("scan_dir err {:?}", er);
                            }
                        }
@@ -1181,7 +1181,12 @@ impl LocalDisk {
                    meta.metadata = res;

                    out.write_obj(&meta).await?;
+
+                    // if let Ok(meta) = FileMeta::load(&meta.metadata)
+                    //     && !meta.all_hidden(true)
+                    // {
                    *objs_returned += 1;
+                    // }
                }
                Err(err) => {
                    if err == Error::FileNotFound || err == Error::IsNotRegular {
@@ -1200,7 +1205,6 @@ impl LocalDisk {

        while let Some(dir) = dir_stack.pop() {
            if opts.limit > 0 && *objs_returned >= opts.limit {
-                // warn!("scan list_dir {}, limit reached 3", &current);
                return Ok(());
            }

@@ -1209,19 +1213,14 @@ impl LocalDisk {
                ..Default::default()
            })
            .await?;
-            *objs_returned += 1;

            if opts.recursive {
-                let mut dir = dir;
-                let mut opts = opts.clone();
-                opts.filter_prefix = None;
-                if let Err(er) = Box::pin(self.scan_dir(&mut dir, &opts, out, objs_returned)).await {
+                if let Err(er) = Box::pin(self.scan_dir(dir, prefix.clone(), opts, out, objs_returned)).await {
                    warn!("scan_dir err {:?}", &er);
                }
            }
        }

-        // warn!("scan list_dir {}, done", &current);
        Ok(())
    }
 }
@@ -1884,8 +1883,14 @@ impl DiskAPI for LocalDisk {
            }
        }

-        let mut current = opts.base_dir.clone();
-        self.scan_dir(&mut current, &opts, &mut out, &mut objs_returned).await?;
+        self.scan_dir(
+            opts.base_dir.clone(),
+            opts.filter_prefix.clone().unwrap_or_default(),
+            &opts,
+            &mut out,
+            &mut objs_returned,
+        )
+        .await?;

        Ok(())
    }
@@ -2087,6 +2092,7 @@ impl DiskAPI for LocalDisk {
        for vol in volumes {
            if let Err(e) = self.make_volume(vol).await {
                if e != DiskError::VolumeExists {
+                    error!("local disk make volumes failed: {e}");
                    return Err(e);
                }
            }
@@ -2108,6 +2114,7 @@ impl DiskAPI for LocalDisk {
                os::make_dir_all(&volume_dir, self.root.as_path()).await?;
                return Ok(());
            }
+            error!("local disk make volume failed: {e}");
            return Err(to_volume_error(e).into());
        }

@@ -301,6 +301,10 @@ impl Erasure {
            written += n;
        }

+        if ret_err.is_some() {
+            return (written, ret_err);
+        }
+
        if written < length {
            ret_err = Some(Error::LessData.into());
        }
@@ -145,7 +145,9 @@ impl Erasure {
                            return Err(std::io::Error::other(format!("Failed to send encoded data : {err}")));
                        }
                    }
-                    Ok(_) => break,
+                    Ok(_) => {
+                        break;
+                    }
                    Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => {
                        break;
                    }
@@ -27,7 +27,7 @@
 //!
 //! ## Example
 //!
-//! ```rust
+//! ```ignore
 //! use rustfs_ecstore::erasure_coding::Erasure;
 //!
 //! let erasure = Erasure::new(4, 2, 1024); // 4 data shards, 2 parity shards, 1KB block size
@@ -83,7 +83,6 @@ impl ReedSolomonEncoder {
            return Ok(());
        }

-        // 使用 SIMD 进行编码
        let simd_result = self.encode_with_simd(&mut shards_vec);

        match simd_result {
@@ -176,7 +175,6 @@ impl ReedSolomonEncoder {
            .find_map(|s| s.as_ref().map(|v| v.len()))
            .ok_or_else(|| io::Error::other("No valid shards found for reconstruction"))?;

-        // 获取或创建decoder
        let mut decoder = {
            let mut cache_guard = self
                .decoder_cache
@@ -185,21 +183,17 @@ impl ReedSolomonEncoder {

            match cache_guard.take() {
                Some(mut cached_decoder) => {
-                    // 使用reset方法重置现有decoder
                    if let Err(e) = cached_decoder.reset(self.data_shards, self.parity_shards, shard_len) {
                        warn!("Failed to reset SIMD decoder: {:?}, creating new one", e);
-                        // 如果reset失败，创建新的decoder
+
                        reed_solomon_simd::ReedSolomonDecoder::new(self.data_shards, self.parity_shards, shard_len)
                            .map_err(|e| io::Error::other(format!("Failed to create SIMD decoder: {e:?}")))?
                    } else {
                        cached_decoder
                    }
                }
-                None => {
-                    // 第一次使用，创建新decoder
-                    reed_solomon_simd::ReedSolomonDecoder::new(self.data_shards, self.parity_shards, shard_len)
-                        .map_err(|e| io::Error::other(format!("Failed to create SIMD decoder: {e:?}")))?
-                }
+                None => reed_solomon_simd::ReedSolomonDecoder::new(self.data_shards, self.parity_shards, shard_len)
+                    .map_err(|e| io::Error::other(format!("Failed to create SIMD decoder: {e:?}")))?,
            }
        };

@@ -235,8 +229,7 @@ impl ReedSolomonEncoder {
            }
        }

-        // 将decoder放回缓存（在result被drop后decoder自动重置，可以重用）
-        drop(result); // 显式drop result，确保decoder被重置
+        drop(result);

        *self
            .decoder_cache
@@ -262,7 +255,7 @@ impl ReedSolomonEncoder {
 /// - `_buf`: Internal buffer for block operations.
 ///
 /// # Example
-/// ```
+/// ```ignore
 /// use rustfs_ecstore::erasure_coding::Erasure;
 /// let erasure = Erasure::new(4, 2, 8);
 /// let data = b"hello world";
@@ -468,15 +461,21 @@ impl Erasure {
            let mut buf = vec![0u8; block_size];
            match rustfs_utils::read_full(&mut *reader, &mut buf).await {
                Ok(n) if n > 0 => {
+                    warn!("encode_stream_callback_async read n={}", n);
                    total += n;
                    let res = self.encode_data(&buf[..n]);
                    on_block(res).await?
                }
-                Ok(_) => break,
+                Ok(_) => {
+                    warn!("encode_stream_callback_async read unexpected ok");
+                    break;
+                }
                Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof => {
+                    warn!("encode_stream_callback_async read unexpected eof");
                    break;
                }
                Err(e) => {
+                    warn!("encode_stream_callback_async read error={:?}", e);
                    on_block(Err(e)).await?;
                    break;
                }
@@ -38,7 +38,7 @@ pub const DISK_RESERVE_FRACTION: f64 = 0.15;

 lazy_static! {
    static ref GLOBAL_RUSTFS_PORT: OnceLock<u16> = OnceLock::new();
-    static ref GLOBAL_RUSTFS_EXTERNAL_PORT: OnceLock<u16> = OnceLock::new();
+    static ref globalDeploymentIDPtr: OnceLock<Uuid> = OnceLock::new();
    pub static ref GLOBAL_OBJECT_API: OnceLock<Arc<ECStore>> = OnceLock::new();
    pub static ref GLOBAL_LOCAL_DISK: Arc<RwLock<Vec<Option<DiskStore>>>> = Arc::new(RwLock::new(Vec::new()));
    pub static ref GLOBAL_IsErasure: RwLock<bool> = RwLock::new(false);
@@ -51,8 +51,6 @@ lazy_static! {
    pub static ref GLOBAL_TierConfigMgr: Arc<RwLock<TierConfigMgr>> = TierConfigMgr::new();
    pub static ref GLOBAL_LifecycleSys: Arc<LifecycleSys> = LifecycleSys::new();
    pub static ref GLOBAL_EventNotifier: Arc<RwLock<EventNotifier>> = EventNotifier::new();
-    //pub static ref GLOBAL_RemoteTargetTransport
-    static ref globalDeploymentIDPtr: OnceLock<Uuid> = OnceLock::new();
    pub static ref GLOBAL_BOOT_TIME: OnceCell<SystemTime> = OnceCell::new();
    pub static ref GLOBAL_LocalNodeName: String = "127.0.0.1:9000".to_string();
    pub static ref GLOBAL_LocalNodeNameHex: String = rustfs_utils::crypto::hex(GLOBAL_LocalNodeName.as_bytes());
@@ -60,12 +58,22 @@ lazy_static! {
    pub static ref GLOBAL_REGION: OnceLock<String> = OnceLock::new();
 }

-// Global cancellation token for background services (data scanner and auto heal)
+/// Global cancellation token for background services (data scanner and auto heal)
 static GLOBAL_BACKGROUND_SERVICES_CANCEL_TOKEN: OnceLock<CancellationToken> = OnceLock::new();

+/// Global active credentials
 static GLOBAL_ACTIVE_CRED: OnceLock<Credentials> = OnceLock::new();

-pub fn init_global_action_cred(ak: Option<String>, sk: Option<String>) {
+/// Initialize the global action credentials
+///
+/// # Arguments
+/// * `ak` - Optional access key
+/// * `sk` - Optional secret key
+///
+/// # Returns
+/// * None
+///
+pub fn init_global_action_credentials(ak: Option<String>, sk: Option<String>) {
    let ak = {
        if let Some(k) = ak {
            k
@@ -91,11 +99,16 @@ pub fn init_global_action_cred(ak: Option<String>, sk: Option<String>) {
        .unwrap();
 }

+/// Get the global action credentials
 pub fn get_global_action_cred() -> Option<Credentials> {
    GLOBAL_ACTIVE_CRED.get().cloned()
 }

 /// Get the global rustfs port
+///
+/// # Returns
+/// * `u16` - The global rustfs port
+///
 pub fn global_rustfs_port() -> u16 {
    if let Some(p) = GLOBAL_RUSTFS_PORT.get() {
        *p
@@ -105,36 +118,44 @@ pub fn global_rustfs_port() -> u16 {
 }

 /// Set the global rustfs port
+///
+/// # Arguments
+/// * `value` - The port value to set globally
+///
+/// # Returns
+/// * None
 pub fn set_global_rustfs_port(value: u16) {
    GLOBAL_RUSTFS_PORT.set(value).expect("set_global_rustfs_port fail");
 }

-/// Get the global rustfs external port
-pub fn global_rustfs_external_port() -> u16 {
-    if let Some(p) = GLOBAL_RUSTFS_EXTERNAL_PORT.get() {
-        *p
-    } else {
-        rustfs_config::DEFAULT_PORT
-    }
-}
-
-/// Set the global rustfs external port
-pub fn set_global_rustfs_external_port(value: u16) {
-    GLOBAL_RUSTFS_EXTERNAL_PORT
-        .set(value)
-        .expect("set_global_rustfs_external_port fail");
-}
-
-/// Get the global rustfs port
+/// Set the global deployment id
+///
+/// # Arguments
+/// * `id` - The Uuid to set as the global deployment id
+///
+/// # Returns
+/// * None
+///
 pub fn set_global_deployment_id(id: Uuid) {
    globalDeploymentIDPtr.set(id).unwrap();
 }

 /// Get the global deployment id
+///
+/// # Returns
+/// * `Option<String>` - The global deployment id as a string, if set
+///
 pub fn get_global_deployment_id() -> Option<String> {
    globalDeploymentIDPtr.get().map(|v| v.to_string())
 }
-/// Get the global deployment id
+/// Set the global endpoints
+///
+/// # Arguments
+/// * `eps` - A vector of PoolEndpoints to set globally
+///
+/// # Returns
+/// * None
+///
 pub fn set_global_endpoints(eps: Vec<PoolEndpoints>) {
    GLOBAL_Endpoints
        .set(EndpointServerPools::from(eps))
@@ -142,6 +163,10 @@ pub fn set_global_endpoints(eps: Vec<PoolEndpoints>) {
 }

 /// Get the global endpoints
+///
+/// # Returns
+/// * `EndpointServerPools` - The global endpoints
+///
 pub fn get_global_endpoints() -> EndpointServerPools {
    if let Some(eps) = GLOBAL_Endpoints.get() {
        eps.clone()
@@ -150,29 +175,63 @@ pub fn get_global_endpoints() -> EndpointServerPools {
    }
 }

+/// Create a new object layer instance
+///
+/// # Returns
+/// * `Option<Arc<ECStore>>` - The global object layer instance, if set
+///
 pub fn new_object_layer_fn() -> Option<Arc<ECStore>> {
    GLOBAL_OBJECT_API.get().cloned()
 }

+/// Set the global object layer
+///
+/// # Arguments
+/// * `o` - The ECStore instance to set globally
+///
+/// # Returns
+/// * None
 pub async fn set_object_layer(o: Arc<ECStore>) {
    GLOBAL_OBJECT_API.set(o).expect("set_object_layer fail ")
 }

+/// Check if the setup type is distributed erasure coding
+///
+/// # Returns
+/// * `bool` - True if the setup type is distributed erasure coding, false otherwise
+///
 pub async fn is_dist_erasure() -> bool {
    let lock = GLOBAL_IsDistErasure.read().await;
    *lock
 }

+/// Check if the setup type is erasure coding with single data center
+///
+/// # Returns
+/// * `bool` - True if the setup type is erasure coding with single data center, false otherwise
+///
 pub async fn is_erasure_sd() -> bool {
    let lock = GLOBAL_IsErasureSD.read().await;
    *lock
 }

+/// Check if the setup type is erasure coding
+///
+/// # Returns
+/// * `bool` - True if the setup type is erasure coding, false otherwise
+///
 pub async fn is_erasure() -> bool {
    let lock = GLOBAL_IsErasure.read().await;
    *lock
 }

+/// Update the global erasure type based on the setup type
+///
+/// # Arguments
+/// * `setup_type` - The SetupType to update the global erasure type
+///
+/// # Returns
+/// * None
 pub async fn update_erasure_type(setup_type: SetupType) {
    let mut is_erasure = GLOBAL_IsErasure.write().await;
    *is_erasure = setup_type == SetupType::Erasure;
@@ -198,25 +257,53 @@ pub async fn update_erasure_type(setup_type: SetupType) {

 type TypeLocalDiskSetDrives = Vec<Vec<Vec<Option<DiskStore>>>>;

+/// Set the global region
+///
+/// # Arguments
+/// * `region` - The region string to set globally
+///
+/// # Returns
+/// * None
 pub fn set_global_region(region: String) {
    GLOBAL_REGION.set(region).unwrap();
 }

+/// Get the global region
+///
+/// # Returns
+/// * `Option<String>` - The global region string, if set
+///
 pub fn get_global_region() -> Option<String> {
    GLOBAL_REGION.get().cloned()
 }

 /// Initialize the global background services cancellation token
+///
+/// # Arguments
+/// * `cancel_token` - The CancellationToken instance to set globally
+///
+/// # Returns
+/// * `Ok(())` if successful
+/// * `Err(CancellationToken)` if setting fails
+///
 pub fn init_background_services_cancel_token(cancel_token: CancellationToken) -> Result<(), CancellationToken> {
    GLOBAL_BACKGROUND_SERVICES_CANCEL_TOKEN.set(cancel_token)
 }

 /// Get the global background services cancellation token
+///
+/// # Returns
+/// * `Option<&'static CancellationToken>` - The global cancellation token, if set
+///
 pub fn get_background_services_cancel_token() -> Option<&'static CancellationToken> {
    GLOBAL_BACKGROUND_SERVICES_CANCEL_TOKEN.get()
 }

 /// Create and initialize the global background services cancellation token
+///
+/// # Returns
+/// * `CancellationToken` - The newly created global cancellation token
+///
 pub fn create_background_services_cancel_token() -> CancellationToken {
    let cancel_token = CancellationToken::new();
    init_background_services_cancel_token(cancel_token.clone()).expect("Background services cancel token already initialized");
@@ -224,6 +311,9 @@ pub fn create_background_services_cancel_token() -> CancellationToken {
 }

 /// Shutdown all background services gracefully
+///
+/// # Returns
+/// * None
 pub fn shutdown_background_services() {
    if let Some(cancel_token) = GLOBAL_BACKGROUND_SERVICES_CANCEL_TOKEN.get() {
        cancel_token.cancel();
@@ -44,7 +44,7 @@ mod store_init;
 pub mod store_list_objects;
 pub mod store_utils;

-pub mod checksum;
+// pub mod checksum;
 pub mod client;
 pub mod event;
 pub mod event_notification;
@@ -23,7 +23,7 @@ use rustfs_common::{
 use rustfs_madmin::metrics::{DiskIOStats, DiskMetric, RealtimeMetrics};
 use rustfs_utils::os::get_drive_stats;
 use serde::{Deserialize, Serialize};
-use tracing::info;
+use tracing::{debug, info};

 use crate::{
    admin_server_info::get_local_server_property,
@@ -44,7 +44,7 @@ pub struct CollectMetricsOpts {
 pub struct MetricType(u32);

 impl MetricType {
-    // 定义一些常量
+    // Define some constants
    pub const NONE: MetricType = MetricType(0);
    pub const SCANNER: MetricType = MetricType(1 << 0);
    pub const DISK: MetricType = MetricType(1 << 1);
@@ -70,8 +70,18 @@ impl MetricType {
    }
 }

+/// Collect local metrics based on the specified types and options.
+///
+/// # Arguments
+///
+/// * `types` - A `MetricType` specifying which types of metrics to collect.
+/// * `opts` - A reference to `CollectMetricsOpts` containing additional options for metric collection.
+///
+/// # Returns
+/// * A `RealtimeMetrics` struct containing the collected metrics.
+///
 pub async fn collect_local_metrics(types: MetricType, opts: &CollectMetricsOpts) -> RealtimeMetrics {
-    info!("collect_local_metrics");
+    debug!("collect_local_metrics");
    let mut real_time_metrics = RealtimeMetrics::default();
    if types.0 == MetricType::NONE.0 {
        info!("types is None, return");
@@ -93,13 +103,13 @@ pub async fn collect_local_metrics(types: MetricType, opts: &CollectMetricsOpts)
    }

    if types.contains(&MetricType::DISK) {
-        info!("start get disk metrics");
+        debug!("start get disk metrics");
        let mut aggr = DiskMetric {
            collected_at: Utc::now(),
            ..Default::default()
        };
        for (name, disk) in collect_local_disks_metrics(&opts.disks).await.into_iter() {
-            info!("got disk metric, name: {name}, metric: {disk:?}");
+            debug!("got disk metric, name: {name}, metric: {disk:?}");
            real_time_metrics.by_disk.insert(name, disk.clone());
            aggr.merge(&disk);
        }
@@ -107,7 +117,7 @@ pub async fn collect_local_metrics(types: MetricType, opts: &CollectMetricsOpts)
    }

    if types.contains(&MetricType::SCANNER) {
-        info!("start get scanner metrics");
+        debug!("start get scanner metrics");
        let metrics = globalMetrics.report().await;
        real_time_metrics.aggregated.scanner = Some(metrics);
    }
@@ -1140,6 +1140,7 @@ impl ECStore {
                .await
            {
                if !is_err_bucket_exists(&err) {
+                    error!("decommission: make bucket failed: {err}");
                    return Err(err);
                }
            }
@@ -1262,6 +1263,8 @@ impl ECStore {
                parts[i] = CompletePart {
                    part_num: pi.part_num,
                    etag: pi.etag,
+
+                    ..Default::default()
                };
            }

@@ -1289,7 +1292,7 @@ impl ECStore {
        }

        let reader = BufReader::new(rd.stream);
-        let hrd = HashReader::new(Box::new(WarpReader::new(reader)), object_info.size, object_info.size, None, false)?;
+        let hrd = HashReader::new(Box::new(WarpReader::new(reader)), object_info.size, object_info.size, None, None, false)?;
        let mut data = PutObjReader::new(hrd);

        if let Err(err) = self
@@ -979,6 +979,7 @@ impl ECStore {
                parts[i] = CompletePart {
                    part_num: pi.part_num,
                    etag: pi.etag,
+                    ..Default::default()
                };
            }

@@ -1005,7 +1006,7 @@ impl ECStore {
        }

        let reader = BufReader::new(rd.stream);
-        let hrd = HashReader::new(Box::new(WarpReader::new(reader)), object_info.size, object_info.size, None, false)?;
+        let hrd = HashReader::new(Box::new(WarpReader::new(reader)), object_info.size, object_info.size, None, None, false)?;
        let mut data = PutObjReader::new(hrd);

        if let Err(err) = self
@@ -94,11 +94,11 @@ impl S3PeerSys {

        let mut pool_errs = Vec::new();
        for pool_idx in 0..self.pools_count {
-            let mut per_pool_errs = Vec::new();
+            let mut per_pool_errs = vec![None; self.clients.len()];
            for (i, client) in self.clients.iter().enumerate() {
                if let Some(v) = client.get_pools() {
                    if v.contains(&pool_idx) {
-                        per_pool_errs.push(errs[i].clone());
+                        per_pool_errs[i] = errs[i].clone();
                    }
                }
            }
@@ -129,20 +129,28 @@ impl S3PeerSys {
        let errs = join_all(futures).await;

        for pool_idx in 0..self.pools_count {
-            let mut per_pool_errs = Vec::new();
+            let mut per_pool_errs = vec![None; self.clients.len()];
            for (i, client) in self.clients.iter().enumerate() {
                if let Some(v) = client.get_pools() {
                    if v.contains(&pool_idx) {
-                        per_pool_errs.push(errs[i].clone());
+                        per_pool_errs[i] = errs[i].clone();
                    }
                }
            }
            let qu = per_pool_errs.len() / 2;
            if let Some(pool_err) = reduce_write_quorum_errs(&per_pool_errs, BUCKET_OP_IGNORED_ERRS, qu) {
+                tracing::error!("heal_bucket per_pool_errs: {per_pool_errs:?}");
+                tracing::error!("heal_bucket reduce_write_quorum_errs: {pool_err}");
                return Err(pool_err);
            }
        }

+        if let Some(err) = reduce_write_quorum_errs(&errs, BUCKET_OP_IGNORED_ERRS, (errs.len() / 2) + 1) {
+            tracing::error!("heal_bucket errs: {errs:?}");
+            tracing::error!("heal_bucket reduce_write_quorum_errs: {err}");
+            return Err(err);
+        }
+
        for (i, err) in errs.iter().enumerate() {
            if err.is_none() {
                return Ok(heal_bucket_results.read().await[i].clone());
@@ -157,34 +165,36 @@ impl S3PeerSys {
            futures.push(cli.make_bucket(bucket, opts));
        }

-        let mut errors = Vec::with_capacity(self.clients.len());
+        let mut errors = vec![None; self.clients.len()];

        let results = join_all(futures).await;
-        for result in results {
+        for (i, result) in results.into_iter().enumerate() {
            match result {
                Ok(_) => {
-                    errors.push(None);
+                    errors[i] = None;
                }
                Err(e) => {
-                    errors.push(Some(e));
+                    errors[i] = Some(e);
                }
            }
        }

        for i in 0..self.pools_count {
-            let mut per_pool_errs = Vec::with_capacity(self.clients.len());
+            let mut per_pool_errs = vec![None; self.clients.len()];
            for (j, cli) in self.clients.iter().enumerate() {
                let pools = cli.get_pools();
                let idx = i;
                if pools.unwrap_or_default().contains(&idx) {
-                    per_pool_errs.push(errors[j].clone());
+                    per_pool_errs[j] = errors[j].clone();
                }
+            }

-                if let Some(pool_err) =
-                    reduce_write_quorum_errs(&per_pool_errs, BUCKET_OP_IGNORED_ERRS, (per_pool_errs.len() / 2) + 1)
-                {
-                    return Err(pool_err);
-                }
+            if let Some(pool_err) =
+                reduce_write_quorum_errs(&per_pool_errs, BUCKET_OP_IGNORED_ERRS, (per_pool_errs.len() / 2) + 1)
+            {
+                tracing::error!("make_bucket per_pool_errs: {per_pool_errs:?}");
+                tracing::error!("make_bucket reduce_write_quorum_errs: {pool_err}");
+                return Err(pool_err);
            }
        }

@@ -196,42 +206,74 @@ impl S3PeerSys {
            futures.push(cli.list_bucket(opts));
        }

-        let mut errors = Vec::with_capacity(self.clients.len());
-        let mut ress = Vec::with_capacity(self.clients.len());
+        let mut errors = vec![None; self.clients.len()];
+        let mut node_buckets = vec![None; self.clients.len()];

        let results = join_all(futures).await;
-        for result in results {
+        for (i, result) in results.into_iter().enumerate() {
            match result {
                Ok(res) => {
-                    ress.push(Some(res));
-                    errors.push(None);
+                    node_buckets[i] = Some(res);
+                    errors[i] = None;
                }
                Err(e) => {
-                    ress.push(None);
-                    errors.push(Some(e));
-                }
-            }
-        }
-        // TODO: reduceWriteQuorumErrs
-        // for i in 0..self.pools_count {}
-
-        let mut uniq_map: HashMap<&String, &BucketInfo> = HashMap::new();
-
-        for res in ress.iter() {
-            if res.is_none() {
-                continue;
-            }
-
-            let buckets = res.as_ref().unwrap();
-
-            for bucket in buckets.iter() {
-                if !uniq_map.contains_key(&bucket.name) {
-                    uniq_map.insert(&bucket.name, bucket);
+                    node_buckets[i] = None;
+                    errors[i] = Some(e);
                }
            }
        }

-        let buckets: Vec<BucketInfo> = uniq_map.values().map(|&v| v.clone()).collect();
+        let mut result_map: HashMap<&String, BucketInfo> = HashMap::new();
+        for i in 0..self.pools_count {
+            let mut per_pool_errs = vec![None; self.clients.len()];
+            for (j, cli) in self.clients.iter().enumerate() {
+                let pools = cli.get_pools();
+                let idx = i;
+                if pools.unwrap_or_default().contains(&idx) {
+                    per_pool_errs[j] = errors[j].clone();
+                }
+            }
+
+            let quorum = per_pool_errs.len() / 2;
+
+            if let Some(pool_err) = reduce_write_quorum_errs(&per_pool_errs, BUCKET_OP_IGNORED_ERRS, quorum) {
+                tracing::error!("list_bucket per_pool_errs: {per_pool_errs:?}");
+                tracing::error!("list_bucket reduce_write_quorum_errs: {pool_err}");
+                return Err(pool_err);
+            }
+
+            let mut bucket_map: HashMap<&String, usize> = HashMap::new();
+            for (j, node_bucket) in node_buckets.iter().enumerate() {
+                if let Some(buckets) = node_bucket.as_ref() {
+                    if buckets.is_empty() {
+                        continue;
+                    }
+
+                    if !self.clients[j].get_pools().unwrap_or_default().contains(&i) {
+                        continue;
+                    }
+
+                    for bucket in buckets.iter() {
+                        if result_map.contains_key(&bucket.name) {
+                            continue;
+                        }
+
+                        // incr bucket_map count create if not exists
+                        let count = bucket_map.entry(&bucket.name).or_insert(0usize);
+                        *count += 1;
+
+                        if *count >= quorum {
+                            result_map.insert(&bucket.name, bucket.clone());
+                        }
+                    }
+                }
+            }
+            // TODO: MRF
+        }
+
+        let mut buckets: Vec<BucketInfo> = result_map.into_values().collect();
+
+        buckets.sort_by_key(|b| b.name.clone());

        Ok(buckets)
    }
@@ -241,22 +283,27 @@ impl S3PeerSys {
            futures.push(cli.delete_bucket(bucket, opts));
        }

-        let mut errors = Vec::with_capacity(self.clients.len());
+        let mut errors = vec![None; self.clients.len()];

        let results = join_all(futures).await;

-        for result in results {
+        for (i, result) in results.into_iter().enumerate() {
            match result {
                Ok(_) => {
-                    errors.push(None);
+                    errors[i] = None;
                }
                Err(e) => {
-                    errors.push(Some(e));
+                    errors[i] = Some(e);
                }
            }
        }

-        // TODO: reduceWriteQuorumErrs
+        if let Some(err) = reduce_write_quorum_errs(&errors, BUCKET_OP_IGNORED_ERRS, (errors.len() / 2) + 1) {
+            if !Error::is_err_object_not_found(&err) && !opts.no_recreate {
+                let _ = self.make_bucket(bucket, &MakeBucketOptions::default()).await;
+            }
+            return Err(err);
+        }

        Ok(())
    }
@@ -266,37 +313,44 @@ impl S3PeerSys {
            futures.push(cli.get_bucket_info(bucket, opts));
        }

-        let mut ress = Vec::with_capacity(self.clients.len());
-        let mut errors = Vec::with_capacity(self.clients.len());
+        let mut ress = vec![None; self.clients.len()];
+        let mut errors = vec![None; self.clients.len()];

        let results = join_all(futures).await;
-        for result in results {
+        for (i, result) in results.into_iter().enumerate() {
            match result {
                Ok(res) => {
-                    ress.push(Some(res));
-                    errors.push(None);
+                    ress[i] = Some(res);
+                    errors[i] = None;
                }
                Err(e) => {
-                    ress.push(None);
-                    errors.push(Some(e));
+                    ress[i] = None;
+                    errors[i] = Some(e);
                }
            }
        }

        for i in 0..self.pools_count {
-            let mut per_pool_errs = Vec::with_capacity(self.clients.len());
+            let mut per_pool_errs = vec![None; self.clients.len()];
            for (j, cli) in self.clients.iter().enumerate() {
                let pools = cli.get_pools();
                let idx = i;
                if pools.unwrap_or_default().contains(&idx) {
-                    per_pool_errs.push(errors[j].as_ref());
+                    per_pool_errs[j] = errors[j].clone();
                }
+            }

-                // TODO: reduceWriteQuorumErrs
+            if let Some(pool_err) =
+                reduce_write_quorum_errs(&per_pool_errs, BUCKET_OP_IGNORED_ERRS, (per_pool_errs.len() / 2) + 1)
+            {
+                return Err(pool_err);
            }
        }

-        ress.iter().find_map(|op| op.clone()).ok_or(Error::VolumeNotFound)
+        ress.into_iter()
+            .filter(|op| op.is_some())
+            .find_map(|op| op.clone())
+            .ok_or(Error::VolumeNotFound)
    }

    pub fn get_pools(&self) -> Option<Vec<usize>> {
@@ -31,13 +31,15 @@ use crate::disk::{
 use crate::erasure_coding;
 use crate::erasure_coding::bitrot_verify;
 use crate::error::{Error, Result, is_err_version_not_found};
-use crate::error::{ObjectApiError, is_err_object_not_found};
+use crate::error::{GenericError, ObjectApiError, is_err_object_not_found};
 use crate::global::{GLOBAL_LocalNodeName, GLOBAL_TierConfigMgr};
 use crate::store_api::ListObjectVersionsInfo;
 use crate::store_api::{ListPartsInfo, ObjectOptions, ObjectToDelete};
 use crate::store_api::{ObjectInfoOrErr, WalkOptions};
 use crate::{
-    bucket::lifecycle::bucket_lifecycle_ops::{gen_transition_objname, get_transitioned_object_reader, put_restore_opts},
+    bucket::lifecycle::bucket_lifecycle_ops::{
+        LifecycleOps, gen_transition_objname, get_transitioned_object_reader, put_restore_opts,
+    },
    cache_value::metacache_set::{ListPathRawOptions, list_path_raw},
    config::{GLOBAL_STORAGE_CLASS, storageclass},
    disk::{
@@ -72,13 +74,13 @@ use rustfs_filemeta::{
 };
 use rustfs_lock::fast_lock::types::LockResult;
 use rustfs_madmin::heal_commands::{HealDriveInfo, HealResultItem};
-use rustfs_rio::{EtagResolvable, HashReader, TryGetIndex as _, WarpReader};
-use rustfs_utils::http::headers::AMZ_OBJECT_TAGGING;
+use rustfs_rio::{EtagResolvable, HashReader, HashReaderMut, TryGetIndex as _, WarpReader};
+use rustfs_utils::http::RUSTFS_BUCKET_REPLICATION_SSEC_CHECKSUM;
 use rustfs_utils::http::headers::AMZ_STORAGE_CLASS;
-use rustfs_utils::http::headers::RESERVED_METADATA_PREFIX_LOWER;
+use rustfs_utils::http::headers::{AMZ_OBJECT_TAGGING, RESERVED_METADATA_PREFIX, RESERVED_METADATA_PREFIX_LOWER};
 use rustfs_utils::{
    HashAlgorithm,
-    crypto::{base64_decode, base64_encode, hex},
+    crypto::hex,
    path::{SLASH_SEPARATOR, encode_dir_object, has_suffix, path_join_buf},
 };
 use rustfs_workers::workers::Workers;
@@ -96,7 +98,7 @@ use std::{
 };
 use time::OffsetDateTime;
 use tokio::{
-    io::AsyncWrite,
+    io::{AsyncReadExt, AsyncWrite, AsyncWriteExt, BufReader},
    sync::{RwLock, broadcast},
 };
 use tokio::{
@@ -158,10 +160,7 @@ impl SetDisks {
            LockResult::Conflict {
                current_owner,
                current_mode,
-            } => format!(
-                "{mode} lock conflicted on {bucket}/{object}: held by {current_owner} as {:?}",
-                current_mode
-            ),
+            } => format!("{mode} lock conflicted on {bucket}/{object}: held by {current_owner} as {current_mode:?}"),
            LockResult::Acquired => format!("unexpected lock state while acquiring {mode} lock on {bucket}/{object}"),
        }
    }
@@ -922,9 +921,8 @@ impl SetDisks {
    }

    fn get_upload_id_dir(bucket: &str, object: &str, upload_id: &str) -> String {
-        // warn!("get_upload_id_dir upload_id {:?}", upload_id);
-
-        let upload_uuid = base64_decode(upload_id.as_bytes())
+        let upload_uuid = base64_simd::URL_SAFE_NO_PAD
+            .decode_to_vec(upload_id.as_bytes())
            .and_then(|v| {
                String::from_utf8(v).map_or(Ok(upload_id.to_owned()), |v| {
                    let parts: Vec<_> = v.splitn(2, '.').collect();
@@ -2950,6 +2948,7 @@ impl SetDisks {
                                        part.mod_time,
                                        part.actual_size,
                                        part.index.clone(),
+                                        part.checksums.clone(),
                                    );
                                    if is_inline_buffer {
                                        if let Some(writer) = writers[index].take() {
@@ -3422,7 +3421,7 @@ impl SetDisks {
        oi.user_defined.remove(X_AMZ_RESTORE.as_str());

        let version_id = oi.version_id.map(|v| v.to_string());
-        let obj = self
+        let _obj = self
            .copy_object(
                bucket,
                object,
@@ -3438,8 +3437,7 @@ impl SetDisks {
                    ..Default::default()
                },
            )
-            .await;
-        obj?;
+            .await?;
        Ok(())
    }

@@ -3528,9 +3526,9 @@ impl ObjectIO for SetDisks {
        // }

        if object_info.size == 0 {
-            if let Some(rs) = range {
-                let _ = rs.get_offset_length(object_info.size)?;
-            }
+            // if let Some(rs) = range {
+            //     let _ = rs.get_offset_length(object_info.size)?;
+            // }

            let reader = GetObjectReader {
                stream: Box::new(Cursor::new(Vec::new())),
@@ -3539,7 +3537,10 @@ impl ObjectIO for SetDisks {
            return Ok(reader);
        }

-        // TODO: remote
+        if object_info.is_remote() {
+            let gr = get_transitioned_object_reader(bucket, object, &range, &h, &object_info, opts).await?;
+            return Ok(gr);
+        }

        let (rd, wd) = tokio::io::duplex(DEFAULT_READ_BUFFER_SIZE);

@@ -3712,7 +3713,7 @@ impl ObjectIO for SetDisks {

        let stream = mem::replace(
            &mut data.stream,
-            HashReader::new(Box::new(WarpReader::new(Cursor::new(Vec::new()))), 0, 0, None, false)?,
+            HashReader::new(Box::new(WarpReader::new(Cursor::new(Vec::new()))), 0, 0, None, None, false)?,
        );

        let (reader, w_size) = match Arc::new(erasure).encode(stream, &mut writers, write_quorum).await {
@@ -3729,7 +3730,12 @@ impl ObjectIO for SetDisks {
        // }

        if (w_size as i64) < data.size() {
-            return Err(Error::other("put_object write size < data.size()"));
+            warn!("put_object write size < data.size(), w_size={}, data.size={}", w_size, data.size());
+            return Err(Error::other(format!(
+                "put_object write size < data.size(), w_size={}, data.size={}",
+                w_size,
+                data.size()
+            )));
        }

        if user_defined.contains_key(&format!("{RESERVED_METADATA_PREFIX_LOWER}compression")) {
@@ -3756,31 +3762,42 @@ impl ObjectIO for SetDisks {
            }
        }

+        if fi.checksum.is_none() {
+            if let Some(content_hash) = data.as_hash_reader().content_hash() {
+                fi.checksum = Some(content_hash.to_bytes(&[]));
+            }
+        }
+
        if let Some(sc) = user_defined.get(AMZ_STORAGE_CLASS) {
            if sc == storageclass::STANDARD {
                let _ = user_defined.remove(AMZ_STORAGE_CLASS);
            }
        }

-        let now = OffsetDateTime::now_utc();
+        let mod_time = if let Some(mod_time) = opts.mod_time {
+            Some(mod_time)
+        } else {
+            Some(OffsetDateTime::now_utc())
+        };

-        for (i, fi) in parts_metadatas.iter_mut().enumerate() {
-            fi.metadata = user_defined.clone();
+        for (i, pfi) in parts_metadatas.iter_mut().enumerate() {
+            pfi.metadata = user_defined.clone();
            if is_inline_buffer {
                if let Some(writer) = writers[i].take() {
-                    fi.data = Some(writer.into_inline_data().map(bytes::Bytes::from).unwrap_or_default());
+                    pfi.data = Some(writer.into_inline_data().map(bytes::Bytes::from).unwrap_or_default());
                }

-                fi.set_inline_data();
+                pfi.set_inline_data();
            }

-            fi.mod_time = Some(now);
-            fi.size = w_size as i64;
-            fi.versioned = opts.versioned || opts.version_suspended;
-            fi.add_object_part(1, etag.clone(), w_size, fi.mod_time, actual_size, index_op.clone());
+            pfi.mod_time = mod_time;
+            pfi.size = w_size as i64;
+            pfi.versioned = opts.versioned || opts.version_suspended;
+            pfi.add_object_part(1, etag.clone(), w_size, mod_time, actual_size, index_op.clone(), None);
+            pfi.checksum = fi.checksum.clone();

            if opts.data_movement {
-                fi.set_data_moved();
+                pfi.set_data_moved();
            }
        }

@@ -3815,7 +3832,8 @@ impl ObjectIO for SetDisks {

        fi.replication_state_internal = Some(opts.put_replication_state());

-        // TODO: version support
+        fi.is_latest = true;
+
        Ok(ObjectInfo::from_file_info(&fi, bucket, object, opts.versioned || opts.version_suspended))
    }
 }
@@ -4430,8 +4448,6 @@ impl StorageAPI for SetDisks {
            .await
            .map_err(|e| to_object_err(e, vec![bucket, object]))?;

-        // warn!("get object_info fi {:?}", &fi);
-
        let oi = ObjectInfo::from_file_info(&fi, bucket, object, opts.versioned || opts.version_suspended);

        Ok(oi)
@@ -4553,7 +4569,7 @@ impl StorageAPI for SetDisks {
        let tgt_client = match tier_config_mgr.get_driver(&opts.transition.tier).await {
            Ok(client) => client,
            Err(err) => {
-                return Err(Error::other(err.to_string()));
+                return Err(Error::other(format!("remote tier error: {}", err)));
            }
        };

@@ -4582,10 +4598,10 @@ impl StorageAPI for SetDisks {
        // Normalize ETags by removing quotes before comparison (PR #592 compatibility)
        let transition_etag = rustfs_utils::path::trim_etag(&opts.transition.etag);
        let stored_etag = rustfs_utils::path::trim_etag(&get_raw_etag(&fi.metadata));
-        if !opts.mod_time.expect("err").unix_timestamp() == fi.mod_time.as_ref().expect("err").unix_timestamp()
+        if opts.mod_time.expect("err").unix_timestamp() != fi.mod_time.as_ref().expect("err").unix_timestamp()
            || transition_etag != stored_etag
        {
-            return Err(to_object_err(Error::from(DiskError::FileNotFound), vec![bucket, object]));
+            return Err(to_object_err(Error::other(DiskError::FileNotFound), vec![bucket, object]));
        }
        if fi.transition_status == TRANSITION_COMPLETE {
            return Ok(());
@@ -4687,7 +4703,7 @@ impl StorageAPI for SetDisks {
    }

    #[tracing::instrument(level = "debug", skip(self))]
-    async fn restore_transitioned_object(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
+    async fn restore_transitioned_object(self: Arc<Self>, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
        // Acquire write-lock early for the restore operation
        // if !opts.no_lock {
        //     let guard_opt = self
@@ -4699,6 +4715,7 @@ impl StorageAPI for SetDisks {
        //     }
        //     _lock_guard = guard_opt;
        // }
+        let self_ = self.clone();
        let set_restore_header_fn = async move |oi: &mut ObjectInfo, rerr: Option<Error>| -> Result<()> {
            if rerr.is_none() {
                return Ok(());
@@ -4707,66 +4724,106 @@ impl StorageAPI for SetDisks {
            Err(rerr.unwrap())
        };
        let mut oi = ObjectInfo::default();
-        let fi = self.get_object_fileinfo(bucket, object, opts, true).await;
+        let fi = self_.clone().get_object_fileinfo(bucket, object, opts, true).await;
        if let Err(err) = fi {
            return set_restore_header_fn(&mut oi, Some(to_object_err(err, vec![bucket, object]))).await;
        }
        let (actual_fi, _, _) = fi.unwrap();

        oi = ObjectInfo::from_file_info(&actual_fi, bucket, object, opts.versioned || opts.version_suspended);
-        let ropts = put_restore_opts(bucket, object, &opts.transition.restore_request, &oi);
-        /*if oi.parts.len() == 1 {
-            let mut rs: HTTPRangeSpec;
-            let gr = get_transitioned_object_reader(bucket, object, rs, HeaderMap::new(), oi, opts);
-            //if err != nil {
-            //    return set_restore_header_fn(&mut oi, Some(toObjectErr(err, bucket, object)));
-            //}
-            let hash_reader = HashReader::new(gr, gr.obj_info.size, "", "", gr.obj_info.size);
-            let p_reader = PutObjReader::new(StreamingBlob::from(Box::pin(hash_reader)), hash_reader.size());
-            if let Err(err) = self.put_object(bucket, object, &mut p_reader, &ropts).await {
-                return set_restore_header_fn(&mut oi, Some(to_object_err(err, vec![bucket, object])));
+        let ropts = put_restore_opts(bucket, object, &opts.transition.restore_request, &oi).await?;
+        if oi.parts.len() == 1 {
+            let rs: Option<HTTPRangeSpec> = None;
+            let gr = get_transitioned_object_reader(bucket, object, &rs, &HeaderMap::new(), &oi, opts).await;
+            if let Err(err) = gr {
+                return set_restore_header_fn(&mut oi, Some(to_object_err(err.into(), vec![bucket, object]))).await;
+            }
+            let gr = gr.unwrap();
+            let reader = BufReader::new(gr.stream);
+            let hash_reader = HashReader::new(
+                Box::new(WarpReader::new(reader)),
+                gr.object_info.size,
+                gr.object_info.size,
+                None,
+                None,
+                false,
+            )?;
+            let mut p_reader = PutObjReader::new(hash_reader);
+            if let Err(err) = self_.clone().put_object(bucket, object, &mut p_reader, &ropts).await {
+                return set_restore_header_fn(&mut oi, Some(to_object_err(err, vec![bucket, object]))).await;
            } else {
                return Ok(());
            }
        }

-        let res = self.new_multipart_upload(bucket, object, &ropts).await?;
+        let res = self_.clone().new_multipart_upload(bucket, object, &ropts).await?;
        //if err != nil {
-        //    return set_restore_header_fn(&mut oi, err);
+        //    return set_restore_header_fn(&mut oi, err).await;
        //}

        let mut uploaded_parts: Vec<CompletePart> = vec![];
-        let mut rs: HTTPRangeSpec;
-        let gr = get_transitioned_object_reader(bucket, object, rs, HeaderMap::new(), oi, opts).await?;
-        //if err != nil {
-        //    return set_restore_header_fn(&mut oi, err);
-        //}
+        let rs: Option<HTTPRangeSpec> = None;
+        let gr = get_transitioned_object_reader(bucket, object, &rs, &HeaderMap::new(), &oi, opts).await;
+        if let Err(err) = gr {
+            return set_restore_header_fn(&mut oi, Some(StorageError::Io(err))).await;
+        }
+        let gr = gr.unwrap();

-        for part_info in oi.parts {
-            //let hr = HashReader::new(LimitReader(gr, part_info.size), part_info.size, "", "", part_info.size);
-            let hr = HashReader::new(gr, part_info.size as i64, part_info.size as i64, None, false);
-            //if err != nil {
-            //    return set_restore_header_fn(&mut oi, err);
-            //}
-            let mut p_reader = PutObjReader::new(hr, hr.size());
-            let p_info = self.put_object_part(bucket, object, &res.upload_id, part_info.number, &mut p_reader, &ObjectOptions::default()).await?;
+        for part_info in &oi.parts {
+            let reader = BufReader::new(Cursor::new(vec![] /*gr.stream*/));
+            let hash_reader = HashReader::new(
+                Box::new(WarpReader::new(reader)),
+                part_info.size as i64,
+                part_info.size as i64,
+                None,
+                None,
+                false,
+            )?;
+            let mut p_reader = PutObjReader::new(hash_reader);
+            let p_info = self_
+                .clone()
+                .put_object_part(bucket, object, &res.upload_id, part_info.number, &mut p_reader, &ObjectOptions::default())
+                .await?;
            //if let Err(err) = p_info {
-            //    return set_restore_header_fn(&mut oi, err);
+            //    return set_restore_header_fn(&mut oi, err).await;
            //}
            if p_info.size != part_info.size {
-                return set_restore_header_fn(&mut oi, Some(Error::from(ObjectApiError::InvalidObjectState(GenericError{bucket: bucket.to_string(), object: object.to_string(), ..Default::default()}))));
+                return set_restore_header_fn(
+                    &mut oi,
+                    Some(Error::other(ObjectApiError::InvalidObjectState(GenericError {
+                        bucket: bucket.to_string(),
+                        object: object.to_string(),
+                        ..Default::default()
+                    }))),
+                )
+                .await;
            }
            uploaded_parts.push(CompletePart {
                part_num: p_info.part_num,
                etag: p_info.etag,
+                checksum_crc32: None,
+                checksum_crc32c: None,
+                checksum_sha1: None,
+                checksum_sha256: None,
+                checksum_crc64nvme: None,
            });
        }
-        if let Err(err) = self.complete_multipart_upload(bucket, object, &res.upload_id, uploaded_parts, &ObjectOptions {
-            mod_time: oi.mod_time,
-            ..Default::default()
-        }).await {
-            set_restore_header_fn(&mut oi, Some(err));
-        }*/
+        if let Err(err) = self_
+            .clone()
+            .complete_multipart_upload(
+                bucket,
+                object,
+                &res.upload_id,
+                uploaded_parts,
+                &ObjectOptions {
+                    mod_time: oi.mod_time,
+                    ..Default::default()
+                },
+            )
+            .await
+        {
+            return set_restore_header_fn(&mut oi, Some(err)).await;
+        }
        Ok(())
    }

@@ -4834,64 +4891,24 @@ impl StorageAPI for SetDisks {

        let write_quorum = fi.write_quorum(self.default_write_quorum());

-        let disks = self.disks.read().await;
+        if let Some(checksum) = fi.metadata.get(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM)
+            && !checksum.is_empty()
+            && data
+                .as_hash_reader()
+                .content_crc_type()
+                .is_none_or(|v| v.to_string() != *checksum)
+        {
+            return Err(Error::other(format!("checksum mismatch: {checksum}")));
+        }
+
+        let disks = self.disks.read().await.clone();

-        let disks = disks.clone();
        let shuffle_disks = Self::shuffle_disks(&disks, &fi.erasure.distribution);

        let part_suffix = format!("part.{part_id}");
        let tmp_part = format!("{}x{}", Uuid::new_v4(), OffsetDateTime::now_utc().unix_timestamp());
        let tmp_part_path = Arc::new(format!("{tmp_part}/{part_suffix}"));

-        // let mut writers = Vec::with_capacity(disks.len());
-        // let erasure = Erasure::new(fi.erasure.data_blocks, fi.erasure.parity_blocks, fi.erasure.block_size);
-        // let shared_size = erasure.shard_size(erasure.block_size);
-
-        // let futures = disks.iter().map(|disk| {
-        //     let disk = disk.clone();
-        //     let tmp_part_path = tmp_part_path.clone();
-        //     tokio::spawn(async move {
-        //         if let Some(disk) = disk {
-        //             // let writer = disk.append_file(RUSTFS_META_TMP_BUCKET, &tmp_part_path).await?;
-        //             // let filewriter = disk
-        //             //     .create_file("", RUSTFS_META_TMP_BUCKET, &tmp_part_path, data.content_length)
-        //             //     .await?;
-        //             match new_bitrot_filewriter(
-        //                 disk.clone(),
-        //                 RUSTFS_META_TMP_BUCKET,
-        //                 &tmp_part_path,
-        //                 false,
-        //                 DEFAULT_BITROT_ALGO,
-        //                 shared_size,
-        //             )
-        //             .await
-        //             {
-        //                 Ok(writer) => Ok(Some(writer)),
-        //                 Err(e) => Err(e),
-        //             }
-        //         } else {
-        //             Ok(None)
-        //         }
-        //     })
-        // });
-        // for x in join_all(futures).await {
-        //     let x = x??;
-        //     writers.push(x);
-        // }
-
-        // let erasure = Erasure::new(fi.erasure.data_blocks, fi.erasure.parity_blocks, fi.erasure.block_size);
-
-        // let stream = replace(&mut data.stream, Box::new(empty()));
-        // let etag_stream = EtagReader::new(stream);
-
-        // let (w_size, mut etag) = Arc::new(erasure)
-        //     .encode(etag_stream, &mut writers, data.content_length, write_quorum)
-        //     .await?;
-
-        // if let Err(err) = close_bitrot_writers(&mut writers).await {
-        //     error!("close_bitrot_writers err {:?}", err);
-        // }
-
        let erasure = erasure_coding::Erasure::new(fi.erasure.data_blocks, fi.erasure.parity_blocks, fi.erasure.block_size);

        let mut writers = Vec::with_capacity(shuffle_disks.len());
@@ -4944,7 +4961,7 @@ impl StorageAPI for SetDisks {

        let stream = mem::replace(
            &mut data.stream,
-            HashReader::new(Box::new(WarpReader::new(Cursor::new(Vec::new()))), 0, 0, None, false)?,
+            HashReader::new(Box::new(WarpReader::new(Cursor::new(Vec::new()))), 0, 0, None, None, false)?,
        );

        let (reader, w_size) = Arc::new(erasure).encode(stream, &mut writers, write_quorum).await?; // TODO: 出错，删除临时目录
@@ -4952,7 +4969,12 @@ impl StorageAPI for SetDisks {
        let _ = mem::replace(&mut data.stream, reader);

        if (w_size as i64) < data.size() {
-            return Err(Error::other("put_object_part write size < data.size()"));
+            warn!("put_object_part write size < data.size(), w_size={}, data.size={}", w_size, data.size());
+            return Err(Error::other(format!(
+                "put_object_part write size < data.size(), w_size={}, data.size={}",
+                w_size,
+                data.size()
+            )));
        }

        let index_op = data.stream.try_get_index().map(|v| v.clone().into_vec());
@@ -4971,6 +4993,8 @@ impl StorageAPI for SetDisks {
            }
        }

+        let checksums = data.as_hash_reader().content_crc();
+
        let part_info = ObjectPartInfo {
            etag: etag.clone(),
            number: part_id,
@@ -4978,13 +5002,10 @@ impl StorageAPI for SetDisks {
            mod_time: Some(OffsetDateTime::now_utc()),
            actual_size,
            index: index_op,
+            checksums: if checksums.is_empty() { None } else { Some(checksums) },
            ..Default::default()
        };

-        // debug!("put_object_part part_info {:?}", part_info);
-
-        // fi.parts = vec![part_info.clone()];
-
        let part_info_buff = part_info.marshal_msg()?;

        drop(writers); // drop writers to close all files
@@ -5227,7 +5248,8 @@ impl StorageAPI for SetDisks {
            uploads.push(MultipartInfo {
                bucket: bucket.to_owned(),
                object: object.to_owned(),
-                upload_id: base64_encode(format!("{}.{}", get_global_deployment_id().unwrap_or_default(), upload_id).as_bytes()),
+                upload_id: base64_simd::URL_SAFE_NO_PAD
+                    .encode_to_string(format!("{}.{}", get_global_deployment_id().unwrap_or_default(), upload_id).as_bytes()),
                initiated: Some(start_time),
                ..Default::default()
            });
@@ -5334,7 +5356,13 @@ impl StorageAPI for SetDisks {
        }

        fi.data_dir = Some(Uuid::new_v4());
-        fi.fresh = true;
+
+        if let Some(cssum) = user_defined.get(RUSTFS_BUCKET_REPLICATION_SSEC_CHECKSUM)
+            && !cssum.is_empty()
+        {
+            fi.checksum = base64_simd::STANDARD.decode_to_vec(cssum).ok().map(Bytes::from);
+            user_defined.remove(RUSTFS_BUCKET_REPLICATION_SSEC_CHECKSUM);
+        }

        let parts_metadata = vec![fi.clone(); disks.len()];

@@ -5348,21 +5376,30 @@ impl StorageAPI for SetDisks {
            }
        }

+        if let Some(checksum) = &opts.want_checksum {
+            user_defined.insert(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM.to_string(), checksum.checksum_type.to_string());
+            user_defined.insert(
+                rustfs_rio::RUSTFS_MULTIPART_CHECKSUM_TYPE.to_string(),
+                checksum.checksum_type.obj_type().to_string(),
+            );
+        }
+
        let (shuffle_disks, mut parts_metadatas) = Self::shuffle_disks_and_parts_metadata(&disks, &parts_metadata, &fi);

        let mod_time = opts.mod_time.unwrap_or(OffsetDateTime::now_utc());

-        for fi in parts_metadatas.iter_mut() {
-            fi.metadata = user_defined.clone();
-            fi.mod_time = Some(mod_time);
-            fi.fresh = true;
+        for f in parts_metadatas.iter_mut() {
+            f.metadata = user_defined.clone();
+            f.mod_time = Some(mod_time);
+            f.fresh = true;
        }

        // fi.mod_time = Some(now);

        let upload_uuid = format!("{}x{}", Uuid::new_v4(), mod_time.unix_timestamp_nanos());

-        let upload_id = base64_encode(format!("{}.{}", get_global_deployment_id().unwrap_or_default(), upload_uuid).as_bytes());
+        let upload_id = base64_simd::URL_SAFE_NO_PAD
+            .encode_to_string(format!("{}.{}", get_global_deployment_id().unwrap_or_default(), upload_uuid).as_bytes());

        let upload_path = Self::get_upload_id_dir(bucket, object, upload_uuid.as_str());

@@ -5379,7 +5416,11 @@ impl StorageAPI for SetDisks {

        // evalDisks

-        Ok(MultipartUploadResult { upload_id })
+        Ok(MultipartUploadResult {
+            upload_id,
+            checksum_algo: user_defined.get(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM).cloned(),
+            checksum_type: user_defined.get(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM_TYPE).cloned(),
+        })
    }

    #[tracing::instrument(skip(self))]
@@ -5467,6 +5508,29 @@ impl StorageAPI for SetDisks {
            return Err(Error::other("part result number err"));
        }

+        let mut checksum_type = rustfs_rio::ChecksumType::NONE;
+
+        if let Some(cs) = fi.metadata.get(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM) {
+            let Some(ct) = fi.metadata.get(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM_TYPE) else {
+                return Err(Error::other("checksum type not found"));
+            };
+
+            if opts.want_checksum.is_some()
+                && !opts.want_checksum.as_ref().is_some_and(|v| {
+                    v.checksum_type
+                        .is(rustfs_rio::ChecksumType::from_string_with_obj_type(cs, ct))
+                })
+            {
+                return Err(Error::other(format!(
+                    "checksum type mismatch, got {:?}, want {:?}",
+                    opts.want_checksum.as_ref().unwrap(),
+                    rustfs_rio::ChecksumType::from_string_with_obj_type(cs, ct)
+                )));
+            }
+
+            checksum_type = rustfs_rio::ChecksumType::from_string_with_obj_type(cs, ct);
+        }
+
        for (i, part) in object_parts.iter().enumerate() {
            if let Some(err) = &part.error {
                error!("complete_multipart_upload part error: {:?}", &err);
@@ -5487,6 +5551,7 @@ impl StorageAPI for SetDisks {
                part.mod_time,
                part.actual_size,
                part.index.clone(),
+                part.checksums.clone(),
            );
        }

@@ -5499,6 +5564,12 @@ impl StorageAPI for SetDisks {
        let mut object_size: usize = 0;
        let mut object_actual_size: i64 = 0;

+        let mut checksum_combined = bytes::BytesMut::new();
+        let mut checksum = rustfs_rio::Checksum {
+            checksum_type,
+            ..Default::default()
+        };
+
        for (i, p) in uploaded_parts.iter().enumerate() {
            let has_part = curr_fi.parts.iter().find(|v| v.number == p.part_num);
            if has_part.is_none() {
@@ -5539,6 +5610,75 @@ impl StorageAPI for SetDisks {
                ));
            }

+            if checksum_type.is_set() {
+                let Some(crc) = ext_part
+                    .checksums
+                    .as_ref()
+                    .and_then(|f| f.get(checksum_type.to_string().as_str()))
+                    .cloned()
+                else {
+                    error!(
+                        "complete_multipart_upload fi.checksum not found type={checksum_type}, part_id={}, bucket={}, object={}",
+                        p.part_num, bucket, object
+                    );
+                    return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                };
+
+                let part_crc = match checksum_type {
+                    rustfs_rio::ChecksumType::SHA256 => p.checksum_sha256.clone(),
+                    rustfs_rio::ChecksumType::SHA1 => p.checksum_sha1.clone(),
+                    rustfs_rio::ChecksumType::CRC32 => p.checksum_crc32.clone(),
+                    rustfs_rio::ChecksumType::CRC32C => p.checksum_crc32c.clone(),
+                    rustfs_rio::ChecksumType::CRC64_NVME => p.checksum_crc64nvme.clone(),
+                    _ => {
+                        error!(
+                            "complete_multipart_upload checksum type={checksum_type}, part_id={}, bucket={}, object={}",
+                            p.part_num, bucket, object
+                        );
+                        return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                    }
+                };
+
+                if part_crc.clone().unwrap_or_default() != crc {
+                    error!("complete_multipart_upload checksum_type={checksum_type:?}, part_crc={part_crc:?}, crc={crc:?}");
+                    error!(
+                        "complete_multipart_upload checksum mismatch part_id={}, bucket={}, object={}",
+                        p.part_num, bucket, object
+                    );
+                    return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                }
+
+                let Some(cs) = rustfs_rio::Checksum::new_with_type(checksum_type, &crc) else {
+                    error!(
+                        "complete_multipart_upload checksum new_with_type failed part_id={}, bucket={}, object={}",
+                        p.part_num, bucket, object
+                    );
+                    return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                };
+
+                if !cs.valid() {
+                    error!(
+                        "complete_multipart_upload checksum valid failed part_id={}, bucket={}, object={}",
+                        p.part_num, bucket, object
+                    );
+                    return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                }
+
+                if checksum_type.full_object_requested() {
+                    if let Err(err) = checksum.add_part(&cs, ext_part.actual_size) {
+                        error!(
+                            "complete_multipart_upload checksum add_part failed part_id={}, bucket={}, object={}",
+                            p.part_num, bucket, object
+                        );
+                        return Err(Error::InvalidPart(p.part_num, ext_part.etag.clone(), p.etag.clone().unwrap_or_default()));
+                    }
+                }
+
+                checksum_combined.extend_from_slice(cs.raw.as_slice());
+            }
+
+            // TODO: check min part size
+
            object_size += ext_part.size;
            object_actual_size += ext_part.actual_size;

@@ -5553,6 +5693,52 @@ impl StorageAPI for SetDisks {
            });
        }

+        if let Some(wtcs) = opts.want_checksum.as_ref() {
+            if checksum_type.full_object_requested() {
+                if wtcs.encoded != checksum.encoded {
+                    error!(
+                        "complete_multipart_upload checksum mismatch want={}, got={}",
+                        wtcs.encoded, checksum.encoded
+                    );
+                    return Err(Error::other(format!(
+                        "complete_multipart_upload checksum mismatch want={}, got={}",
+                        wtcs.encoded, checksum.encoded
+                    )));
+                }
+            } else if let Err(err) = wtcs.matches(&checksum_combined, uploaded_parts.len() as i32) {
+                error!(
+                    "complete_multipart_upload checksum matches failed want={}, got={}",
+                    wtcs.encoded, checksum.encoded
+                );
+                return Err(Error::other(format!(
+                    "complete_multipart_upload checksum matches failed want={}, got={}",
+                    wtcs.encoded, checksum.encoded
+                )));
+            }
+        }
+
+        if let Some(rc_crc) = opts.user_defined.get(RUSTFS_BUCKET_REPLICATION_SSEC_CHECKSUM) {
+            if let Ok(rc_crc_bytes) = base64_simd::STANDARD.decode_to_vec(rc_crc) {
+                fi.checksum = Some(Bytes::from(rc_crc_bytes));
+            } else {
+                error!("complete_multipart_upload decode rc_crc failed rc_crc={}", rc_crc);
+            }
+        }
+
+        if checksum_type.is_set() {
+            checksum_type
+                .merge(rustfs_rio::ChecksumType::MULTIPART)
+                .merge(rustfs_rio::ChecksumType::INCLUDES_MULTIPART);
+            if !checksum_type.full_object_requested() {
+                checksum = rustfs_rio::Checksum::new_from_data(checksum_type, &checksum_combined)
+                    .ok_or_else(|| Error::other("checksum new_from_data failed"))?;
+            }
+            fi.checksum = Some(checksum.to_bytes(&checksum_combined));
+        }
+
+        fi.metadata.remove(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM);
+        fi.metadata.remove(rustfs_rio::RUSTFS_MULTIPART_CHECKSUM_TYPE);
+
        fi.size = object_size as i64;
        fi.mod_time = opts.mod_time;
        if fi.mod_time.is_none() {
@@ -5570,11 +5756,22 @@ impl StorageAPI for SetDisks {

        fi.metadata.insert("etag".to_owned(), etag);

-        fi.metadata
-            .insert(format!("{RESERVED_METADATA_PREFIX_LOWER}actual-size"), object_actual_size.to_string());
-
-        fi.metadata
-            .insert("x-rustfs-encryption-original-size".to_string(), object_actual_size.to_string());
+        if opts.replication_request {
+            if let Some(actual_size) = opts
+                .user_defined
+                .get(format!("{RESERVED_METADATA_PREFIX_LOWER}Actual-Object-Size").as_str())
+            {
+                fi.metadata
+                    .insert(format!("{RESERVED_METADATA_PREFIX}actual-size"), actual_size.clone());
+                fi.metadata
+                    .insert("x-rustfs-encryption-original-size".to_string(), actual_size.to_string());
+            }
+        } else {
+            fi.metadata
+                .insert(format!("{RESERVED_METADATA_PREFIX}actual-size"), object_actual_size.to_string());
+            fi.metadata
+                .insert("x-rustfs-encryption-original-size".to_string(), object_actual_size.to_string());
+        }

        if fi.is_compressed() {
            fi.metadata
@@ -5585,9 +5782,6 @@ impl StorageAPI for SetDisks {
            fi.set_data_moved();
        }

-        // TODO: object_actual_size
-        let _ = object_actual_size;
-
        for meta in parts_metadatas.iter_mut() {
            if meta.is_valid() {
                meta.size = fi.size;
@@ -5595,13 +5789,12 @@ impl StorageAPI for SetDisks {
                meta.parts.clone_from(&fi.parts);
                meta.metadata = fi.metadata.clone();
                meta.versioned = opts.versioned || opts.version_suspended;
-
-                // TODO: Checksum
+                meta.checksum = fi.checksum.clone();
            }
        }

        let mut parts = Vec::with_capacity(curr_fi.parts.len());
-        // TODO: 优化 cleanupMultipartPath
+
        for p in curr_fi.parts.iter() {
            parts.push(path_join_buf(&[
                &upload_id_path,
@@ -5616,28 +5809,6 @@ impl StorageAPI for SetDisks {
                    format!("part.{}", p.number).as_str(),
                ]));
            }
-
-            // let _ = self
-            //     .remove_part_meta(
-            //         bucket,
-            //         object,
-            //         upload_id,
-            //         curr_fi.data_dir.unwrap_or(Uuid::nil()).to_string().as_str(),
-            //         p.number,
-            //     )
-            //     .await;
-
-            // if !fi.parts.iter().any(|v| v.number == p.number) {
-            //     let _ = self
-            //         .remove_object_part(
-            //             bucket,
-            //             object,
-            //             upload_id,
-            //             curr_fi.data_dir.unwrap_or(Uuid::nil()).to_string().as_str(),
-            //             p.number,
-            //         )
-            //         .await;
-            // }
        }

        {
@@ -5656,9 +5827,6 @@ impl StorageAPI for SetDisks {
        )
        .await?;

-        // debug!("complete fileinfo {:?}", &fi);
-
-        // TODO: reduce_common_data_dir
        if let Some(old_dir) = op_old_dir {
            self.commit_rename_data_dir(&shuffle_disks, bucket, object, &old_dir.to_string(), write_quorum)
                .await?;
@@ -6422,10 +6590,20 @@ mod tests {
            CompletePart {
                part_num: 1,
                etag: Some("d41d8cd98f00b204e9800998ecf8427e".to_string()),
+                checksum_crc32: None,
+                checksum_crc32c: None,
+                checksum_sha1: None,
+                checksum_sha256: None,
+                checksum_crc64nvme: None,
            },
            CompletePart {
                part_num: 2,
                etag: Some("098f6bcd4621d373cade4e832627b4f6".to_string()),
+                checksum_crc32: None,
+                checksum_crc32c: None,
+                checksum_sha1: None,
+                checksum_sha256: None,
+                checksum_crc64nvme: None,
            },
        ];

@@ -6442,6 +6620,11 @@ mod tests {
        let single_part = vec![CompletePart {
            part_num: 1,
            etag: Some("d41d8cd98f00b204e9800998ecf8427e".to_string()),
+            checksum_crc32: None,
+            checksum_crc32c: None,
+            checksum_sha1: None,
+            checksum_sha256: None,
+            checksum_crc64nvme: None,
        }];
        let single_result = get_complete_multipart_md5(&single_part);
        assert!(single_result.ends_with("-1"));
@@ -646,7 +646,7 @@ impl StorageAPI for Sets {
    }

    #[tracing::instrument(skip(self))]
-    async fn restore_transitioned_object(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
+    async fn restore_transitioned_object(self: Arc<Self>, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
        self.get_disks_by_key(object)
            .restore_transitioned_object(bucket, object, opts)
            .await
@@ -59,7 +59,6 @@ use rustfs_common::globals::{GLOBAL_Local_Node_Name, GLOBAL_Rustfs_Host, GLOBAL_
 use rustfs_common::heal_channel::{HealItemType, HealOpts};
 use rustfs_filemeta::FileInfo;
 use rustfs_madmin::heal_commands::HealResultItem;
-use rustfs_utils::crypto::base64_decode;
 use rustfs_utils::path::{SLASH_SEPARATOR, decode_dir_object, encode_dir_object, path_join_buf};
 use s3s::dto::{BucketVersioningStatus, ObjectLockConfiguration, ObjectLockEnabled, VersioningConfiguration};
 use std::cmp::Ordering;
@@ -1231,6 +1230,7 @@ impl StorageAPI for ECStore {
        if let Err(err) = self.peer_sys.make_bucket(bucket, opts).await {
            let err = to_object_err(err.into(), vec![bucket]);
            if !is_err_bucket_exists(&err) {
+                error!("make bucket failed: {err}");
                let _ = self
                    .delete_bucket(
                        bucket,
@@ -1864,17 +1864,20 @@ impl StorageAPI for ECStore {
    }

    #[tracing::instrument(skip(self))]
-    async fn restore_transitioned_object(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
+    async fn restore_transitioned_object(self: Arc<Self>, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()> {
        let object = encode_dir_object(object);
        if self.single_pool() {
-            return self.pools[0].restore_transitioned_object(bucket, &object, opts).await;
+            return self.pools[0].clone().restore_transitioned_object(bucket, &object, opts).await;
        }

        //opts.skip_decommissioned = true;
        //opts.nolock = true;
        let idx = self.get_pool_idx_existing_with_opts(bucket, object.as_str(), opts).await?;

-        self.pools[idx].restore_transitioned_object(bucket, &object, opts).await
+        self.pools[idx]
+            .clone()
+            .restore_transitioned_object(bucket, &object, opts)
+            .await
    }

    #[tracing::instrument(skip(self))]
@@ -2421,7 +2424,7 @@ fn check_list_multipart_args(
            }
        }

-        if let Err(_e) = base64_decode(upload_id_marker.as_bytes()) {
+        if let Err(_e) = base64_simd::URL_SAFE_NO_PAD.decode_to_vec(upload_id_marker.as_bytes()) {
            return Err(StorageError::MalformedUploadID(upload_id_marker.to_owned()));
        }
    }
@@ -2448,7 +2451,7 @@ fn check_new_multipart_args(bucket: &str, object: &str) -> Result<()> {
 }

 fn check_multipart_object_args(bucket: &str, object: &str, upload_id: &str) -> Result<()> {
-    if let Err(e) = base64_decode(upload_id.as_bytes()) {
+    if let Err(e) = base64_simd::URL_SAFE_NO_PAD.decode_to_vec(upload_id.as_bytes()) {
        return Err(StorageError::MalformedUploadID(format!("{bucket}/{object}-{upload_id},err:{e}")));
    };
    check_object_args(bucket, object)
@@ -13,9 +13,6 @@
 // limitations under the License.

 use crate::bucket::metadata_sys::get_versioning_config;
-use crate::bucket::replication::REPLICATION_RESET;
-use crate::bucket::replication::REPLICATION_STATUS;
-use crate::bucket::replication::{ReplicateDecision, replication_statuses_map, version_purge_statuses_map};
 use crate::bucket::versioning::VersioningApi as _;
 use crate::disk::DiskStore;
 use crate::error::{Error, Result};
@@ -25,12 +22,15 @@ use crate::{
    bucket::lifecycle::lifecycle::ExpirationOptions,
    bucket::lifecycle::{bucket_lifecycle_ops::TransitionedObject, lifecycle::TransitionOptions},
 };
+use bytes::Bytes;
 use http::{HeaderMap, HeaderValue};
 use rustfs_common::heal_channel::HealOpts;
 use rustfs_filemeta::{
-    FileInfo, MetaCacheEntriesSorted, ObjectPartInfo, ReplicationState, ReplicationStatusType, VersionPurgeStatusType,
+    FileInfo, MetaCacheEntriesSorted, ObjectPartInfo, REPLICATION_RESET, REPLICATION_STATUS, ReplicateDecision, ReplicationState,
+    ReplicationStatusType, VersionPurgeStatusType, replication_statuses_map, version_purge_statuses_map,
 };
 use rustfs_madmin::heal_commands::HealResultItem;
+use rustfs_rio::Checksum;
 use rustfs_rio::{DecompressReader, HashReader, LimitReader, WarpReader};
 use rustfs_utils::CompressionAlgorithm;
 use rustfs_utils::http::headers::{AMZ_OBJECT_TAGGING, RESERVED_METADATA_PREFIX_LOWER};
@@ -92,11 +92,28 @@ impl PutObjReader {
        PutObjReader { stream }
    }

+    pub fn as_hash_reader(&self) -> &HashReader {
+        &self.stream
+    }
+
    pub fn from_vec(data: Vec<u8>) -> Self {
+        use sha2::{Digest, Sha256};
        let content_length = data.len() as i64;
+        let sha256hex = if content_length > 0 {
+            Some(hex_simd::encode_to_string(Sha256::digest(&data), hex_simd::AsciiCase::Lower))
+        } else {
+            None
+        };
        PutObjReader {
-            stream: HashReader::new(Box::new(WarpReader::new(Cursor::new(data))), content_length, content_length, None, false)
-                .unwrap(),
+            stream: HashReader::new(
+                Box::new(WarpReader::new(Cursor::new(data))),
+                content_length,
+                content_length,
+                None,
+                sha256hex,
+                false,
+            )
+            .unwrap(),
        }
    }

@@ -374,6 +391,8 @@ pub struct ObjectOptions {
    pub lifecycle_audit_event: LcAuditEvent,

    pub eval_metadata: Option<HashMap<String, String>>,
+
+    pub want_checksum: Option<Checksum>,
 }

 impl ObjectOptions {
@@ -456,6 +475,8 @@ pub struct BucketInfo {
 #[derive(Debug, Default, Clone)]
 pub struct MultipartUploadResult {
    pub upload_id: String,
+    pub checksum_algo: Option<String>,
+    pub checksum_type: Option<String>,
 }

 #[derive(Debug, Default, Clone)]
@@ -471,13 +492,24 @@ pub struct PartInfo {
 pub struct CompletePart {
    pub part_num: usize,
    pub etag: Option<String>,
+    // pub size: Option<usize>,
+    pub checksum_crc32: Option<String>,
+    pub checksum_crc32c: Option<String>,
+    pub checksum_sha1: Option<String>,
+    pub checksum_sha256: Option<String>,
+    pub checksum_crc64nvme: Option<String>,
 }

 impl From<s3s::dto::CompletedPart> for CompletePart {
    fn from(value: s3s::dto::CompletedPart) -> Self {
        Self {
            part_num: value.part_number.unwrap_or_default() as usize,
-            etag: value.e_tag.map(|e| e.value().to_owned()),
+            etag: value.e_tag.map(|v| v.value().to_owned()),
+            checksum_crc32: value.checksum_crc32,
+            checksum_crc32c: value.checksum_crc32c,
+            checksum_sha1: value.checksum_sha1,
+            checksum_sha256: value.checksum_sha256,
+            checksum_crc64nvme: value.checksum_crc64nvme,
        }
    }
 }
@@ -517,7 +549,7 @@ pub struct ObjectInfo {
    pub version_purge_status_internal: Option<String>,
    pub version_purge_status: VersionPurgeStatusType,
    pub replication_decision: String,
-    pub checksum: Vec<u8>,
+    pub checksum: Option<Bytes>,
 }

 impl Clone for ObjectInfo {
@@ -554,7 +586,7 @@ impl Clone for ObjectInfo {
            version_purge_status_internal: self.version_purge_status_internal.clone(),
            version_purge_status: self.version_purge_status.clone(),
            replication_decision: self.replication_decision.clone(),
-            checksum: Default::default(),
+            checksum: self.checksum.clone(),
            expires: self.expires,
        }
    }
@@ -694,6 +726,7 @@ impl ObjectInfo {
            inlined,
            user_defined: metadata,
            transitioned_object,
+            checksum: fi.checksum.clone(),
            ..Default::default()
        }
    }
@@ -884,6 +917,23 @@ impl ObjectInfo {
            ..Default::default()
        }
    }
+
+    pub fn decrypt_checksums(&self, part: usize, _headers: &HeaderMap) -> Result<(HashMap<String, String>, bool)> {
+        if part > 0 {
+            if let Some(checksums) = self.parts.iter().find(|p| p.number == part).and_then(|p| p.checksums.clone()) {
+                return Ok((checksums, true));
+            }
+        }
+
+        // TODO: decrypt checksums
+
+        if let Some(data) = &self.checksum {
+            let (checksums, is_multipart) = rustfs_rio::read_checksums(data.as_ref(), 0);
+            return Ok((checksums, is_multipart));
+        }
+
+        Ok((HashMap::new(), false))
+    }
 }

 #[derive(Debug, Default)]
@@ -1275,7 +1325,7 @@ pub trait StorageAPI: ObjectIO + Debug {
    async fn get_object_tags(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<String>;
    async fn add_partial(&self, bucket: &str, object: &str, version_id: &str) -> Result<()>;
    async fn transition_object(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()>;
-    async fn restore_transitioned_object(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()>;
+    async fn restore_transitioned_object(self: Arc<Self>, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<()>;
    async fn put_object_tags(&self, bucket: &str, object: &str, tags: &str, opts: &ObjectOptions) -> Result<ObjectInfo>;
    async fn delete_object_tags(&self, bucket: &str, object: &str, opts: &ObjectOptions) -> Result<ObjectInfo>;

@@ -952,6 +952,12 @@ async fn gather_results(
    let mut recv = recv;
    let mut entries = Vec::new();
    while let Some(mut entry) = recv.recv().await {
+        #[cfg(windows)]
+        {
+            // normalize windows path separator
+            entry.name = entry.name.replace("\\", "/");
+        }
+
        if returned {
            continue;
        }
@@ -1050,6 +1056,10 @@ async fn merge_entry_channels(
    out_channel: Sender<MetaCacheEntry>,
    read_quorum: usize,
 ) -> Result<()> {
+    if in_channels.is_empty() {
+        return Ok(());
+    }
+
    let mut in_channels = in_channels;
    if in_channels.len() == 1 {
        loop {
@@ -1086,18 +1096,18 @@ async fn merge_entry_channels(
            return Ok(());
        }

-        let mut best: Option<MetaCacheEntry> = None;
+        let mut best = top[0].clone();
        let mut best_idx = 0;
        to_merge.clear();

        // FIXME: top move when select_from call
-        let vtop = top.clone();
+        // let vtop = top.clone();

-        for (i, other) in vtop.iter().enumerate() {
-            if let Some(other_entry) = other {
+        // let vtop = top.as_slice();
+
+        for other_idx in 1..top.len() {
+            if let Some(other_entry) = &top[other_idx] {
                if let Some(best_entry) = &best {
-                    let other_idx = i;
-
                    // println!("get other_entry {:?}", other_entry.name);

                    if path::clean(&best_entry.name) == path::clean(&other_entry.name) {
@@ -1124,21 +1134,20 @@ async fn merge_entry_channels(
                            best_idx = other_idx;
                            continue;
                        }
-                    } else if best_entry.name > other_entry.name {
+                    }
+
+                    if best_entry.name > other_entry.name {
                        to_merge.clear();
                        best = Some(other_entry.clone());
-                        best_idx = i;
+                        best_idx = other_idx;
                    }
                } else {
                    best = Some(other_entry.clone());
-                    best_idx = i;
+                    best_idx = other_idx;
                }
            }
        }

-        // println!("get best_entry {} {:?}", &best_idx, &best.clone().unwrap_or_default().name);
-
-        // TODO:
        if !to_merge.is_empty() {
            if let Some(entry) = &best {
                let mut versions = Vec::with_capacity(to_merge.len() + 1);
@@ -1150,9 +1159,9 @@ async fn merge_entry_channels(
                }

                for &idx in to_merge.iter() {
-                    let has_entry = { top.get(idx).cloned() };
+                    let has_entry = top[idx].clone();

-                    if let Some(Some(entry)) = has_entry {
+                    if let Some(entry) = has_entry {
                        let xl2 = match entry.clone().xl_meta() {
                            Ok(res) => res,
                            Err(_) => {
@@ -1198,9 +1207,9 @@ async fn merge_entry_channels(
                out_channel.send(best_entry.clone()).await.map_err(Error::other)?;
                last = best_entry.name.clone();
            }
-            top[best_idx] = None; // Replace entry we just sent
-            select_from(&mut in_channels, best_idx, &mut top, &mut n_done).await?;
        }
+
+        select_from(&mut in_channels, best_idx, &mut top, &mut n_done).await?;
    }
 }

@@ -18,6 +18,13 @@ pub mod tier_config;
 pub mod tier_gen;
 pub mod tier_handlers;
 pub mod warm_backend;
+pub mod warm_backend_aliyun;
+pub mod warm_backend_azure;
+pub mod warm_backend_gcs;
+pub mod warm_backend_huaweicloud;
 pub mod warm_backend_minio;
+pub mod warm_backend_r2;
 pub mod warm_backend_rustfs;
 pub mod warm_backend_s3;
+pub mod warm_backend_s3sdk;
+pub mod warm_backend_tencent;
@@ -141,8 +141,8 @@ impl TierConfigMgr {
        (TierType::Unsupported, false)
    }

-    pub async fn add(&mut self, tier: TierConfig, force: bool) -> std::result::Result<(), AdminError> {
-        let tier_name = &tier.name;
+    pub async fn add(&mut self, tier_config: TierConfig, force: bool) -> std::result::Result<(), AdminError> {
+        let tier_name = &tier_config.name;
        if tier_name != tier_name.to_uppercase().as_str() {
            return Err(ERR_TIER_NAME_NOT_UPPERCASE.clone());
        }
@@ -152,7 +152,7 @@ impl TierConfigMgr {
            return Err(ERR_TIER_ALREADY_EXISTS.clone());
        }

-        let d = new_warm_backend(&tier, true).await?;
+        let d = new_warm_backend(&tier_config, true).await?;

        if !force {
            let in_use = d.in_use().await;
@@ -180,7 +180,7 @@ impl TierConfigMgr {
        }

        self.driver_cache.insert(tier_name.to_string(), d);
-        self.tiers.insert(tier_name.to_string(), tier);
+        self.tiers.insert(tier_name.to_string(), tier_config);

        Ok(())
    }
@@ -260,10 +260,10 @@ impl TierConfigMgr {
            return Err(ERR_TIER_NOT_FOUND.clone());
        }

-        let mut cfg = self.tiers[tier_name].clone();
+        let mut tier_config = self.tiers[tier_name].clone();
        match tier_type {
            TierType::S3 => {
-                let mut s3 = cfg.s3.as_mut().expect("err");
+                let mut s3 = tier_config.s3.as_mut().expect("err");
                if creds.aws_role {
                    s3.aws_role = true
                }
@@ -277,7 +277,7 @@ impl TierConfigMgr {
                }
            }
            TierType::RustFS => {
-                let mut rustfs = cfg.rustfs.as_mut().expect("err");
+                let mut rustfs = tier_config.rustfs.as_mut().expect("err");
                if creds.access_key == "" || creds.secret_key == "" {
                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
                }
@@ -285,18 +285,65 @@ impl TierConfigMgr {
                rustfs.secret_key = creds.secret_key;
            }
            TierType::MinIO => {
-                let mut minio = cfg.minio.as_mut().expect("err");
+                let mut minio = tier_config.minio.as_mut().expect("err");
                if creds.access_key == "" || creds.secret_key == "" {
                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
                }
                minio.access_key = creds.access_key;
                minio.secret_key = creds.secret_key;
            }
+            TierType::Aliyun => {
+                let mut aliyun = tier_config.aliyun.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                aliyun.access_key = creds.access_key;
+                aliyun.secret_key = creds.secret_key;
+            }
+            TierType::Tencent => {
+                let mut tencent = tier_config.tencent.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                tencent.access_key = creds.access_key;
+                tencent.secret_key = creds.secret_key;
+            }
+            TierType::Huaweicloud => {
+                let mut huaweicloud = tier_config.huaweicloud.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                huaweicloud.access_key = creds.access_key;
+                huaweicloud.secret_key = creds.secret_key;
+            }
+            TierType::Azure => {
+                let mut azure = tier_config.azure.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                azure.access_key = creds.access_key;
+                azure.secret_key = creds.secret_key;
+            }
+            TierType::GCS => {
+                let mut gcs = tier_config.gcs.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                gcs.creds = creds.access_key; //creds.creds_json
+            }
+            TierType::R2 => {
+                let mut r2 = tier_config.r2.as_mut().expect("err");
+                if creds.access_key == "" || creds.secret_key == "" {
+                    return Err(ERR_TIER_MISSING_CREDENTIALS.clone());
+                }
+                r2.access_key = creds.access_key;
+                r2.secret_key = creds.secret_key;
+            }
            _ => (),
        }

-        let d = new_warm_backend(&cfg, true).await?;
-        self.tiers.insert(tier_name.to_string(), cfg);
+        let d = new_warm_backend(&tier_config, true).await?;
+        self.tiers.insert(tier_name.to_string(), tier_config);
        self.driver_cache.insert(tier_name.to_string(), d);
        Ok(())
    }
@@ -26,14 +26,22 @@ pub enum TierType {
    Unsupported,
    #[serde(rename = "s3")]
    S3,
-    #[serde(rename = "azure")]
-    Azure,
-    #[serde(rename = "gcs")]
-    GCS,
    #[serde(rename = "rustfs")]
    RustFS,
    #[serde(rename = "minio")]
    MinIO,
+    #[serde(rename = "aliyun")]
+    Aliyun,
+    #[serde(rename = "tencent")]
+    Tencent,
+    #[serde(rename = "huaweicloud")]
+    Huaweicloud,
+    #[serde(rename = "azure")]
+    Azure,
+    #[serde(rename = "gcs")]
+    GCS,
+    #[serde(rename = "r2")]
+    R2,
 }

 impl Display for TierType {
@@ -48,6 +56,24 @@ impl Display for TierType {
            TierType::MinIO => {
                write!(f, "MinIO")
            }
+            TierType::Aliyun => {
+                write!(f, "Aliyun")
+            }
+            TierType::Tencent => {
+                write!(f, "Tencent")
+            }
+            TierType::Huaweicloud => {
+                write!(f, "Huaweicloud")
+            }
+            TierType::Azure => {
+                write!(f, "Azure")
+            }
+            TierType::GCS => {
+                write!(f, "GCS")
+            }
+            TierType::R2 => {
+                write!(f, "R2")
+            }
            _ => {
                write!(f, "Unsupported")
            }
@@ -61,6 +87,12 @@ impl TierType {
            "S3" => TierType::S3,
            "RustFS" => TierType::RustFS,
            "MinIO" => TierType::MinIO,
+            "Aliyun" => TierType::Aliyun,
+            "Tencent" => TierType::Tencent,
+            "Huaweicloud" => TierType::Huaweicloud,
+            "Azure" => TierType::Azure,
+            "GCS" => TierType::GCS,
+            "R2" => TierType::R2,
            _ => TierType::Unsupported,
        }
    }
@@ -70,6 +102,12 @@ impl TierType {
            TierType::S3 => "s3".to_string(),
            TierType::RustFS => "rustfs".to_string(),
            TierType::MinIO => "minio".to_string(),
+            TierType::Aliyun => "aliyun".to_string(),
+            TierType::Tencent => "tencent".to_string(),
+            TierType::Huaweicloud => "huaweicloud".to_string(),
+            TierType::Azure => "azure".to_string(),
+            TierType::GCS => "gcs".to_string(),
+            TierType::R2 => "r2".to_string(),
            _ => "unsupported".to_string(),
        }
    }
@@ -86,8 +124,18 @@ pub struct TierConfig {
    pub name: String,
    #[serde(rename = "s3", skip_serializing_if = "Option::is_none")]
    pub s3: Option<TierS3>,
-    //TODO: azure: Option<TierAzure>,
-    //TODO: gcs: Option<TierGCS>,
+    #[serde(rename = "aliyun", skip_serializing_if = "Option::is_none")]
+    pub aliyun: Option<TierAliyun>,
+    #[serde(rename = "tencent", skip_serializing_if = "Option::is_none")]
+    pub tencent: Option<TierTencent>,
+    #[serde(rename = "huaweicloud", skip_serializing_if = "Option::is_none")]
+    pub huaweicloud: Option<TierHuaweicloud>,
+    #[serde(rename = "azure", skip_serializing_if = "Option::is_none")]
+    pub azure: Option<TierAzure>,
+    #[serde(rename = "gcs", skip_serializing_if = "Option::is_none")]
+    pub gcs: Option<TierGCS>,
+    #[serde(rename = "r2", skip_serializing_if = "Option::is_none")]
+    pub r2: Option<TierR2>,
    #[serde(rename = "rustfs", skip_serializing_if = "Option::is_none")]
    pub rustfs: Option<TierRustFS>,
    #[serde(rename = "minio", skip_serializing_if = "Option::is_none")]
@@ -97,10 +145,14 @@ pub struct TierConfig {
 impl Clone for TierConfig {
    fn clone(&self) -> TierConfig {
        let mut s3 = None;
-        //az  TierAzure
-        //gcs TierGCS
        let mut r = None;
        let mut m = None;
+        let mut aliyun = None;
+        let mut tencent = None;
+        let mut huaweicloud = None;
+        let mut azure = None;
+        let mut gcs = None;
+        let mut r2 = None;
        match self.tier_type {
            TierType::S3 => {
                let mut s3_ = self.s3.as_ref().expect("err").clone();
@@ -117,6 +169,36 @@ impl Clone for TierConfig {
                m_.secret_key = "REDACTED".to_string();
                m = Some(m_);
            }
+            TierType::Aliyun => {
+                let mut aliyun_ = self.aliyun.as_ref().expect("err").clone();
+                aliyun_.secret_key = "REDACTED".to_string();
+                aliyun = Some(aliyun_);
+            }
+            TierType::Tencent => {
+                let mut tencent_ = self.tencent.as_ref().expect("err").clone();
+                tencent_.secret_key = "REDACTED".to_string();
+                tencent = Some(tencent_);
+            }
+            TierType::Huaweicloud => {
+                let mut huaweicloud_ = self.huaweicloud.as_ref().expect("err").clone();
+                huaweicloud_.secret_key = "REDACTED".to_string();
+                huaweicloud = Some(huaweicloud_);
+            }
+            TierType::Azure => {
+                let mut azure_ = self.azure.as_ref().expect("err").clone();
+                azure_.secret_key = "REDACTED".to_string();
+                azure = Some(azure_);
+            }
+            TierType::GCS => {
+                let mut gcs_ = self.gcs.as_ref().expect("err").clone();
+                gcs_.creds = "REDACTED".to_string();
+                gcs = Some(gcs_);
+            }
+            TierType::R2 => {
+                let mut r2_ = self.r2.as_ref().expect("err").clone();
+                r2_.secret_key = "REDACTED".to_string();
+                r2 = Some(r2_);
+            }
            _ => (),
        }
        TierConfig {
@@ -126,6 +208,12 @@ impl Clone for TierConfig {
            s3,
            rustfs: r,
            minio: m,
+            aliyun,
+            tencent,
+            huaweicloud,
+            azure,
+            gcs,
+            r2,
        }
    }
 }
@@ -137,6 +225,12 @@ impl TierConfig {
            TierType::S3 => self.s3.as_ref().expect("err").endpoint.clone(),
            TierType::RustFS => self.rustfs.as_ref().expect("err").endpoint.clone(),
            TierType::MinIO => self.minio.as_ref().expect("err").endpoint.clone(),
+            TierType::Aliyun => self.aliyun.as_ref().expect("err").endpoint.clone(),
+            TierType::Tencent => self.tencent.as_ref().expect("err").endpoint.clone(),
+            TierType::Huaweicloud => self.huaweicloud.as_ref().expect("err").endpoint.clone(),
+            TierType::Azure => self.azure.as_ref().expect("err").endpoint.clone(),
+            TierType::GCS => self.gcs.as_ref().expect("err").endpoint.clone(),
+            TierType::R2 => self.r2.as_ref().expect("err").endpoint.clone(),
            _ => {
                info!("unexpected tier type {}", self.tier_type);
                "".to_string()
@@ -149,6 +243,12 @@ impl TierConfig {
            TierType::S3 => self.s3.as_ref().expect("err").bucket.clone(),
            TierType::RustFS => self.rustfs.as_ref().expect("err").bucket.clone(),
            TierType::MinIO => self.minio.as_ref().expect("err").bucket.clone(),
+            TierType::Aliyun => self.aliyun.as_ref().expect("err").bucket.clone(),
+            TierType::Tencent => self.tencent.as_ref().expect("err").bucket.clone(),
+            TierType::Huaweicloud => self.huaweicloud.as_ref().expect("err").bucket.clone(),
+            TierType::Azure => self.azure.as_ref().expect("err").bucket.clone(),
+            TierType::GCS => self.gcs.as_ref().expect("err").bucket.clone(),
+            TierType::R2 => self.r2.as_ref().expect("err").bucket.clone(),
            _ => {
                info!("unexpected tier type {}", self.tier_type);
                "".to_string()
@@ -161,6 +261,12 @@ impl TierConfig {
            TierType::S3 => self.s3.as_ref().expect("err").prefix.clone(),
            TierType::RustFS => self.rustfs.as_ref().expect("err").prefix.clone(),
            TierType::MinIO => self.minio.as_ref().expect("err").prefix.clone(),
+            TierType::Aliyun => self.aliyun.as_ref().expect("err").prefix.clone(),
+            TierType::Tencent => self.tencent.as_ref().expect("err").prefix.clone(),
+            TierType::Huaweicloud => self.huaweicloud.as_ref().expect("err").prefix.clone(),
+            TierType::Azure => self.azure.as_ref().expect("err").prefix.clone(),
+            TierType::GCS => self.gcs.as_ref().expect("err").prefix.clone(),
+            TierType::R2 => self.r2.as_ref().expect("err").prefix.clone(),
            _ => {
                info!("unexpected tier type {}", self.tier_type);
                "".to_string()
@@ -173,6 +279,12 @@ impl TierConfig {
            TierType::S3 => self.s3.as_ref().expect("err").region.clone(),
            TierType::RustFS => self.rustfs.as_ref().expect("err").region.clone(),
            TierType::MinIO => self.minio.as_ref().expect("err").region.clone(),
+            TierType::Aliyun => self.aliyun.as_ref().expect("err").region.clone(),
+            TierType::Tencent => self.tencent.as_ref().expect("err").region.clone(),
+            TierType::Huaweicloud => self.huaweicloud.as_ref().expect("err").region.clone(),
+            TierType::Azure => self.azure.as_ref().expect("err").region.clone(),
+            TierType::GCS => self.gcs.as_ref().expect("err").region.clone(),
+            TierType::R2 => self.r2.as_ref().expect("err").region.clone(),
            _ => {
                info!("unexpected tier type {}", self.tier_type);
                "".to_string()
@@ -319,3 +431,152 @@ impl TierMinIO {
        })
    }
 }
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierAliyun {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "accessKey")]
+    pub access_key: String,
+    #[serde(rename = "secretKey")]
+    pub secret_key: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+}
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierTencent {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "accessKey")]
+    pub access_key: String,
+    #[serde(rename = "secretKey")]
+    pub secret_key: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+}
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierHuaweicloud {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "accessKey")]
+    pub access_key: String,
+    #[serde(rename = "secretKey")]
+    pub secret_key: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+}
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct ServicePrincipalAuth {
+    pub tenant_id: String,
+    pub client_id: String,
+    pub client_secret: String,
+}
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierAzure {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "accessKey")]
+    pub access_key: String,
+    #[serde(rename = "secretKey")]
+    pub secret_key: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+    #[serde(rename = "storageClass")]
+    pub storage_class: String,
+    #[serde(rename = "spAuth")]
+    pub sp_auth: ServicePrincipalAuth,
+}
+
+impl TierAzure {
+    pub fn is_sp_enabled(&self) -> bool {
+        !self.sp_auth.tenant_id.is_empty() && !self.sp_auth.client_id.is_empty() && !self.sp_auth.client_secret.is_empty()
+    }
+}
+
+/*
+fn AzureServicePrincipal(tenantID, clientID, clientSecret string) func(az *TierAzure) error {
+  return func(az *TierAzure) error {
+    if tenantID == "" {
+      return errors.New("empty tenant ID unsupported")
+    }
+    if clientID == "" {
+      return errors.New("empty client ID unsupported")
+    }
+    if clientSecret == "" {
+      return errors.New("empty client secret unsupported")
+    }
+    az.SPAuth.TenantID = tenantID
+    az.SPAuth.ClientID = clientID
+    az.SPAuth.ClientSecret = clientSecret
+    return nil
+  }
+}
+
+fn AzurePrefix(prefix string) func(az *TierAzure) error {
+  return func(az *TierAzure) error {
+    az.Prefix = prefix
+    return nil
+  }
+}
+
+fn AzureEndpoint(endpoint string) func(az *TierAzure) error {
+  return func(az *TierAzure) error {
+    az.Endpoint = endpoint
+    return nil
+  }
+}
+
+fn AzureRegion(region string) func(az *TierAzure) error {
+  return func(az *TierAzure) error {
+    az.Region = region
+    return nil
+  }
+}
+
+fn AzureStorageClass(sc string) func(az *TierAzure) error {
+  return func(az *TierAzure) error {
+    az.StorageClass = sc
+    return nil
+  }
+}*/
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierGCS {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "creds")]
+    pub creds: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+    #[serde(rename = "storageClass")]
+    pub storage_class: String,
+}
+
+#[derive(Serialize, Deserialize, Default, Debug, Clone)]
+#[serde(default)]
+pub struct TierR2 {
+    pub name: String,
+    pub endpoint: String,
+    #[serde(rename = "accessKey")]
+    pub access_key: String,
+    #[serde(rename = "secretKey")]
+    pub secret_key: String,
+    pub bucket: String,
+    pub prefix: String,
+    pub region: String,
+}
@@ -27,9 +27,15 @@ use crate::tier::{
    tier::ERR_TIER_TYPE_UNSUPPORTED,
    tier_config::{TierConfig, TierType},
    tier_handlers::{ERR_TIER_BUCKET_NOT_FOUND, ERR_TIER_PERM_ERR},
+    warm_backend_aliyun::WarmBackendAliyun,
+    warm_backend_azure::WarmBackendAzure,
+    warm_backend_gcs::WarmBackendGCS,
+    warm_backend_huaweicloud::WarmBackendHuaweicloud,
    warm_backend_minio::WarmBackendMinIO,
+    warm_backend_r2::WarmBackendR2,
    warm_backend_rustfs::WarmBackendRustFS,
    warm_backend_s3::WarmBackendS3,
+    warm_backend_tencent::WarmBackendTencent,
 };
 use bytes::Bytes;
 use http::StatusCode;
@@ -128,6 +134,78 @@ pub async fn new_warm_backend(tier: &TierConfig, probe: bool) -> Result<WarmBack
            }
            d = Some(Box::new(dd.expect("err")));
        }
+        TierType::Aliyun => {
+            let dd = WarmBackendAliyun::new(tier.aliyun.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
+        TierType::Tencent => {
+            let dd = WarmBackendTencent::new(tier.tencent.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
+        TierType::Huaweicloud => {
+            let dd = WarmBackendHuaweicloud::new(tier.huaweicloud.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
+        TierType::Azure => {
+            let dd = WarmBackendAzure::new(tier.azure.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
+        TierType::GCS => {
+            let dd = WarmBackendGCS::new(tier.gcs.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
+        TierType::R2 => {
+            let dd = WarmBackendR2::new(tier.r2.as_ref().expect("err"), &tier.name).await;
+            if let Err(err) = dd {
+                warn!("{}", err);
+                return Err(AdminError {
+                    code: "XRustFSAdminTierInvalidConfig".to_string(),
+                    message: format!("Unable to setup remote tier, check tier configuration: {}", err.to_string()),
+                    status_code: StatusCode::BAD_REQUEST,
+                });
+            }
+            d = Some(Box::new(dd.expect("err")));
+        }
        _ => {
            return Err(ERR_TIER_TYPE_UNSUPPORTED.clone());
        }
@@ -0,0 +1,164 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    credentials::{Credentials, SignatureType, Static, Value},
+    transition_api::{BucketLookupType, Options, ReadCloser, ReaderImpl, TransitionClient, TransitionCore},
+};
+use crate::tier::{
+    tier_config::TierAliyun,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+    warm_backend_s3::WarmBackendS3,
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendAliyun(WarmBackendS3);
+
+impl WarmBackendAliyun {
+    pub async fn new(conf: &TierAliyun, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let u = match url::Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(e) => {
+                return Err(std::io::Error::other(e.to_string()));
+            }
+        };
+
+        let creds = Credentials::new(Static(Value {
+            access_key_id: conf.access_key.clone(),
+            secret_access_key: conf.secret_key.clone(),
+            session_token: "".to_string(),
+            signer_type: SignatureType::SignatureV4,
+            ..Default::default()
+        }));
+        let opts = Options {
+            creds,
+            secure: u.scheme() == "https",
+            //transport: GLOBAL_RemoteTargetTransport,
+            trailing_headers: true,
+            region: conf.region.clone(),
+            bucket_lookup: BucketLookupType::BucketLookupDNS,
+            ..Default::default()
+        };
+        let scheme = u.scheme();
+        let default_port = if scheme == "https" { 443 } else { 80 };
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "aliyun",
+        )
+        .await?;
+
+        let client = Arc::new(client);
+        let core = TransitionCore(Arc::clone(&client));
+        Ok(Self(WarmBackendS3 {
+            client,
+            core,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        }))
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendAliyun {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = optimal_part_size(length)?;
+        let client = self.0.client.clone();
+        let res = client
+            .put_object(
+                &self.0.bucket,
+                &self.0.get_dest(object),
+                r,
+                length,
+                &PutObjectOptions {
+                    storage_class: self.0.storage_class.clone(),
+                    part_size: part_size as u64,
+                    disable_content_sha256: true,
+                    user_metadata: meta,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        //self.ToObjectError(err, object)
+        Ok(res.version_id)
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        self.0.get(object, rv, opts).await
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        self.0.remove(object, rv).await
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        self.0.in_use().await
+    }
+}
+
+fn optimal_part_size(object_size: i64) -> Result<i64, std::io::Error> {
+    let mut object_size = object_size;
+    if object_size == -1 {
+        object_size = MAX_MULTIPART_PUT_OBJECT_SIZE;
+    }
+
+    if object_size > MAX_MULTIPART_PUT_OBJECT_SIZE {
+        return Err(std::io::Error::other("entity too large"));
+    }
+
+    let configured_part_size = MIN_PART_SIZE;
+    let mut part_size_flt = object_size as f64 / MAX_PARTS_COUNT as f64;
+    part_size_flt = (part_size_flt as f64 / configured_part_size as f64).ceil() * configured_part_size as f64;
+
+    let part_size = part_size_flt as i64;
+    if part_size == 0 {
+        return Ok(MIN_PART_SIZE);
+    }
+    Ok(part_size)
+}
@@ -0,0 +1,164 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    credentials::{Credentials, SignatureType, Static, Value},
+    transition_api::{BucketLookupType, Options, ReadCloser, ReaderImpl, TransitionClient, TransitionCore},
+};
+use crate::tier::{
+    tier_config::TierAzure,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+    warm_backend_s3::WarmBackendS3,
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendAzure(WarmBackendS3);
+
+impl WarmBackendAzure {
+    pub async fn new(conf: &TierAzure, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let u = match url::Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(e) => {
+                return Err(std::io::Error::other(e.to_string()));
+            }
+        };
+
+        let creds = Credentials::new(Static(Value {
+            access_key_id: conf.access_key.clone(),
+            secret_access_key: conf.secret_key.clone(),
+            session_token: "".to_string(),
+            signer_type: SignatureType::SignatureV4,
+            ..Default::default()
+        }));
+        let opts = Options {
+            creds,
+            secure: u.scheme() == "https",
+            //transport: GLOBAL_RemoteTargetTransport,
+            trailing_headers: true,
+            region: conf.region.clone(),
+            bucket_lookup: BucketLookupType::BucketLookupDNS,
+            ..Default::default()
+        };
+        let scheme = u.scheme();
+        let default_port = if scheme == "https" { 443 } else { 80 };
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "azure",
+        )
+        .await?;
+
+        let client = Arc::new(client);
+        let core = TransitionCore(Arc::clone(&client));
+        Ok(Self(WarmBackendS3 {
+            client,
+            core,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        }))
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendAzure {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = optimal_part_size(length)?;
+        let client = self.0.client.clone();
+        let res = client
+            .put_object(
+                &self.0.bucket,
+                &self.0.get_dest(object),
+                r,
+                length,
+                &PutObjectOptions {
+                    storage_class: self.0.storage_class.clone(),
+                    part_size: part_size as u64,
+                    disable_content_sha256: true,
+                    user_metadata: meta,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        //self.ToObjectError(err, object)
+        Ok(res.version_id)
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        self.0.get(object, rv, opts).await
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        self.0.remove(object, rv).await
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        self.0.in_use().await
+    }
+}
+
+fn optimal_part_size(object_size: i64) -> Result<i64, std::io::Error> {
+    let mut object_size = object_size;
+    if object_size == -1 {
+        object_size = MAX_MULTIPART_PUT_OBJECT_SIZE;
+    }
+
+    if object_size > MAX_MULTIPART_PUT_OBJECT_SIZE {
+        return Err(std::io::Error::other("entity too large"));
+    }
+
+    let configured_part_size = MIN_PART_SIZE;
+    let mut part_size_flt = object_size as f64 / MAX_PARTS_COUNT as f64;
+    part_size_flt = (part_size_flt as f64 / configured_part_size as f64).ceil() * configured_part_size as f64;
+
+    let part_size = part_size_flt as i64;
+    if part_size == 0 {
+        return Ok(MIN_PART_SIZE);
+    }
+    Ok(part_size)
+}
@@ -0,0 +1,231 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use azure_core::http::{Body, ClientOptions, RequestContent};
+use azure_storage::StorageCredentials;
+use azure_storage_blobs::prelude::*;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    transition_api::{Options, ReadCloser, ReaderImpl},
+};
+use crate::tier::{
+    tier_config::TierAzure,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendAzure {
+    pub client: Arc<BlobServiceClient>,
+    pub bucket: String,
+    pub prefix: String,
+    pub storage_class: String,
+}
+
+impl WarmBackendAzure {
+    pub async fn new(conf: &TierAzure, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let creds = StorageCredentials::access_key(conf.access_key.clone(), conf.secret_key.clone());
+        let client = ClientBuilder::new(conf.access_key.clone(), creds)
+            //.endpoint(conf.endpoint)
+            .blob_service_client();
+        let client = Arc::new(client);
+        Ok(Self {
+            client,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        })
+    }
+
+    /*pub fn tier(&self) -> *blob.AccessTier {
+        if self.storage_class == "" {
+            return None;
+        }
+        for t in blob.PossibleAccessTierValues() {
+            if strings.EqualFold(self.storage_class, t) {
+                return &t
+            }
+        }
+        None
+    }*/
+
+    pub fn get_dest(&self, object: &str) -> String {
+        let mut dest_obj = object.to_string();
+        if self.prefix != "" {
+            dest_obj = format!("{}/{}", &self.prefix, object);
+        }
+        return dest_obj;
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendAzure {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = length;
+        let client = self.client.clone();
+        let container_client = client.container_client(self.bucket.clone());
+        let blob_client = container_client.blob_client(self.get_dest(object));
+        /*let res = blob_client
+            .upload(
+                RequestContent::from(match r {
+                    ReaderImpl::Body(content_body) => content_body.to_vec(),
+                    ReaderImpl::ObjectBody(mut content_body) => content_body.read_all().await?,
+                }),
+                false,
+                length as u64,
+                None,
+            )
+            .await
+        else {
+            return Err(std::io::Error::other("upload error"));
+        };*/
+
+        let Ok(res) = blob_client
+            .put_block_blob(match r {
+                ReaderImpl::Body(content_body) => content_body.to_vec(),
+                ReaderImpl::ObjectBody(mut content_body) => content_body.read_all().await?,
+            })
+            .content_type("text/plain")
+            .into_future()
+            .await
+        else {
+            return Err(std::io::Error::other("put_block_blob error"));
+        };
+
+        //self.ToObjectError(err, object)
+        Ok(res.request_id.to_string())
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        let client = self.client.clone();
+        let container_client = client.container_client(self.bucket.clone());
+        let blob_client = container_client.blob_client(self.get_dest(object));
+        blob_client.get();
+        todo!();
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        let client = self.client.clone();
+        let container_client = client.container_client(self.bucket.clone());
+        let blob_client = container_client.blob_client(self.get_dest(object));
+        blob_client.delete();
+        todo!();
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        /*let result = self.client
+            .list_objects_v2(&self.bucket, &self.prefix, "", "", SLASH_SEPARATOR, 1)
+            .await?;
+
+        Ok(result.common_prefixes.len() > 0 || result.contents.len() > 0)*/
+        Ok(false)
+    }
+}
+
+/*fn azure_to_object_error(err: Error, params: Vec<String>) -> Option<error> {
+    if err == nil {
+      return nil
+    }
+
+    bucket := ""
+    object := ""
+    if len(params) >= 1 {
+      bucket = params[0]
+    }
+    if len(params) == 2 {
+      object = params[1]
+    }
+
+    azureErr, ok := err.(*azcore.ResponseError)
+    if !ok {
+      // We don't interpret non Azure errors. As azure errors will
+      // have StatusCode to help to convert to object errors.
+      return err
+    }
+
+    serviceCode := azureErr.ErrorCode
+    statusCode := azureErr.StatusCode
+
+    azureCodesToObjectError(err, serviceCode, statusCode, bucket, object)
+}*/
+
+/*fn azure_codes_to_object_error(err: Error, service_code: String, status_code: i32, bucket: String, object: String) -> Option<Error> {
+  switch serviceCode {
+  case "ContainerNotFound", "ContainerBeingDeleted":
+    err = BucketNotFound{Bucket: bucket}
+  case "ContainerAlreadyExists":
+    err = BucketExists{Bucket: bucket}
+  case "InvalidResourceName":
+    err = BucketNameInvalid{Bucket: bucket}
+  case "RequestBodyTooLarge":
+    err = PartTooBig{}
+  case "InvalidMetadata":
+    err = UnsupportedMetadata{}
+  case "BlobAccessTierNotSupportedForAccountType":
+    err = NotImplemented{}
+  case "OutOfRangeInput":
+    err = ObjectNameInvalid{
+      Bucket: bucket,
+      Object: object,
+    }
+  default:
+    switch statusCode {
+    case http.StatusNotFound:
+      if object != "" {
+        err = ObjectNotFound{
+          Bucket: bucket,
+          Object: object,
+        }
+      } else {
+        err = BucketNotFound{Bucket: bucket}
+      }
+    case http.StatusBadRequest:
+      err = BucketNameInvalid{Bucket: bucket}
+    }
+  }
+  return err
+}*/
@@ -0,0 +1,248 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use bytes::Bytes;
+use google_cloud_auth::credentials::Credentials;
+use google_cloud_auth::credentials::user_account::Builder;
+use google_cloud_storage as gcs;
+use google_cloud_storage::client::Storage;
+use std::convert::TryFrom;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    transition_api::{Options, ReadCloser, ReaderImpl},
+};
+use crate::tier::{
+    tier_config::TierGCS,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendGCS {
+    pub client: Arc<Storage>,
+    pub bucket: String,
+    pub prefix: String,
+    pub storage_class: String,
+}
+
+impl WarmBackendGCS {
+    pub async fn new(conf: &TierGCS, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.creds == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let authorized_user = serde_json::from_str(&conf.creds)?;
+        let credentials = Builder::new(authorized_user)
+            //.with_retry_policy(AlwaysRetry.with_attempt_limit(3))
+            //.with_backoff_policy(backoff)
+            .build()
+            .map_err(|e| std::io::Error::other(format!("Invalid credentials JSON: {}", e)))?;
+
+        let Ok(client) = Storage::builder()
+            .with_endpoint(conf.endpoint.clone())
+            .with_credentials(credentials)
+            .build()
+            .await
+        else {
+            return Err(std::io::Error::other("Storage::builder error"));
+        };
+        let client = Arc::new(client);
+        Ok(Self {
+            client,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        })
+    }
+
+    pub fn get_dest(&self, object: &str) -> String {
+        let mut dest_obj = object.to_string();
+        if self.prefix != "" {
+            dest_obj = format!("{}/{}", &self.prefix, object);
+        }
+        return dest_obj;
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendGCS {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let d = match r {
+            ReaderImpl::Body(content_body) => content_body.to_vec(),
+            ReaderImpl::ObjectBody(mut content_body) => content_body.read_all().await?,
+        };
+        let Ok(res) = self
+            .client
+            .write_object(&self.bucket, &self.get_dest(object), Bytes::from(d))
+            .send_buffered()
+            .await
+        else {
+            return Err(std::io::Error::other("write_object error"));
+        };
+        //self.ToObjectError(err, object)
+        Ok(res.generation.to_string())
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        let Ok(mut reader) = self.client.read_object(&self.bucket, &self.get_dest(object)).send().await else {
+            return Err(std::io::Error::other("read_object error"));
+        };
+        let mut contents = Vec::new();
+        while let Ok(Some(chunk)) = reader.next().await.transpose() {
+            contents.extend_from_slice(&chunk);
+        }
+        Ok(ReadCloser::new(std::io::Cursor::new(contents)))
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        /*self.client
+        .delete_object()
+        .set_bucket(&self.bucket)
+        .set_object(&self.get_dest(object))
+        //.set_generation(object.generation)
+        .send()
+        .await?;*/
+        Ok(())
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        /*let result = self.client
+            .list_objects_v2(&self.bucket, &self.prefix, "", "", SLASH_SEPARATOR, 1)
+            .await?;
+
+        Ok(result.common_prefixes.len() > 0 || result.contents.len() > 0)*/
+        Ok(false)
+    }
+}
+
+/*fn gcs_to_object_error(err: Error, params: Vec<String>) -> Option<Error> {
+  if err == nil {
+    return nil
+  }
+
+  bucket := ""
+  object := ""
+  uploadID := ""
+  if len(params) >= 1 {
+    bucket = params[0]
+  }
+  if len(params) == 2 {
+    object = params[1]
+  }
+  if len(params) == 3 {
+    uploadID = params[2]
+  }
+
+  // in some cases just a plain error is being returned
+  switch err.Error() {
+  case "storage: bucket doesn't exist":
+    err = BucketNotFound{
+      Bucket: bucket,
+    }
+    return err
+  case "storage: object doesn't exist":
+    if uploadID != "" {
+      err = InvalidUploadID{
+        UploadID: uploadID,
+      }
+    } else {
+      err = ObjectNotFound{
+        Bucket: bucket,
+        Object: object,
+      }
+    }
+    return err
+  }
+
+  googleAPIErr, ok := err.(*googleapi.Error)
+  if !ok {
+    // We don't interpret non MinIO errors. As minio errors will
+    // have StatusCode to help to convert to object errors.
+    return err
+  }
+
+  if len(googleAPIErr.Errors) == 0 {
+    return err
+  }
+
+  reason := googleAPIErr.Errors[0].Reason
+  message := googleAPIErr.Errors[0].Message
+
+  switch reason {
+  case "required":
+    // Anonymous users does not have storage.xyz access to project 123.
+    fallthrough
+  case "keyInvalid":
+    fallthrough
+  case "forbidden":
+    err = PrefixAccessDenied{
+      Bucket: bucket,
+      Object: object,
+    }
+  case "invalid":
+    err = BucketNameInvalid{
+      Bucket: bucket,
+    }
+  case "notFound":
+    if object != "" {
+      err = ObjectNotFound{
+        Bucket: bucket,
+        Object: object,
+      }
+      break
+    }
+    err = BucketNotFound{Bucket: bucket}
+  case "conflict":
+    if message == "You already own this bucket. Please select another name." {
+      err = BucketAlreadyOwnedByYou{Bucket: bucket}
+      break
+    }
+    if message == "Sorry, that name is not available. Please try a different one." {
+      err = BucketAlreadyExists{Bucket: bucket}
+      break
+    }
+    err = BucketNotEmpty{Bucket: bucket}
+  }
+
+  return err
+}*/
@@ -0,0 +1,164 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    credentials::{Credentials, SignatureType, Static, Value},
+    transition_api::{BucketLookupType, Options, ReadCloser, ReaderImpl, TransitionClient, TransitionCore},
+};
+use crate::tier::{
+    tier_config::TierHuaweicloud,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+    warm_backend_s3::WarmBackendS3,
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendHuaweicloud(WarmBackendS3);
+
+impl WarmBackendHuaweicloud {
+    pub async fn new(conf: &TierHuaweicloud, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let u = match url::Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(e) => {
+                return Err(std::io::Error::other(e.to_string()));
+            }
+        };
+
+        let creds = Credentials::new(Static(Value {
+            access_key_id: conf.access_key.clone(),
+            secret_access_key: conf.secret_key.clone(),
+            session_token: "".to_string(),
+            signer_type: SignatureType::SignatureV4,
+            ..Default::default()
+        }));
+        let opts = Options {
+            creds,
+            secure: u.scheme() == "https",
+            //transport: GLOBAL_RemoteTargetTransport,
+            trailing_headers: true,
+            region: conf.region.clone(),
+            bucket_lookup: BucketLookupType::BucketLookupDNS,
+            ..Default::default()
+        };
+        let scheme = u.scheme();
+        let default_port = if scheme == "https" { 443 } else { 80 };
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "huaweicloud",
+        )
+        .await?;
+
+        let client = Arc::new(client);
+        let core = TransitionCore(Arc::clone(&client));
+        Ok(Self(WarmBackendS3 {
+            client,
+            core,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        }))
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendHuaweicloud {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = optimal_part_size(length)?;
+        let client = self.0.client.clone();
+        let res = client
+            .put_object(
+                &self.0.bucket,
+                &self.0.get_dest(object),
+                r,
+                length,
+                &PutObjectOptions {
+                    storage_class: self.0.storage_class.clone(),
+                    part_size: part_size as u64,
+                    disable_content_sha256: true,
+                    user_metadata: meta,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        //self.ToObjectError(err, object)
+        Ok(res.version_id)
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        self.0.get(object, rv, opts).await
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        self.0.remove(object, rv).await
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        self.0.in_use().await
+    }
+}
+
+fn optimal_part_size(object_size: i64) -> Result<i64, std::io::Error> {
+    let mut object_size = object_size;
+    if object_size == -1 {
+        object_size = MAX_MULTIPART_PUT_OBJECT_SIZE;
+    }
+
+    if object_size > MAX_MULTIPART_PUT_OBJECT_SIZE {
+        return Err(std::io::Error::other("entity too large"));
+    }
+
+    let configured_part_size = MIN_PART_SIZE;
+    let mut part_size_flt = object_size as f64 / MAX_PARTS_COUNT as f64;
+    part_size_flt = (part_size_flt as f64 / configured_part_size as f64).ceil() * configured_part_size as f64;
+
+    let part_size = part_size_flt as i64;
+    if part_size == 0 {
+        return Ok(MIN_PART_SIZE);
+    }
+    Ok(part_size)
+}
@@ -1,4 +1,3 @@
-#![allow(unused_imports)]
 // Copyright 2024 RustFS Team
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,6 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+#![allow(unused_imports)]
 #![allow(unused_variables)]
 #![allow(unused_mut)]
 #![allow(unused_assignments)]
@@ -70,12 +70,17 @@ impl WarmBackendMinIO {
            secure: u.scheme() == "https",
            //transport: GLOBAL_RemoteTargetTransport,
            trailing_headers: true,
+            region: conf.region.clone(),
            ..Default::default()
        };
        let scheme = u.scheme();
        let default_port = if scheme == "https" { 443 } else { 80 };
-        let client =
-            TransitionClient::new(&format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)), opts).await?;
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "minio",
+        )
+        .await?;

        let client = Arc::new(client);
        let core = TransitionCore(Arc::clone(&client));
@@ -0,0 +1,163 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    credentials::{Credentials, SignatureType, Static, Value},
+    transition_api::{Options, ReadCloser, ReaderImpl, TransitionClient, TransitionCore},
+};
+use crate::tier::{
+    tier_config::TierR2,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+    warm_backend_s3::WarmBackendS3,
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendR2(WarmBackendS3);
+
+impl WarmBackendR2 {
+    pub async fn new(conf: &TierR2, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let u = match url::Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(e) => {
+                return Err(std::io::Error::other(e.to_string()));
+            }
+        };
+
+        let creds = Credentials::new(Static(Value {
+            access_key_id: conf.access_key.clone(),
+            secret_access_key: conf.secret_key.clone(),
+            session_token: "".to_string(),
+            signer_type: SignatureType::SignatureV4,
+            ..Default::default()
+        }));
+        let opts = Options {
+            creds,
+            secure: u.scheme() == "https",
+            //transport: GLOBAL_RemoteTargetTransport,
+            trailing_headers: true,
+            region: conf.region.clone(),
+            ..Default::default()
+        };
+        let scheme = u.scheme();
+        let default_port = if scheme == "https" { 443 } else { 80 };
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "r2",
+        )
+        .await?;
+
+        let client = Arc::new(client);
+        let core = TransitionCore(Arc::clone(&client));
+        Ok(Self(WarmBackendS3 {
+            client,
+            core,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        }))
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendR2 {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = optimal_part_size(length)?;
+        let client = self.0.client.clone();
+        let res = client
+            .put_object(
+                &self.0.bucket,
+                &self.0.get_dest(object),
+                r,
+                length,
+                &PutObjectOptions {
+                    storage_class: self.0.storage_class.clone(),
+                    part_size: part_size as u64,
+                    disable_content_sha256: true,
+                    user_metadata: meta,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        //self.ToObjectError(err, object)
+        Ok(res.version_id)
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        self.0.get(object, rv, opts).await
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        self.0.remove(object, rv).await
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        self.0.in_use().await
+    }
+}
+
+fn optimal_part_size(object_size: i64) -> Result<i64, std::io::Error> {
+    let mut object_size = object_size;
+    if object_size == -1 {
+        object_size = MAX_MULTIPART_PUT_OBJECT_SIZE;
+    }
+
+    if object_size > MAX_MULTIPART_PUT_OBJECT_SIZE {
+        return Err(std::io::Error::other("entity too large"));
+    }
+
+    let configured_part_size = MIN_PART_SIZE;
+    let mut part_size_flt = object_size as f64 / MAX_PARTS_COUNT as f64;
+    part_size_flt = (part_size_flt as f64 / configured_part_size as f64).ceil() * configured_part_size as f64;
+
+    let part_size = part_size_flt as i64;
+    if part_size == 0 {
+        return Ok(MIN_PART_SIZE);
+    }
+    Ok(part_size)
+}
@@ -1,4 +1,3 @@
-#![allow(unused_imports)]
 // Copyright 2024 RustFS Team
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,6 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+#![allow(unused_imports)]
 #![allow(unused_variables)]
 #![allow(unused_mut)]
 #![allow(unused_assignments)]
@@ -67,12 +67,17 @@ impl WarmBackendRustFS {
            secure: u.scheme() == "https",
            //transport: GLOBAL_RemoteTargetTransport,
            trailing_headers: true,
+            region: conf.region.clone(),
            ..Default::default()
        };
        let scheme = u.scheme();
        let default_port = if scheme == "https" { 443 } else { 80 };
-        let client =
-            TransitionClient::new(&format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)), opts).await?;
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "rustfs",
+        )
+        .await?;

        let client = Arc::new(client);
        let core = TransitionCore(Arc::clone(&client));
@@ -1,4 +1,3 @@
-#![allow(unused_imports)]
 // Copyright 2024 RustFS Team
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,6 +11,7 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+#![allow(unused_imports)]
 #![allow(unused_variables)]
 #![allow(unused_mut)]
 #![allow(unused_assignments)]
@@ -92,9 +92,10 @@ impl WarmBackendS3 {
            creds,
            secure: u.scheme() == "https",
            //transport: GLOBAL_RemoteTargetTransport,
+            region: conf.region.clone(),
            ..Default::default()
        };
-        let client = TransitionClient::new(&u.host().expect("err").to_string(), opts).await?;
+        let client = TransitionClient::new(&u.host().expect("err").to_string(), opts, "s3").await?;

        let client = Arc::new(client);
        let core = TransitionCore(Arc::clone(&client));
@@ -0,0 +1,196 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use url::Url;
+
+use aws_config::meta::region::RegionProviderChain;
+use aws_sdk_s3::Client;
+use aws_sdk_s3::config::{Credentials, Region};
+use aws_sdk_s3::primitives::ByteStream;
+
+use crate::client::{
+    api_get_options::GetObjectOptions,
+    api_put_object::PutObjectOptions,
+    api_remove::RemoveObjectOptions,
+    transition_api::{ReadCloser, ReaderImpl},
+};
+use crate::error::ErrorResponse;
+use crate::error::error_resp_to_object_err;
+use crate::tier::{
+    tier_config::TierS3,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+};
+use rustfs_utils::path::SLASH_SEPARATOR;
+
+pub struct WarmBackendS3 {
+    pub client: Arc<Client>,
+    pub bucket: String,
+    pub prefix: String,
+    pub storage_class: String,
+}
+
+impl WarmBackendS3 {
+    pub async fn new(conf: &TierS3, tier: &str) -> Result<Self, std::io::Error> {
+        let u = match Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(err) => {
+                return Err(std::io::Error::other(err.to_string()));
+            }
+        };
+
+        if conf.aws_role_web_identity_token_file == "" && conf.aws_role_arn != ""
+            || conf.aws_role_web_identity_token_file != "" && conf.aws_role_arn == ""
+        {
+            return Err(std::io::Error::other("both the token file and the role ARN are required"));
+        } else if conf.access_key == "" && conf.secret_key != "" || conf.access_key != "" && conf.secret_key == "" {
+            return Err(std::io::Error::other("both the access and secret keys are required"));
+        } else if conf.aws_role
+            && (conf.aws_role_web_identity_token_file != ""
+                || conf.aws_role_arn != ""
+                || conf.access_key != ""
+                || conf.secret_key != "")
+        {
+            return Err(std::io::Error::other(
+                "AWS Role cannot be activated with static credentials or the web identity token file",
+            ));
+        } else if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let creds;
+        if conf.access_key != "" && conf.secret_key != "" {
+            creds = Credentials::new(
+                conf.access_key.clone(), // access_key_id
+                conf.secret_key.clone(), // secret_access_key
+                None,                    // session_token (可选)
+                None,
+                "Static",
+            );
+        } else {
+            return Err(std::io::Error::other("insufficient parameters for S3 backend authentication"));
+        }
+        let region_provider = RegionProviderChain::default_provider().or_else(Region::new(conf.region.clone()));
+        #[allow(deprecated)]
+        let config = aws_config::from_env()
+            .endpoint_url(conf.endpoint.clone())
+            .region(region_provider)
+            .credentials_provider(creds)
+            .load()
+            .await;
+        let client = Client::new(&config);
+        let client = Arc::new(client);
+        Ok(Self {
+            client,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.clone().trim_matches('/').to_string(),
+            storage_class: conf.storage_class.clone(),
+        })
+    }
+
+    pub fn get_dest(&self, object: &str) -> String {
+        let mut dest_obj = object.to_string();
+        if self.prefix != "" {
+            dest_obj = format!("{}/{}", &self.prefix, object);
+        }
+        return dest_obj;
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendS3 {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let client = self.client.clone();
+        let Ok(res) = client
+            .put_object()
+            .bucket(&self.bucket)
+            .key(&self.get_dest(object))
+            .body(match r {
+                ReaderImpl::Body(content_body) => ByteStream::from(content_body.to_vec()),
+                ReaderImpl::ObjectBody(mut content_body) => ByteStream::from(content_body.read_all().await?),
+            })
+            .send()
+            .await
+        else {
+            return Err(std::io::Error::other("put_object error"));
+        };
+
+        Ok(res.version_id().unwrap_or("").to_string())
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        let client = self.client.clone();
+        let Ok(res) = client
+            .get_object()
+            .bucket(&self.bucket)
+            .key(&self.get_dest(object))
+            .send()
+            .await
+        else {
+            return Err(std::io::Error::other("get_object error"));
+        };
+
+        Ok(ReadCloser::new(std::io::Cursor::new(
+            res.body.collect().await.map(|data| data.into_bytes().to_vec())?,
+        )))
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        let client = self.client.clone();
+        if let Err(_) = client
+            .delete_object()
+            .bucket(&self.bucket)
+            .key(&self.get_dest(object))
+            .send()
+            .await
+        {
+            return Err(std::io::Error::other("delete_object error"));
+        }
+
+        Ok(())
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        let client = self.client.clone();
+        let Ok(res) = client
+            .list_objects_v2()
+            .bucket(&self.bucket)
+            //.max_keys(10)
+            //.into_paginator()
+            .send()
+            .await
+        else {
+            return Err(std::io::Error::other("list_objects_v2 error"));
+        };
+
+        Ok(res.common_prefixes.unwrap().len() > 0 || res.contents.unwrap().len() > 0)
+    }
+}
@@ -0,0 +1,164 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#![allow(unused_imports)]
+#![allow(unused_variables)]
+#![allow(unused_mut)]
+#![allow(unused_assignments)]
+#![allow(unused_must_use)]
+#![allow(clippy::all)]
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::client::{
+    admin_handler_utils::AdminError,
+    api_put_object::PutObjectOptions,
+    credentials::{Credentials, SignatureType, Static, Value},
+    transition_api::{BucketLookupType, Options, ReadCloser, ReaderImpl, TransitionClient, TransitionCore},
+};
+use crate::tier::{
+    tier_config::TierTencent,
+    warm_backend::{WarmBackend, WarmBackendGetOpts},
+    warm_backend_s3::WarmBackendS3,
+};
+use tracing::warn;
+
+const MAX_MULTIPART_PUT_OBJECT_SIZE: i64 = 1024 * 1024 * 1024 * 1024 * 5;
+const MAX_PARTS_COUNT: i64 = 10000;
+const _MAX_PART_SIZE: i64 = 1024 * 1024 * 1024 * 5;
+const MIN_PART_SIZE: i64 = 1024 * 1024 * 128;
+
+pub struct WarmBackendTencent(WarmBackendS3);
+
+impl WarmBackendTencent {
+    pub async fn new(conf: &TierTencent, tier: &str) -> Result<Self, std::io::Error> {
+        if conf.access_key == "" || conf.secret_key == "" {
+            return Err(std::io::Error::other("both access and secret keys are required"));
+        }
+
+        if conf.bucket == "" {
+            return Err(std::io::Error::other("no bucket name was provided"));
+        }
+
+        let u = match url::Url::parse(&conf.endpoint) {
+            Ok(u) => u,
+            Err(e) => {
+                return Err(std::io::Error::other(e.to_string()));
+            }
+        };
+
+        let creds = Credentials::new(Static(Value {
+            access_key_id: conf.access_key.clone(),
+            secret_access_key: conf.secret_key.clone(),
+            session_token: "".to_string(),
+            signer_type: SignatureType::SignatureV4,
+            ..Default::default()
+        }));
+        let opts = Options {
+            creds,
+            secure: u.scheme() == "https",
+            //transport: GLOBAL_RemoteTargetTransport,
+            trailing_headers: true,
+            region: conf.region.clone(),
+            bucket_lookup: BucketLookupType::BucketLookupDNS,
+            ..Default::default()
+        };
+        let scheme = u.scheme();
+        let default_port = if scheme == "https" { 443 } else { 80 };
+        let client = TransitionClient::new(
+            &format!("{}:{}", u.host_str().expect("err"), u.port().unwrap_or(default_port)),
+            opts,
+            "tencent",
+        )
+        .await?;
+
+        let client = Arc::new(client);
+        let core = TransitionCore(Arc::clone(&client));
+        Ok(Self(WarmBackendS3 {
+            client,
+            core,
+            bucket: conf.bucket.clone(),
+            prefix: conf.prefix.strip_suffix("/").unwrap_or(&conf.prefix).to_owned(),
+            storage_class: "".to_string(),
+        }))
+    }
+}
+
+#[async_trait::async_trait]
+impl WarmBackend for WarmBackendTencent {
+    async fn put_with_meta(
+        &self,
+        object: &str,
+        r: ReaderImpl,
+        length: i64,
+        meta: HashMap<String, String>,
+    ) -> Result<String, std::io::Error> {
+        let part_size = optimal_part_size(length)?;
+        let client = self.0.client.clone();
+        let res = client
+            .put_object(
+                &self.0.bucket,
+                &self.0.get_dest(object),
+                r,
+                length,
+                &PutObjectOptions {
+                    storage_class: self.0.storage_class.clone(),
+                    part_size: part_size as u64,
+                    disable_content_sha256: true,
+                    user_metadata: meta,
+                    ..Default::default()
+                },
+            )
+            .await?;
+        //self.ToObjectError(err, object)
+        Ok(res.version_id)
+    }
+
+    async fn put(&self, object: &str, r: ReaderImpl, length: i64) -> Result<String, std::io::Error> {
+        self.put_with_meta(object, r, length, HashMap::new()).await
+    }
+
+    async fn get(&self, object: &str, rv: &str, opts: WarmBackendGetOpts) -> Result<ReadCloser, std::io::Error> {
+        self.0.get(object, rv, opts).await
+    }
+
+    async fn remove(&self, object: &str, rv: &str) -> Result<(), std::io::Error> {
+        self.0.remove(object, rv).await
+    }
+
+    async fn in_use(&self) -> Result<bool, std::io::Error> {
+        self.0.in_use().await
+    }
+}
+
+fn optimal_part_size(object_size: i64) -> Result<i64, std::io::Error> {
+    let mut object_size = object_size;
+    if object_size == -1 {
+        object_size = MAX_MULTIPART_PUT_OBJECT_SIZE;
+    }
+
+    if object_size > MAX_MULTIPART_PUT_OBJECT_SIZE {
+        return Err(std::io::Error::other("entity too large"));
+    }
+
+    let configured_part_size = MIN_PART_SIZE;
+    let mut part_size_flt = object_size as f64 / MAX_PARTS_COUNT as f64;
+    part_size_flt = (part_size_flt as f64 / configured_part_size as f64).ceil() * configured_part_size as f64;
+
+    let part_size = part_size_flt as i64;
+    if part_size == 0 {
+        return Ok(MIN_PART_SIZE);
+    }
+    Ok(part_size)
+}
@@ -40,6 +40,8 @@ byteorder = { workspace = true }
 tracing.workspace = true
 thiserror.workspace = true
 s3s.workspace = true
+lazy_static.workspace = true
+regex.workspace = true

 [dev-dependencies]
 criterion = { workspace = true }
@@ -12,16 +12,19 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

+use super::filemeta::TRANSITION_COMPLETE;
 use crate::error::{Error, Result};
 use crate::{ReplicationState, ReplicationStatusType, VersionPurgeStatusType};
 use bytes::Bytes;
 use rmp_serde::Serializer;
 use rustfs_utils::HashAlgorithm;
 use rustfs_utils::http::headers::{RESERVED_METADATA_PREFIX_LOWER, RUSTFS_HEALING};
+use s3s::dto::{RestoreStatus, Timestamp};
+use s3s::header::X_AMZ_RESTORE;
 use serde::Deserialize;
 use serde::Serialize;
 use std::collections::HashMap;
-use time::OffsetDateTime;
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 use uuid::Uuid;

 pub const ERASURE_ALGORITHM: &str = "rs-vandermonde";
@@ -35,6 +38,8 @@ pub const TIER_FV_ID: &str = "tier-free-versionID";
 pub const TIER_FV_MARKER: &str = "tier-free-marker";
 pub const TIER_SKIP_FV_ID: &str = "tier-skip-fvid";

+const ERR_RESTORE_HDR_MALFORMED: &str = "x-amz-restore header malformed";
+
 #[derive(Serialize, Deserialize, Debug, PartialEq, Clone, Default)]
 pub struct ObjectPartInfo {
    pub etag: String,
@@ -284,6 +289,7 @@ impl FileInfo {
        Ok(t)
    }

+    #[allow(clippy::too_many_arguments)]
    pub fn add_object_part(
        &mut self,
        num: usize,
@@ -292,6 +298,7 @@ impl FileInfo {
        mod_time: Option<OffsetDateTime>,
        actual_size: i64,
        index: Option<Bytes>,
+        checksums: Option<HashMap<String, String>>,
    ) {
        let part = ObjectPartInfo {
            etag,
@@ -300,7 +307,7 @@ impl FileInfo {
            mod_time,
            actual_size,
            index,
-            checksums: None,
+            checksums,
            error: None,
        };

@@ -392,7 +399,10 @@ impl FileInfo {

    /// Check if the object is remote (transitioned to another tier)
    pub fn is_remote(&self) -> bool {
-        !self.transition_tier.is_empty()
+        if self.transition_status != TRANSITION_COMPLETE {
+            return false;
+        }
+        !is_restored_object_on_disk(&self.metadata)
    }

    /// Get the data directory for this object
@@ -533,3 +543,101 @@ pub struct FilesInfo {
    pub files: Vec<FileInfo>,
    pub is_truncated: bool,
 }
+
+pub trait RestoreStatusOps {
+    fn expiry(&self) -> Option<OffsetDateTime>;
+    fn on_going(&self) -> bool;
+    fn on_disk(&self) -> bool;
+    fn to_string(&self) -> String;
+}
+
+impl RestoreStatusOps for RestoreStatus {
+    fn expiry(&self) -> Option<OffsetDateTime> {
+        if self.on_going() {
+            return None;
+        }
+        self.restore_expiry_date.clone().map(OffsetDateTime::from)
+    }
+
+    fn on_going(&self) -> bool {
+        if let Some(on_going) = self.is_restore_in_progress {
+            return on_going;
+        }
+        false
+    }
+
+    fn on_disk(&self) -> bool {
+        let expiry = self.expiry();
+        if let Some(expiry0) = expiry
+            && OffsetDateTime::now_utc().unix_timestamp() < expiry0.unix_timestamp()
+        {
+            return true;
+        }
+        false
+    }
+
+    fn to_string(&self) -> String {
+        if self.on_going() {
+            return "ongoing-request=\"true\"".to_string();
+        }
+        format!(
+            "ongoing-request=\"false\", expiry-date=\"{}\"",
+            OffsetDateTime::from(self.restore_expiry_date.clone().unwrap())
+                .format(&Rfc3339)
+                .unwrap()
+        )
+    }
+}
+
+fn parse_restore_obj_status(restore_hdr: &str) -> Result<RestoreStatus> {
+    let tokens: Vec<&str> = restore_hdr.splitn(2, ",").collect();
+    let progress_tokens: Vec<&str> = tokens[0].splitn(2, "=").collect();
+    if progress_tokens.len() != 2 {
+        return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+    }
+    if progress_tokens[0].trim() != "ongoing-request" {
+        return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+    }
+
+    match progress_tokens[1] {
+        "true" | "\"true\"" => {
+            if tokens.len() == 1 {
+                return Ok(RestoreStatus {
+                    is_restore_in_progress: Some(true),
+                    ..Default::default()
+                });
+            }
+        }
+        "false" | "\"false\"" => {
+            if tokens.len() != 2 {
+                return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+            }
+            let expiry_tokens: Vec<&str> = tokens[1].splitn(2, "=").collect();
+            if expiry_tokens.len() != 2 {
+                return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+            }
+            if expiry_tokens[0].trim() != "expiry-date" {
+                return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+            }
+            let expiry = OffsetDateTime::parse(expiry_tokens[1].trim_matches('"'), &Rfc3339).unwrap();
+            /*if err != nil {
+                return Err(Error::other(ERR_RESTORE_HDR_MALFORMED));
+            }*/
+            return Ok(RestoreStatus {
+                is_restore_in_progress: Some(false),
+                restore_expiry_date: Some(Timestamp::from(expiry)),
+            });
+        }
+        _ => (),
+    }
+    Err(Error::other(ERR_RESTORE_HDR_MALFORMED))
+}
+
+pub fn is_restored_object_on_disk(meta: &HashMap<String, String>) -> bool {
+    if let Some(restore_hdr) = meta.get(X_AMZ_RESTORE.as_str()) {
+        if let Ok(restore_status) = parse_restore_obj_status(restore_hdr) {
+            return restore_status.on_disk();
+        }
+    }
+    false
+}
@@ -15,12 +15,16 @@
 use crate::error::{Error, Result};
 use crate::fileinfo::{ErasureAlgo, ErasureInfo, FileInfo, FileInfoVersions, ObjectPartInfo, RawFileInfo};
 use crate::filemeta_inline::InlineData;
-use crate::{ReplicationStatusType, VersionPurgeStatusType};
+use crate::{
+    ReplicationState, ReplicationStatusType, VersionPurgeStatusType, replication_statuses_map, version_purge_statuses_map,
+};
 use byteorder::ByteOrder;
 use bytes::Bytes;
+use rustfs_utils::http::AMZ_BUCKET_REPLICATION_STATUS;
 use rustfs_utils::http::headers::{
-    self, AMZ_META_UNENCRYPTED_CONTENT_LENGTH, AMZ_META_UNENCRYPTED_CONTENT_MD5, AMZ_STORAGE_CLASS, RESERVED_METADATA_PREFIX,
-    RESERVED_METADATA_PREFIX_LOWER, VERSION_PURGE_STATUS_KEY,
+    self, AMZ_META_UNENCRYPTED_CONTENT_LENGTH, AMZ_META_UNENCRYPTED_CONTENT_MD5, AMZ_RESTORE_EXPIRY_DAYS,
+    AMZ_RESTORE_REQUEST_DATE, AMZ_STORAGE_CLASS, RESERVED_METADATA_PREFIX, RESERVED_METADATA_PREFIX_LOWER,
+    VERSION_PURGE_STATUS_KEY,
 };
 use s3s::header::X_AMZ_RESTORE;
 use serde::{Deserialize, Serialize};
@@ -30,6 +34,7 @@ use std::hash::Hasher;
 use std::io::{Read, Write};
 use std::{collections::HashMap, io::Cursor};
 use time::OffsetDateTime;
+use time::format_description::well_known::Rfc3339;
 use tokio::io::AsyncRead;
 use tracing::error;
 use uuid::Uuid;
@@ -64,9 +69,6 @@ pub const TRANSITIONED_OBJECTNAME: &str = "transitioned-object";
 pub const TRANSITIONED_VERSION_ID: &str = "transitioned-versionID";
 pub const TRANSITION_TIER: &str = "transition-tier";

-const X_AMZ_RESTORE_EXPIRY_DAYS: &str = "X-Amz-Restore-Expiry-Days";
-const X_AMZ_RESTORE_REQUEST_DATE: &str = "X-Amz-Restore-Request-Date";
-
 // type ScanHeaderVersionFn = Box<dyn Fn(usize, &[u8], &[u8]) -> Result<()>>;

 #[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
@@ -689,11 +691,6 @@ impl FileMeta {
            }
        }

-        // ???
-        if fi.transition_status == TRANSITION_COMPLETE {
-            update_version = false;
-        }
-
        for (i, ver) in self.versions.iter().enumerate() {
            if ver.header.version_id != fi.version_id {
                continue;
@@ -1084,13 +1081,24 @@ impl FileMeta {

    /// Count shared data directories
    pub fn shared_data_dir_count(&self, version_id: Option<Uuid>, data_dir: Option<Uuid>) -> usize {
+        if self.data.entries().unwrap_or_default() > 0
+            && version_id.is_some()
+            && self
+                .data
+                .find(version_id.unwrap().to_string().as_str())
+                .unwrap_or_default()
+                .is_some()
+        {
+            return 0;
+        }
+
        self.versions
            .iter()
            .filter(|v| {
                v.header.version_type == VersionType::Object && v.header.version_id != version_id && v.header.user_data_dir()
            })
-            .filter_map(|v| FileMetaVersion::decode_data_dir_from_meta(&v.meta).ok().flatten())
-            .filter(|&dir| Some(dir) == data_dir)
+            .filter_map(|v| FileMetaVersion::decode_data_dir_from_meta(&v.meta).ok())
+            .filter(|&dir| dir == data_dir)
            .count()
    }

@@ -1378,7 +1386,7 @@ impl From<FileInfo> for FileMetaVersion {
                FileMetaVersion {
                    version_type: VersionType::Object,
                    delete_marker: None,
-                    object: Some(value.into()),
+                    object: Some(MetaObject::from(value)),
                    write_version: 0,
                }
            }
@@ -1742,7 +1750,25 @@ impl MetaObject {
            }
        }

-        // todo: ReplicationState,Delete
+        let replication_state_internal = get_internal_replication_state(&metadata);
+
+        let mut deleted = false;
+
+        if let Some(v) = replication_state_internal.as_ref() {
+            if !v.composite_version_purge_status().is_empty() {
+                deleted = true;
+            }
+
+            let st = v.composite_replication_status();
+            if !st.is_empty() {
+                metadata.insert(AMZ_BUCKET_REPLICATION_STATUS.to_string(), st.to_string());
+            }
+        }
+
+        let checksum = self
+            .meta_sys
+            .get(format!("{RESERVED_METADATA_PREFIX_LOWER}crc").as_str())
+            .map(|v| Bytes::from(v.clone()));

        let erasure = ErasureInfo {
            algorithm: self.erasure_algorithm.to_string(),
@@ -1754,6 +1780,26 @@ impl MetaObject {
            ..Default::default()
        };

+        let transition_status = self
+            .meta_sys
+            .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITION_STATUS}").as_str())
+            .map(|v| String::from_utf8_lossy(v).to_string())
+            .unwrap_or_default();
+        let transitioned_objname = self
+            .meta_sys
+            .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_OBJECTNAME}").as_str())
+            .map(|v| String::from_utf8_lossy(v).to_string())
+            .unwrap_or_default();
+        let transition_version_id = self
+            .meta_sys
+            .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_VERSION_ID}").as_str())
+            .map(|v| Uuid::from_slice(v.as_slice()).unwrap_or_default());
+        let transition_tier = self
+            .meta_sys
+            .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITION_TIER}").as_str())
+            .map(|v| String::from_utf8_lossy(v).to_string())
+            .unwrap_or_default();
+
        FileInfo {
            version_id,
            erasure,
@@ -1764,6 +1810,13 @@ impl MetaObject {
            volume: volume.to_string(),
            parts,
            metadata,
+            replication_state_internal,
+            deleted,
+            checksum,
+            transition_status,
+            transitioned_objname,
+            transition_version_id,
+            transition_tier,
            ..Default::default()
        }
    }
@@ -1789,8 +1842,8 @@ impl MetaObject {

    pub fn remove_restore_hdrs(&mut self) {
        self.meta_user.remove(X_AMZ_RESTORE.as_str());
-        self.meta_user.remove(X_AMZ_RESTORE_EXPIRY_DAYS);
-        self.meta_user.remove(X_AMZ_RESTORE_REQUEST_DATE);
+        self.meta_user.remove(AMZ_RESTORE_EXPIRY_DAYS);
+        self.meta_user.remove(AMZ_RESTORE_REQUEST_DATE);
    }

    pub fn uses_data_dir(&self) -> bool {
@@ -1904,6 +1957,38 @@ impl From<FileInfo> for MetaObject {
            }
        }

+        if !value.transition_status.is_empty() {
+            meta_sys.insert(
+                format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITION_STATUS}"),
+                value.transition_status.as_bytes().to_vec(),
+            );
+        }
+
+        if !value.transitioned_objname.is_empty() {
+            meta_sys.insert(
+                format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_OBJECTNAME}"),
+                value.transitioned_objname.as_bytes().to_vec(),
+            );
+        }
+
+        if let Some(vid) = &value.transition_version_id {
+            meta_sys.insert(
+                format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_VERSION_ID}"),
+                vid.as_bytes().to_vec(),
+            );
+        }
+
+        if !value.transition_tier.is_empty() {
+            meta_sys.insert(
+                format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITION_TIER}"),
+                value.transition_tier.as_bytes().to_vec(),
+            );
+        }
+
+        if let Some(content_hash) = value.checksum {
+            meta_sys.insert(format!("{RESERVED_METADATA_PREFIX_LOWER}crc"), content_hash.to_vec());
+        }
+
        Self {
            version_id: value.version_id,
            data_dir: value.data_dir,
@@ -1927,6 +2012,50 @@ impl From<FileInfo> for MetaObject {
    }
 }

+fn get_internal_replication_state(metadata: &HashMap<String, String>) -> Option<ReplicationState> {
+    let mut rs = ReplicationState::default();
+    let mut has = false;
+
+    for (k, v) in metadata.iter() {
+        if k == VERSION_PURGE_STATUS_KEY {
+            rs.version_purge_status_internal = Some(v.clone());
+            rs.purge_targets = version_purge_statuses_map(v.as_str());
+            has = true;
+            continue;
+        }
+
+        if let Some(sub_key) = k.strip_prefix(RESERVED_METADATA_PREFIX_LOWER) {
+            match sub_key {
+                "replica-timestamp" => {
+                    has = true;
+                    rs.replica_timestamp = Some(OffsetDateTime::parse(v, &Rfc3339).unwrap_or(OffsetDateTime::UNIX_EPOCH));
+                }
+                "replica-status" => {
+                    has = true;
+                    rs.replica_status = ReplicationStatusType::from(v.as_str());
+                }
+                "replication-timestamp" => {
+                    has = true;
+                    rs.replication_timestamp = Some(OffsetDateTime::parse(v, &Rfc3339).unwrap_or(OffsetDateTime::UNIX_EPOCH))
+                }
+                "replication-status" => {
+                    has = true;
+                    rs.replication_status_internal = Some(v.clone());
+                    rs.targets = replication_statuses_map(v.as_str());
+                }
+                _ => {
+                    if let Some(arn) = sub_key.strip_prefix("replication-reset-") {
+                        has = true;
+                        rs.reset_statuses_map.insert(arn.to_string(), v.clone());
+                    }
+                }
+            }
+        }
+    }
+
+    if has { Some(rs) } else { None }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq)]
 pub struct MetaDeleteMarker {
    #[serde(rename = "ID")]
@@ -1939,24 +2068,51 @@ pub struct MetaDeleteMarker {

 impl MetaDeleteMarker {
    pub fn free_version(&self) -> bool {
-        self.meta_sys.contains_key(FREE_VERSION_META_HEADER)
+        self.meta_sys
+            .contains_key(format!("{RESERVED_METADATA_PREFIX_LOWER}{FREE_VERSION}").as_str())
    }

    pub fn into_fileinfo(&self, volume: &str, path: &str, _all_parts: bool) -> FileInfo {
-        let metadata = self.meta_sys.clone();
+        let metadata = self
+            .meta_sys
+            .clone()
+            .into_iter()
+            .map(|(k, v)| (k, String::from_utf8_lossy(&v).to_string()))
+            .collect();
+        let replication_state_internal = get_internal_replication_state(&metadata);

-        FileInfo {
+        let mut fi = FileInfo {
            version_id: self.version_id.filter(|&vid| !vid.is_nil()),
            name: path.to_string(),
            volume: volume.to_string(),
            deleted: true,
            mod_time: self.mod_time,
-            metadata: metadata
-                .into_iter()
-                .map(|(k, v)| (k, String::from_utf8_lossy(&v).to_string()))
-                .collect(),
+            metadata,
+            replication_state_internal,
            ..Default::default()
+        };
+
+        if self.free_version() {
+            fi.set_tier_free_version();
+            fi.transition_tier = self
+                .meta_sys
+                .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITION_TIER}").as_str())
+                .map(|v| String::from_utf8_lossy(v).to_string())
+                .unwrap_or_default();
+
+            fi.transitioned_objname = self
+                .meta_sys
+                .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_OBJECTNAME}").as_str())
+                .map(|v| String::from_utf8_lossy(v).to_string())
+                .unwrap_or_default();
+
+            fi.transition_version_id = self
+                .meta_sys
+                .get(format!("{RESERVED_METADATA_PREFIX_LOWER}{TRANSITIONED_VERSION_ID}").as_str())
+                .map(|v| Uuid::from_slice(v.as_slice()).unwrap_or_default());
        }
+
+        fi
    }

    pub fn unmarshal_msg(&mut self, buf: &[u8]) -> Result<u64> {
@@ -2160,8 +2316,6 @@ pub enum Flags {
    InlineData = 1 << 2,
 }

-const FREE_VERSION_META_HEADER: &str = "free-version";
-
 // mergeXLV2Versions
 pub fn merge_file_meta_versions(
    mut quorum: usize,
@@ -44,6 +44,20 @@ impl InlineData {
        if self.0.is_empty() { &self.0 } else { &self.0[1..] }
    }

+    pub fn entries(&self) -> Result<usize> {
+        if self.0.is_empty() || !self.version_ok() {
+            return Ok(0);
+        }
+
+        let buf = self.after_version();
+
+        let mut cur = Cursor::new(buf);
+
+        let fields_len = rmp::decode::read_map_len(&mut cur)?;
+
+        Ok(fields_len as usize)
+    }
+
    pub fn find(&self, key: &str) -> Result<Option<Vec<u8>>> {
        if self.0.is_empty() || !self.version_ok() {
            return Ok(None);
@@ -1,8 +1,36 @@
+use bytes::Bytes;
 use core::fmt;
+use regex::Regex;
+use rustfs_utils::http::RESERVED_METADATA_PREFIX_LOWER;
 use serde::{Deserialize, Serialize};
+use std::any::Any;
 use std::collections::HashMap;
 use std::time::Duration;
 use time::OffsetDateTime;
+use uuid::Uuid;
+
+pub const REPLICATION_RESET: &str = "replication-reset";
+pub const REPLICATION_STATUS: &str = "replication-status";
+
+// ReplicateQueued - replication being queued trail
+pub const REPLICATE_QUEUED: &str = "replicate:queue";
+
+// ReplicateExisting - audit trail for existing objects replication
+pub const REPLICATE_EXISTING: &str = "replicate:existing";
+// ReplicateExistingDelete - audit trail for delete replication triggered for existing delete markers
+pub const REPLICATE_EXISTING_DELETE: &str = "replicate:existing:delete";
+
+// ReplicateMRF - audit trail for replication from Most Recent Failures (MRF) queue
+pub const REPLICATE_MRF: &str = "replicate:mrf";
+// ReplicateIncoming - audit trail of inline replication
+pub const REPLICATE_INCOMING: &str = "replicate:incoming";
+// ReplicateIncomingDelete - audit trail of inline replication of deletes.
+pub const REPLICATE_INCOMING_DELETE: &str = "replicate:incoming:delete";
+
+// ReplicateHeal - audit trail for healing of failed/pending replications
+pub const REPLICATE_HEAL: &str = "replicate:heal";
+// ReplicateHealDelete - audit trail of healing of failed/pending delete replications.
+pub const REPLICATE_HEAL_DELETE: &str = "replicate:heal:delete";

 /// StatusType of Replication for x-amz-replication-status header
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default, Hash)]
@@ -492,3 +520,371 @@ impl ReplicatedInfos {
        ReplicationAction::None
    }
 }
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct MrfReplicateEntry {
+    #[serde(rename = "bucket")]
+    pub bucket: String,
+
+    #[serde(rename = "object")]
+    pub object: String,
+
+    #[serde(skip_serializing, skip_deserializing)]
+    pub version_id: Option<Uuid>,
+
+    #[serde(rename = "retryCount")]
+    pub retry_count: i32,
+
+    #[serde(skip_serializing, skip_deserializing)]
+    pub size: i64,
+}
+
+pub trait ReplicationWorkerOperation: Any + Send + Sync {
+    fn to_mrf_entry(&self) -> MrfReplicateEntry;
+    fn as_any(&self) -> &dyn Any;
+    fn get_bucket(&self) -> &str;
+    fn get_object(&self) -> &str;
+    fn get_size(&self) -> i64;
+    fn is_delete_marker(&self) -> bool;
+    fn get_op_type(&self) -> ReplicationType;
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ReplicateTargetDecision {
+    pub replicate: bool,
+    pub synchronous: bool,
+    pub arn: String,
+    pub id: String,
+}
+
+impl ReplicateTargetDecision {
+    pub fn new(arn: String, replicate: bool, sync: bool) -> Self {
+        Self {
+            replicate,
+            synchronous: sync,
+            arn,
+            id: String::new(),
+        }
+    }
+}
+
+impl fmt::Display for ReplicateTargetDecision {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{};{};{};{}", self.replicate, self.synchronous, self.arn, self.id)
+    }
+}
+
+/// ReplicateDecision represents replication decision for each target
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReplicateDecision {
+    pub targets_map: HashMap<String, ReplicateTargetDecision>,
+}
+
+impl ReplicateDecision {
+    pub fn new() -> Self {
+        Self {
+            targets_map: HashMap::new(),
+        }
+    }
+
+    /// Returns true if at least one target qualifies for replication
+    pub fn replicate_any(&self) -> bool {
+        self.targets_map.values().any(|t| t.replicate)
+    }
+
+    /// Returns true if at least one target qualifies for synchronous replication
+    pub fn is_synchronous(&self) -> bool {
+        self.targets_map.values().any(|t| t.synchronous)
+    }
+
+    /// Updates ReplicateDecision with target's replication decision
+    pub fn set(&mut self, target: ReplicateTargetDecision) {
+        self.targets_map.insert(target.arn.clone(), target);
+    }
+
+    /// Returns a stringified representation of internal replication status with all targets marked as `PENDING`
+    pub fn pending_status(&self) -> Option<String> {
+        let mut result = String::new();
+        for target in self.targets_map.values() {
+            if target.replicate {
+                result.push_str(&format!("{}={};", target.arn, ReplicationStatusType::Pending.as_str()));
+            }
+        }
+        if result.is_empty() { None } else { Some(result) }
+    }
+}
+
+impl fmt::Display for ReplicateDecision {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut result = String::new();
+        for (key, value) in &self.targets_map {
+            result.push_str(&format!("{key}={value},"));
+        }
+        write!(f, "{}", result.trim_end_matches(','))
+    }
+}
+
+impl Default for ReplicateDecision {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+// parse k-v pairs of target ARN to stringified ReplicateTargetDecision delimited by ',' into a
+// ReplicateDecision struct
+pub fn parse_replicate_decision(_bucket: &str, s: &str) -> std::io::Result<ReplicateDecision> {
+    let mut decision = ReplicateDecision::new();
+
+    if s.is_empty() {
+        return Ok(decision);
+    }
+
+    for p in s.split(',') {
+        if p.is_empty() {
+            continue;
+        }
+
+        let slc = p.split('=').collect::<Vec<&str>>();
+        if slc.len() != 2 {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                format!("invalid replicate decision format: {s}"),
+            ));
+        }
+
+        let tgt_str = slc[1].trim_matches('"');
+        let tgt = tgt_str.split(';').collect::<Vec<&str>>();
+        if tgt.len() != 4 {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                format!("invalid replicate decision format: {s}"),
+            ));
+        }
+
+        let tgt = ReplicateTargetDecision {
+            replicate: tgt[0] == "true",
+            synchronous: tgt[1] == "true",
+            arn: tgt[2].to_string(),
+            id: tgt[3].to_string(),
+        };
+        decision.targets_map.insert(slc[0].to_string(), tgt);
+    }
+
+    Ok(decision)
+
+    // r = ReplicateDecision{
+    // 	targetsMap: make(map[string]replicateTargetDecision),
+    // }
+    // if len(s) == 0 {
+    // 	return
+    // }
+    // for _, p := range strings.Split(s, ",") {
+    // 	if p == "" {
+    // 		continue
+    // 	}
+    // 	slc := strings.Split(p, "=")
+    // 	if len(slc) != 2 {
+    // 		return r, errInvalidReplicateDecisionFormat
+    // 	}
+    // 	tgtStr := strings.TrimSuffix(strings.TrimPrefix(slc[1], `"`), `"`)
+    // 	tgt := strings.Split(tgtStr, ";")
+    // 	if len(tgt) != 4 {
+    // 		return r, errInvalidReplicateDecisionFormat
+    // 	}
+    // 	r.targetsMap[slc[0]] = replicateTargetDecision{Replicate: tgt[0] == "true", Synchronous: tgt[1] == "true", Arn: tgt[2], ID: tgt[3]}
+    // }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReplicateObjectInfo {
+    pub name: String,
+    pub size: i64,
+    pub actual_size: i64,
+    pub bucket: String,
+    pub version_id: Option<Uuid>,
+    pub etag: Option<String>,
+    pub mod_time: Option<OffsetDateTime>,
+    pub replication_status: ReplicationStatusType,
+    pub replication_status_internal: Option<String>,
+    pub delete_marker: bool,
+    pub version_purge_status_internal: Option<String>,
+    pub version_purge_status: VersionPurgeStatusType,
+    pub replication_state: Option<ReplicationState>,
+    pub op_type: ReplicationType,
+    pub event_type: String,
+    pub dsc: ReplicateDecision,
+    pub existing_obj_resync: ResyncDecision,
+    pub target_statuses: HashMap<String, ReplicationStatusType>,
+    pub target_purge_statuses: HashMap<String, VersionPurgeStatusType>,
+    pub replication_timestamp: Option<OffsetDateTime>,
+    pub ssec: bool,
+    pub user_tags: String,
+    pub checksum: Option<Bytes>,
+    pub retry_count: u32,
+}
+
+impl ReplicationWorkerOperation for ReplicateObjectInfo {
+    fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    fn to_mrf_entry(&self) -> MrfReplicateEntry {
+        MrfReplicateEntry {
+            bucket: self.bucket.clone(),
+            object: self.name.clone(),
+            version_id: self.version_id,
+            retry_count: self.retry_count as i32,
+            size: self.size,
+        }
+    }
+
+    fn get_bucket(&self) -> &str {
+        &self.bucket
+    }
+
+    fn get_object(&self) -> &str {
+        &self.name
+    }
+
+    fn get_size(&self) -> i64 {
+        self.size
+    }
+
+    fn is_delete_marker(&self) -> bool {
+        self.delete_marker
+    }
+
+    fn get_op_type(&self) -> ReplicationType {
+        self.op_type
+    }
+}
+
+lazy_static::lazy_static! {
+    static ref REPL_STATUS_REGEX: Regex = Regex::new(r"([^=].*?)=([^,].*?);").unwrap();
+}
+
+impl ReplicateObjectInfo {
+    /// Returns replication status of a target
+    pub fn target_replication_status(&self, arn: &str) -> ReplicationStatusType {
+        let binding = self.replication_status_internal.clone().unwrap_or_default();
+        let captures = REPL_STATUS_REGEX.captures_iter(&binding);
+        for cap in captures {
+            if cap.len() == 3 && &cap[1] == arn {
+                return ReplicationStatusType::from(&cap[2]);
+            }
+        }
+        ReplicationStatusType::default()
+    }
+
+    /// Returns the relevant info needed by MRF
+    pub fn to_mrf_entry(&self) -> MrfReplicateEntry {
+        MrfReplicateEntry {
+            bucket: self.bucket.clone(),
+            object: self.name.clone(),
+            version_id: self.version_id,
+            retry_count: self.retry_count as i32,
+            size: self.size,
+        }
+    }
+}
+
+// constructs a replication status map from string representation
+pub fn replication_statuses_map(s: &str) -> HashMap<String, ReplicationStatusType> {
+    let mut targets = HashMap::new();
+    let rep_stat_matches = REPL_STATUS_REGEX.captures_iter(s).map(|c| c.extract());
+    for (_, [arn, status]) in rep_stat_matches {
+        if arn.is_empty() {
+            continue;
+        }
+        let status = ReplicationStatusType::from(status);
+        targets.insert(arn.to_string(), status);
+    }
+    targets
+}
+
+// constructs a version purge status map from string representation
+pub fn version_purge_statuses_map(s: &str) -> HashMap<String, VersionPurgeStatusType> {
+    let mut targets = HashMap::new();
+    let purge_status_matches = REPL_STATUS_REGEX.captures_iter(s).map(|c| c.extract());
+    for (_, [arn, status]) in purge_status_matches {
+        if arn.is_empty() {
+            continue;
+        }
+        let status = VersionPurgeStatusType::from(status);
+        targets.insert(arn.to_string(), status);
+    }
+    targets
+}
+
+pub fn get_replication_state(rinfos: &ReplicatedInfos, prev_state: &ReplicationState, _vid: Option<String>) -> ReplicationState {
+    let reset_status_map: Vec<(String, String)> = rinfos
+        .targets
+        .iter()
+        .filter(|v| !v.resync_timestamp.is_empty())
+        .map(|t| (target_reset_header(t.arn.as_str()), t.resync_timestamp.clone()))
+        .collect();
+
+    let repl_statuses = rinfos.replication_status_internal();
+    let vpurge_statuses = rinfos.version_purge_status_internal();
+
+    let mut reset_statuses_map = prev_state.reset_statuses_map.clone();
+    for (key, value) in reset_status_map {
+        reset_statuses_map.insert(key, value);
+    }
+
+    ReplicationState {
+        replicate_decision_str: prev_state.replicate_decision_str.clone(),
+        reset_statuses_map,
+        replica_timestamp: prev_state.replica_timestamp,
+        replica_status: prev_state.replica_status.clone(),
+        targets: replication_statuses_map(&repl_statuses.clone().unwrap_or_default()),
+        replication_status_internal: repl_statuses,
+        replication_timestamp: rinfos.replication_timestamp,
+        purge_targets: version_purge_statuses_map(&vpurge_statuses.clone().unwrap_or_default()),
+        version_purge_status_internal: vpurge_statuses,
+
+        ..Default::default()
+    }
+}
+
+pub fn target_reset_header(arn: &str) -> String {
+    format!("{RESERVED_METADATA_PREFIX_LOWER}{REPLICATION_RESET}-{arn}")
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ResyncTargetDecision {
+    pub replicate: bool,
+    pub reset_id: String,
+    pub reset_before_date: Option<OffsetDateTime>,
+}
+
+/// ResyncDecision is a struct representing a map with target's individual resync decisions
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ResyncDecision {
+    pub targets: HashMap<String, ResyncTargetDecision>,
+}
+
+impl ResyncDecision {
+    pub fn new() -> Self {
+        Self { targets: HashMap::new() }
+    }
+
+    /// Returns true if no targets with resync decision present
+    pub fn is_empty(&self) -> bool {
+        self.targets.is_empty()
+    }
+
+    pub fn must_resync(&self) -> bool {
+        self.targets.values().any(|v| v.replicate)
+    }
+
+    pub fn must_resync_target(&self, tgt_arn: &str) -> bool {
+        self.targets.get(tgt_arn).map(|v| v.replicate).unwrap_or(false)
+    }
+}
+
+impl Default for ResyncDecision {
+    fn default() -> Self {
+        Self::new()
+    }
+}
@@ -34,7 +34,6 @@ time = { workspace = true, features = ["serde-human-readable"] }
 serde = { workspace = true, features = ["derive", "rc"] }
 rustfs-ecstore = { workspace = true }
 rustfs-policy.workspace = true
-rustfs-config.workspace = true
 serde_json.workspace = true
 async-trait.workspace = true
 thiserror.workspace = true
@@ -33,7 +33,6 @@ use rustfs_policy::{
        EMBEDDED_POLICY_TYPE, INHERITED_POLICY_TYPE, Policy, PolicyDoc, default::DEFAULT_POLICIES, iam_policy_claim_name_sa,
    },
 };
-use rustfs_utils::crypto::base64_encode;
 use rustfs_utils::path::path_join_buf;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -555,7 +554,10 @@ where
                    return Err(Error::PolicyTooLarge);
                }

-                m.insert(SESSION_POLICY_NAME.to_owned(), Value::String(base64_encode(&policy_buf)));
+                m.insert(
+                    SESSION_POLICY_NAME.to_owned(),
+                    Value::String(base64_simd::URL_SAFE_NO_PAD.encode_to_string(&policy_buf)),
+                );
                m.insert(iam_policy_claim_name_sa(), Value::String(EMBEDDED_POLICY_TYPE.to_owned()));
            }
        }
@@ -37,7 +37,6 @@ use rustfs_policy::auth::{
 use rustfs_policy::policy::Args;
 use rustfs_policy::policy::opa;
 use rustfs_policy::policy::{EMBEDDED_POLICY_TYPE, INHERITED_POLICY_TYPE, Policy, PolicyDoc, iam_policy_claim_name_sa};
-use rustfs_utils::crypto::{base64_decode, base64_encode};
 use serde_json::Value;
 use serde_json::json;
 use std::collections::HashMap;
@@ -363,7 +362,10 @@ impl<T: Store> IamSys<T> {
        m.insert("parent".to_owned(), Value::String(parent_user.to_owned()));

        if !policy_buf.is_empty() {
-            m.insert(SESSION_POLICY_NAME.to_owned(), Value::String(base64_encode(&policy_buf)));
+            m.insert(
+                SESSION_POLICY_NAME.to_owned(),
+                Value::String(base64_simd::URL_SAFE_NO_PAD.encode_to_string(&policy_buf)),
+            );
            m.insert(iam_policy_claim_name_sa(), Value::String(EMBEDDED_POLICY_TYPE.to_owned()));
        } else {
            m.insert(iam_policy_claim_name_sa(), Value::String(INHERITED_POLICY_TYPE.to_owned()));
@@ -456,7 +458,9 @@ impl<T: Store> IamSys<T> {
        let op_sp = claims.get(SESSION_POLICY_NAME);
        if let (Some(pt), Some(sp)) = (op_pt, op_sp) {
            if pt == EMBEDDED_POLICY_TYPE {
-                let policy = serde_json::from_slice(&base64_decode(sp.as_str().unwrap_or_default().as_bytes())?)?;
+                let policy = serde_json::from_slice(
+                    &base64_simd::URL_SAFE_NO_PAD.decode_to_vec(sp.as_str().unwrap_or_default().as_bytes())?,
+                )?;
                return Ok((sa, Some(policy)));
            }
        }
@@ -515,7 +519,9 @@ impl<T: Store> IamSys<T> {
        let op_sp = claims.get(SESSION_POLICY_NAME);
        if let (Some(pt), Some(sp)) = (op_pt, op_sp) {
            if pt == EMBEDDED_POLICY_TYPE {
-                let policy = serde_json::from_slice(&base64_decode(sp.as_str().unwrap_or_default().as_bytes())?)?;
+                let policy = serde_json::from_slice(
+                    &base64_simd::URL_SAFE_NO_PAD.decode_to_vec(sp.as_str().unwrap_or_default().as_bytes())?,
+                )?;
                return Ok((sa, Some(policy)));
            }
        }
@@ -528,7 +534,7 @@ impl<T: Store> IamSys<T> {
            return Err(IamError::NoSuchServiceAccount(access_key.to_string()));
        };

-        if u.credentials.is_service_account() {
+        if !u.credentials.is_service_account() {
            return Err(IamError::NoSuchServiceAccount(access_key.to_string()));
        }

@@ -906,7 +912,9 @@ pub fn get_claims_from_token_with_secret(token: &str, secret: &str) -> Result<Ha

    if let Some(session_policy) = ms.claims.get(SESSION_POLICY_NAME) {
        let policy_str = session_policy.as_str().unwrap_or_default();
-        let policy = base64_decode(policy_str.as_bytes()).map_err(|e| Error::other(format!("base64 decode err {e}")))?;
+        let policy = base64_simd::URL_SAFE_NO_PAD
+            .decode_to_vec(policy_str.as_bytes())
+            .map_err(|e| Error::other(format!("base64 decode err {e}")))?;
        ms.claims.insert(
            SESSION_POLICY_NAME_EXTRACTED.to_string(),
            Value::String(String::from_utf8(policy).map_err(|e| Error::other(format!("utf8 decode err {e}")))?),
@@ -36,6 +36,8 @@ gpu = ["dep:nvml-wrapper"]
 rustfs-config = { workspace = true, features = ["constants", "observability"] }
 rustfs-utils = { workspace = true, features = ["ip", "path"] }
 flexi_logger = { workspace = true }
+metrics = { workspace = true }
+metrics-exporter-opentelemetry = { workspace = true }
 nu-ansi-term = { workspace = true }
 nvml-wrapper = { workspace = true, optional = true }
 opentelemetry = { workspace = true }
@@ -47,7 +49,6 @@ opentelemetry-semantic-conventions = { workspace = true, features = ["semconv_ex
 serde = { workspace = true }
 smallvec = { workspace = true, features = ["serde"] }
 tracing = { workspace = true, features = ["std", "attributes"] }
-tracing-core = { workspace = true }
 tracing-error = { workspace = true }
 tracing-opentelemetry = { workspace = true }
 tracing-subscriber = { workspace = true, features = ["registry", "std", "fmt", "env-filter", "tracing-log", "time", "local-time", "json"] }
@@ -14,6 +14,8 @@

 use crate::AppConfig;
 use crate::telemetry::{OtelGuard, init_telemetry};
+use opentelemetry::metrics::Meter;
+use rustfs_config::APP_NAME;
 use std::sync::{Arc, Mutex};
 use tokio::sync::{OnceCell, SetError};
 use tracing::{error, info};
@@ -21,6 +23,23 @@ use tracing::{error, info};
 /// Global guard for OpenTelemetry tracing
 static GLOBAL_GUARD: OnceCell<Arc<Mutex<OtelGuard>>> = OnceCell::const_new();

+/// Flag indicating if observability is enabled
+pub(crate) static IS_OBSERVABILITY_ENABLED: OnceCell<bool> = OnceCell::const_new();
+
+/// Name of the observability meter
+pub(crate) static OBSERVABILITY_METER_NAME: OnceCell<String> = OnceCell::const_new();
+
+/// Check whether Observability is enabled
+pub fn is_observability_enabled() -> bool {
+    IS_OBSERVABILITY_ENABLED.get().copied().unwrap_or(false)
+}
+
+/// Get the global meter for observability
+pub fn global_meter() -> Meter {
+    let meter_name = OBSERVABILITY_METER_NAME.get().map(|s| s.as_str()).unwrap_or(APP_NAME);
+    opentelemetry::global::meter(meter_name)
+}
+
 /// Error type for global guard operations
 #[derive(Debug, thiserror::Error)]
 pub enum GlobalError {
@@ -13,11 +13,13 @@
 // limitations under the License.

 use crate::config::OtelConfig;
+use crate::global::{IS_OBSERVABILITY_ENABLED, OBSERVABILITY_METER_NAME};
 use flexi_logger::{
    Age, Cleanup, Criterion, DeferredNow, FileSpec, LogSpecification, Naming, Record, WriteMode,
    WriteMode::{AsyncWith, BufferAndFlush},
    style,
 };
+use metrics::counter;
 use nu_ansi_term::Color;
 use opentelemetry::trace::TracerProvider;
 use opentelemetry::{KeyValue, global};
@@ -232,6 +234,13 @@ pub(crate) fn init_telemetry(config: &OtelConfig) -> OtelGuard {
            meter_provider
        };

+        match metrics_exporter_opentelemetry::Recorder::builder("order-service").install_global() {
+            Ok(_) => {}
+            Err(e) => {
+                eprintln!("Failed to set global metrics recorder: {e:?}");
+            }
+        }
+
        // initialize logger provider
        let logger_provider = {
            let mut builder = SdkLoggerProvider::builder().with_resource(res);
@@ -302,9 +311,11 @@ pub(crate) fn init_telemetry(config: &OtelConfig) -> OtelGuard {
                    logger_level,
                    env::var("RUST_LOG").unwrap_or_else(|_| "Not set".to_string())
                );
+                IS_OBSERVABILITY_ENABLED.set(true).ok();
+                OBSERVABILITY_METER_NAME.set(service_name.to_string()).ok();
            }
        }
-
+        counter!("rustfs.start.total").increment(1);
        return OtelGuard {
            tracer_provider: Some(tracer_provider),
            meter_provider: Some(meter_provider),
@@ -30,7 +30,7 @@ workspace = true

 [dependencies]
 rustfs-config = { workspace = true, features = ["constants","opa"] }
-tokio.workspace = true
+tokio = { workspace = true, features = ["full"] }
 time = { workspace = true, features = ["serde-human-readable"] }
 serde = { workspace = true, features = ["derive", "rc"] }
 serde_json.workspace = true
@@ -39,7 +39,7 @@ pub struct AuthZPlugin {
 fn check() -> Result<(), String> {
    let env_list = env::vars();
    let mut candidate = HashMap::new();
-    let prefix = format!("{}{}", ENV_PREFIX, POLICY_PLUGIN_SUB_SYS).to_uppercase();
+    let prefix = format!("{ENV_PREFIX}{POLICY_PLUGIN_SUB_SYS}").to_uppercase();
    for (key, value) in env_list {
        if key.starts_with(&prefix) {
            candidate.insert(key.to_string(), value);
@@ -48,13 +48,13 @@ fn check() -> Result<(), String> {

    //check required env vars
    if candidate.remove(ENV_POLICY_PLUGIN_OPA_URL).is_none() {
-        return Err(format!("Missing required env var: {}", ENV_POLICY_PLUGIN_OPA_URL));
+        return Err(format!("Missing required env var: {ENV_POLICY_PLUGIN_OPA_URL}"));
    }

    // check optional env vars
    candidate.remove(ENV_POLICY_PLUGIN_AUTH_TOKEN);
    if !candidate.is_empty() {
-        return Err(format!("Invalid env vars: {:?}", candidate));
+        return Err(format!("Invalid env vars: {candidate:?}"));
    }
    Ok(())
 }
@@ -73,7 +73,7 @@ async fn validate(config: &Args) -> Result<(), String> {
            };
        }
        Err(err) => {
-            return Err(format!("Error connecting to OPA: {}", err));
+            return Err(format!("Error connecting to OPA: {err}"));
        }
    };
    Ok(())
@@ -83,7 +83,7 @@ pub async fn lookup_config() -> Result<Args, String> {
    let args = Args::default();

    let get_cfg =
-        |cfg: &str| -> Result<String, String> { env::var(cfg).map_err(|e| format!("Error getting env var {}: {:?}", cfg, e)) };
+        |cfg: &str| -> Result<String, String> { env::var(cfg).map_err(|e| format!("Error getting env var {cfg}: {e:?}")) };

    let url = get_cfg(ENV_POLICY_PLUGIN_OPA_URL);
    if url.is_err() {
@@ -154,8 +154,8 @@ impl Validator for Policy {
    type Error = Error;

    fn is_valid(&self) -> Result<()> {
-        if !self.id.is_empty() && !self.id.eq(DEFAULT_VERSION) {
-            return Err(IamError::InvalidVersion(self.id.0.clone()).into());
+        if !self.version.is_empty() && !self.version.eq(DEFAULT_VERSION) {
+            return Err(IamError::InvalidVersion(self.version.clone()).into());
        }

        for statement in self.statements.iter() {
@@ -213,8 +213,8 @@ impl Validator for BucketPolicy {
    type Error = Error;

    fn is_valid(&self) -> Result<()> {
-        if !self.id.is_empty() && !self.id.eq(DEFAULT_VERSION) {
-            return Err(IamError::InvalidVersion(self.id.0.clone()).into());
+        if !self.version.is_empty() && !self.version.eq(DEFAULT_VERSION) {
+            return Err(IamError::InvalidVersion(self.version.clone()).into());
        }

        for statement in self.statements.iter() {
@@ -44,6 +44,14 @@ rustfs-utils = { workspace = true, features = ["io", "hash", "compress"] }
 serde_json.workspace = true
 md-5 = { workspace = true }
 tracing.workspace = true
+thiserror.workspace = true
+base64.workspace = true
+sha1.workspace = true
+sha2.workspace = true
+crc64fast-nvme.workspace = true
+s3s.workspace = true
+hex-simd.workspace = true
+crc32c.workspace = true

 [dev-dependencies]
-tokio-test = { workspace = true }
+tokio-test = { workspace = true }
@@ -0,0 +1,73 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use thiserror::Error;
+
+/// SHA256 mismatch error - when content SHA256 does not match what was sent from client
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Bad sha256: Expected {expected_sha256} does not match calculated {calculated_sha256}")]
+pub struct Sha256Mismatch {
+    pub expected_sha256: String,
+    pub calculated_sha256: String,
+}
+
+/// Bad digest error - Content-MD5 you specified did not match what we received
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Bad digest: Expected {expected_md5} does not match calculated {calculated_md5}")]
+pub struct BadDigest {
+    pub expected_md5: String,
+    pub calculated_md5: String,
+}
+
+/// Size too small error - reader size too small
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Size small: got {got}, want {want}")]
+pub struct SizeTooSmall {
+    pub want: i64,
+    pub got: i64,
+}
+
+/// Size too large error - reader size too large
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Size large: got {got}, want {want}")]
+pub struct SizeTooLarge {
+    pub want: i64,
+    pub got: i64,
+}
+
+/// Size mismatch error
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Size mismatch: got {got}, want {want}")]
+pub struct SizeMismatch {
+    pub want: i64,
+    pub got: i64,
+}
+
+/// Checksum mismatch error - when content checksum does not match what was sent from client
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("Bad checksum: Want {want} does not match calculated {got}")]
+pub struct ChecksumMismatch {
+    pub want: String,
+    pub got: String,
+}
+
+/// Invalid checksum error
+#[derive(Error, Debug, Clone, PartialEq)]
+#[error("invalid checksum")]
+pub struct InvalidChecksum;
+
+/// Check if an error is a checksum mismatch
+pub fn is_checksum_mismatch(err: &(dyn std::error::Error + 'static)) -> bool {
+    err.downcast_ref::<ChecksumMismatch>().is_some()
+}
@@ -51,6 +51,7 @@ mod tests {

    use crate::{CompressReader, EncryptReader, EtagReader, HashReader};
    use crate::{WarpReader, resolve_etag_generic};
+    use md5::Md5;
    use rustfs_utils::compress::CompressionAlgorithm;
    use std::io::Cursor;
    use tokio::io::BufReader;
@@ -72,7 +73,7 @@ mod tests {
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
        let mut hash_reader =
-            HashReader::new(reader, data.len() as i64, data.len() as i64, Some("hash_etag".to_string()), false).unwrap();
+            HashReader::new(reader, data.len() as i64, data.len() as i64, Some("hash_etag".to_string()), None, false).unwrap();

        // Test HashReader ETag resolution
        assert_eq!(resolve_etag_generic(&mut hash_reader), Some("hash_etag".to_string()));
@@ -105,20 +106,30 @@ mod tests {
        assert_eq!(resolve_etag_generic(&mut encrypt_reader), Some("encrypt_etag".to_string()));
    }

-    #[test]
-    fn test_complex_nesting() {
+    #[tokio::test]
+    async fn test_complex_nesting() {
+        use md5::Digest;
+        use tokio::io::AsyncReadExt;
        let data = b"test data for complex nesting";
+
+        let mut hasher = Md5::new();
+        hasher.update(data);
+        let etag = hasher.finalize();
+        let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
+
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
        // Create a complex nested structure: CompressReader<EncryptReader<EtagReader<BufReader<Cursor>>>>
-        let etag_reader = EtagReader::new(reader, Some("nested_etag".to_string()));
+        let etag_reader = EtagReader::new(reader, Some(etag_hex.clone()));
        let key = [0u8; 32];
        let nonce = [0u8; 12];
        let encrypt_reader = EncryptReader::new(etag_reader, key, nonce);
        let mut compress_reader = CompressReader::new(encrypt_reader, CompressionAlgorithm::Gzip);

+        compress_reader.read_to_end(&mut Vec::new()).await.unwrap();
+
        // Test that nested structure can resolve ETag
-        assert_eq!(resolve_etag_generic(&mut compress_reader), Some("nested_etag".to_string()));
+        assert_eq!(resolve_etag_generic(&mut compress_reader), Some(etag_hex));
    }

    #[test]
@@ -127,51 +138,80 @@ mod tests {
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
        // Create nested structure: CompressReader<HashReader<BufReader<Cursor>>>
-        let hash_reader =
-            HashReader::new(reader, data.len() as i64, data.len() as i64, Some("hash_nested_etag".to_string()), false).unwrap();
+        let hash_reader = HashReader::new(
+            reader,
+            data.len() as i64,
+            data.len() as i64,
+            Some("hash_nested_etag".to_string()),
+            None,
+            false,
+        )
+        .unwrap();
        let mut compress_reader = CompressReader::new(hash_reader, CompressionAlgorithm::Deflate);

        // Test that nested HashReader can be resolved
        assert_eq!(resolve_etag_generic(&mut compress_reader), Some("hash_nested_etag".to_string()));
    }

-    #[test]
-    fn test_comprehensive_etag_extraction() {
+    #[tokio::test]
+    async fn test_comprehensive_etag_extraction() {
+        use md5::Digest;
+        use tokio::io::AsyncReadExt;
        println!("🔍 Testing comprehensive ETag extraction with real reader types...");

        // Test 1: Simple EtagReader
        let data1 = b"simple test";
+        let mut hasher = Md5::new();
+        hasher.update(data1);
+        let etag = hasher.finalize();
+        let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
        let reader1 = BufReader::new(Cursor::new(&data1[..]));
        let reader1 = Box::new(WarpReader::new(reader1));
-        let mut etag_reader = EtagReader::new(reader1, Some("simple_etag".to_string()));
-        assert_eq!(resolve_etag_generic(&mut etag_reader), Some("simple_etag".to_string()));
+        let mut etag_reader = EtagReader::new(reader1, Some(etag_hex.clone()));
+        etag_reader.read_to_end(&mut Vec::new()).await.unwrap();
+        assert_eq!(resolve_etag_generic(&mut etag_reader), Some(etag_hex.clone()));

        // Test 2: HashReader with ETag
        let data2 = b"hash test";
+        let mut hasher = Md5::new();
+        hasher.update(data2);
+        let etag = hasher.finalize();
+        let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
        let reader2 = BufReader::new(Cursor::new(&data2[..]));
        let reader2 = Box::new(WarpReader::new(reader2));
        let mut hash_reader =
-            HashReader::new(reader2, data2.len() as i64, data2.len() as i64, Some("hash_etag".to_string()), false).unwrap();
-        assert_eq!(resolve_etag_generic(&mut hash_reader), Some("hash_etag".to_string()));
+            HashReader::new(reader2, data2.len() as i64, data2.len() as i64, Some(etag_hex.clone()), None, false).unwrap();
+        hash_reader.read_to_end(&mut Vec::new()).await.unwrap();
+        assert_eq!(resolve_etag_generic(&mut hash_reader), Some(etag_hex.clone()));

        // Test 3: Single wrapper - CompressReader<EtagReader>
        let data3 = b"compress test";
+        let mut hasher = Md5::new();
+        hasher.update(data3);
+        let etag = hasher.finalize();
+        let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
        let reader3 = BufReader::new(Cursor::new(&data3[..]));
        let reader3 = Box::new(WarpReader::new(reader3));
-        let etag_reader3 = EtagReader::new(reader3, Some("compress_wrapped_etag".to_string()));
+        let etag_reader3 = EtagReader::new(reader3, Some(etag_hex.clone()));
        let mut compress_reader = CompressReader::new(etag_reader3, CompressionAlgorithm::Zstd);
-        assert_eq!(resolve_etag_generic(&mut compress_reader), Some("compress_wrapped_etag".to_string()));
+        compress_reader.read_to_end(&mut Vec::new()).await.unwrap();
+        assert_eq!(resolve_etag_generic(&mut compress_reader), Some(etag_hex.clone()));

        // Test 4: Double wrapper - CompressReader<EncryptReader<EtagReader>>
        let data4 = b"double wrap test";
+        let mut hasher = Md5::new();
+        hasher.update(data4);
+        let etag = hasher.finalize();
+        let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
        let reader4 = BufReader::new(Cursor::new(&data4[..]));
        let reader4 = Box::new(WarpReader::new(reader4));
-        let etag_reader4 = EtagReader::new(reader4, Some("double_wrapped_etag".to_string()));
+        let etag_reader4 = EtagReader::new(reader4, Some(etag_hex.clone()));
        let key = [1u8; 32];
        let nonce = [1u8; 12];
        let encrypt_reader4 = EncryptReader::new(etag_reader4, key, nonce);
        let mut compress_reader4 = CompressReader::new(encrypt_reader4, CompressionAlgorithm::Gzip);
-        assert_eq!(resolve_etag_generic(&mut compress_reader4), Some("double_wrapped_etag".to_string()));
+        compress_reader4.read_to_end(&mut Vec::new()).await.unwrap();
+        assert_eq!(resolve_etag_generic(&mut compress_reader4), Some(etag_hex.clone()));

        println!("✅ All ETag extraction methods work correctly!");
        println!("✅ Trait-based approach handles recursive unwrapping!");
@@ -195,6 +235,7 @@ mod tests {
            data.len() as i64,
            data.len() as i64,
            Some("real_world_etag".to_string()),
+            None,
            false,
        )
        .unwrap();
@@ -239,7 +280,7 @@ mod tests {
        let data = b"no etag test";
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
-        let mut hash_reader_no_etag = HashReader::new(reader, data.len() as i64, data.len() as i64, None, false).unwrap();
+        let mut hash_reader_no_etag = HashReader::new(reader, data.len() as i64, data.len() as i64, None, None, false).unwrap();
        assert_eq!(resolve_etag_generic(&mut hash_reader_no_etag), None);

        // Test with EtagReader that has None etag
@@ -19,6 +19,7 @@ use pin_project_lite::pin_project;
 use std::pin::Pin;
 use std::task::{Context, Poll};
 use tokio::io::{AsyncRead, ReadBuf};
+use tracing::error;

 pin_project! {
    pub struct  EtagReader {
@@ -43,7 +44,8 @@ impl EtagReader {
    /// Get the final md5 value (etag) as a hex string, only compute once.
    /// Can be called multiple times, always returns the same result after finished.
    pub fn get_etag(&mut self) -> String {
-        format!("{:x}", self.md5.clone().finalize())
+        let etag = self.md5.clone().finalize().to_vec();
+        hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower)
    }
 }

@@ -60,8 +62,10 @@ impl AsyncRead for EtagReader {
                // EOF
                *this.finished = true;
                if let Some(checksum) = this.checksum {
-                    let etag = format!("{:x}", this.md5.clone().finalize());
-                    if *checksum != etag {
+                    let etag = this.md5.clone().finalize().to_vec();
+                    let etag_hex = hex_simd::encode_to_string(etag, hex_simd::AsciiCase::Lower);
+                    if *checksum != etag_hex {
+                        error!("Checksum mismatch, expected={:?}, actual={:?}", checksum, etag_hex);
                        return Poll::Ready(Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "Checksum mismatch")));
                    }
                }
@@ -214,7 +218,7 @@ mod tests {
        let data = b"checksum test data";
        let mut hasher = Md5::new();
        hasher.update(data);
-        let expected = format!("{:x}", hasher.finalize());
+        let expected = hex_simd::encode_to_string(hasher.finalize(), hex_simd::AsciiCase::Lower);
        let reader = BufReader::new(&data[..]);
        let reader = Box::new(WarpReader::new(reader));
        let mut etag_reader = EtagReader::new(reader, Some(expected.clone()));
@@ -233,7 +237,7 @@ mod tests {
        let wrong_checksum = "deadbeefdeadbeefdeadbeefdeadbeef".to_string();
        let reader = BufReader::new(&data[..]);
        let reader = Box::new(WarpReader::new(reader));
-        let mut etag_reader = EtagReader::new(reader, Some(wrong_checksum));
+        let mut etag_reader = EtagReader::new(reader, Some(wrong_checksum.clone()));

        let mut buf = Vec::new();
        // Verification failed, should return InvalidData error
@@ -50,7 +50,7 @@
 //! let diskable_md5 = false;
 //!
 //! // Method 1: Simple creation (recommended for most cases)
-//! let hash_reader = HashReader::new(reader, size, actual_size, etag.clone(), diskable_md5).unwrap();
+//! let hash_reader = HashReader::new(reader, size, actual_size, etag.clone(), None, diskable_md5).unwrap();
 //!
 //! // Method 2: With manual wrapping to recreate original logic
 //! let reader2 = BufReader::new(Cursor::new(&data[..]));
@@ -71,7 +71,7 @@
 //!     // No wrapping needed
 //!     reader2
 //! };
-//! let hash_reader2 = HashReader::new(wrapped_reader, size, actual_size, etag, diskable_md5).unwrap();
+//! let hash_reader2 = HashReader::new(wrapped_reader, size, actual_size, etag.clone(), None, diskable_md5).unwrap();
 //! # });
 //! ```
 //!
@@ -88,28 +88,43 @@
 //! # tokio_test::block_on(async {
 //! let data = b"test";
 //! let reader = BufReader::new(Cursor::new(&data[..]));
-//! let hash_reader = HashReader::new(Box::new(WarpReader::new(reader)), 4, 4, None, false).unwrap();
+//! let hash_reader = HashReader::new(Box::new(WarpReader::new(reader)), 4, 4, None, None,false).unwrap();
 //!
 //! // Check if a type is a HashReader
 //! assert!(hash_reader.is_hash_reader());
 //!
 //! // Use new for compatibility (though it's simpler to use new() directly)
 //! let reader2 = BufReader::new(Cursor::new(&data[..]));
-//! let result = HashReader::new(Box::new(WarpReader::new(reader2)), 4, 4, None, false);
+//! let result = HashReader::new(Box::new(WarpReader::new(reader2)), 4, 4, None, None, false);
 //! assert!(result.is_ok());
 //! # });
 //! ```

+use crate::Checksum;
+use crate::ChecksumHasher;
+use crate::ChecksumType;
+use crate::Sha256Hasher;
+use crate::compress_index::{Index, TryGetIndex};
+use crate::get_content_checksum;
+use crate::{EtagReader, EtagResolvable, HardLimitReader, HashReaderDetector, Reader, WarpReader};
+use base64::Engine;
+use base64::engine::general_purpose;
+use http::HeaderMap;
 use pin_project_lite::pin_project;
+use s3s::TrailingHeaders;
+use std::collections::HashMap;
+use std::io::Cursor;
+use std::io::Write;
+use std::mem;
 use std::pin::Pin;
 use std::task::{Context, Poll};
 use tokio::io::{AsyncRead, ReadBuf};
-
-use crate::compress_index::{Index, TryGetIndex};
-use crate::{EtagReader, EtagResolvable, HardLimitReader, HashReaderDetector, Reader};
+use tracing::error;

 /// Trait for mutable operations on HashReader
 pub trait HashReaderMut {
+    fn into_inner(self) -> Box<dyn Reader>;
+    fn take_inner(&mut self) -> Box<dyn Reader>;
    fn bytes_read(&self) -> u64;
    fn checksum(&self) -> &Option<String>;
    fn set_checksum(&mut self, checksum: Option<String>);
@@ -117,6 +132,10 @@ pub trait HashReaderMut {
    fn set_size(&mut self, size: i64);
    fn actual_size(&self) -> i64;
    fn set_actual_size(&mut self, actual_size: i64);
+    fn content_hash(&self) -> &Option<Checksum>;
+    fn content_sha256(&self) -> &Option<String>;
+    fn get_trailer(&self) -> Option<&TrailingHeaders>;
+    fn set_trailer(&mut self, trailer: Option<TrailingHeaders>);
 }

 pin_project! {
@@ -129,7 +148,14 @@ pin_project! {
        pub actual_size: i64,
        pub diskable_md5: bool,
        bytes_read: u64,
-        // TODO: content_hash
+        content_hash: Option<Checksum>,
+        content_hasher: Option<Box<dyn ChecksumHasher>>,
+        content_sha256: Option<String>,
+        content_sha256_hasher: Option<Sha256Hasher>,
+        checksum_on_finish: bool,
+
+        trailer_s3s: Option<TrailingHeaders>,
+
    }

 }
@@ -139,7 +165,8 @@ impl HashReader {
        mut inner: Box<dyn Reader>,
        size: i64,
        actual_size: i64,
-        md5: Option<String>,
+        md5hex: Option<String>,
+        sha256hex: Option<String>,
        diskable_md5: bool,
    ) -> std::io::Result<Self> {
        // Check if it's already a HashReader and update its parameters
@@ -152,7 +179,7 @@ impl HashReader {
            }

            if let Some(checksum) = existing_hash_reader.checksum() {
-                if let Some(ref md5) = md5 {
+                if let Some(ref md5) = md5hex {
                    if checksum != md5 {
                        return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "HashReader checksum mismatch"));
                    }
@@ -166,7 +193,7 @@ impl HashReader {
                ));
            }

-            existing_hash_reader.set_checksum(md5.clone());
+            existing_hash_reader.set_checksum(md5hex.clone());

            if existing_hash_reader.size() < 0 && size >= 0 {
                existing_hash_reader.set_size(size);
@@ -176,13 +203,29 @@ impl HashReader {
                existing_hash_reader.set_actual_size(actual_size);
            }

+            let size = existing_hash_reader.size();
+            let actual_size = existing_hash_reader.actual_size();
+            let content_hash = existing_hash_reader.content_hash().clone();
+            let content_hasher = existing_hash_reader
+                .content_hash()
+                .clone()
+                .map(|hash| hash.checksum_type.hasher().unwrap());
+            let content_sha256 = existing_hash_reader.content_sha256().clone();
+            let content_sha256_hasher = existing_hash_reader.content_sha256().clone().map(|_| Sha256Hasher::new());
+            let inner = existing_hash_reader.take_inner();
            return Ok(Self {
                inner,
                size,
-                checksum: md5,
+                checksum: md5hex.clone(),
                actual_size,
                diskable_md5,
                bytes_read: 0,
+                content_sha256,
+                content_sha256_hasher,
+                content_hash,
+                content_hasher,
+                checksum_on_finish: false,
+                trailer_s3s: existing_hash_reader.get_trailer().cloned(),
            });
        }

@@ -190,23 +233,33 @@ impl HashReader {
            let hr = HardLimitReader::new(inner, size);
            inner = Box::new(hr);
            if !diskable_md5 && !inner.is_hash_reader() {
-                let er = EtagReader::new(inner, md5.clone());
+                let er = EtagReader::new(inner, md5hex.clone());
                inner = Box::new(er);
            }
        } else if !diskable_md5 {
-            let er = EtagReader::new(inner, md5.clone());
+            let er = EtagReader::new(inner, md5hex.clone());
            inner = Box::new(er);
        }
        Ok(Self {
            inner,
            size,
-            checksum: md5,
+            checksum: md5hex,
            actual_size,
            diskable_md5,
            bytes_read: 0,
+            content_hash: None,
+            content_hasher: None,
+            content_sha256: sha256hex.clone(),
+            content_sha256_hasher: sha256hex.clone().map(|_| Sha256Hasher::new()),
+            checksum_on_finish: false,
+            trailer_s3s: None,
        })
    }

+    pub fn into_inner(self) -> Box<dyn Reader> {
+        self.inner
+    }
+
    /// Update HashReader parameters
    pub fn update_params(&mut self, size: i64, actual_size: i64, etag: Option<String>) {
        if self.size < 0 && size >= 0 {
@@ -228,9 +281,115 @@ impl HashReader {
    pub fn actual_size(&self) -> i64 {
        self.actual_size
    }
+
+    pub fn add_checksum_from_s3s(
+        &mut self,
+        headers: &HeaderMap,
+        trailing_headers: Option<TrailingHeaders>,
+        ignore_value: bool,
+    ) -> Result<(), std::io::Error> {
+        let cs = get_content_checksum(headers)?;
+
+        if ignore_value {
+            return Ok(());
+        }
+
+        if let Some(checksum) = cs {
+            if checksum.checksum_type.trailing() {
+                self.trailer_s3s = trailing_headers.clone();
+            }
+
+            self.content_hash = Some(checksum.clone());
+
+            return self.add_non_trailing_checksum(Some(checksum), ignore_value);
+        }
+
+        Ok(())
+    }
+
+    pub fn add_checksum_no_trailer(&mut self, header: &HeaderMap, ignore_value: bool) -> Result<(), std::io::Error> {
+        let cs = get_content_checksum(header)?;
+
+        if let Some(checksum) = cs {
+            self.content_hash = Some(checksum.clone());
+
+            return self.add_non_trailing_checksum(Some(checksum), ignore_value);
+        }
+        Ok(())
+    }
+
+    pub fn add_non_trailing_checksum(&mut self, checksum: Option<Checksum>, ignore_value: bool) -> Result<(), std::io::Error> {
+        if let Some(checksum) = checksum {
+            self.content_hash = Some(checksum.clone());
+
+            if ignore_value {
+                return Ok(());
+            }
+
+            if let Some(hasher) = checksum.checksum_type.hasher() {
+                self.content_hasher = Some(hasher);
+            } else {
+                return Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "Invalid checksum type"));
+            }
+
+            tracing::debug!("add_non_trailing_checksum checksum={checksum:?}");
+        }
+        Ok(())
+    }
+
+    pub fn checksum(&self) -> Option<Checksum> {
+        if self
+            .content_hash
+            .as_ref()
+            .is_none_or(|v| !v.checksum_type.is_set() || !v.valid())
+        {
+            return None;
+        }
+        self.content_hash.clone()
+    }
+    pub fn content_crc_type(&self) -> Option<ChecksumType> {
+        self.content_hash.as_ref().map(|v| v.checksum_type)
+    }
+
+    pub fn content_crc(&self) -> HashMap<String, String> {
+        let mut map = HashMap::new();
+        if let Some(checksum) = self.content_hash.as_ref() {
+            if !checksum.valid() || checksum.checksum_type.is(ChecksumType::NONE) {
+                return map;
+            }
+
+            if checksum.checksum_type.trailing() {
+                if let Some(trailer) = self.trailer_s3s.as_ref() {
+                    if let Some(Some(checksum_str)) = trailer.read(|headers| {
+                        checksum
+                            .checksum_type
+                            .key()
+                            .and_then(|key| headers.get(key).and_then(|value| value.to_str().ok().map(|s| s.to_string())))
+                    }) {
+                        map.insert(checksum.checksum_type.to_string(), checksum_str);
+                    }
+                }
+                return map;
+            }
+
+            map.insert(checksum.checksum_type.to_string(), checksum.encoded.clone());
+
+            return map;
+        }
+        map
+    }
 }

 impl HashReaderMut for HashReader {
+    fn into_inner(self) -> Box<dyn Reader> {
+        self.inner
+    }
+
+    fn take_inner(&mut self) -> Box<dyn Reader> {
+        // Replace inner with an empty reader to move it out safely while keeping self valid
+        mem::replace(&mut self.inner, Box::new(WarpReader::new(Cursor::new(Vec::new()))))
+    }
+
    fn bytes_read(&self) -> u64 {
        self.bytes_read
    }
@@ -258,22 +417,108 @@ impl HashReaderMut for HashReader {
    fn set_actual_size(&mut self, actual_size: i64) {
        self.actual_size = actual_size;
    }
+
+    fn content_hash(&self) -> &Option<Checksum> {
+        &self.content_hash
+    }
+
+    fn content_sha256(&self) -> &Option<String> {
+        &self.content_sha256
+    }
+
+    fn get_trailer(&self) -> Option<&TrailingHeaders> {
+        self.trailer_s3s.as_ref()
+    }
+
+    fn set_trailer(&mut self, trailer: Option<TrailingHeaders>) {
+        self.trailer_s3s = trailer;
+    }
 }

 impl AsyncRead for HashReader {
    fn poll_read(self: Pin<&mut Self>, cx: &mut Context<'_>, buf: &mut ReadBuf<'_>) -> Poll<std::io::Result<()>> {
        let this = self.project();
-        let poll = this.inner.poll_read(cx, buf);
-        if let Poll::Ready(Ok(())) = &poll {
-            let filled = buf.filled().len();
-            *this.bytes_read += filled as u64;

-            if filled == 0 {
-                // EOF
-                // TODO: check content_hash
+        let before = buf.filled().len();
+        match this.inner.poll_read(cx, buf) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Ok(())) => {
+                let data = &buf.filled()[before..];
+                let filled = data.len();
+
+                *this.bytes_read += filled as u64;
+
+                if filled > 0 {
+                    // Update SHA256 hasher
+                    if let Some(hasher) = this.content_sha256_hasher {
+                        if let Err(e) = hasher.write_all(data) {
+                            error!("SHA256 hasher write error, error={:?}", e);
+                            return Poll::Ready(Err(std::io::Error::other(e)));
+                        }
+                    }
+
+                    // Update content hasher
+                    if let Some(hasher) = this.content_hasher {
+                        if let Err(e) = hasher.write_all(data) {
+                            return Poll::Ready(Err(std::io::Error::other(e)));
+                        }
+                    }
+                }
+
+                if filled == 0 && !*this.checksum_on_finish {
+                    // check SHA256
+                    if let (Some(hasher), Some(expected_sha256)) = (this.content_sha256_hasher, this.content_sha256) {
+                        let sha256 = hex_simd::encode_to_string(hasher.finalize(), hex_simd::AsciiCase::Lower);
+                        if sha256 != *expected_sha256 {
+                            error!("SHA256 mismatch, expected={:?}, actual={:?}", expected_sha256, sha256);
+                            return Poll::Ready(Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "SHA256 mismatch")));
+                        }
+                    }
+
+                    // check content hasher
+                    if let (Some(hasher), Some(expected_content_hash)) = (this.content_hasher, this.content_hash) {
+                        if expected_content_hash.checksum_type.trailing() {
+                            if let Some(trailer) = this.trailer_s3s.as_ref() {
+                                if let Some(Some(checksum_str)) = trailer.read(|headers| {
+                                    expected_content_hash.checksum_type.key().and_then(|key| {
+                                        headers.get(key).and_then(|value| value.to_str().ok().map(|s| s.to_string()))
+                                    })
+                                }) {
+                                    expected_content_hash.encoded = checksum_str;
+                                    expected_content_hash.raw = general_purpose::STANDARD
+                                        .decode(&expected_content_hash.encoded)
+                                        .map_err(|_| std::io::Error::other("Invalid base64 checksum"))?;
+
+                                    if expected_content_hash.raw.is_empty() {
+                                        return Poll::Ready(Err(std::io::Error::other("Content hash mismatch")));
+                                    }
+                                }
+                            }
+                        }
+
+                        let content_hash = hasher.finalize();
+
+                        if content_hash != expected_content_hash.raw {
+                            error!(
+                                "Content hash mismatch, type={:?}, encoded={:?}, expected={:?}, actual={:?}",
+                                expected_content_hash.checksum_type,
+                                expected_content_hash.encoded,
+                                hex_simd::encode_to_string(&expected_content_hash.raw, hex_simd::AsciiCase::Lower),
+                                hex_simd::encode_to_string(content_hash, hex_simd::AsciiCase::Lower)
+                            );
+                            return Poll::Ready(Err(std::io::Error::new(
+                                std::io::ErrorKind::InvalidData,
+                                "Content hash mismatch",
+                            )));
+                        }
+                    }
+
+                    *this.checksum_on_finish = true;
+                }
+                Poll::Ready(Ok(()))
            }
+            Poll::Ready(Err(e)) => Poll::Ready(Err(e)),
        }
-        poll
    }
 }

@@ -323,7 +568,7 @@ mod tests {
        // Test 1: Simple creation
        let reader1 = BufReader::new(Cursor::new(&data[..]));
        let reader1 = Box::new(WarpReader::new(reader1));
-        let hash_reader1 = HashReader::new(reader1, size, actual_size, etag.clone(), false).unwrap();
+        let hash_reader1 = HashReader::new(reader1, size, actual_size, etag.clone(), None, false).unwrap();
        assert_eq!(hash_reader1.size(), size);
        assert_eq!(hash_reader1.actual_size(), actual_size);

@@ -332,7 +577,7 @@ mod tests {
        let reader2 = Box::new(WarpReader::new(reader2));
        let hard_limit = HardLimitReader::new(reader2, size);
        let hard_limit = Box::new(hard_limit);
-        let hash_reader2 = HashReader::new(hard_limit, size, actual_size, etag.clone(), false).unwrap();
+        let hash_reader2 = HashReader::new(hard_limit, size, actual_size, etag.clone(), None, false).unwrap();
        assert_eq!(hash_reader2.size(), size);
        assert_eq!(hash_reader2.actual_size(), actual_size);

@@ -341,7 +586,7 @@ mod tests {
        let reader3 = Box::new(WarpReader::new(reader3));
        let etag_reader = EtagReader::new(reader3, etag.clone());
        let etag_reader = Box::new(etag_reader);
-        let hash_reader3 = HashReader::new(etag_reader, size, actual_size, etag.clone(), false).unwrap();
+        let hash_reader3 = HashReader::new(etag_reader, size, actual_size, etag.clone(), None, false).unwrap();
        assert_eq!(hash_reader3.size(), size);
        assert_eq!(hash_reader3.actual_size(), actual_size);
    }
@@ -351,7 +596,7 @@ mod tests {
        let data = b"hello hashreader";
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
-        let mut hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, false).unwrap();
+        let mut hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, None, false).unwrap();
        let mut buf = Vec::new();
        let _ = hash_reader.read_to_end(&mut buf).await.unwrap();
        // Since we removed EtagReader integration, etag might be None
@@ -365,7 +610,7 @@ mod tests {
        let data = b"no etag";
        let reader = BufReader::new(Cursor::new(&data[..]));
        let reader = Box::new(WarpReader::new(reader));
-        let mut hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, true).unwrap();
+        let mut hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, None, true).unwrap();
        let mut buf = Vec::new();
        let _ = hash_reader.read_to_end(&mut buf).await.unwrap();
        // Etag should be None when diskable_md5 is true
@@ -381,10 +626,17 @@ mod tests {
        let reader = Box::new(WarpReader::new(reader));
        // Create a HashReader first
        let hash_reader =
-            HashReader::new(reader, data.len() as i64, data.len() as i64, Some("test_etag".to_string()), false).unwrap();
+            HashReader::new(reader, data.len() as i64, data.len() as i64, Some("test_etag".to_string()), None, false).unwrap();
        let hash_reader = Box::new(WarpReader::new(hash_reader));
        // Now try to create another HashReader from the existing one using new
-        let result = HashReader::new(hash_reader, data.len() as i64, data.len() as i64, Some("test_etag".to_string()), false);
+        let result = HashReader::new(
+            hash_reader,
+            data.len() as i64,
+            data.len() as i64,
+            Some("test_etag".to_string()),
+            None,
+            false,
+        );

        assert!(result.is_ok());
        let final_reader = result.unwrap();
@@ -422,7 +674,7 @@ mod tests {

        let reader = Box::new(WarpReader::new(reader));
        // Create HashReader
-        let mut hr = HashReader::new(reader, size, actual_size, Some(expected.clone()), false).unwrap();
+        let mut hr = HashReader::new(reader, size, actual_size, Some(expected.clone()), None, false).unwrap();

        // If compression is enabled, compress data first
        let compressed_data = if is_compress {
@@ -518,7 +770,7 @@ mod tests {

        let reader = BufReader::new(Cursor::new(data.clone()));
        let reader = Box::new(WarpReader::new(reader));
-        let hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, false).unwrap();
+        let hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, None, false).unwrap();

        // Test compression
        let compress_reader = CompressReader::new(hash_reader, CompressionAlgorithm::Gzip);
@@ -564,7 +816,7 @@ mod tests {

            let reader = BufReader::new(Cursor::new(data.clone()));
            let reader = Box::new(WarpReader::new(reader));
-            let hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, false).unwrap();
+            let hash_reader = HashReader::new(reader, data.len() as i64, data.len() as i64, None, None, false).unwrap();

            // Compress
            let compress_reader = CompressReader::new(hash_reader, algorithm);
@@ -34,6 +34,11 @@ pub use hardlimit_reader::HardLimitReader;

 mod hash_reader;
 pub use hash_reader::*;
+mod checksum;
+pub use checksum::*;
+
+mod errors;
+pub use errors::*;

 pub mod reader;
 pub use reader::WarpReader;
@@ -34,6 +34,7 @@ hyper.workspace = true
 serde_urlencoded.workspace = true
 rustfs-utils = { workspace = true, features = ["full"] }
 s3s.workspace = true
+base64-simd.workspace = true

 [dev-dependencies]

@@ -20,7 +20,7 @@ use std::fmt::Write;
 use time::{OffsetDateTime, format_description};

 use super::utils::get_host_addr;
-use rustfs_utils::crypto::{base64_encode, hex, hmac_sha1};
+use rustfs_utils::crypto::{hex, hmac_sha1};
 use s3s::Body;

 const _SIGN_V4_ALGORITHM: &str = "AWS4-HMAC-SHA256";
@@ -111,7 +111,11 @@ pub fn sign_v2(
    }

    let auth_header = format!("{SIGN_V2_ALGORITHM} {access_key_id}:");
-    let auth_header = format!("{}{}", auth_header, base64_encode(&hmac_sha1(secret_access_key, string_to_sign)));
+    let auth_header = format!(
+        "{}{}",
+        auth_header,
+        base64_simd::URL_SAFE_NO_PAD.encode_to_string(hmac_sha1(secret_access_key, string_to_sign))
+    );

    headers.insert("Authorization", auth_header.parse().unwrap());

@@ -167,11 +167,13 @@ fn get_canonical_request(req: &request::Request<Body>, ignored_headers: &HashMap
    if let Some(q) = req.uri().query() {
        // Parse query string into key-value pairs
        let mut query_params: Vec<(String, String)> = Vec::new();
-        for param in q.split('&') {
-            if let Some((key, value)) = param.split_once('=') {
-                query_params.push((key.to_string(), value.to_string()));
-            } else {
-                query_params.push((param.to_string(), "".to_string()));
+        if !q.is_empty() {
+            for param in q.split('&') {
+                if let Some((key, value)) = param.split_once('=') {
+                    query_params.push((key.to_string(), value.to_string()));
+                } else {
+                    query_params.push((param.to_string(), "".to_string()));
+                }
            }
        }

@@ -179,6 +181,7 @@ fn get_canonical_request(req: &request::Request<Body>, ignored_headers: &HashMap
        query_params.sort_by(|a, b| a.0.cmp(&b.0));

        // Build canonical query string
+        //println!("query_params: {query_params:?}");
        let sorted_params: Vec<String> = query_params.iter().map(|(k, v)| format!("{k}={v}")).collect();

        canonical_query_string = sorted_params.join("&");
@@ -417,3 +420,390 @@ pub fn sign_v4_trailer(
        trailer,
    )
 }
+
+#[cfg(test)]
+#[allow(unused_variables, unused_mut)]
+mod tests {
+    use http::request;
+    use time::macros::datetime;
+
+    use super::*;
+
+    #[test]
+    fn example_list_objects() {
+        // let access_key_id = "AKIAIOSFODNN7EXAMPLE";
+        let secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+        let timestamp = "20130524T000000Z";
+        let t = datetime!(2013-05-24 0:00 UTC);
+        // let bucket = "examplebucket";
+        let region = "us-east-1";
+        let service = "s3";
+        let path = "/";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://examplebucket.s3.amazonaws.com/?")
+            .body(Body::empty())
+            .unwrap();
+        let mut headers = req.headers_mut();
+        headers.insert("host", "examplebucket.s3.amazonaws.com".parse().unwrap());
+        headers.insert(
+            "x-amz-content-sha256",
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                .parse()
+                .unwrap(),
+        );
+        headers.insert("x-amz-date", timestamp.parse().unwrap());
+
+        let query = vec![
+            ("max-keys".to_string(), "2".to_string()),
+            ("prefix".to_string(), "J".to_string()),
+        ];
+        let uri = req.uri().clone();
+        let mut parts = req.uri().clone().into_parts();
+        parts.path_and_query = Some(
+            format!("{}?{}", uri.path(), serde_urlencoded::to_string(&query).unwrap())
+                .parse()
+                .unwrap(),
+        );
+        *req.uri_mut() = Uri::from_parts(parts).unwrap();
+
+        let canonical_request = get_canonical_request(&req, &v4_ignored_headers, &get_hashed_payload(&req));
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/\n",
+                "max-keys=2&prefix=J\n",
+                "host:examplebucket.s3.amazonaws.com\n",
+                "x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n",
+                "x-amz-date:",
+                "20130524T000000Z",
+                "\n",
+                "\n",
+                "host;x-amz-content-sha256;x-amz-date\n",
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            )
+        );
+
+        let string_to_sign = get_string_to_sign_v4(t, region, &canonical_request, service);
+        assert_eq!(
+            string_to_sign,
+            concat!(
+                "AWS4-HMAC-SHA256\n",
+                "20130524T000000Z",
+                "\n",
+                "20130524/us-east-1/s3/aws4_request\n",
+                "df57d21db20da04d7fa30298dd4488ba3a2b47ca3a489c74750e0f1e7df1b9b7",
+            )
+        );
+
+        let signing_key = get_signing_key(secret_access_key, region, t, service);
+        let signature = get_signature(signing_key, &string_to_sign);
+
+        assert_eq!(signature, "34b48302e7b5fa45bde8084f4b7868a86f0a534bc59db6670ed5711ef69dc6f7");
+    }
+
+    #[test]
+    fn example_signature() {
+        // let access_key_id = "rustfsadmin";
+        let secret_access_key = "rustfsadmin";
+        let timestamp = "20250505T011054Z";
+        let t = datetime!(2025-05-05 01:10:54 UTC);
+        // let bucket = "mblock2";
+        let region = "us-east-1";
+        let service = "s3";
+        let path = "/mblock2/";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://192.168.1.11:9020/mblock2/?")
+            .body(Body::empty())
+            .unwrap();
+
+        let mut headers = req.headers_mut();
+        headers.insert("host", "192.168.1.11:9020".parse().unwrap());
+        headers.insert(
+            "x-amz-content-sha256",
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                .parse()
+                .unwrap(),
+        );
+        headers.insert("x-amz-date", timestamp.parse().unwrap());
+
+        let mut query: Vec<(String, String)> = Vec::new();
+        let uri = req.uri().clone();
+        let mut parts = req.uri().clone().into_parts();
+        parts.path_and_query = Some(
+            format!("{}?{}", uri.path(), serde_urlencoded::to_string(&query).unwrap())
+                .parse()
+                .unwrap(),
+        );
+        //println!("parts.path_and_query: {:?}", parts.path_and_query);
+        *req.uri_mut() = Uri::from_parts(parts).unwrap();
+
+        let canonical_request = get_canonical_request(&req, &v4_ignored_headers, &get_hashed_payload(&req));
+        println!("canonical_request: \n{}\n", canonical_request);
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/mblock2/\n",
+                "\n",
+                "host:192.168.1.11:9020\n",
+                "x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n",
+                "x-amz-date:",
+                "20250505T011054Z",
+                "\n",
+                "\n",
+                "host;x-amz-content-sha256;x-amz-date\n",
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            )
+        );
+
+        let string_to_sign = get_string_to_sign_v4(t, region, &canonical_request, service);
+        println!("string_to_sign: \n{}\n", string_to_sign);
+        assert_eq!(
+            string_to_sign,
+            concat!(
+                "AWS4-HMAC-SHA256\n",
+                "20250505T011054Z",
+                "\n",
+                "20250505/us-east-1/s3/aws4_request\n",
+                "c2960d00cc7de7bed3e2e2d1330ec298ded8f78a231c1d32dedac72ebec7f9b0",
+            )
+        );
+
+        let signing_key = get_signing_key(secret_access_key, region, t, service);
+        let signature = get_signature(signing_key, &string_to_sign);
+        println!("signature: \n{}\n", signature);
+        assert_eq!(signature, "73fad2dfea0727e10a7179bf49150360a56f2e6b519c53999fd6e011152187d0");
+    }
+
+    #[test]
+    fn example_signature2() {
+        // let access_key_id = "rustfsadmin";
+        let secret_access_key = "rustfsadmin";
+        let timestamp = "20250507T051030Z";
+        let t = datetime!(2025-05-07 05:10:30 UTC);
+        // let bucket = "mblock2";
+        let region = "us-east-1";
+        let service = "s3";
+        let path = "/mblock2/";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://192.168.1.11:9020/mblock2/?list-type=2&encoding-type=url&prefix=mypre&delimiter=%2F&fetch-owner=true&max-keys=1")
+            .body(Body::empty()).unwrap();
+
+        let mut headers = req.headers_mut();
+        headers.insert("host", "192.168.1.11:9020".parse().unwrap());
+        headers.insert(
+            "x-amz-content-sha256",
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                .parse()
+                .unwrap(),
+        );
+        headers.insert("x-amz-date", timestamp.parse().unwrap());
+
+        println!("{:?}", req.uri().query());
+        let canonical_request = get_canonical_request(&req, &v4_ignored_headers, &get_hashed_payload(&req));
+        println!("canonical_request: \n{}\n", canonical_request);
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/mblock2/\n",
+                "delimiter=%2F&encoding-type=url&fetch-owner=true&list-type=2&max-keys=1&prefix=mypre\n",
+                "host:192.168.1.11:9020\n",
+                "x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n",
+                "x-amz-date:",
+                "20250507T051030Z",
+                "\n",
+                "\n",
+                "host;x-amz-content-sha256;x-amz-date\n",
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            )
+        );
+
+        let string_to_sign = get_string_to_sign_v4(t, region, &canonical_request, service);
+        println!("string_to_sign: \n{}\n", string_to_sign);
+        assert_eq!(
+            string_to_sign,
+            concat!(
+                "AWS4-HMAC-SHA256\n",
+                "20250507T051030Z",
+                "\n",
+                "20250507/us-east-1/s3/aws4_request\n",
+                "e6db9e09e9c873aff0b9ca170998b4753f6a6c36c90bc2dca80613affb47f999",
+            )
+        );
+
+        let signing_key = get_signing_key(secret_access_key, region, t, service);
+        let signature = get_signature(signing_key, &string_to_sign);
+        println!("signature: \n{}\n", signature);
+        assert_eq!(signature, "dfbed913d1982428f6224ee506431fc133dbcad184194c0cbf01bc517435788a");
+    }
+
+    #[test]
+    fn example_signature3() {
+        // let access_key_id = "rustfsadmin";
+        let secret_access_key = "rustfsadmin";
+        let timestamp = "20250628T061107Z";
+        let t = datetime!(2025-06-28 06:11:07 UTC);
+        // let bucket = "mbver";
+        let region = "";
+        let service = "s3";
+        let path = "/mbver/";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://192.168.1.11:9020/mbver/?list-type=2&encoding-type=url&prefix=mypre99&delimiter=%2F&fetch-owner=true&max-keys=1")
+            .body(Body::empty()).unwrap();
+
+        let mut headers = req.headers_mut();
+        headers.insert("host", "127.0.0.1:9000".parse().unwrap());
+        headers.insert(
+            "x-amz-content-sha256",
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                .parse()
+                .unwrap(),
+        );
+        headers.insert("x-amz-date", timestamp.parse().unwrap());
+
+        println!("{:?}", req.uri().query());
+        let canonical_request = get_canonical_request(&req, &v4_ignored_headers, &get_hashed_payload(&req));
+        println!("canonical_request: \n{}\n", canonical_request);
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/mbver/\n",
+                "delimiter=%2F&encoding-type=url&fetch-owner=true&list-type=2&max-keys=1&prefix=mypre99\n",
+                "host:127.0.0.1:9000\n",
+                "x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n",
+                "x-amz-date:",
+                "20250628T061107Z",
+                "\n",
+                "\n",
+                "host;x-amz-content-sha256;x-amz-date\n",
+                "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+            )
+        );
+
+        let string_to_sign = get_string_to_sign_v4(t, region, &canonical_request, service);
+        println!("string_to_sign: \n{}\n", string_to_sign);
+        assert_eq!(
+            string_to_sign,
+            concat!(
+                "AWS4-HMAC-SHA256\n",
+                "20250628T061107Z",
+                "\n",
+                "20250628//s3/aws4_request\n",
+                "9dcfa3d3139baf71a046e7fa17dacab8ee11676771e25e7cd09098bf39f09d5b", //payload hash
+            )
+        );
+
+        let signing_key = get_signing_key(secret_access_key, region, t, service);
+        let signature = get_signature(signing_key, &string_to_sign);
+        println!("signature: \n{}\n", signature);
+        assert_eq!(signature, "c7c7c6e12e5709c0c2ffc4707600a86c3cd261dd1de7409126a17f5b08c58dfa");
+    }
+
+    #[test]
+    fn example_presigned_url() {
+        let access_key_id = "AKIAIOSFODNN7EXAMPLE";
+        let secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+        let timestamp = "20130524T000000Z";
+        let t = datetime!(2013-05-24 0:00 UTC);
+        // let bucket = "mblock2";
+        let region = "us-east-1";
+        let service = "s3";
+        let path = "/";
+        let session_token = "";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://examplebucket.s3.amazonaws.com/test.txt")
+            .body(Body::empty())
+            .unwrap();
+
+        let mut headers = req.headers_mut();
+        headers.insert("host", "examplebucket.s3.amazonaws.com".parse().unwrap());
+
+        req = pre_sign_v4(req, access_key_id, secret_access_key, "", region, 86400, t);
+
+        let mut canonical_request = req.method().as_str().to_string();
+        canonical_request.push('\n');
+        canonical_request.push_str(req.uri().path());
+        canonical_request.push('\n');
+        canonical_request.push_str(req.uri().query().unwrap());
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_canonical_headers(&req, &v4_ignored_headers));
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_signed_headers(&req, &v4_ignored_headers));
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_hashed_payload(&req));
+        //println!("canonical_request: \n{}\n", canonical_request);
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/test.txt\n",
+                "X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20130524T000000Z&X-Amz-Expires=0000086400&X-Amz-SignedHeaders=host&X-Amz-Credential=AKIAIOSFODNN7EXAMPLE%2F20130524%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=98f1c9f47b39a4c40662680a9b029b046b7da5542c2e35d67edb8ff18d2ccf5c\n",
+                "host:examplebucket.s3.amazonaws.com\n",
+                "\n",
+                "host\n",
+                "UNSIGNED-PAYLOAD",
+            )
+        );
+    }
+
+    #[test]
+    fn example_presigned_url2() {
+        let access_key_id = "rustfsadmin";
+        let secret_access_key = "rustfsadmin";
+        let timestamp = "20130524T000000Z";
+        let t = datetime!(2013-05-24 0:00 UTC);
+        // let bucket = "mblock2";
+        let region = "us-east-1";
+        let service = "s3";
+        let path = "/mblock2/";
+        let session_token = "";
+
+        let mut req = request::Request::builder()
+            .method(http::Method::GET)
+            .uri("http://192.168.1.11:9020/mblock2/test.txt?delimiter=%2F&fetch-owner=true&prefix=mypre&encoding-type=url&max-keys=1&list-type=2")
+            .body(Body::empty()).unwrap();
+
+        let mut headers = req.headers_mut();
+        headers.insert("host", "192.168.1.11:9020".parse().unwrap());
+
+        req = pre_sign_v4(req, access_key_id, secret_access_key, "", region, 86400, t);
+
+        let mut canonical_request = req.method().as_str().to_string();
+        canonical_request.push('\n');
+        canonical_request.push_str(req.uri().path());
+        canonical_request.push('\n');
+        canonical_request.push_str(req.uri().query().unwrap());
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_canonical_headers(&req, &v4_ignored_headers));
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_signed_headers(&req, &v4_ignored_headers));
+        canonical_request.push('\n');
+        canonical_request.push_str(&get_hashed_payload(&req));
+        //println!("canonical_request: \n{}\n", canonical_request);
+        assert_eq!(
+            canonical_request,
+            concat!(
+                "GET\n",
+                "/mblock2/test.txt\n",
+                "delimiter=%2F&fetch-owner=true&prefix=mypre&encoding-type=url&max-keys=1&list-type=2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20130524T000000Z&X-Amz-Expires=0000086400&X-Amz-SignedHeaders=host&X-Amz-Credential=rustfsadmin%2F20130524%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=fe7f63f41e4ca18be9e70f560bbe9c079cf06ab97630934e04f7524751ff302d\n",
+                "host:192.168.1.11:9020\n",
+                "\n",
+                "host\n",
+                "UNSIGNED-PAYLOAD",
+            )
+        );
+    }
+}
@@ -35,14 +35,13 @@ futures = { workspace = true, optional = true }
 hashbrown = { workspace = true, optional = true }
 hex-simd = { workspace = true, optional = true }
 highway = { workspace = true, optional = true }
-hickory-resolver = { workspace = true, optional = true }
 hmac = { workspace = true, optional = true }
+http = { workspace = true, optional = true }
 hyper = { workspace = true, optional = true }
 libc = { workspace = true, optional = true }
 local-ip-address = { workspace = true, optional = true }
 lz4 = { workspace = true, optional = true }
 md-5 = { workspace = true, optional = true }
-moka = { workspace = true, optional = true, features = ["future"] }
 netif = { workspace = true, optional = true }
 nix = { workspace = true, optional = true }
 rand = { workspace = true, optional = true }
@@ -82,7 +81,7 @@ workspace = true
 default = ["ip"]  # features that are enabled by default
 ip = ["dep:local-ip-address"]  # ip characteristics and their dependencies
 tls = ["dep:rustls", "dep:rustls-pemfile", "dep:rustls-pki-types"]  # tls characteristics and their dependencies
-net = ["ip", "dep:url", "dep:netif", "dep:futures", "dep:transform-stream", "dep:bytes", "dep:s3s", "dep:hyper", "dep:hickory-resolver", "dep:moka", "dep:thiserror", "dep:tokio"]  # network features with DNS resolver
+net = ["ip", "dep:url", "dep:netif", "dep:futures", "dep:transform-stream", "dep:bytes", "dep:s3s", "dep:hyper", "dep:thiserror", "dep:tokio"]  # network features with DNS resolver
 io = ["dep:tokio"]
 path = []
 notify = ["dep:hyper", "dep:s3s", "dep:hashbrown", "dep:thiserror", "dep:serde", "dep:libc"]  # file system notification features
@@ -93,5 +92,5 @@ hash = ["dep:highway", "dep:md-5", "dep:sha2", "dep:blake3", "dep:serde", "dep:s
 os = ["dep:nix", "dep:tempfile", "winapi"]  # operating system utilities
 integration = []  # integration test features
 sys = ["dep:sysinfo"]  # system information features
-http = ["dep:convert_case"]
+http = ["dep:convert_case", "dep:http"]
 full = ["ip", "tls", "net", "io", "hash", "os", "integration", "path", "crypto", "string", "compress", "sys", "notify", "http"]  # all features
@@ -17,11 +17,11 @@ use std::mem::MaybeUninit;
 use hex_simd::{AsOut, AsciiCase};
 use hyper::body::Bytes;

-pub fn base64_encode(input: &[u8]) -> String {
+pub fn base64_encode_url_safe_no_pad(input: &[u8]) -> String {
    base64_simd::URL_SAFE_NO_PAD.encode_to_string(input)
 }

-pub fn base64_decode(input: &[u8]) -> Result<Vec<u8>, base64_simd::Error> {
+pub fn base64_decode_url_safe_no_pad(input: &[u8]) -> Result<Vec<u8>, base64_simd::Error> {
    base64_simd::URL_SAFE_NO_PAD.decode_to_vec(input)
 }

@@ -89,11 +89,11 @@ pub fn hex_sha256_chunk<R>(chunk: &[Bytes], f: impl FnOnce(&str) -> R) -> R {
 fn test_base64_encoding_decoding() {
    let original_uuid_timestamp = "c0194290-d911-45cb-8e12-79ec563f46a8x1735460504394878000";

-    let encoded_string = base64_encode(original_uuid_timestamp.as_bytes());
+    let encoded_string = base64_encode_url_safe_no_pad(original_uuid_timestamp.as_bytes());

    println!("Encoded: {}", &encoded_string);

-    let decoded_bytes = base64_decode(encoded_string.clone().as_bytes()).unwrap();
+    let decoded_bytes = base64_decode_url_safe_no_pad(encoded_string.clone().as_bytes()).unwrap();
    let decoded_string = String::from_utf8(decoded_bytes).unwrap();

    assert_eq!(decoded_string, original_uuid_timestamp)
@@ -12,465 +12,465 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-#![allow(dead_code)]
-
-//! Layered DNS resolution utility for Kubernetes environments
-//!
-//! This module provides robust DNS resolution with multiple fallback layers:
-//! 1. Local cache (Moka) for previously resolved results
-//! 2. System DNS resolver (container/host adaptive) using hickory-resolver
-//! 3. Public DNS servers as final fallback (8.8.8.8, 1.1.1.1) using hickory-resolver with TLS
-//!
-//! The resolver is designed to handle 5-level or deeper domain names that may fail
-//! in Kubernetes environments due to CoreDNS configuration, DNS recursion limits,
-//! or network-related issues. Uses hickory-resolver for actual DNS queries with TLS support.
-
-use hickory_resolver::Resolver;
-use hickory_resolver::config::ResolverConfig;
-use hickory_resolver::name_server::TokioConnectionProvider;
-use moka::future::Cache;
-use std::net::IpAddr;
-use std::sync::OnceLock;
-use std::time::Duration;
-use tracing::{debug, error, info, instrument, warn};
-
-/// Maximum FQDN length according to RFC standards
-const MAX_FQDN_LENGTH: usize = 253;
-/// Maximum DNS label length according to RFC standards
-const MAX_LABEL_LENGTH: usize = 63;
-/// Cache entry TTL in seconds
-const CACHE_TTL_SECONDS: u64 = 300; // 5 minutes
-/// Maximum cache size (number of entries)
-const MAX_CACHE_SIZE: u64 = 10000;
-
-/// DNS resolution error types with detailed context and tracing information
-#[derive(Debug, thiserror::Error)]
-pub enum DnsError {
-    #[error("Invalid domain format: {reason}")]
-    InvalidFormat { reason: String },
-
-    #[error("Local cache miss for domain: {domain}")]
-    CacheMiss { domain: String },
-
-    #[error("System DNS resolution failed for domain: {domain} - {source}")]
-    SystemDnsFailed {
-        domain: String,
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-
-    #[error("Public DNS resolution failed for domain: {domain} - {source}")]
-    PublicDnsFailed {
-        domain: String,
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-
-    #[error(
-        "All DNS resolution attempts failed for domain: {domain}. Please check your domain spelling, network connectivity, or DNS configuration"
-    )]
-    AllAttemptsFailed { domain: String },
-
-    #[error("DNS resolver initialization failed: {source}")]
-    InitializationFailed {
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-
-    #[error("DNS configuration error: {source}")]
-    ConfigurationError {
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-}
-
-/// Layered DNS resolver with caching and multiple fallback strategies
-pub struct LayeredDnsResolver {
-    /// Local cache for resolved domains using Moka for high performance
-    cache: Cache<String, Vec<IpAddr>>,
-    /// System DNS resolver using hickory-resolver with default configuration
-    system_resolver: Resolver<TokioConnectionProvider>,
-    /// Public DNS resolver using hickory-resolver with Cloudflare DNS servers
-    public_resolver: Resolver<TokioConnectionProvider>,
-}
-
-impl LayeredDnsResolver {
-    /// Create a new layered DNS resolver with automatic DNS configuration detection
-    #[instrument(skip_all)]
-    pub async fn new() -> Result<Self, DnsError> {
-        info!("Initializing layered DNS resolver with hickory-resolver, Moka cache and public DNS fallback");
-
-        // Create Moka cache with TTL and size limits
-        let cache = Cache::builder()
-            .time_to_live(Duration::from_secs(CACHE_TTL_SECONDS))
-            .max_capacity(MAX_CACHE_SIZE)
-            .build();
-
-        // Create system DNS resolver with default configuration (auto-detects container/host DNS)
-        let system_resolver =
-            Resolver::builder_with_config(ResolverConfig::default(), TokioConnectionProvider::default()).build();
-
-        let mut config = ResolverConfig::cloudflare_tls();
-        for ns in ResolverConfig::google_tls().name_servers() {
-            config.add_name_server(ns.clone())
-        }
-        // Create public DNS resolver using Cloudflare DNS with TLS support
-        let public_resolver = Resolver::builder_with_config(config, TokioConnectionProvider::default()).build();
-
-        info!("DNS resolver initialized successfully with hickory-resolver system and Cloudflare TLS public fallback");
-
-        Ok(Self {
-            cache,
-            system_resolver,
-            public_resolver,
-        })
-    }
-
-    /// Validate domain format according to RFC standards
-    #[instrument(skip_all, fields(domain = %domain))]
-    fn validate_domain_format(domain: &str) -> Result<(), DnsError> {
-        info!("Validating domain format start");
-        // Check FQDN length
-        if domain.len() > MAX_FQDN_LENGTH {
-            return Err(DnsError::InvalidFormat {
-                reason: format!("FQDN must not exceed {} bytes, got {} bytes", MAX_FQDN_LENGTH, domain.len()),
-            });
-        }
-
-        // Check each label length
-        for label in domain.split('.') {
-            if label.len() > MAX_LABEL_LENGTH {
-                return Err(DnsError::InvalidFormat {
-                    reason: format!(
-                        "Each label must not exceed {} bytes, label '{}' has {} bytes",
-                        MAX_LABEL_LENGTH,
-                        label,
-                        label.len()
-                    ),
-                });
-            }
-        }
-
-        // Check for empty labels (except trailing dot)
-        let labels: Vec<&str> = domain.trim_end_matches('.').split('.').collect();
-        for label in &labels {
-            if label.is_empty() {
-                return Err(DnsError::InvalidFormat {
-                    reason: "Domain contains empty labels".to_string(),
-                });
-            }
-        }
-        info!("DNS resolver validated successfully");
-        Ok(())
-    }
-
-    /// Check local cache for resolved domain
-    #[instrument(skip_all, fields(domain = %domain))]
-    async fn check_cache(&self, domain: &str) -> Option<Vec<IpAddr>> {
-        match self.cache.get(domain).await {
-            Some(ips) => {
-                debug!("DNS cache hit for domain: {}, found {} IPs", domain, ips.len());
-                Some(ips)
-            }
-            None => {
-                debug!("DNS cache miss for domain: {}", domain);
-                None
-            }
-        }
-    }
-
-    /// Update local cache with resolved IPs
-    #[instrument(skip_all, fields(domain = %domain, ip_count = ips.len()))]
-    async fn update_cache(&self, domain: &str, ips: Vec<IpAddr>) {
-        self.cache.insert(domain.to_string(), ips.clone()).await;
-        debug!("DNS cache updated for domain: {} with {} IPs", domain, ips.len());
-    }
-
-    /// Get cache statistics for monitoring
-    #[instrument(skip_all)]
-    pub async fn cache_stats(&self) -> (u64, u64) {
-        let entry_count = self.cache.entry_count();
-        let weighted_size = self.cache.weighted_size();
-        debug!("DNS cache stats - entries: {}, weighted_size: {}", entry_count, weighted_size);
-        (entry_count, weighted_size)
-    }
-
-    /// Manually invalidate cache entries (useful for testing or forced refresh)
-    #[instrument(skip_all)]
-    pub async fn invalidate_cache(&self) {
-        self.cache.invalidate_all();
-        info!("DNS cache invalidated");
-    }
-
-    /// Resolve domain using system DNS (cluster/host DNS configuration) with hickory-resolver
-    #[instrument(skip_all, fields(domain = %domain))]
-    async fn resolve_with_system_dns(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
-        debug!("Attempting system DNS resolution for domain: {} using hickory-resolver", domain);
-
-        match self.system_resolver.lookup_ip(domain).await {
-            Ok(lookup) => {
-                let ips: Vec<IpAddr> = lookup.iter().collect();
-                if !ips.is_empty() {
-                    info!("System DNS resolution successful for domain: {} -> {} IPs", domain, ips.len());
-                    Ok(ips)
-                } else {
-                    warn!("System DNS returned empty result for domain: {}", domain);
-                    Err(DnsError::SystemDnsFailed {
-                        domain: domain.to_string(),
-                        source: "No IP addresses found".to_string().into(),
-                    })
-                }
-            }
-            Err(e) => {
-                warn!("System DNS resolution failed for domain: {} - {}", domain, e);
-                Err(DnsError::SystemDnsFailed {
-                    domain: domain.to_string(),
-                    source: Box::new(e),
-                })
-            }
-        }
-    }
-
-    /// Resolve domain using public DNS servers (Cloudflare TLS DNS) with hickory-resolver
-    #[instrument(skip_all, fields(domain = %domain))]
-    async fn resolve_with_public_dns(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
-        debug!(
-            "Attempting public DNS resolution for domain: {} using hickory-resolver with TLS-enabled Cloudflare DNS",
-            domain
-        );
-
-        match self.public_resolver.lookup_ip(domain).await {
-            Ok(lookup) => {
-                let ips: Vec<IpAddr> = lookup.iter().collect();
-                if !ips.is_empty() {
-                    info!("Public DNS resolution successful for domain: {} -> {} IPs", domain, ips.len());
-                    Ok(ips)
-                } else {
-                    warn!("Public DNS returned empty result for domain: {}", domain);
-                    Err(DnsError::PublicDnsFailed {
-                        domain: domain.to_string(),
-                        source: "No IP addresses found".to_string().into(),
-                    })
-                }
-            }
-            Err(e) => {
-                error!("Public DNS resolution failed for domain: {} - {}", domain, e);
-                Err(DnsError::PublicDnsFailed {
-                    domain: domain.to_string(),
-                    source: Box::new(e),
-                })
-            }
-        }
-    }
-
-    /// Resolve domain with layered fallback strategy using hickory-resolver
-    ///
-    /// Resolution order with detailed tracing:
-    /// 1. Local cache (Moka with TTL)
-    /// 2. System DNS (hickory-resolver with host/container adaptive configuration)  
-    /// 3. Public DNS (hickory-resolver with TLS-enabled Cloudflare DNS fallback)
-    #[instrument(skip_all, fields(domain = %domain))]
-    pub async fn resolve(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
-        info!("Starting DNS resolution process for domain: {} start", domain);
-        // Validate domain format first
-        Self::validate_domain_format(domain)?;
-
-        info!("Starting DNS resolution for domain: {}", domain);
-
-        // Step 1: Check local cache
-        if let Some(ips) = self.check_cache(domain).await {
-            info!("DNS resolution completed from cache for domain: {} -> {} IPs", domain, ips.len());
-            return Ok(ips);
-        }
-
-        debug!("Local cache miss for domain: {}, attempting system DNS", domain);
-
-        // Step 2: Try system DNS (cluster/host adaptive)
-        match self.resolve_with_system_dns(domain).await {
-            Ok(ips) => {
-                self.update_cache(domain, ips.clone()).await;
-                info!("DNS resolution completed via system DNS for domain: {} -> {} IPs", domain, ips.len());
-                return Ok(ips);
-            }
-            Err(system_err) => {
-                warn!("System DNS failed for domain: {} - {}", domain, system_err);
-            }
-        }
-
-        // Step 3: Fallback to public DNS
-        info!("Falling back to public DNS for domain: {}", domain);
-        match self.resolve_with_public_dns(domain).await {
-            Ok(ips) => {
-                self.update_cache(domain, ips.clone()).await;
-                info!("DNS resolution completed via public DNS for domain: {} -> {} IPs", domain, ips.len());
-                Ok(ips)
-            }
-            Err(public_err) => {
-                error!(
-                    "All DNS resolution attempts failed for domain:` {}`. System DNS: failed, Public DNS: {}",
-                    domain, public_err
-                );
-                Err(DnsError::AllAttemptsFailed {
-                    domain: domain.to_string(),
-                })
-            }
-        }
-    }
-}
-
-/// Global DNS resolver instance
-static GLOBAL_DNS_RESOLVER: OnceLock<LayeredDnsResolver> = OnceLock::new();
-
-/// Initialize the global DNS resolver
-#[instrument]
-pub async fn init_global_dns_resolver() -> Result<(), DnsError> {
-    info!("Initializing global DNS resolver");
-    let resolver = LayeredDnsResolver::new().await?;
-
-    match GLOBAL_DNS_RESOLVER.set(resolver) {
-        Ok(()) => {
-            info!("Global DNS resolver initialized successfully");
-            Ok(())
-        }
-        Err(_) => {
-            warn!("Global DNS resolver was already initialized");
-            Ok(())
-        }
-    }
-}
-
-/// Get the global DNS resolver instance
-pub fn get_global_dns_resolver() -> Option<&'static LayeredDnsResolver> {
-    GLOBAL_DNS_RESOLVER.get()
-}
-
-/// Resolve domain using the global DNS resolver with comprehensive tracing
-#[instrument(skip_all, fields(domain = %domain))]
-pub async fn resolve_domain(domain: &str) -> Result<Vec<IpAddr>, DnsError> {
-    info!("resolving domain for: {}", domain);
-    match get_global_dns_resolver() {
-        Some(resolver) => resolver.resolve(domain).await,
-        None => Err(DnsError::InitializationFailed {
-            source: "Global DNS resolver not initialized. Call init_global_dns_resolver() first."
-                .to_string()
-                .into(),
-        }),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_domain_validation() {
-        // Valid domains
-        assert!(LayeredDnsResolver::validate_domain_format("example.com").is_ok());
-        assert!(LayeredDnsResolver::validate_domain_format("sub.example.com").is_ok());
-        assert!(LayeredDnsResolver::validate_domain_format("very.deep.sub.domain.example.com").is_ok());
-
-        // Invalid domains - too long FQDN
-        let long_domain = "a".repeat(254);
-        assert!(LayeredDnsResolver::validate_domain_format(&long_domain).is_err());
-
-        // Invalid domains - label too long
-        let long_label = format!("{}.com", "a".repeat(64));
-        assert!(LayeredDnsResolver::validate_domain_format(&long_label).is_err());
-
-        // Invalid domains - empty label
-        assert!(LayeredDnsResolver::validate_domain_format("example..com").is_err());
-    }
-
-    #[tokio::test]
-    async fn test_cache_functionality() {
-        let resolver = LayeredDnsResolver::new().await.unwrap();
-
-        // Test cache miss
-        assert!(resolver.check_cache("example.com").await.is_none());
-
-        // Update cache
-        let test_ips = vec![IpAddr::from([192, 0, 2, 1])];
-        resolver.update_cache("example.com", test_ips.clone()).await;
-
-        // Test cache hit
-        assert_eq!(resolver.check_cache("example.com").await, Some(test_ips));
-
-        // Test cache stats (note: moka cache might not immediately reflect changes)
-        let (total, _weighted_size) = resolver.cache_stats().await;
-        // Cache should have at least the entry we just added (might be 0 due to async nature)
-        assert!(total <= 1, "Cache should have at most 1 entry, got {total}");
-    }
-
-    #[tokio::test]
-    async fn test_dns_resolution() {
-        let resolver = LayeredDnsResolver::new().await.unwrap();
-
-        // Test resolution of a known domain (localhost should always resolve)
-        match resolver.resolve("localhost").await {
-            Ok(ips) => {
-                assert!(!ips.is_empty());
-                println!("Resolved localhost to: {ips:?}");
-            }
-            Err(e) => {
-                // In some test environments, even localhost might fail
-                // This is acceptable as long as our error handling works
-                println!("DNS resolution failed (might be expected in test environments): {e}");
-            }
-        }
-    }
-
-    #[tokio::test]
-    async fn test_invalid_domain_resolution() {
-        let resolver = LayeredDnsResolver::new().await.unwrap();
-
-        // Test resolution of invalid domain
-        let result = resolver
-            .resolve("nonexistent.invalid.domain.example.thisdefinitelydoesnotexist")
-            .await;
-        assert!(result.is_err());
-
-        if let Err(e) = result {
-            println!("Expected error for invalid domain: {e}");
-            // Should be AllAttemptsFailed since both system and public DNS should fail
-            assert!(matches!(e, DnsError::AllAttemptsFailed { .. }));
-        }
-    }
-
-    #[tokio::test]
-    async fn test_cache_invalidation() {
-        let resolver = LayeredDnsResolver::new().await.unwrap();
-
-        // Add entry to cache
-        let test_ips = vec![IpAddr::from([192, 0, 2, 1])];
-        resolver.update_cache("test.example.com", test_ips.clone()).await;
-
-        // Verify cache hit
-        assert_eq!(resolver.check_cache("test.example.com").await, Some(test_ips));
-
-        // Invalidate cache
-        resolver.invalidate_cache().await;
-
-        // Verify cache miss after invalidation
-        assert!(resolver.check_cache("test.example.com").await.is_none());
-    }
-
-    #[tokio::test]
-    async fn test_global_resolver_initialization() {
-        // Test initialization
-        assert!(init_global_dns_resolver().await.is_ok());
-
-        // Test that resolver is available
-        assert!(get_global_dns_resolver().is_some());
-
-        // Test domain resolution through global resolver
-        match resolve_domain("localhost").await {
-            Ok(ips) => {
-                assert!(!ips.is_empty());
-                println!("Global resolver resolved localhost to: {ips:?}");
-            }
-            Err(e) => {
-                println!("Global resolver DNS resolution failed (might be expected in test environments): {e}");
-            }
-        }
-    }
-}
+// #![allow(dead_code)]
+//
+// //! Layered DNS resolution utility for Kubernetes environments
+// //!
+// //! This module provides robust DNS resolution with multiple fallback layers:
+// //! 1. Local cache (Moka) for previously resolved results
+// //! 2. System DNS resolver (container/host adaptive) using hickory-resolver
+// //! 3. Public DNS servers as final fallback (8.8.8.8, 1.1.1.1) using hickory-resolver with TLS
+// //!
+// //! The resolver is designed to handle 5-level or deeper domain names that may fail
+// //! in Kubernetes environments due to CoreDNS configuration, DNS recursion limits,
+// //! or network-related issues. Uses hickory-resolver for actual DNS queries with TLS support.
+//
+// use hickory_resolver::Resolver;
+// use hickory_resolver::config::ResolverConfig;
+// use hickory_resolver::name_server::TokioConnectionProvider;
+// use moka::future::Cache;
+// use std::net::IpAddr;
+// use std::sync::OnceLock;
+// use std::time::Duration;
+// use tracing::{debug, error, info, instrument, warn};
+//
+// /// Maximum FQDN length according to RFC standards
+// const MAX_FQDN_LENGTH: usize = 253;
+// /// Maximum DNS label length according to RFC standards
+// const MAX_LABEL_LENGTH: usize = 63;
+// /// Cache entry TTL in seconds
+// const CACHE_TTL_SECONDS: u64 = 300; // 5 minutes
+// /// Maximum cache size (number of entries)
+// const MAX_CACHE_SIZE: u64 = 10000;
+//
+// /// DNS resolution error types with detailed context and tracing information
+// #[derive(Debug, thiserror::Error)]
+// pub enum DnsError {
+//     #[error("Invalid domain format: {reason}")]
+//     InvalidFormat { reason: String },
+//
+//     #[error("Local cache miss for domain: {domain}")]
+//     CacheMiss { domain: String },
+//
+//     #[error("System DNS resolution failed for domain: {domain} - {source}")]
+//     SystemDnsFailed {
+//         domain: String,
+//         #[source]
+//         source: Box<dyn std::error::Error + Send + Sync>,
+//     },
+//
+//     #[error("Public DNS resolution failed for domain: {domain} - {source}")]
+//     PublicDnsFailed {
+//         domain: String,
+//         #[source]
+//         source: Box<dyn std::error::Error + Send + Sync>,
+//     },
+//
+//     #[error(
+//         "All DNS resolution attempts failed for domain: {domain}. Please check your domain spelling, network connectivity, or DNS configuration"
+//     )]
+//     AllAttemptsFailed { domain: String },
+//
+//     #[error("DNS resolver initialization failed: {source}")]
+//     InitializationFailed {
+//         #[source]
+//         source: Box<dyn std::error::Error + Send + Sync>,
+//     },
+//
+//     #[error("DNS configuration error: {source}")]
+//     ConfigurationError {
+//         #[source]
+//         source: Box<dyn std::error::Error + Send + Sync>,
+//     },
+// }
+//
+// /// Layered DNS resolver with caching and multiple fallback strategies
+// pub struct LayeredDnsResolver {
+//     /// Local cache for resolved domains using Moka for high performance
+//     cache: Cache<String, Vec<IpAddr>>,
+//     /// System DNS resolver using hickory-resolver with default configuration
+//     system_resolver: Resolver<TokioConnectionProvider>,
+//     /// Public DNS resolver using hickory-resolver with Cloudflare DNS servers
+//     public_resolver: Resolver<TokioConnectionProvider>,
+// }
+//
+// impl LayeredDnsResolver {
+//     /// Create a new layered DNS resolver with automatic DNS configuration detection
+//     #[instrument(skip_all)]
+//     pub async fn new() -> Result<Self, DnsError> {
+//         info!("Initializing layered DNS resolver with hickory-resolver, Moka cache and public DNS fallback");
+//
+//         // Create Moka cache with TTL and size limits
+//         let cache = Cache::builder()
+//             .time_to_live(Duration::from_secs(CACHE_TTL_SECONDS))
+//             .max_capacity(MAX_CACHE_SIZE)
+//             .build();
+//
+//         // Create system DNS resolver with default configuration (auto-detects container/host DNS)
+//         let system_resolver =
+//             Resolver::builder_with_config(ResolverConfig::default(), TokioConnectionProvider::default()).build();
+//
+//         let mut config = ResolverConfig::cloudflare_tls();
+//         for ns in ResolverConfig::google_tls().name_servers() {
+//             config.add_name_server(ns.clone())
+//         }
+//         // Create public DNS resolver using Cloudflare DNS with TLS support
+//         let public_resolver = Resolver::builder_with_config(config, TokioConnectionProvider::default()).build();
+//
+//         info!("DNS resolver initialized successfully with hickory-resolver system and Cloudflare TLS public fallback");
+//
+//         Ok(Self {
+//             cache,
+//             system_resolver,
+//             public_resolver,
+//         })
+//     }
+//
+//     /// Validate domain format according to RFC standards
+//     #[instrument(skip_all, fields(domain = %domain))]
+//     fn validate_domain_format(domain: &str) -> Result<(), DnsError> {
+//         info!("Validating domain format start");
+//         // Check FQDN length
+//         if domain.len() > MAX_FQDN_LENGTH {
+//             return Err(DnsError::InvalidFormat {
+//                 reason: format!("FQDN must not exceed {} bytes, got {} bytes", MAX_FQDN_LENGTH, domain.len()),
+//             });
+//         }
+//
+//         // Check each label length
+//         for label in domain.split('.') {
+//             if label.len() > MAX_LABEL_LENGTH {
+//                 return Err(DnsError::InvalidFormat {
+//                     reason: format!(
+//                         "Each label must not exceed {} bytes, label '{}' has {} bytes",
+//                         MAX_LABEL_LENGTH,
+//                         label,
+//                         label.len()
+//                     ),
+//                 });
+//             }
+//         }
+//
+//         // Check for empty labels (except trailing dot)
+//         let labels: Vec<&str> = domain.trim_end_matches('.').split('.').collect();
+//         for label in &labels {
+//             if label.is_empty() {
+//                 return Err(DnsError::InvalidFormat {
+//                     reason: "Domain contains empty labels".to_string(),
+//                 });
+//             }
+//         }
+//         info!("DNS resolver validated successfully");
+//         Ok(())
+//     }
+//
+//     /// Check local cache for resolved domain
+//     #[instrument(skip_all, fields(domain = %domain))]
+//     async fn check_cache(&self, domain: &str) -> Option<Vec<IpAddr>> {
+//         match self.cache.get(domain).await {
+//             Some(ips) => {
+//                 debug!("DNS cache hit for domain: {}, found {} IPs", domain, ips.len());
+//                 Some(ips)
+//             }
+//             None => {
+//                 debug!("DNS cache miss for domain: {}", domain);
+//                 None
+//             }
+//         }
+//     }
+//
+//     /// Update local cache with resolved IPs
+//     #[instrument(skip_all, fields(domain = %domain, ip_count = ips.len()))]
+//     async fn update_cache(&self, domain: &str, ips: Vec<IpAddr>) {
+//         self.cache.insert(domain.to_string(), ips.clone()).await;
+//         debug!("DNS cache updated for domain: {} with {} IPs", domain, ips.len());
+//     }
+//
+//     /// Get cache statistics for monitoring
+//     #[instrument(skip_all)]
+//     pub async fn cache_stats(&self) -> (u64, u64) {
+//         let entry_count = self.cache.entry_count();
+//         let weighted_size = self.cache.weighted_size();
+//         debug!("DNS cache stats - entries: {}, weighted_size: {}", entry_count, weighted_size);
+//         (entry_count, weighted_size)
+//     }
+//
+//     /// Manually invalidate cache entries (useful for testing or forced refresh)
+//     #[instrument(skip_all)]
+//     pub async fn invalidate_cache(&self) {
+//         self.cache.invalidate_all();
+//         info!("DNS cache invalidated");
+//     }
+//
+//     /// Resolve domain using system DNS (cluster/host DNS configuration) with hickory-resolver
+//     #[instrument(skip_all, fields(domain = %domain))]
+//     async fn resolve_with_system_dns(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
+//         debug!("Attempting system DNS resolution for domain: {} using hickory-resolver", domain);
+//
+//         match self.system_resolver.lookup_ip(domain).await {
+//             Ok(lookup) => {
+//                 let ips: Vec<IpAddr> = lookup.iter().collect();
+//                 if !ips.is_empty() {
+//                     info!("System DNS resolution successful for domain: {} -> {} IPs", domain, ips.len());
+//                     Ok(ips)
+//                 } else {
+//                     warn!("System DNS returned empty result for domain: {}", domain);
+//                     Err(DnsError::SystemDnsFailed {
+//                         domain: domain.to_string(),
+//                         source: "No IP addresses found".to_string().into(),
+//                     })
+//                 }
+//             }
+//             Err(e) => {
+//                 warn!("System DNS resolution failed for domain: {} - {}", domain, e);
+//                 Err(DnsError::SystemDnsFailed {
+//                     domain: domain.to_string(),
+//                     source: Box::new(e),
+//                 })
+//             }
+//         }
+//     }
+//
+//     /// Resolve domain using public DNS servers (Cloudflare TLS DNS) with hickory-resolver
+//     #[instrument(skip_all, fields(domain = %domain))]
+//     async fn resolve_with_public_dns(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
+//         debug!(
+//             "Attempting public DNS resolution for domain: {} using hickory-resolver with TLS-enabled Cloudflare DNS",
+//             domain
+//         );
+//
+//         match self.public_resolver.lookup_ip(domain).await {
+//             Ok(lookup) => {
+//                 let ips: Vec<IpAddr> = lookup.iter().collect();
+//                 if !ips.is_empty() {
+//                     info!("Public DNS resolution successful for domain: {} -> {} IPs", domain, ips.len());
+//                     Ok(ips)
+//                 } else {
+//                     warn!("Public DNS returned empty result for domain: {}", domain);
+//                     Err(DnsError::PublicDnsFailed {
+//                         domain: domain.to_string(),
+//                         source: "No IP addresses found".to_string().into(),
+//                     })
+//                 }
+//             }
+//             Err(e) => {
+//                 error!("Public DNS resolution failed for domain: {} - {}", domain, e);
+//                 Err(DnsError::PublicDnsFailed {
+//                     domain: domain.to_string(),
+//                     source: Box::new(e),
+//                 })
+//             }
+//         }
+//     }
+//
+//     /// Resolve domain with layered fallback strategy using hickory-resolver
+//     ///
+//     /// Resolution order with detailed tracing:
+//     /// 1. Local cache (Moka with TTL)
+//     /// 2. System DNS (hickory-resolver with host/container adaptive configuration)
+//     /// 3. Public DNS (hickory-resolver with TLS-enabled Cloudflare DNS fallback)
+//     #[instrument(skip_all, fields(domain = %domain))]
+//     pub async fn resolve(&self, domain: &str) -> Result<Vec<IpAddr>, DnsError> {
+//         info!("Starting DNS resolution process for domain: {} start", domain);
+//         // Validate domain format first
+//         Self::validate_domain_format(domain)?;
+//
+//         info!("Starting DNS resolution for domain: {}", domain);
+//
+//         // Step 1: Check local cache
+//         if let Some(ips) = self.check_cache(domain).await {
+//             info!("DNS resolution completed from cache for domain: {} -> {} IPs", domain, ips.len());
+//             return Ok(ips);
+//         }
+//
+//         debug!("Local cache miss for domain: {}, attempting system DNS", domain);
+//
+//         // Step 2: Try system DNS (cluster/host adaptive)
+//         match self.resolve_with_system_dns(domain).await {
+//             Ok(ips) => {
+//                 self.update_cache(domain, ips.clone()).await;
+//                 info!("DNS resolution completed via system DNS for domain: {} -> {} IPs", domain, ips.len());
+//                 return Ok(ips);
+//             }
+//             Err(system_err) => {
+//                 warn!("System DNS failed for domain: {} - {}", domain, system_err);
+//             }
+//         }
+//
+//         // Step 3: Fallback to public DNS
+//         info!("Falling back to public DNS for domain: {}", domain);
+//         match self.resolve_with_public_dns(domain).await {
+//             Ok(ips) => {
+//                 self.update_cache(domain, ips.clone()).await;
+//                 info!("DNS resolution completed via public DNS for domain: {} -> {} IPs", domain, ips.len());
+//                 Ok(ips)
+//             }
+//             Err(public_err) => {
+//                 error!(
+//                     "All DNS resolution attempts failed for domain:` {}`. System DNS: failed, Public DNS: {}",
+//                     domain, public_err
+//                 );
+//                 Err(DnsError::AllAttemptsFailed {
+//                     domain: domain.to_string(),
+//                 })
+//             }
+//         }
+//     }
+// }
+//
+// /// Global DNS resolver instance
+// static GLOBAL_DNS_RESOLVER: OnceLock<LayeredDnsResolver> = OnceLock::new();
+//
+// /// Initialize the global DNS resolver
+// #[instrument]
+// pub async fn init_global_dns_resolver() -> Result<(), DnsError> {
+//     info!("Initializing global DNS resolver");
+//     let resolver = LayeredDnsResolver::new().await?;
+//
+//     match GLOBAL_DNS_RESOLVER.set(resolver) {
+//         Ok(()) => {
+//             info!("Global DNS resolver initialized successfully");
+//             Ok(())
+//         }
+//         Err(_) => {
+//             warn!("Global DNS resolver was already initialized");
+//             Ok(())
+//         }
+//     }
+// }
+//
+// /// Get the global DNS resolver instance
+// pub fn get_global_dns_resolver() -> Option<&'static LayeredDnsResolver> {
+//     GLOBAL_DNS_RESOLVER.get()
+// }
+//
+// /// Resolve domain using the global DNS resolver with comprehensive tracing
+// #[instrument(skip_all, fields(domain = %domain))]
+// pub async fn resolve_domain(domain: &str) -> Result<Vec<IpAddr>, DnsError> {
+//     info!("resolving domain for: {}", domain);
+//     match get_global_dns_resolver() {
+//         Some(resolver) => resolver.resolve(domain).await,
+//         None => Err(DnsError::InitializationFailed {
+//             source: "Global DNS resolver not initialized. Call init_global_dns_resolver() first."
+//                 .to_string()
+//                 .into(),
+//         }),
+//     }
+// }
+//
+// #[cfg(test)]
+// mod tests {
+//     use super::*;
+//
+//     #[test]
+//     fn test_domain_validation() {
+//         // Valid domains
+//         assert!(LayeredDnsResolver::validate_domain_format("example.com").is_ok());
+//         assert!(LayeredDnsResolver::validate_domain_format("sub.example.com").is_ok());
+//         assert!(LayeredDnsResolver::validate_domain_format("very.deep.sub.domain.example.com").is_ok());
+//
+//         // Invalid domains - too long FQDN
+//         let long_domain = "a".repeat(254);
+//         assert!(LayeredDnsResolver::validate_domain_format(&long_domain).is_err());
+//
+//         // Invalid domains - label too long
+//         let long_label = format!("{}.com", "a".repeat(64));
+//         assert!(LayeredDnsResolver::validate_domain_format(&long_label).is_err());
+//
+//         // Invalid domains - empty label
+//         assert!(LayeredDnsResolver::validate_domain_format("example..com").is_err());
+//     }
+//
+//     #[tokio::test]
+//     async fn test_cache_functionality() {
+//         let resolver = LayeredDnsResolver::new().await.unwrap();
+//
+//         // Test cache miss
+//         assert!(resolver.check_cache("example.com").await.is_none());
+//
+//         // Update cache
+//         let test_ips = vec![IpAddr::from([192, 0, 2, 1])];
+//         resolver.update_cache("example.com", test_ips.clone()).await;
+//
+//         // Test cache hit
+//         assert_eq!(resolver.check_cache("example.com").await, Some(test_ips));
+//
+//         // Test cache stats (note: moka cache might not immediately reflect changes)
+//         let (total, _weighted_size) = resolver.cache_stats().await;
+//         // Cache should have at least the entry we just added (might be 0 due to async nature)
+//         assert!(total <= 1, "Cache should have at most 1 entry, got {total}");
+//     }
+//
+//     #[tokio::test]
+//     async fn test_dns_resolution() {
+//         let resolver = LayeredDnsResolver::new().await.unwrap();
+//
+//         // Test resolution of a known domain (localhost should always resolve)
+//         match resolver.resolve("localhost").await {
+//             Ok(ips) => {
+//                 assert!(!ips.is_empty());
+//                 println!("Resolved localhost to: {ips:?}");
+//             }
+//             Err(e) => {
+//                 // In some test environments, even localhost might fail
+//                 // This is acceptable as long as our error handling works
+//                 println!("DNS resolution failed (might be expected in test environments): {e}");
+//             }
+//         }
+//     }
+//
+//     #[tokio::test]
+//     async fn test_invalid_domain_resolution() {
+//         let resolver = LayeredDnsResolver::new().await.unwrap();
+//
+//         // Test resolution of invalid domain
+//         let result = resolver
+//             .resolve("nonexistent.invalid.domain.example.thisdefinitelydoesnotexist")
+//             .await;
+//         assert!(result.is_err());
+//
+//         if let Err(e) = result {
+//             println!("Expected error for invalid domain: {e}");
+//             // Should be AllAttemptsFailed since both system and public DNS should fail
+//             assert!(matches!(e, DnsError::AllAttemptsFailed { .. }));
+//         }
+//     }
+//
+//     #[tokio::test]
+//     async fn test_cache_invalidation() {
+//         let resolver = LayeredDnsResolver::new().await.unwrap();
+//
+//         // Add entry to cache
+//         let test_ips = vec![IpAddr::from([192, 0, 2, 1])];
+//         resolver.update_cache("test.example.com", test_ips.clone()).await;
+//
+//         // Verify cache hit
+//         assert_eq!(resolver.check_cache("test.example.com").await, Some(test_ips));
+//
+//         // Invalidate cache
+//         resolver.invalidate_cache().await;
+//
+//         // Verify cache miss after invalidation
+//         assert!(resolver.check_cache("test.example.com").await.is_none());
+//     }
+//
+//     #[tokio::test]
+//     async fn test_global_resolver_initialization() {
+//         // Test initialization
+//         assert!(init_global_dns_resolver().await.is_ok());
+//
+//         // Test that resolver is available
+//         assert!(get_global_dns_resolver().is_some());
+//
+//         // Test domain resolution through global resolver
+//         match resolve_domain("localhost").await {
+//             Ok(ips) => {
+//                 assert!(!ips.is_empty());
+//                 println!("Global resolver resolved localhost to: {ips:?}");
+//             }
+//             Err(e) => {
+//                 println!("Global resolver DNS resolution failed (might be expected in test environments): {e}");
+//             }
+//         }
+//     }
+// }
@@ -51,10 +51,8 @@ pub const AMZ_TAG_COUNT: &str = "x-amz-tagging-count";
 pub const AMZ_TAG_DIRECTIVE: &str = "X-Amz-Tagging-Directive";

 // S3 transition restore
-pub const AMZ_RESTORE: &str = "x-amz-restore";
 pub const AMZ_RESTORE_EXPIRY_DAYS: &str = "X-Amz-Restore-Expiry-Days";
 pub const AMZ_RESTORE_REQUEST_DATE: &str = "X-Amz-Restore-Request-Date";
-pub const AMZ_RESTORE_OUTPUT_PATH: &str = "x-amz-restore-output-path";

 // S3 extensions
 pub const AMZ_COPY_SOURCE_IF_MODIFIED_SINCE: &str = "x-amz-copy-source-if-modified-since";
@@ -176,6 +174,7 @@ pub const RUSTFS_BUCKET_REPLICATION_DELETE_MARKER: &str = "X-Rustfs-Source-Delet
 pub const RUSTFS_BUCKET_REPLICATION_PROXY_REQUEST: &str = "X-Rustfs-Source-Proxy-Request";
 pub const RUSTFS_BUCKET_REPLICATION_REQUEST: &str = "X-Rustfs-Source-Replication-Request";
 pub const RUSTFS_BUCKET_REPLICATION_CHECK: &str = "X-Rustfs-Source-Replication-Check";
+pub const RUSTFS_BUCKET_REPLICATION_SSEC_CHECKSUM: &str = "X-Rustfs-Source-Replication-Ssec-Crc";

 // SSEC encryption header constants
 pub const SSEC_ALGORITHM_HEADER: &str = "x-amz-server-side-encryption-customer-algorithm";
@@ -0,0 +1,201 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use http::HeaderMap;
+use regex::Regex;
+use std::env;
+use std::net::SocketAddr;
+use std::str::FromStr;
+use std::sync::LazyLock;
+
+/// De-facto standard header keys.
+const X_FORWARDED_FOR: &str = "x-forwarded-for";
+const X_FORWARDED_PROTO: &str = "x-forwarded-proto";
+const X_FORWARDED_SCHEME: &str = "x-forwarded-scheme";
+const X_REAL_IP: &str = "x-real-ip";
+
+/// RFC7239 defines a new "Forwarded: " header designed to replace the
+/// existing use of X-Forwarded-* headers.
+/// e.g. Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43
+const FORWARDED: &str = "forwarded";
+
+static FOR_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?i)(?:for=)([^(;|,| )]+)(.*)").unwrap());
+static PROTO_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?i)^(;|,| )+(?:proto=)(https|http)").unwrap());
+
+/// Used to disable all processing of the X-Forwarded-For header in source IP discovery.
+fn is_xff_header_enabled() -> bool {
+    env::var("_RUSTFS_API_XFF_HEADER")
+        .unwrap_or_else(|_| "on".to_string())
+        .to_lowercase()
+        == "on"
+}
+
+/// GetSourceScheme retrieves the scheme from the X-Forwarded-Proto and RFC7239
+/// Forwarded headers (in that order).
+pub fn get_source_scheme(headers: &HeaderMap) -> Option<String> {
+    // Retrieve the scheme from X-Forwarded-Proto.
+    if let Some(proto) = headers.get(X_FORWARDED_PROTO) {
+        if let Ok(proto_str) = proto.to_str() {
+            return Some(proto_str.to_lowercase());
+        }
+    }
+
+    if let Some(proto) = headers.get(X_FORWARDED_SCHEME) {
+        if let Ok(proto_str) = proto.to_str() {
+            return Some(proto_str.to_lowercase());
+        }
+    }
+
+    if let Some(forwarded) = headers.get(FORWARDED) {
+        if let Ok(forwarded_str) = forwarded.to_str() {
+            // match should contain at least two elements if the protocol was
+            // specified in the Forwarded header. The first element will always be
+            // the 'for=', which we ignore, subsequently we proceed to look for
+            // 'proto=' which should precede right after `for=` if not
+            // we simply ignore the values and return empty. This is in line
+            // with the approach we took for returning first ip from multiple
+            // params.
+            if let Some(for_match) = FOR_REGEX.captures(forwarded_str) {
+                if for_match.len() > 1 {
+                    let remaining = &for_match[2];
+                    if let Some(proto_match) = PROTO_REGEX.captures(remaining) {
+                        if proto_match.len() > 1 {
+                            return Some(proto_match[2].to_lowercase());
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    None
+}
+
+/// GetSourceIPFromHeaders retrieves the IP from the X-Forwarded-For, X-Real-IP
+/// and RFC7239 Forwarded headers (in that order)
+pub fn get_source_ip_from_headers(headers: &HeaderMap) -> Option<String> {
+    let mut addr = None;
+
+    if is_xff_header_enabled() {
+        if let Some(forwarded_for) = headers.get(X_FORWARDED_FOR) {
+            if let Ok(forwarded_str) = forwarded_for.to_str() {
+                // Only grab the first (client) address. Note that '192.168.0.1,
+                // 10.1.1.1' is a valid key for X-Forwarded-For where addresses after
+                // the first may represent forwarding proxies earlier in the chain.
+                let first_comma = forwarded_str.find(", ");
+                let end = first_comma.unwrap_or(forwarded_str.len());
+                addr = Some(forwarded_str[..end].to_string());
+            }
+        }
+    }
+
+    if addr.is_none() {
+        if let Some(real_ip) = headers.get(X_REAL_IP) {
+            if let Ok(real_ip_str) = real_ip.to_str() {
+                // X-Real-IP should only contain one IP address (the client making the
+                // request).
+                addr = Some(real_ip_str.to_string());
+            }
+        } else if let Some(forwarded) = headers.get(FORWARDED) {
+            if let Ok(forwarded_str) = forwarded.to_str() {
+                // match should contain at least two elements if the protocol was
+                // specified in the Forwarded header. The first element will always be
+                // the 'for=' capture, which we ignore. In the case of multiple IP
+                // addresses (for=8.8.8.8, 8.8.4.4, 172.16.1.20 is valid) we only
+                // extract the first, which should be the client IP.
+                if let Some(for_match) = FOR_REGEX.captures(forwarded_str) {
+                    if for_match.len() > 1 {
+                        // IPv6 addresses in Forwarded headers are quoted-strings. We strip
+                        // these quotes.
+                        let ip = for_match[1].trim_matches('"');
+                        addr = Some(ip.to_string());
+                    }
+                }
+            }
+        }
+    }
+
+    addr
+}
+
+/// GetSourceIPRaw retrieves the IP from the request headers
+/// and falls back to remote_addr when necessary.
+/// however returns without bracketing.
+pub fn get_source_ip_raw(headers: &HeaderMap, remote_addr: &str) -> String {
+    let addr = get_source_ip_from_headers(headers).unwrap_or_else(|| remote_addr.to_string());
+
+    // Default to remote address if headers not set.
+    if let Ok(socket_addr) = SocketAddr::from_str(&addr) {
+        socket_addr.ip().to_string()
+    } else {
+        addr
+    }
+}
+
+/// GetSourceIP retrieves the IP from the request headers
+/// and falls back to remote_addr when necessary.
+pub fn get_source_ip(headers: &HeaderMap, remote_addr: &str) -> String {
+    let addr = get_source_ip_raw(headers, remote_addr);
+    if addr.contains(':') { format!("[{addr}]") } else { addr }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use http::HeaderValue;
+
+    fn create_test_headers() -> HeaderMap {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-forwarded-for", HeaderValue::from_static("192.168.1.1"));
+        headers.insert("x-forwarded-proto", HeaderValue::from_static("https"));
+        headers
+    }
+
+    #[test]
+    fn test_get_source_scheme() {
+        let headers = create_test_headers();
+        assert_eq!(get_source_scheme(&headers), Some("https".to_string()));
+    }
+
+    #[test]
+    fn test_get_source_ip_from_headers() {
+        let headers = create_test_headers();
+        assert_eq!(get_source_ip_from_headers(&headers), Some("192.168.1.1".to_string()));
+    }
+
+    #[test]
+    fn test_get_source_ip_raw() {
+        let headers = create_test_headers();
+        let remote_addr = "127.0.0.1:8080";
+        let result = get_source_ip_raw(&headers, remote_addr);
+        assert_eq!(result, "192.168.1.1");
+    }
+
+    #[test]
+    fn test_get_source_ip() {
+        let headers = create_test_headers();
+        let remote_addr = "127.0.0.1:8080";
+        let result = get_source_ip(&headers, remote_addr);
+        assert_eq!(result, "192.168.1.1");
+    }
+
+    #[test]
+    fn test_get_source_ip_ipv6() {
+        let mut headers = HeaderMap::new();
+        headers.insert("x-forwarded-for", HeaderValue::from_static("2001:db8::1"));
+        let remote_addr = "127.0.0.1:8080";
+        let result = get_source_ip(&headers, remote_addr);
+        assert_eq!(result, "[2001:db8::1]");
+    }
+}
@@ -1,3 +1,18 @@
-pub mod headers;
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.

+pub mod headers;
+pub mod ip;
 pub use headers::*;
+pub use ip::*;
@@ -24,8 +24,6 @@ pub mod net;
 #[cfg(feature = "http")]
 pub mod http;

-#[cfg(feature = "net")]
-pub use dns_resolver::*;
 #[cfg(feature = "net")]
 pub use net::*;

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
shiro.lee	d2ced233e5	fix: when the error returned by make_bucket is BucketExists, replace … (#735 ) * fix: when the error returned by make_bucket is BucketExists, replace BucketAlreadyExists with BucketAlreadyOwnedByYou (#719) * test: In the test_api_error_from_storage_error_mappings test method, modify the corresponding mapping relationships --------- Co-authored-by: weisd <im@weisd.in>	2025-10-28 15:26:34 +08:00
weisd	40660e7b80	fix: scandir object (#733 ) * fix: scandir object count * fix: base64 list continuation_token	2025-10-28 15:02:43 +08:00
likewu	2aca1f77af	Fix/ilm (#721 ) * fix tip remote tier error * fix transitioned_object * fix filemeta * add GCS R2 * add aliyun tencent huaweicloud azure gcs r2 backend tier * fix signer * change azure to s3 Co-authored-by: houseme <housemecn@gmail.com> Co-authored-by: loverustfs <155562731+loverustfs@users.noreply.github.com>	2025-10-27 20:23:50 +08:00
Ben Scholzen	6f3d2885cd	fix: take content type from PutObjectInput instead of headers (#718 ) fixes #716 Co-authored-by: loverustfs <155562731+loverustfs@users.noreply.github.com>	2025-10-26 21:44:54 +08:00
shiro.lee	6ab7619023	fix: The issue of multi-level objects created in Windows not being displayed has been fixed (#661 ) (#723 )	2025-10-26 12:00:13 +08:00
weisd	ed73e2b782	fix:add favicon.ico route (#713 )	2025-10-25 16:11:18 +08:00
weisd	6a59c0a474	fix: multipart upload checksum validation (#712 ) * fix multipart upload checksum	2025-10-24 18:23:32 +08:00
houseme	c5264f9703	improve code for metrics and switch tokio-tar to astral-tokio-tar (#705 ) * improve code for metrics and switch tokio-tar to astral-tokio-tar * remove log * fix	2025-10-24 13:07:56 +08:00
DamonXue	b47765b4c0	docs: add Star History section to README files (#696 ) Co-authored-by: 0xdx2 <xuedamon2@gmail.com> Co-authored-by: loverustfs <155562731+loverustfs@users.noreply.github.com>	2025-10-24 08:58:58 +08:00
houseme	e22b24684f	chore: bump dependencies, add metrics support, remove DNS resolver (#699 ) * upgrade version * add metrics * remove dns resolver * add metrics counter for create bucket * fix * fix * fix	2025-10-24 00:16:17 +08:00
weisd	1d069fd351	Improve the peer client (#693 )	2025-10-23 17:21:55 +08:00
houseme	416d3ad5b7	Refactor: Add observability enable flag, improve comments, remove unused config params, and enhance run function error logging. (#689 ) * improve code for dns log * fix * Improve comments, remove unused parameters in config.rs (opt), add observability enable flag, and enhance error logging in run function execution.	2025-10-23 13:59:57 +08:00
weisd	f30698ec7f	Refactor Console Server Architecture (#685 ) * todo * fix console server * fix console server * fix console server * fix console server * fix console server	2025-10-23 00:06:09 +08:00
houseme	7dcf01f127	feat: adjust metrics push interval to 3 seconds (#686 ) - Reduce metrics push frequency from default to 3s for better performance - Optimize resource utilization during metrics collection - Improve real-time monitoring responsiveness Related to admin metrics optimization on fix/admin-metrics branch	2025-10-22 23:47:11 +08:00
weisd	e524a106c5	add make bucket error logs (#683 ) * add make bucket error logs	2025-10-22 16:23:08 +08:00
weisd	d9e5f5d2e3	fix (#682 )	2025-10-22 10:35:40 +08:00
livelycode36	684e832530	fix: prevent duplicate data volumes in entrypoint.sh (#681 )	2025-10-22 09:04:04 +08:00
weisd	a65856bdf4	Fix CRC32C Checksum Implementation and Enhance Authentication System (#678 ) * fix: get_condition_values * fix checksum crc32c * fix clippy	2025-10-21 21:28:00 +08:00
weisd	2edb2929b2	fix: DataUsageInfo add list bucket permission (#674 )	2025-10-21 10:05:54 +08:00
majinghe	14bc55479b	fix docker healthcheck unhealthy issue (#672 )	2025-10-21 09:39:15 +08:00
weisd	cd1e244c68	Refactor: Introduce content checksums and improve multipart/object metadata handling (#671 ) * feat: adapt to s3s typed etag support * refactor: move replication struct to rustfs_filemeta, fix filemeta transition bug * add head_object checksum, filter object metadata output * fix multipart checksum * fix multipart checksum * add content md5,sha256 check * fix test * fix cargo --------- Co-authored-by: overtrue <anzhengchao@gmail.com>	2025-10-20 23:46:13 +08:00
songhahaha66	46797dc815	fix(export): fix the policy and service account export (#665 ) * fix(export): fix the policy export mechanism * fix: correct service account check logic in IamSys	2025-10-20 19:40:54 +08:00