cephmount: new hybrid driver to connect to CephFS clusters with go 1.25 (#5273)

* nceph: new hybrid driver to connect to ceph clusters.

It relies on a locally mounted filesystem and
only relies on libcephfs and librados to obtain
the path from an device inode.

* add per-user thread pool

* nceph: improve logging

* nceph: control testing dir with env variables

* nceph: add integration tests

* nceph: ensure validation tests only run with ceph flag

* nceph: divide conn and getpath tests

* nceph: add debug logs to each conn step

* nceph: enable debug logs in ceph integration tests

* nceph: be more flexible when parsing mds fs

* nceph: be even more flexible on mds parsing

* nceph: be even more flexible on mds parsing

* nceph: be more versbose on rados conns

* nceph: try different aproach to dump inode

* nceph: revert approach

* nceph: be more versbose about mds election

* nceph: use MDScommand

* nceph: use mount with root

* nceph: misc

* nepch: refactor admin conn logic

* nceph: avoid redundant calls to ceph mount

* nceph: be more verbose

* nceph: add path<>inode integration test

* nceph:log current uid in tests

* nceph: be more verbose

* nceph: run tests as root

* nceph: use root

* nceph: fix id to uid/gid mapping

* nceph: trim root prefix

* nceph: use fstab as source of truth

* nceph: fix user context

* nceph: add more verbose logs

* nceph: be even more verbose

* nceph: force local mount for integration tests

* nceph: test

* nceph: run ceph tests with build flag

* nceph: enable logging on demand for ceph tests

* nceph: remove temp tests

* nceph: add security tests for path traversal

* nceph: use current user

* nceph: clean test

* nceph: add benchmark

* nceph: dedicated ceph benchmarks

* nceph: fix typo

* nceph: fix inode 1 test

* nceph: fix security validation

* nceph: fix test setup

* nceph: fix bench tests

* nceph: fix rel paths

* nceph: add list folder tests

* nceph: add upload tests

* nceph: add multi-user benchs

* nceph: add thread isolation tests

* nceph: fix typo

* nceph: ensure propper permissions

* nceph: fix path translation

* nceph: fix typo

* nceph: fix test

* nceph: fix package

* nceph: fix mount point for benchs

* nceph: fix ceph benchs

* nceph: skip user switch tests if no root

* nceph: make test more robust when ceph is not available

* nchep to cephmount: polish

* cephmount: fix README.md

* cephmount: fix README.md

* cephmount: fix README.md

* cephmount: add debug lines for returned entries

* cephmount: log also hidden entries

* cephmount: bump log level to INFO for cephmount ops

* cephmount: add more logs

* cephmount: switch to debug mode

* all: bump go.mod to 1.25

* add changelog

* bump Dockerfile to go1.25.1

* bump Docker base image to go.1.25

* bump Dockerfile to 1.25.1

* fix buildtags

* protomote go vet as linting tool

* avoid using reflect.DeepEqual on protobufs

* ignore linting on .md files

* trigger CI

* trigger ci

Author: labkode

.codacy.yml

@@ -0,0 +1,3 @@
+---
+exclude_paths:
+  - "**./*md"

Makefile

@@ -10,16 +10,8 @@ all: revad reva test-go lint gen-doc
 ################################################################################
 
 TOOLCHAIN		?= $(CURDIR)/toolchain
-GOLANGCI_LINT	?= $(TOOLCHAIN)/golangci-lint
 CALENS			?= $(TOOLCHAIN)/calens
 
-.PHONY: toolchain
-toolchain: $(GOLANGCI_LINT) $(CALENS)
-
-$(GOLANGCI_LINT):
-	@mkdir -p $(@D)
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | BINDIR=$(@D) sh -s v1.64.8
-
 CALENS_DIR := $(shell mktemp -d)
 $(CALENS):
 	@mkdir -p $(@D)
@@ -124,14 +116,8 @@ else
 endif
 
 .PHONY: lint
-lint: $(GOLANGCI_LINT)
-	@$(GOLANGCI_LINT) run || (echo "Tip: many lint errors can be automatically fixed with \"make lint-fix\""; exit 1)
-
-.PHONY: lint-fix
-lint-fix: $(GOLANGCI_LINT)
-	gofmt -w .
-	$(GOLANGCI_LINT) run --fix
-
+lint:
+	go vet ./...
 
 ################################################################################
 # Release

changelog/unreleased/cephmount.md

@@ -0,0 +1,5 @@
+Enhancement: add new storage driver cephmount
+
+The cephmount driver is now available.
+
+https://github.com/cs3org/reva/pull/5273

docker/Dockerfile.reva

@@ -16,7 +16,7 @@
 # granted to it by virtue of its status as an Intergovernmental Organization
 # or submit itself to any jurisdiction.
 
-FROM golang:1.24-alpine3.21 as builder
+FROM golang:1.25.1-alpine as builder
 
 RUN apk --no-cache add \
   ca-certificates \

docker/Dockerfile.revad

@@ -16,7 +16,7 @@
 # granted to it by virtue of its status as an Intergovernmental Organization
 # or submit itself to any jurisdiction.
 
-FROM golang:1.24-alpine3.21 as builder
+FROM golang:1.25.1-alpine as builder
 
 WORKDIR /home/reva
 COPY . .

docker/Dockerfile.revad-ceph

@@ -30,12 +30,12 @@ RUN dnf update --nobest -y  && dnf install -y \
   librbd-devel \
   librados-devel
 
-ADD https://go.dev/dl/go1.24.2.linux-amd64.tar.gz \
-  go1.24.2.linux-amd64.tar.gz
+ADD https://go.dev/dl/go1.25.1.linux-amd64.tar.gz \
+  go1.25.1.linux-amd64.tar.gz
 
 RUN rm -rf /usr/local/go && \
-  tar -C /usr/local -xzf go1.24.2.linux-amd64.tar.gz && \
-  rm go1.24.2.linux-amd64.tar.gz
+  tar -C /usr/local -xzf go1.25.1.linux-amd64.tar.gz && \
+  rm go1.25.1.linux-amd64.tar.gz
 
 ENV PATH /go/bin:/usr/local/go/bin:$PATH
 ENV GOPATH /go

docker/Dockerfile.revad-eos

@@ -16,7 +16,7 @@
 # granted to it by virtue of its status as an Intergovernmental Organization
 # or submit itself to any jurisdiction.
 
-FROM golang:1.24-alpine3.21 as builder
+FROM golang:1.25.1-alpine as builder
 
 WORKDIR /home/reva
 COPY . .

go.mod

@@ -43,6 +43,7 @@ require (
 	github.com/onsi/gomega v1.38.0
 	github.com/owncloud/libre-graph-api-go v1.0.5-0.20250217093259-fa3804be6c27
 	github.com/pkg/errors v0.9.1
+	github.com/pkg/xattr v0.4.12
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rs/cors v1.11.1
 	github.com/rs/zerolog v1.34.0
@@ -143,9 +144,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-go 1.24.0
-
-toolchain go1.24.2
+go 1.25
 
 replace (
 	github.com/eventials/go-tus => github.com/andrewmostello/go-tus v0.0.0-20200314041820-904a9904af9a

go.sum

@@ -1438,6 +1438,8 @@ github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZ
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pkg/term v1.2.0-beta.2 h1:L3y/h2jkuBVFdWiJvNfYfKmzcCnILw7mJWm2JQuMppw=
 github.com/pkg/term v1.2.0-beta.2/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
+github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=
+github.com/pkg/xattr v0.4.12/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
@@ -1924,6 +1926,7 @@ golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

internal/grpc/services/gateway/authprovider.go

@@ -35,6 +35,7 @@ import (
 	"github.com/cs3org/reva/v3/pkg/sharedconf"
 	"github.com/pkg/errors"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/proto"
 )
 
 func (s *svc) Authenticate(ctx context.Context, req *gateway.AuthenticateRequest) (*gateway.AuthenticateResponse, error) {
@@ -92,7 +93,7 @@ func (s *svc) Authenticate(ctx context.Context, req *gateway.AuthenticateRequest
 		}, nil
 	}
 
-	u := *res.User
+	u := proto.Clone(res.User).(*userpb.User)
 	if sharedconf.SkipUserGroupsInToken() {
 		u.Groups = []string{}
 	}
@@ -102,7 +103,7 @@ func (s *svc) Authenticate(ctx context.Context, req *gateway.AuthenticateRequest
 	// the resources referenced by these. Since the current scope can do that,
 	// mint a temporary token based on that and expand the scope. Then set the
 	// token obtained from the updated scope in the context.
-	token, err := s.tokenmgr.MintToken(ctx, &u, res.TokenScope)
+	token, err := s.tokenmgr.MintToken(ctx, u, res.TokenScope)
 	if err != nil {
 		err = errors.Wrap(err, "authsvc: error in MintToken")
 		res := &gateway.AuthenticateResponse{
@@ -127,7 +128,7 @@ func (s *svc) Authenticate(ctx context.Context, req *gateway.AuthenticateRequest
 	*/
 	scope := res.TokenScope
 
-	token, err = s.tokenmgr.MintToken(ctx, &u, scope)
+	token, err = s.tokenmgr.MintToken(ctx, u, scope)
 	if err != nil {
 		err = errors.Wrap(err, "authsvc: error in MintToken")
 		res := &gateway.AuthenticateResponse{