2.0.0-alpha.8

Highlights

• feat: dual S3 + Swift mode — the proxy can now serve S3 and Swift clients on the same instance. The flavor is detected per request (AWS4 signature → S3, X-Auth-Token → Swift) and routed to its own upstream (#158).
• New flags --s3-upstream-url / --swift-upstream-url (env DS_S3_UPSTREAM_URL / DS_SWIFT_UPSTREAM_URL); --upstream-url stays the shared default, a flavor-specific flag overrides it.

Breaking changes

• breaking(config): --connect-url renamed to --s3-connect-url
• breaking(socket): explicit --socket-path — the Unix socket is no longer created implicitly, and the TCP listener is now optional. You must pass --socket-path to enable the socket. (#159)

Fixes

• fix(write-once): cover S3 presigned URLs — write-once protection previously only triggered on Swift temp_url_expires; it now also covers S3 presigned PUTs (x-amz-expires), case-insensitively. (#156)

Docs

• Document S3, Swift and dual modes in the README. (#158)
• Add Rails, rclone and tooling configuration examples. (#155)
• Fix the --upstream-url flag in the README. (#157)

Maintenance

• chore(deps): lighter dependency tree and bumps. (#160, #161, #162)

Full changelog: 2.0.0-alpha.7...2.0.0-alpha.8

2.0.0-alpha.7

What's new

• feat(connect): S3 connect target override — new --connect-url flag
  (env DS_CONNECT_URL) to rewrite the host the proxy connects to for S3
  traffic, independently of the signed/host URL. Signature is still computed
  against the original endpoint, only the actual TCP target is redirected.
  See the README for usage. (#153)

Maintenance

• chore(deps): dependency bump. (#154)

Full changelog: 2.0.0-alpha.6...2.0.0-alpha.7

2.0.0-alpha.6

Fixes

#150 remove the user provided content-md5 from the header because it's altered by the proxy

various

#151 #152 bump deps

2.0.0-alpha.5

We are changing the version numbering scheme by removing the v prefix, which was causing issues with deb tools.

Fixes

#143 When initializing the keyring or rotating the master password, the new password is now written without a trailing newline when the command output is redirected to a file.

Various

#141 Bump deps
#142 Dockerfile build from deb is now the main one

v2.0.0-alpha.4

Features

#134 few changes:

• add rotate-password command to rotate the master password. it returns a new random password and update the keyring (and removes the salt, which becomes useless since the new password is randomly generated)
• add the command init-keyring to intialize a new keyring with a corresponding random master password
• modify add-key to panic if no keyring is found at the provided path

Various

#135 update dependencies and rust to 1.93.1
#131 add docker_file to build container from deb
#137 fix write_once
#139 fix traversal_attack_detection

v2.0.0-alpha.3

important

#123 switches from amazing but deprecrated sodiumoxyde lib to the official libsodium_rs binding. Retro compatibility is included.

breaking changes

#122 removes the chunk-size cli parameter and the DS_CHUNK_SIZE env var
#124 moves the salt params from the command line argument to the keyring file

! see #124 to know how moving the salt, the new encoding could be made by using echo -n 'previous_salt' | base64

various

#127 simplify code by using serde_with

v2.0.0-alpha.2

breaking changes

#117 Some cli args have been renamed to better frame the s3 protocol :

--aws-access-key -> --s3-access-key
--aws-secret-key -> --s3-secret-key
--aws-region -> --s3-region
--bypass-aws-signature-check -> --bypass-s3-signature-check

also rename --verify-ssl-certificate -> --bypass-ssl-certificate-check

#120 in s3 mode, the Content-Length header is now mandatory

perf

in s3 mode, all the uploads are now processed in memory, whatever their size.

v2.0.0-alpha.1

This version brings together important changes regarding the use of ds-proxy in s3 mode.

breaking changes

In s3 mode, requests targeting upstream must now be signed using the Signature SigV4 spec. The server can be launched with the --bypass-aws-signature-check flag to disable this verification.

new features

• --bypass-aws-signature-check flag to disable signature verification for incoming s3 requests.
• --verify-ssl-certificate flag to enable/disable SSL certificate verification for upstream requests (enabled by default).
• PUT requests to upstream now record the x-amz-meta-original-content-length metadata with the unencrypted size of the uploaded file.
• HEAD requests to upstream return the x-amz-meta-original-content-length metadata in the content-length header when possible.

misc

use of the official AWS framework to verify s3 request signatures and sign upstream requests.

v1.0.0 : oldie but goodie

Last release before a major change in the tool's behavior in s3 mode.

This release establishes the ability to use redis to ensure write-once functionality for requests targeting upstream that include the temp_url_expires query parameter.

f03453afad8d13a4aa7176326cad9fed9976701d

f03453a