From 0b3bca255797f628af08c13ddc2a2e617759f05a Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 09:49:23 +0100
Subject: [PATCH 01/54] vk-registry/dav: share the files object layer

Move the object model of the plain-file area (directories, objects,
foreign tags, the namespace lock) and the streaming write out of the
WebDAV handlers into vk-registry/src/files.rs, so another wire protocol
can serve the same objects with its own status codes and bodies. The
write is split into staging (stream to uploads/ while hashing) and a
commit that promotes and tags under the namespace lock, and the reason
a path cannot take an object is returned as a value each front maps to
its own status. No behaviour change.
---
 vk-registry/src/dav/files.rs | 411 +++------------------------------
 vk-registry/src/dav/mod.rs   |   2 +-
 vk-registry/src/files.rs     | 436 +++++++++++++++++++++++++++++++++++
 vk-registry/src/lib.rs       |   1 +
 4 files changed, 475 insertions(+), 375 deletions(-)
 create mode 100644 vk-registry/src/files.rs

diff --git a/vk-registry/src/dav/files.rs b/vk-registry/src/dav/files.rs
index 8931b3e7..021ccc74 100644
--- a/vk-registry/src/dav/files.rs
+++ b/vk-registry/src/dav/files.rs
@@ -1,165 +1,30 @@
-//! Plain files under `/dav/files/<dir>/` share the OCI pool. Directories map to repositories
-//! under `files/`; each leaf is a tag on a single-layer raw-file manifest, as written by
-//! `/upload`, whose layer holds the file bytes. `PUT` streams to `uploads/` while hashing,
-//! promotes the blob, then writes the manifest and tag. `MKCOL` creates an empty repository;
-//! `DELETE` removes a tag or an empty repository. Authorization uses the resource's repository,
-//! so `files/<dir>/*` covers a whole tree. Entries expire under gc's tag retention and blob
-//! grace windows.
+//! The WebDAV view of the plain-file area, under `/dav/files/<dir>/`, over the object layer in
+//! [`crate::files`]: this module maps WebDAV verbs, statuses and bodies onto it. `PUT` stages
+//! and commits an object; `MKCOL` creates an empty repository; `DELETE` removes a tag or an
+//! empty repository. Authorization uses the resource's repository, so `files/<dir>/*` covers
+//! a whole tree.
 
-use std::path::PathBuf;
-use std::sync::{Arc, Mutex, PoisonError};
-use std::time::{Duration, SystemTime};
+use std::sync::Arc;
+use std::time::Duration;
 
 use anyhow::{Context, Result};
-use bytes::Bytes;
-use http_body_util::BodyExt;
 use hyper::body::Incoming;
 use hyper::header::{CONTENT_DISPOSITION, CONTENT_LENGTH, LAST_MODIFIED};
 use hyper::{Request, Response, StatusCode};
-use sha2::{Digest, Sha256};
-use tokio::io::{AsyncWrite, AsyncWriteExt};
 
 use super::{
     ALLOWED_FILES, ALLOWED_READ, Depth, Entry, blocking, created, href, http_date,
     method_not_allowed, multistatus, no_content, not_found, options, propfind_depth, refuse,
 };
-use crate::{Authz, Body, RepoRemoval, STREAM_CHUNK, ServerState, Store, accounts, error_response};
-
-/// The repository every `/dav/files/` path lives under.
-pub(super) const FILES_REPO: &str = "files";
-
-/// Maximum object size, checked both against Content-Length and while streaming.
-const MAX_OBJECT: u64 = 4 << 30;
+use crate::files::{
+    FILES_REPO, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, drain_into,
+    namespace, object_of, repo_name, resolve, under_object,
+};
+use crate::{Authz, Body, RepoRemoval, ServerState, Store, accounts, error_response};
 
 /// What every object is served as, matching `/v2/` blobs.
 const OBJECT_TYPE: &str = "application/octet-stream";
 
-/// Minimum idle age before a `GET` refreshes the tag's mtime — the "last used" record the
-/// gc's retention keys on — so a cache read is a metadata write at most once an hour.
-const TOUCH_AFTER: Duration = Duration::from_secs(3600);
-
-/// Serialize `files/` checks and namespace changes (`PUT` tags, `MKCOL`, `DELETE`) in this
-/// server so a `PUT` and `MKCOL` of the same path cannot both succeed. Acquire before the
-/// store lock, never while holding it. `/v2/` writes into `files/` do not take this lock.
-static NAMESPACE: Mutex<()> = Mutex::new(());
-
-/// The namespace held, in this process and against any other serving the store: a registry
-/// and the release it hands over to serve it together for a while.
-struct Namespace {
-    _process: std::sync::MutexGuard<'static, ()>,
-    _store: crate::LockGuard,
-}
-
-/// Hold [`NAMESPACE`], then the store's namespace lock. Accept a poisoned mutex: it guards
-/// no data that a panic could leave inconsistent.
-fn namespace(store: &Store) -> Result<Namespace> {
-    let process = NAMESPACE.lock().unwrap_or_else(PoisonError::into_inner);
-    Ok(Namespace {
-        _process: process,
-        _store: store.lock_namespace()?,
-    })
-}
-
-/// What a `files/` path names once the store has been looked at.
-enum Node {
-    /// A repository under `files/`, or a path component above one: a directory.
-    Dir(String),
-    /// A tag on a raw-file manifest: an object.
-    Object(Object),
-    /// A tag on any other manifest — an image pushed over `/v2/` into a `files/`
-    /// repository. Absent to reads; a write there is 409, so nothing here replaces or
-    /// deletes it.
-    Foreign(String),
-}
-
-/// An object's tag and what its manifest says about the layer.
-struct Object {
-    repo: String,
-    tag: String,
-    /// the layer blob's hex
-    layer: String,
-    /// the layer's canonical length
-    size: u64,
-    /// the tag's mtime
-    modified: SystemTime,
-}
-
-impl Node {
-    /// The repository this node authorizes as.
-    fn repo(&self) -> &str {
-        match self {
-            Node::Dir(r) | Node::Foreign(r) => r,
-            Node::Object(o) => &o.repo,
-        }
-    }
-}
-
-/// The repository a run of path components names: `files/<segs…>`.
-fn repo_name(segs: &[String]) -> String {
-    let mut name = String::from(FILES_REPO);
-    for s in segs {
-        name.push('/');
-        name.push_str(s);
-    }
-    name
-}
-
-/// The repository and tag an object at `segs` would have: the last component is the tag.
-fn object_of(segs: &[String]) -> Option<(String, &str)> {
-    let (leaf, parents) = segs.split_last()?;
-    (!parents.is_empty()).then(|| (repo_name(parents), leaf.as_str()))
-}
-
-/// What is at `segs`: a directory, an object, a foreign tag, or nothing. A directory is any
-/// path under `repos/files/` that is one — a repository, or the parent a nested repository's
-/// name created — so the tree reads as the client wrote it.
-fn resolve(store: &Store, segs: &[String]) -> Result<Option<Node>> {
-    let dir = repo_name(segs);
-    if store.repo_dir_exists(&dir) {
-        return Ok(Some(Node::Dir(dir)));
-    }
-    let Some((repo, tag)) = object_of(segs) else {
-        return Ok(None);
-    };
-    let Some((manifest_hex, modified)) = store.tag_target(&repo, tag) else {
-        return Ok(None);
-    };
-    let layer = match store.get_blob(&manifest_hex)? {
-        Some(manifest) => crate::raw_file_layer(&manifest),
-        None => None,
-    };
-    Ok(Some(match layer {
-        Some((layer, size)) => Node::Object(Object {
-            repo,
-            tag: tag.to_string(),
-            layer,
-            size,
-            modified,
-        }),
-        None => Node::Foreign(repo),
-    }))
-}
-
-/// Whether an ancestor of `segs` is a tag. Writing below one would make its path a directory
-/// too, and [`resolve`] would then find the directory and hide the tag: RFC 4918 wants a 409
-/// for a parent that is not a collection. A top-level name is always a directory.
-fn under_object(store: &Store, segs: &[String]) -> Result<bool> {
-    for n in 2..segs.len() {
-        if matches!(
-            resolve(store, &segs[..n])?,
-            Some(Node::Object(_) | Node::Foreign(_))
-        ) {
-            return Ok(true);
-        }
-    }
-    Ok(false)
-}
-
-/// Whether this caller may `action` on `repo`.
-fn allowed(authz: &Authz<'_>, action: accounts::Action, repo: &str) -> bool {
-    crate::authorize_or_forbidden(authz, action, repo).is_none()
-}
-
 /// Serve one `files/` request; `segs` are the decoded components after `/dav/files/`, and
 /// `collection` whether the path ended in a slash — which an object's path never does.
 pub(super) async fn route(
@@ -339,12 +204,8 @@ fn get(
     if resp.status() == StatusCode::OK {
         // A GET served is a use, which is what keeps the tag from the gc's retention.
         // Refreshed only once idle, so a hot entry is not a metadata write per hit.
-        if !head
-            && SystemTime::now()
-                .duration_since(obj.modified)
-                .is_ok_and(|idle| idle > TOUCH_AFTER)
-        {
-            store.touch_tag(&obj.repo, &obj.tag);
+        if !head {
+            crate::files::touch_if_idle(store, &obj);
         }
         let headers = resp.headers_mut();
         // Prevent uploaded content from rendering on the `/browse` origin.
@@ -419,46 +280,15 @@ fn propfind(
     }
 }
 
-/// Why a streamed `PUT` stopped short.
-enum PutError {
-    /// the body crossed [`MAX_OBJECT`] — a 413, decided while reading
-    TooLarge,
-    /// the read or the write failed — a 500
-    Failed(anyhow::Error),
-}
-
-/// A staging file under `uploads/`, unlinked when dropped unless its bytes were promoted —
-/// including when the handler's future is dropped with the connection mid-body.
-struct Staging {
-    path: PathBuf,
-    armed: bool,
-}
-
-impl Drop for Staging {
-    fn drop(&mut self) {
-        if self.armed {
-            // Gone already (a promotion that renamed it, or a discard) is the goal; any
-            // other failure leaves it to the gc's sweep of idle uploads.
-            let _ = std::fs::remove_file(&self.path);
-        }
+/// The answer to a `PUT` at a path that takes no object: a top-level name or a directory is
+/// 405, a foreign tag there or any tag above it 409.
+fn put_refusal(why: Unwritable, href: &str) -> Response<Body> {
+    match why {
+        Unwritable::TopLevel | Unwritable::Directory => method_not_allowed(href, ALLOWED_FILES),
+        Unwritable::Foreign | Unwritable::UnderObject => parent_is_object(href),
     }
 }
 
-/// Why `segs` cannot take an object, re-checked under [`NAMESPACE`] before the tag is
-/// written: a top-level name or a directory is 405, a foreign tag there or any tag above
-/// it 409. `None` when the `PUT` may proceed.
-fn put_refusal(store: &Store, segs: &[String], href: &str) -> Result<Option<Response<Body>>> {
-    if object_of(segs).is_none() {
-        return Ok(Some(method_not_allowed(href, ALLOWED_FILES)));
-    }
-    Ok(match resolve(store, segs)? {
-        Some(Node::Dir(_)) => Some(method_not_allowed(href, ALLOWED_FILES)),
-        Some(Node::Foreign(_)) => Some(parent_is_object(href)),
-        _ if under_object(store, segs)? => Some(parent_is_object(href)),
-        _ => None,
-    })
-}
-
 /// Stream an object into staging, hashing it on the way, then promote the blob and write the
 /// raw-file manifest and tag: 201 for a creation, 204 for a replacement. Every refusal but a
 /// declared length over the cap reads the body through first: a status sent with request
@@ -492,27 +322,18 @@ async fn put(
     // Refused before the body is staged when the answer is already known; checked again
     // once it is, under the namespace lock.
     let early = {
-        let (store, segs, href) = (Arc::clone(&state.store), segs.clone(), href.to_string());
-        tokio::task::spawn_blocking(move || put_refusal(&store, &segs, &href))
+        let (store, segs) = (Arc::clone(&state.store), segs.clone());
+        tokio::task::spawn_blocking(move || crate::files::unwritable(&store, &segs))
             .await
             .context("checking a PUT panicked")??
     };
-    if let Some(resp) = early {
-        return refuse(req, resp, href).await;
+    if let Some(why) = early {
+        return refuse(req, put_refusal(why, href), href).await;
     }
 
     // Stream uploads to bound memory use; the digest falls out of the same pass.
-    let (path, file) = state.store.stage_file()?;
-    let staging = Staging { path, armed: true };
-    let mut file = tokio::fs::File::from_std(file);
-    let written = drain_into(&mut file, req.into_body(), MAX_OBJECT).await;
-    let flushed = file
-        .flush()
-        .await
-        .map_err(|e| PutError::Failed(anyhow::Error::from(e).context("writing an object")));
-    drop(file);
-    let (size, hex) = match written.and_then(|w| flushed.map(|()| w)) {
-        Ok(w) => w,
+    let staged = match crate::files::stage(&state.store, req.into_body()).await {
+        Ok(staged) => staged,
         Err(PutError::TooLarge) => {
             return Ok(error_response(
                 StatusCode::PAYLOAD_TOO_LARGE,
@@ -522,42 +343,13 @@ async fn put(
         }
         Err(PutError::Failed(e)) => return Err(e),
     };
-
-    // Off the runtime: staging compresses, and a large object would otherwise block a tokio
-    // worker for seconds. The locks are taken inside, after that pass — the store lock as
-    // the relay takes it.
-    let store = Arc::clone(&state.store);
-    let href = href.to_string();
-    tokio::task::spawn_blocking(move || -> Result<Response<Body>> {
-        let mut staging = staging;
-        let staged = store.stage_promotion(&hex, &staging.path)?;
-        let _namespace = namespace(&store)?;
-        // shared store lock (vs. an exclusive gc) across the promote and the manifest that
-        // references it; see Store::lock_shared. A `MKCOL` or another `PUT` may have changed
-        // the path while the body streamed, so it is checked again.
-        let checked = store.lock_shared().and_then(|lock| {
-            let existed = matches!(resolve(&store, &segs)?, Some(Node::Object(_)));
-            Ok((lock, put_refusal(&store, &segs, &href)?, existed))
-        });
-        let (_lock, existed) = match checked {
-            Ok((lock, None, existed)) => (lock, existed),
-            Ok((_, Some(resp), _)) => {
-                staged.discard();
-                return Ok(resp);
-            }
-            Err(e) => {
-                staged.discard();
-                return Err(e);
-            }
-        };
-        store.promote_staged(&hex, staged)?;
-        staging.armed = false;
-        let (repo, tag) = object_of(&segs).context("a PUT past its checks names an object")?;
-        store.put_raw_file(&repo, tag, &hex, size, None)?;
-        Ok(if existed { no_content() } else { created() })
-    })
-    .await
-    .context("the object's promotion panicked")?
+    Ok(
+        match crate::files::commit(Arc::clone(&state.store), segs, staged).await? {
+            Written::Created => created(),
+            Written::Replaced => no_content(),
+            Written::Refused(why) => put_refusal(why, href),
+        },
+    )
 }
 
 /// Read a request's body through and discard it: a status sent with request bytes unread
@@ -589,55 +381,9 @@ fn parent_is_object(href: &str) -> Response<Body> {
     error_response(StatusCode::CONFLICT, "DENIED", href)
 }
 
-/// Stream `body` to `out`, coalescing small frames and enforcing `cap`, including for chunked
-/// bodies; `(bytes written, sha256 hex)` on success. `out` may be a sink when draining a
-/// rejected PUT. The generic body allows tests with a small cap.
-async fn drain_into<B>(
-    out: &mut (impl AsyncWrite + Unpin),
-    mut body: B,
-    cap: u64,
-) -> std::result::Result<(u64, String), PutError>
-where
-    B: hyper::body::Body<Data = Bytes> + Unpin,
-    B::Error: std::error::Error + Send + Sync + 'static,
-{
-    let mut buf: Vec<u8> = Vec::with_capacity(STREAM_CHUNK);
-    let mut hasher = Sha256::new();
-    let mut total: u64 = 0;
-    let io = |e: std::io::Error| PutError::Failed(anyhow::Error::from(e).context("writing"));
-    while let Some(frame) = body.frame().await {
-        let frame = frame
-            .map_err(|e| PutError::Failed(anyhow::Error::from(e).context("reading a PUT body")))?;
-        // Trailers carry no content; a body that has them simply ends after them.
-        let Ok(data) = frame.into_data() else {
-            continue;
-        };
-        total = total.saturating_add(data.len() as u64);
-        if total > cap {
-            return Err(PutError::TooLarge);
-        }
-        hasher.update(&data);
-        // A frame already worth a write goes straight out rather than through the
-        // coalescing buffer, which is there for the small ones.
-        if buf.is_empty() && data.len() >= STREAM_CHUNK {
-            out.write_all(&data).await.map_err(io)?;
-            continue;
-        }
-        buf.extend_from_slice(&data);
-        if buf.len() >= STREAM_CHUNK {
-            out.write_all(&buf).await.map_err(io)?;
-            buf.clear();
-        }
-    }
-    if !buf.is_empty() {
-        out.write_all(&buf).await.map_err(io)?;
-    }
-    Ok((total, crate::hex_of(&hasher.finalize())))
-}
-
 /// Create a directory — an empty repository — and its missing ancestors: 201, 405 when the
 /// path is already mapped (a directory or a tag), or 409 when a tag is above it. Checked and
-/// created under [`NAMESPACE`].
+/// created under the [`namespace`] lock.
 fn mkcol(store: &Store, segs: &[String], href: &str) -> Result<Response<Body>> {
     let _namespace = namespace(store)?;
     match resolve(store, segs)? {
@@ -660,9 +406,9 @@ const DELETE_LOCK_WAIT: Duration = Duration::from_secs(30);
 /// caller. Recursive deletion is unsupported. An object's bytes stay in the pool until the
 /// gc finds them unreferenced.
 ///
-/// A directory's removal needs the store lock exclusive. It is tried under [`NAMESPACE`],
-/// which is released between attempts so other `files/` writes proceed; past
-/// [`DELETE_LOCK_WAIT`] of shared holders or a gc, the answer is 503.
+/// A directory's removal needs the store lock exclusive. It is tried under the
+/// [`namespace`] lock, which is released between attempts so other `files/` writes proceed;
+/// past [`DELETE_LOCK_WAIT`] of shared holders or a gc, the answer is 503.
 fn delete(
     store: &Store,
     authz: &Authz<'_>,
@@ -719,86 +465,3 @@ fn delete(
         return Ok(resp);
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The namespace held here is held against another process's open of the store: the
-    /// lock file another descriptor cannot take until it is released.
-    #[test]
-    fn the_namespace_is_held_against_other_processes() {
-        use std::os::fd::AsRawFd;
-        let dir = std::env::temp_dir().join(format!("vk-reg-files-ns-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        let store = Store::new(dir.clone()).unwrap();
-        let try_lock = || {
-            let file = std::fs::File::open(dir.join(".files.lock")).unwrap();
-            // SAFETY: flock on a descriptor `file` owns.
-            unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) == 0 }
-        };
-        let held = namespace(&store).unwrap();
-        assert!(!try_lock());
-        drop(held);
-        assert!(try_lock());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    /// Verify the streaming size cap with a small limit and multiple frames, and the digest
-    /// of what went through.
-    #[tokio::test]
-    async fn a_body_over_the_cap_stops_being_written() {
-        let dir = std::env::temp_dir().join(format!("vk-reg-files-cap-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).unwrap();
-        let path = dir.join("staged");
-
-        // Several frames, so the cap is crossed part way through rather than at the first.
-        let frames = || {
-            let chunks: Vec<std::result::Result<hyper::body::Frame<Bytes>, std::io::Error>> = (0
-                ..4)
-                .map(|_| Ok(hyper::body::Frame::data(Bytes::from(vec![1u8; 100]))))
-                .collect();
-            http_body_util::StreamBody::new(futures::stream::iter(chunks))
-        };
-
-        let mut file = tokio::fs::File::create(&path).await.unwrap();
-        assert!(matches!(
-            drain_into(&mut file, frames(), 250).await,
-            Err(PutError::TooLarge)
-        ));
-        drop(file);
-        // Refused where the count crossed, so the partial file is bounded by the cap plus
-        // the frame that crossed it — never the whole body.
-        let staged = std::fs::metadata(&path).unwrap().len();
-        assert!(staged <= 300, "wrote {staged} bytes past a 250-byte cap");
-
-        // Exactly at the cap is not over it, and the digest is the body's.
-        let mut file = tokio::fs::File::create(&path).await.unwrap();
-        let (n, hex) = drain_into(&mut file, frames(), 400).await.ok().unwrap();
-        file.flush().await.unwrap();
-        drop(file);
-        assert_eq!(n, 400);
-        assert_eq!(std::fs::metadata(&path).unwrap().len(), 400);
-        assert_eq!(hex, crate::sha256_hex_raw(&vec![1u8; 400]));
-
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn paths_map_onto_repositories_and_tags() {
-        let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
-        assert_eq!(repo_name(&segs(&[])), "files");
-        assert_eq!(
-            repo_name(&segs(&["sccache", "a", "b"])),
-            "files/sccache/a/b"
-        );
-        assert!(
-            object_of(&segs(&["sccache"])).is_none(),
-            "a top-level name is a directory"
-        );
-        let key = segs(&["sccache", "a", "b", "abcdef"]);
-        let (repo, tag) = object_of(&key).unwrap();
-        assert_eq!((repo.as_str(), tag), ("files/sccache/a/b", "abcdef"));
-    }
-}
diff --git a/vk-registry/src/dav/mod.rs b/vk-registry/src/dav/mod.rs
index 8690af3c..b22e0be0 100644
--- a/vk-registry/src/dav/mod.rs
+++ b/vk-registry/src/dav/mod.rs
@@ -90,7 +90,7 @@ async fn root(
                     entries.push(Entry::collection(href(&["repos"], true), repos));
                     entries.push(Entry::collection(
                         href(&["files"], true),
-                        store.repos_path_modified(files::FILES_REPO),
+                        store.repos_path_modified(crate::files::FILES_REPO),
                     ));
                 }
                 Ok(multistatus(&entries))
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
new file mode 100644
index 00000000..5f885837
--- /dev/null
+++ b/vk-registry/src/files.rs
@@ -0,0 +1,436 @@
+//! The plain-file area of the pool, `files/`, as objects in directories, below any wire
+//! protocol. Directories map to repositories under `files/`; each object is a tag on a
+//! single-layer raw-file manifest, as written by `/upload`, whose layer holds the file bytes.
+//! A write streams to `uploads/` while hashing ([`stage`]), then promotes the blob and writes
+//! the manifest and tag under the namespace lock ([`commit`]). Each wire protocol over this
+//! layer keeps its own status codes and bodies: WebDAV under `/dav/files/` (`crate::dav`)
+//! today, an S3 view in later work. Entries expire under gc's tag retention and blob grace
+//! windows.
+
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::{Duration, SystemTime};
+
+use anyhow::{Context, Result};
+use bytes::Bytes;
+use http_body_util::BodyExt;
+use sha2::{Digest, Sha256};
+use tokio::io::{AsyncWrite, AsyncWriteExt};
+
+use crate::{Authz, STREAM_CHUNK, Store, accounts};
+
+/// The repository every object and directory lives under.
+pub(crate) const FILES_REPO: &str = "files";
+
+/// Maximum object size, checked both against a declared length and while streaming.
+pub(crate) const MAX_OBJECT: u64 = 4 << 30;
+
+/// Minimum idle age before a read refreshes the tag's mtime — the "last used" record the
+/// gc's retention keys on — so a cache read is a metadata write at most once an hour.
+const TOUCH_AFTER: Duration = Duration::from_secs(3600);
+
+/// Serialize `files/` checks and namespace changes (object tags, new directories, deletions)
+/// in this server so a write of an object and of a directory at the same path cannot both
+/// succeed. Acquire before the store lock, never while holding it. `/v2/` writes into
+/// `files/` do not take this lock.
+static NAMESPACE: Mutex<()> = Mutex::new(());
+
+/// The namespace held, in this process and against any other serving the store: a registry
+/// and the release it hands over to serve it together for a while.
+pub(crate) struct Namespace {
+    _process: std::sync::MutexGuard<'static, ()>,
+    _store: crate::LockGuard,
+}
+
+/// Hold [`NAMESPACE`], then the store's namespace lock. Accept a poisoned mutex: it guards
+/// no data that a panic could leave inconsistent.
+pub(crate) fn namespace(store: &Store) -> Result<Namespace> {
+    let process = NAMESPACE.lock().unwrap_or_else(PoisonError::into_inner);
+    Ok(Namespace {
+        _process: process,
+        _store: store.lock_namespace()?,
+    })
+}
+
+/// What a `files/` path names once the store has been looked at.
+pub(crate) enum Node {
+    /// A repository under `files/`, or a path component above one: a directory.
+    Dir(String),
+    /// A tag on a raw-file manifest: an object.
+    Object(Object),
+    /// A tag on any other manifest — an image pushed over `/v2/` into a `files/`
+    /// repository. Absent to reads; a write there is refused, so nothing here replaces or
+    /// deletes it.
+    Foreign(String),
+}
+
+/// An object's tag and what its manifest says about the layer.
+pub(crate) struct Object {
+    pub(crate) repo: String,
+    pub(crate) tag: String,
+    /// the layer blob's hex
+    pub(crate) layer: String,
+    /// the layer's canonical length
+    pub(crate) size: u64,
+    /// the tag's mtime
+    pub(crate) modified: SystemTime,
+}
+
+impl Node {
+    /// The repository this node authorizes as.
+    pub(crate) fn repo(&self) -> &str {
+        match self {
+            Node::Dir(r) | Node::Foreign(r) => r,
+            Node::Object(o) => &o.repo,
+        }
+    }
+}
+
+/// The repository a run of path components names: `files/<segs…>`.
+pub(crate) fn repo_name(segs: &[String]) -> String {
+    let mut name = String::from(FILES_REPO);
+    for s in segs {
+        name.push('/');
+        name.push_str(s);
+    }
+    name
+}
+
+/// The repository and tag an object at `segs` would have: the last component is the tag.
+pub(crate) fn object_of(segs: &[String]) -> Option<(String, &str)> {
+    let (leaf, parents) = segs.split_last()?;
+    (!parents.is_empty()).then(|| (repo_name(parents), leaf.as_str()))
+}
+
+/// What is at `segs`: a directory, an object, a foreign tag, or nothing. A directory is any
+/// path under `repos/files/` that is one — a repository, or the parent a nested repository's
+/// name created — so the tree reads as the client wrote it.
+pub(crate) fn resolve(store: &Store, segs: &[String]) -> Result<Option<Node>> {
+    let dir = repo_name(segs);
+    if store.repo_dir_exists(&dir) {
+        return Ok(Some(Node::Dir(dir)));
+    }
+    let Some((repo, tag)) = object_of(segs) else {
+        return Ok(None);
+    };
+    let Some((manifest_hex, modified)) = store.tag_target(&repo, tag) else {
+        return Ok(None);
+    };
+    let layer = match store.get_blob(&manifest_hex)? {
+        Some(manifest) => crate::raw_file_layer(&manifest),
+        None => None,
+    };
+    Ok(Some(match layer {
+        Some((layer, size)) => Node::Object(Object {
+            repo,
+            tag: tag.to_string(),
+            layer,
+            size,
+            modified,
+        }),
+        None => Node::Foreign(repo),
+    }))
+}
+
+/// Whether an ancestor of `segs` is a tag. Writing below one would make its path a directory
+/// too, and [`resolve`] would then find the directory and hide the tag. A top-level name is
+/// always a directory.
+pub(crate) fn under_object(store: &Store, segs: &[String]) -> Result<bool> {
+    for n in 2..segs.len() {
+        if matches!(
+            resolve(store, &segs[..n])?,
+            Some(Node::Object(_) | Node::Foreign(_))
+        ) {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+/// Whether this caller may `action` on `repo`.
+pub(crate) fn allowed(authz: &Authz<'_>, action: accounts::Action, repo: &str) -> bool {
+    crate::authorize_or_forbidden(authz, action, repo).is_none()
+}
+
+/// Refresh the tag of an object just served once it has been idle past [`TOUCH_AFTER`]: a
+/// read is a use, which is what keeps the tag from the gc's retention, and a hot entry is
+/// not a metadata write per hit.
+pub(crate) fn touch_if_idle(store: &Store, obj: &Object) {
+    if SystemTime::now()
+        .duration_since(obj.modified)
+        .is_ok_and(|idle| idle > TOUCH_AFTER)
+    {
+        store.touch_tag(&obj.repo, &obj.tag);
+    }
+}
+
+/// Why `segs` cannot take an object.
+pub(crate) enum Unwritable {
+    /// a single component: a top-level name is always a directory
+    TopLevel,
+    /// a directory is there
+    Directory,
+    /// a foreign tag is there
+    Foreign,
+    /// a tag is above it
+    UnderObject,
+}
+
+/// Why `segs` cannot take an object, or `None` when a write may proceed. Checked before a
+/// body is staged when the answer is already known, and again by [`commit`] under
+/// [`NAMESPACE`] before the tag is written.
+pub(crate) fn unwritable(store: &Store, segs: &[String]) -> Result<Option<Unwritable>> {
+    if object_of(segs).is_none() {
+        return Ok(Some(Unwritable::TopLevel));
+    }
+    Ok(match resolve(store, segs)? {
+        Some(Node::Dir(_)) => Some(Unwritable::Directory),
+        Some(Node::Foreign(_)) => Some(Unwritable::Foreign),
+        _ if under_object(store, segs)? => Some(Unwritable::UnderObject),
+        _ => None,
+    })
+}
+
+/// Why a streamed body stopped short.
+pub(crate) enum PutError {
+    /// the body crossed the cap — decided while reading
+    TooLarge,
+    /// the read or the write failed
+    Failed(anyhow::Error),
+}
+
+/// A staging file under `uploads/`, unlinked when dropped unless its bytes were promoted —
+/// including when the handler's future is dropped with the connection mid-body.
+struct Staging {
+    path: PathBuf,
+    armed: bool,
+}
+
+impl Drop for Staging {
+    fn drop(&mut self) {
+        if self.armed {
+            // Gone already (a promotion that renamed it, or a discard) is the goal; any
+            // other failure leaves it to the gc's sweep of idle uploads.
+            let _ = std::fs::remove_file(&self.path);
+        }
+    }
+}
+
+/// A body written whole to a staging file and hashed, not yet in the pool. Dropping it
+/// removes the file, so a caller that refuses what it sees here simply lets it go.
+pub(crate) struct Staged {
+    /// the body's length
+    pub(crate) size: u64,
+    /// the body's sha256 hex
+    pub(crate) hex: String,
+    staging: Staging,
+}
+
+/// Stream `body` into a staging file under `uploads/`, hashing it on the way, up to
+/// [`MAX_OBJECT`]. Memory use is bounded by the coalescing buffer whatever the size.
+pub(crate) async fn stage<B>(store: &Store, body: B) -> std::result::Result<Staged, PutError>
+where
+    B: hyper::body::Body<Data = Bytes> + Unpin,
+    B::Error: std::error::Error + Send + Sync + 'static,
+{
+    let (path, file) = store.stage_file().map_err(PutError::Failed)?;
+    let staging = Staging { path, armed: true };
+    let mut file = tokio::fs::File::from_std(file);
+    let written = drain_into(&mut file, body, MAX_OBJECT).await;
+    let flushed = file
+        .flush()
+        .await
+        .map_err(|e| PutError::Failed(anyhow::Error::from(e).context("writing an object")));
+    drop(file);
+    let (size, hex) = written.and_then(|w| flushed.map(|()| w))?;
+    Ok(Staged { size, hex, staging })
+}
+
+/// What [`commit`] did.
+pub(crate) enum Written {
+    /// the object is new
+    Created,
+    /// the object replaced one at the same path
+    Replaced,
+    /// the path changed while the body streamed and no longer takes an object; nothing was
+    /// written
+    Refused(Unwritable),
+}
+
+/// Promote a [`stage`]d body into the pool and tag it at `segs` as a raw file, re-checking
+/// [`unwritable`] under [`NAMESPACE`] and the shared store lock first. Off the runtime:
+/// staging compresses, and a large object would otherwise block a tokio worker for seconds.
+/// The locks are taken inside, after that pass — the store lock as the relay takes it.
+pub(crate) async fn commit(
+    store: Arc<Store>,
+    segs: Vec<String>,
+    staged: Staged,
+) -> Result<Written> {
+    tokio::task::spawn_blocking(move || -> Result<Written> {
+        let Staged {
+            size,
+            hex,
+            mut staging,
+        } = staged;
+        let promotion = store.stage_promotion(&hex, &staging.path)?;
+        let _namespace = namespace(&store)?;
+        // shared store lock (vs. an exclusive gc) across the promote and the manifest that
+        // references it; see Store::lock_shared. Another write may have changed the path
+        // while the body streamed, so it is checked again.
+        let checked = store.lock_shared().and_then(|lock| {
+            let existed = matches!(resolve(&store, &segs)?, Some(Node::Object(_)));
+            Ok((lock, unwritable(&store, &segs)?, existed))
+        });
+        let (_lock, existed) = match checked {
+            Ok((lock, None, existed)) => (lock, existed),
+            Ok((_, Some(why), _)) => {
+                promotion.discard();
+                return Ok(Written::Refused(why));
+            }
+            Err(e) => {
+                promotion.discard();
+                return Err(e);
+            }
+        };
+        store.promote_staged(&hex, promotion)?;
+        staging.armed = false;
+        let (repo, tag) = object_of(&segs).context("a write past its checks names an object")?;
+        store.put_raw_file(&repo, tag, &hex, size, None)?;
+        Ok(if existed {
+            Written::Replaced
+        } else {
+            Written::Created
+        })
+    })
+    .await
+    .context("the object's promotion panicked")?
+}
+
+/// Stream `body` to `out`, coalescing small frames and enforcing `cap`, including for chunked
+/// bodies; `(bytes written, sha256 hex)` on success. `out` may be a sink when draining a
+/// refused request. The generic body allows tests with a small cap.
+pub(crate) async fn drain_into<B>(
+    out: &mut (impl AsyncWrite + Unpin),
+    mut body: B,
+    cap: u64,
+) -> std::result::Result<(u64, String), PutError>
+where
+    B: hyper::body::Body<Data = Bytes> + Unpin,
+    B::Error: std::error::Error + Send + Sync + 'static,
+{
+    let mut buf: Vec<u8> = Vec::with_capacity(STREAM_CHUNK);
+    let mut hasher = Sha256::new();
+    let mut total: u64 = 0;
+    let io = |e: std::io::Error| PutError::Failed(anyhow::Error::from(e).context("writing"));
+    while let Some(frame) = body.frame().await {
+        let frame = frame
+            .map_err(|e| PutError::Failed(anyhow::Error::from(e).context("reading a PUT body")))?;
+        // Trailers carry no content; a body that has them simply ends after them.
+        let Ok(data) = frame.into_data() else {
+            continue;
+        };
+        total = total.saturating_add(data.len() as u64);
+        if total > cap {
+            return Err(PutError::TooLarge);
+        }
+        hasher.update(&data);
+        // A frame already worth a write goes straight out rather than through the
+        // coalescing buffer, which is there for the small ones.
+        if buf.is_empty() && data.len() >= STREAM_CHUNK {
+            out.write_all(&data).await.map_err(io)?;
+            continue;
+        }
+        buf.extend_from_slice(&data);
+        if buf.len() >= STREAM_CHUNK {
+            out.write_all(&buf).await.map_err(io)?;
+            buf.clear();
+        }
+    }
+    if !buf.is_empty() {
+        out.write_all(&buf).await.map_err(io)?;
+    }
+    Ok((total, crate::hex_of(&hasher.finalize())))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The namespace held here is held against another process's open of the store: the
+    /// lock file another descriptor cannot take until it is released.
+    #[test]
+    fn the_namespace_is_held_against_other_processes() {
+        use std::os::fd::AsRawFd;
+        let dir = std::env::temp_dir().join(format!("vk-reg-files-ns-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Store::new(dir.clone()).unwrap();
+        let try_lock = || {
+            let file = std::fs::File::open(dir.join(".files.lock")).unwrap();
+            // SAFETY: flock on a descriptor `file` owns.
+            unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) == 0 }
+        };
+        let held = namespace(&store).unwrap();
+        assert!(!try_lock());
+        drop(held);
+        assert!(try_lock());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// Verify the streaming size cap with a small limit and multiple frames, and the digest
+    /// of what went through.
+    #[tokio::test]
+    async fn a_body_over_the_cap_stops_being_written() {
+        let dir = std::env::temp_dir().join(format!("vk-reg-files-cap-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("staged");
+
+        // Several frames, so the cap is crossed part way through rather than at the first.
+        let frames = || {
+            let chunks: Vec<std::result::Result<hyper::body::Frame<Bytes>, std::io::Error>> = (0
+                ..4)
+                .map(|_| Ok(hyper::body::Frame::data(Bytes::from(vec![1u8; 100]))))
+                .collect();
+            http_body_util::StreamBody::new(futures::stream::iter(chunks))
+        };
+
+        let mut file = tokio::fs::File::create(&path).await.unwrap();
+        assert!(matches!(
+            drain_into(&mut file, frames(), 250).await,
+            Err(PutError::TooLarge)
+        ));
+        drop(file);
+        // Refused where the count crossed, so the partial file is bounded by the cap plus
+        // the frame that crossed it — never the whole body.
+        let staged = std::fs::metadata(&path).unwrap().len();
+        assert!(staged <= 300, "wrote {staged} bytes past a 250-byte cap");
+
+        // Exactly at the cap is not over it, and the digest is the body's.
+        let mut file = tokio::fs::File::create(&path).await.unwrap();
+        let (n, hex) = drain_into(&mut file, frames(), 400).await.ok().unwrap();
+        file.flush().await.unwrap();
+        drop(file);
+        assert_eq!(n, 400);
+        assert_eq!(std::fs::metadata(&path).unwrap().len(), 400);
+        assert_eq!(hex, crate::sha256_hex_raw(&vec![1u8; 400]));
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn paths_map_onto_repositories_and_tags() {
+        let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        assert_eq!(repo_name(&segs(&[])), "files");
+        assert_eq!(
+            repo_name(&segs(&["sccache", "a", "b"])),
+            "files/sccache/a/b"
+        );
+        assert!(
+            object_of(&segs(&["sccache"])).is_none(),
+            "a top-level name is a directory"
+        );
+        let key = segs(&["sccache", "a", "b", "abcdef"]);
+        let (repo, tag) = object_of(&key).unwrap();
+        assert_eq!((repo.as_str(), tag), ("files/sccache/a/b", "abcdef"));
+    }
+}
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 13553873..ae226434 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -51,6 +51,7 @@ pub(crate) mod captions;
 pub mod client;
 pub mod config;
 pub(crate) mod dav;
+pub(crate) mod files;
 pub(crate) mod forms;
 pub mod handover;
 pub(crate) mod html;

From acff68c58a90a75c6122d34b0639c9f207438acc Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 09:49:24 +0100
Subject: [PATCH 02/54] vk-registry: add the s3 server setting

---
 vk-driver/src/registry.rs         |  8 +++++++
 vk-registry/src/config.rs         | 35 +++++++++++++++++++++++++++++++
 vk-registry/src/config/help.rs    |  5 +++++
 vk-registry/src/hub/mod.rs        |  1 +
 vk-registry/src/lib.rs            |  7 +++++++
 vk-registry/tests/accounts_e2e.rs |  4 ++++
 vk-registry/tests/exists_e2e.rs   |  1 +
 vk-registry/tests/hubtoken_e2e.rs |  1 +
 vk-registry/tests/relay_e2e.rs    | 16 ++++++++++++++
 9 files changed, 78 insertions(+)

diff --git a/vk-driver/src/registry.rs b/vk-driver/src/registry.rs
index f3999db4..19a3fce2 100644
--- a/vk-driver/src/registry.rs
+++ b/vk-driver/src/registry.rs
@@ -5660,6 +5660,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(auth),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }))
@@ -5707,6 +5708,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -5742,6 +5744,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -5855,6 +5858,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6104,6 +6108,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6162,6 +6167,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6203,6 +6209,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6239,6 +6246,7 @@ pub(crate) mod tests {
             auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
             tls: None,
             webdav: true,
+            s3: true,
             tokens: Default::default(),
             handover: Default::default(),
         }));
diff --git a/vk-registry/src/config.rs b/vk-registry/src/config.rs
index 78b639e7..461a241a 100644
--- a/vk-registry/src/config.rs
+++ b/vk-registry/src/config.rs
@@ -87,6 +87,9 @@ pub struct ServerConfig {
     /// objects already stored under `files/` stay reachable over `/v2/` and expire under `gc`
     /// like any tag.
     pub webdav: bool,
+    /// Enable `/s3/` (default: true). When disabled, requests return 404 after auth; the
+    /// objects already stored under `files/` stay reachable over `/dav/` and `/v2/`.
+    pub s3: bool,
     /// Connections served at once; past it, new ones wait in the listen backlog.
     pub max_connections: usize,
     /// Connections served at once from one client address (an IPv6 /64); past it, new ones
@@ -258,6 +261,8 @@ struct FileConfig {
     admin_socket: Option<FileAdminSocket>,
     /// Enable `/dav/`; defaults to true.
     webdav: Option<bool>,
+    /// Enable `/s3/`; defaults to true.
+    s3: Option<bool>,
     max_connections: Option<usize>,
     max_connections_per_client: Option<usize>,
     oidc: Option<FileOidc>,
@@ -378,6 +383,7 @@ impl ServerConfig {
             admin_socket: AdminSocket::Unset,
             oidc: None,
             webdav: true,
+            s3: true,
             max_connections: crate::DEFAULT_MAX_CONNECTIONS,
             max_connections_per_client: crate::DEFAULT_MAX_CONNECTIONS_PER_CLIENT,
             hub: HubSettings::default(),
@@ -452,6 +458,10 @@ impl ServerConfig {
         if *tokens {
             described.push_str(" tokens=true");
         }
+        // Only when off, so a registry that leaves it on keeps the hash it had.
+        if !self.s3 {
+            described.push_str(" s3=false");
+        }
         // Only when set, so a registry that leaves it keeps the hash it had.
         if *update_drain_minutes != DEFAULT_UPDATE_DRAIN_MINUTES {
             described.push_str(&format!(" update_drain_minutes={update_drain_minutes}"));
@@ -669,6 +679,7 @@ impl ServerConfig {
                 public_url: o.public_url,
             }),
             webdav: f.webdav.unwrap_or(true),
+            s3: f.s3.unwrap_or(true),
             max_connections: f.max_connections.unwrap_or(crate::DEFAULT_MAX_CONNECTIONS),
             max_connections_per_client: f
                 .max_connections_per_client
@@ -952,6 +963,7 @@ impl ServerConfig {
             auth,
             tls: None,
             webdav: self.webdav,
+            s3: self.s3,
             tokens: Default::default(),
             handover: Default::default(),
         })
@@ -1889,6 +1901,29 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// `s3` defaults to on, reads both ways, and changes the config hash only when off.
+    #[test]
+    fn s3_defaults_to_on_and_changes_the_config_hash_only_when_off() {
+        let dir = std::env::temp_dir().join(format!("vk-regserve-s3-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let load = |body: &str| {
+            let p = dir.join("c.toml");
+            std::fs::write(&p, body).unwrap();
+            ServerConfig::load(&p, None, None).unwrap()
+        };
+        assert!(load("").s3);
+        assert!(load("s3 = true\n").s3);
+        let off = load("s3 = false\n");
+        assert!(!off.s3);
+        let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), "/s".into());
+        assert!(cfg.s3);
+        assert_eq!(cfg.hub_facts().config_hash, "e3609a2059e9c15e");
+        cfg.s3 = false;
+        assert_ne!(cfg.hub_facts().config_hash, "e3609a2059e9c15e");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// With `[hub] tokens = true`, a shared secret that reads as a hub token is refused.
     #[test]
     fn a_shared_secret_that_reads_as_a_hub_token_is_refused_with_tokens_on() {
diff --git a/vk-registry/src/config/help.rs b/vk-registry/src/config/help.rs
index 5c2b81d8..2acb29da 100644
--- a/vk-registry/src/config/help.rs
+++ b/vk-registry/src/config/help.rs
@@ -96,6 +96,11 @@ const KEYS: &[Key] = &[
         name: "webdav",
         help: "enable /dav/; false returns 404 [default: true]",
     },
+    Key {
+        table: Table::Top,
+        name: "s3",
+        help: "enable /s3/; false returns 404 [default: true]",
+    },
     Key {
         table: Table::Top,
         name: "max_connections",
diff --git a/vk-registry/src/hub/mod.rs b/vk-registry/src/hub/mod.rs
index b699d9c0..8e114638 100644
--- a/vk-registry/src/hub/mod.rs
+++ b/vk-registry/src/hub/mod.rs
@@ -921,6 +921,7 @@ mod tests {
             auth: crate::Authenticator::Shared(crate::auth::Auth::None),
             tls: None,
             webdav: false,
+            s3: false,
             tokens: Default::default(),
             handover: Default::default(),
         })
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index ae226434..b8946db9 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -107,6 +107,8 @@ pub struct ServerState {
     pub tls: Option<tokio_rustls::TlsAcceptor>,
     /// Enable WebDAV routes.
     pub webdav: bool,
+    /// Enable the S3 routes under `/s3/`.
+    pub s3: bool,
     /// The hub tokens taken, once enrolled with `[hub] tokens = true`.
     pub tokens: hubtoken::TokenGate,
     /// The listeners served through, to hand to a release.
@@ -4042,6 +4044,9 @@ async fn serve_refusing(
     if !state.webdav {
         eprintln!("vk-registry: WebDAV off (webdav = false): /dav/ answers 404");
     }
+    if !state.s3 {
+        eprintln!("vk-registry: S3 off (s3 = false): /s3/ answers 404");
+    }
     let slots = Arc::new(tokio::sync::Semaphore::new(limits.connections));
     let peers = PeerCounts::default();
     let mut refused = RefusalLog::default();
@@ -6414,6 +6419,7 @@ mod tests {
             auth: Authenticator::Shared(auth),
             tls,
             webdav: false,
+            s3: false,
             tokens: Default::default(),
             handover: Default::default(),
         });
@@ -6855,6 +6861,7 @@ mod tests {
                 auth: Authenticator::Shared(auth::Auth::None),
                 tls: acceptor,
                 webdav: false,
+                s3: false,
                 tokens: Default::default(),
                 handover: Default::default(),
             });
diff --git a/vk-registry/tests/accounts_e2e.rs b/vk-registry/tests/accounts_e2e.rs
index 2425ace7..48b8e6a4 100644
--- a/vk-registry/tests/accounts_e2e.rs
+++ b/vk-registry/tests/accounts_e2e.rs
@@ -1366,6 +1366,7 @@ async fn a_relayed_blob_becomes_a_member_of_the_repo_it_was_fetched_for() {
         auth: Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1471,6 +1472,7 @@ async fn shared_secret_mode_is_unchanged_by_repo_scoping() {
         auth: Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1691,6 +1693,7 @@ async fn deleting_a_manifest_on_an_open_server() {
         auth: Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -2185,6 +2188,7 @@ async fn a_cross_site_write_is_refused_on_an_open_server() {
         auth: Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
diff --git a/vk-registry/tests/exists_e2e.rs b/vk-registry/tests/exists_e2e.rs
index dbd95932..1a5f4fb8 100644
--- a/vk-registry/tests/exists_e2e.rs
+++ b/vk-registry/tests/exists_e2e.rs
@@ -61,6 +61,7 @@ async fn batch_probe_answers_every_tag_in_order() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
diff --git a/vk-registry/tests/hubtoken_e2e.rs b/vk-registry/tests/hubtoken_e2e.rs
index 3adfa24e..3dc11cac 100644
--- a/vk-registry/tests/hubtoken_e2e.rs
+++ b/vk-registry/tests/hubtoken_e2e.rs
@@ -90,6 +90,7 @@ fn shared_with(
         auth: vk_registry::Authenticator::Shared(auth),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
diff --git a/vk-registry/tests/relay_e2e.rs b/vk-registry/tests/relay_e2e.rs
index 2b8d2ec4..7090e158 100644
--- a/vk-registry/tests/relay_e2e.rs
+++ b/vk-registry/tests/relay_e2e.rs
@@ -96,6 +96,7 @@ async fn relay_caches_digest_not_tag() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -117,6 +118,7 @@ async fn relay_caches_digest_not_tag() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -191,6 +193,7 @@ async fn multi_lock_is_atomic_all_or_nothing() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -267,6 +270,7 @@ async fn lock_client_authenticates_with_basic() {
         }),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -311,6 +315,7 @@ async fn lock_client_authenticates_with_bearer() {
         }),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -351,6 +356,7 @@ async fn lock_client_round_trips_against_the_server() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -420,6 +426,7 @@ async fn bearer_auth_gates_everything_including_the_probe() {
         }),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -505,6 +512,7 @@ async fn basic_auth_gates_and_challenges() {
         }),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -722,6 +730,7 @@ async fn relay_does_not_leak_upstream_credentials_to_the_client() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -766,6 +775,7 @@ async fn lock_api_build_once_over_http() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -1075,6 +1085,7 @@ async fn browse_belongs_to_accounts_mode_and_redirects_a_signed_out_browser() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -1267,6 +1278,7 @@ fn mirror_of(up_addr: std::net::SocketAddr, dir: &std::path::Path) -> Arc<Server
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     })
@@ -1544,6 +1556,7 @@ async fn a_blob_head_is_never_relayed() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1563,6 +1576,7 @@ async fn a_blob_head_is_never_relayed() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1630,6 +1644,7 @@ async fn a_blob_head_agrees_with_the_get_for_a_compressed_blob() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1735,6 +1750,7 @@ async fn a_blob_larger_than_one_chunk_streams_back_intact() {
         auth: vk_registry::Authenticator::Shared(vk_registry::auth::Auth::None),
         tls: None,
         webdav: true,
+        s3: true,
         tokens: Default::default(),
         handover: Default::default(),
     }));

From 64bc138ce02b63238fd2d1073219d08afe4fd210 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 10:29:02 +0100
Subject: [PATCH 03/54] vk-registry/s3: check SigV4 credentials on /s3/

Requests under /s3/ now pass a gate S3 clients understand: a SigV4
Authorization header is verified, refusals are S3 XML errors carrying a
request id, and a missing or refused credential is a 403 rather than the
401 challenge. The access key id is a credential the registry already
takes (an API key, a hub token, the shared bearer, or the Basic user),
authenticated as a bearer would be before any secret is used, and the
signing secret is that same string (the password for the Basic user),
so nothing new is stored. Presigned URLs and temporary credentials are
refused. No operation is served yet: authenticated requests get 404 or
501.
---
 Cargo.lock                                    |   2 +
 NOTICE                                        |   6 +
 vk-registry/Cargo.toml                        |   3 +
 vk-registry/src/accounts.rs                   |   9 +-
 vk-registry/src/auth.rs                       |  40 +-
 vk-registry/src/dav/mod.rs                    |   2 +-
 vk-registry/src/files.rs                      |  14 +
 vk-registry/src/lib.rs                        |  15 +-
 vk-registry/src/s3/mod.rs                     | 443 +++++++++
 vk-registry/src/s3/sigv4.rs                   | 879 ++++++++++++++++++
 vk-registry/src/s3/testdata/sigv4/LICENSE     | 202 ++++
 vk-registry/src/s3/testdata/sigv4/README      |  14 +
 .../get-header-key-duplicate/context.json     |  12 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   8 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-header-key-duplicate/request.txt      |   5 +
 .../get-header-value-multiline/context.json   |  12 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   8 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-header-value-multiline/request.txt    |   5 +
 .../sigv4/get-header-value-order/context.json |  12 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   9 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-header-value-order/request.txt  |   6 +
 .../sigv4/get-header-value-trim/context.json  |  12 +
 .../header-canonical-request.txt              |  10 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   7 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-header-value-trim/request.txt   |   4 +
 .../get-relative-normalized/context.json      |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-relative-normalized/request.txt |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../get-relative-unnormalized/context.json    |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-relative-unnormalized/request.txt     |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../sigv4/get-slash-normalized/context.json   |  12 +
 .../header-canonical-request.txt              |   8 +
 .../get-slash-normalized/header-signature.txt |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-slash-normalized/request.txt    |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../sigv4/get-slash-unnormalized/context.json |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-slash-unnormalized/request.txt  |   2 +
 .../sigv4/get-slashes-normalized/context.json |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-slashes-normalized/request.txt  |   2 +
 .../get-slashes-unnormalized/context.json     |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-slashes-unnormalized/request.txt      |   2 +
 .../sigv4/get-space-normalized/context.json   |  12 +
 .../header-canonical-request.txt              |   8 +
 .../get-space-normalized/header-signature.txt |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-space-normalized/request.txt    |   2 +
 .../sigv4/get-space-unnormalized/context.json |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-space-unnormalized/request.txt  |   2 +
 .../sigv4/get-unreserved/context.json         |  12 +
 .../header-canonical-request.txt              |   8 +
 .../sigv4/get-unreserved/header-signature.txt |   1 +
 .../get-unreserved/header-signed-request.txt  |   5 +
 .../get-unreserved/header-string-to-sign.txt  |   4 +
 .../testdata/sigv4/get-unreserved/request.txt |   2 +
 .../s3/testdata/sigv4/get-utf8/context.json   |  12 +
 .../get-utf8/header-canonical-request.txt     |   8 +
 .../sigv4/get-utf8/header-signature.txt       |   1 +
 .../sigv4/get-utf8/header-signed-request.txt  |   5 +
 .../sigv4/get-utf8/header-string-to-sign.txt  |   4 +
 .../s3/testdata/sigv4/get-utf8/request.txt    |   2 +
 .../get-vanilla-empty-query-key/context.json  |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-vanilla-empty-query-key/request.txt   |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../get-vanilla-query-unreserved/context.json |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../get-vanilla-query-unreserved/request.txt  |   2 +
 .../sigv4/get-vanilla-query/context.json      |  12 +
 .../header-canonical-request.txt              |   8 +
 .../get-vanilla-query/header-signature.txt    |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-vanilla-query/request.txt       |   2 +
 .../sigv4/get-vanilla-utf8-query/context.json |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/get-vanilla-utf8-query/request.txt  |   2 +
 .../context.json                              |  13 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   6 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../testdata/sigv4/get-vanilla/context.json   |  12 +
 .../get-vanilla/header-canonical-request.txt  |   8 +
 .../sigv4/get-vanilla/header-signature.txt    |   1 +
 .../get-vanilla/header-signed-request.txt     |   5 +
 .../get-vanilla/header-string-to-sign.txt     |   4 +
 .../s3/testdata/sigv4/get-vanilla/request.txt |   2 +
 .../sigv4/post-header-key-case/context.json   |  12 +
 .../header-canonical-request.txt              |   8 +
 .../post-header-key-case/header-signature.txt |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-header-key-case/request.txt    |   2 +
 .../sigv4/post-header-key-sort/context.json   |  12 +
 .../header-canonical-request.txt              |   9 +
 .../post-header-key-sort/header-signature.txt |   1 +
 .../header-signed-request.txt                 |   6 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-header-key-sort/request.txt    |   3 +
 .../sigv4/post-header-value-case/context.json |  12 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   6 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-header-value-case/request.txt  |   3 +
 .../sigv4/post-sts-header-after/context.json  |  14 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   6 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-sts-header-after/request.txt   |   2 +
 .../sigv4/post-sts-header-before/context.json |  14 +
 .../header-canonical-request.txt              |   9 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   6 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-sts-header-before/request.txt  |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |   8 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   2 +
 .../sigv4/post-vanilla-query/context.json     |  12 +
 .../header-canonical-request.txt              |   8 +
 .../post-vanilla-query/header-signature.txt   |   1 +
 .../header-signed-request.txt                 |   5 +
 .../header-string-to-sign.txt                 |   4 +
 .../sigv4/post-vanilla-query/request.txt      |   2 +
 .../testdata/sigv4/post-vanilla/context.json  |  12 +
 .../post-vanilla/header-canonical-request.txt |   8 +
 .../sigv4/post-vanilla/header-signature.txt   |   1 +
 .../post-vanilla/header-signed-request.txt    |   5 +
 .../post-vanilla/header-string-to-sign.txt    |   4 +
 .../testdata/sigv4/post-vanilla/request.txt   |   2 +
 .../context.json                              |  12 +
 .../header-canonical-request.txt              |  11 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   9 +
 .../header-string-to-sign.txt                 |   4 +
 .../request.txt                               |   6 +
 .../post-x-www-form-urlencoded/context.json   |  12 +
 .../header-canonical-request.txt              |  11 +
 .../header-signature.txt                      |   1 +
 .../header-signed-request.txt                 |   9 +
 .../header-string-to-sign.txt                 |   4 +
 .../post-x-www-form-urlencoded/request.txt    |   6 +
 vk-registry/src/s3/xml.rs                     |  74 ++
 vk-registry/tests/s3_e2e.rs                   | 809 ++++++++++++++++
 242 files changed, 3781 insertions(+), 14 deletions(-)
 create mode 100644 vk-registry/src/s3/mod.rs
 create mode 100644 vk-registry/src/s3/sigv4.rs
 create mode 100644 vk-registry/src/s3/testdata/sigv4/LICENSE
 create mode 100644 vk-registry/src/s3/testdata/sigv4/README
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-order/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-header-value-trim/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-normalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-unreserved/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-utf8/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-query/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/get-vanilla/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-case/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-key-sort/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-header-value-case/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-after/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-sts-header-before/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla-query/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-vanilla/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/context.json
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-canonical-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signature.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signed-request.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-string-to-sign.txt
 create mode 100644 vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/request.txt
 create mode 100644 vk-registry/src/s3/xml.rs
 create mode 100644 vk-registry/tests/s3_e2e.rs

diff --git a/Cargo.lock b/Cargo.lock
index bcc53cc9..096ef156 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4305,6 +4305,7 @@ dependencies = [
  "bytes",
  "clap",
  "futures",
+ "hmac",
  "http-body-util",
  "httpdate",
  "hyper",
@@ -4328,6 +4329,7 @@ dependencies = [
  "vk-oidc",
  "vk-peer",
  "vk-selfupdate",
+ "zeroize",
  "zstd",
 ]
 
diff --git a/NOTICE b/NOTICE
index cf283b38..dacd4dbb 100644
--- a/NOTICE
+++ b/NOTICE
@@ -74,6 +74,12 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+vk-registry's SigV4 tests use AWS's signing test suite, as vendored in awslabs/aws-c-auth
+(tests/aws-signing-test-suite/v4), copied under vk-registry/src/s3/testdata/sigv4/:
+https://github.com/awslabs/aws-c-auth/tree/3281f8692e6fd10562c4585a4dded5c16b322698/tests/aws-signing-test-suite/v4
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Apache License 2.0; see vk-registry/src/s3/testdata/sigv4/LICENSE.
+
 The variable expansion in vk-gitlab/src/spec.rs (`expand`) and vk-driver/src/node/jobs/vars.rs
 is adapted from Go's os.Expand (src/os/env.go) and its tests, as gitlab-runner uses it:
 https://github.com/golang/go/blob/go1.24.0/src/os/env.go
diff --git a/vk-registry/Cargo.toml b/vk-registry/Cargo.toml
index 225338b2..894afe18 100644
--- a/vk-registry/Cargo.toml
+++ b/vk-registry/Cargo.toml
@@ -35,6 +35,9 @@ rustls.workspace = true
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging", "tls12"] }
 oci-client.workspace = true
 sha2.workspace = true
+# SigV4's HMAC chain for /s3/; zeroize wipes the keys it derives.
+hmac.workspace = true
+zeroize.workspace = true
 zstd.workspace = true
 libc.workspace = true
 # Private admin-socket binding, shared with vk-core.
diff --git a/vk-registry/src/accounts.rs b/vk-registry/src/accounts.rs
index 7fd1a4d5..ac2c1549 100644
--- a/vk-registry/src/accounts.rs
+++ b/vk-registry/src/accounts.rs
@@ -960,8 +960,13 @@ pub fn resolve_principal(
 }
 
 /// [`resolve_principal`]'s body, over the headers alone — a `Request<Incoming>` can only
-/// be built by a live connection, so this is the testable half.
-fn resolve_headers(db: &Db, headers: &HeaderMap, secure: bool) -> Result<Option<Principal>> {
+/// be built by a live connection, so this is the testable half. The S3 gate also hands it
+/// a SigV4 access key id, as the one header `Authorization: Bearer <id>`.
+pub(crate) fn resolve_headers(
+    db: &Db,
+    headers: &HeaderMap,
+    secure: bool,
+) -> Result<Option<Principal>> {
     // An `Authorization` header is a claim to be authenticated by it, so one that does not
     // carry a `vkr_…` key is a failed authentication rather than a reason to fall back to
     // the cookie — otherwise a stale shared-secret client would silently authenticate as
diff --git a/vk-registry/src/auth.rs b/vk-registry/src/auth.rs
index a0d46e02..fbda55d7 100644
--- a/vk-registry/src/auth.rs
+++ b/vk-registry/src/auth.rs
@@ -4,8 +4,7 @@
 //! `GET /v2/` version probe — its 401 + `WWW-Authenticate` is how OCI clients discover
 //! they must authenticate before the real blob requests.
 
-use hyper::body::Incoming;
-use hyper::{Request, Response};
+use hyper::{HeaderMap, Response};
 
 use crate::Body;
 
@@ -26,14 +25,15 @@ impl Auth {
         !matches!(self, Auth::None)
     }
 
-    /// Whether `req` carries valid credentials (always true when disabled).
-    pub fn allows(&self, req: &Request<Incoming>) -> bool {
+    /// Whether a request with `headers` carries valid credentials (always true when
+    /// disabled).
+    pub fn allows(&self, headers: &HeaderMap) -> bool {
         match self {
             Auth::None => true,
-            Auth::Bearer { token } => authorization(req)
+            Auth::Bearer { token } => authorization(headers)
                 .and_then(|v| v.strip_prefix("Bearer "))
                 .is_some_and(|t| constant_eq(t.as_bytes(), token.as_bytes())),
-            Auth::Basic { user, pass } => authorization(req)
+            Auth::Basic { user, pass } => authorization(headers)
                 .and_then(|v| v.strip_prefix("Basic "))
                 .and_then(|b| base64_decode(b.trim()))
                 .and_then(|raw| String::from_utf8(raw).ok())
@@ -48,6 +48,16 @@ impl Auth {
         }
     }
 
+    /// The secret a SigV4 access key id `id` signs with, when it is not `id` itself: in Basic
+    /// mode, the password when `id` is the user (compared in constant time), so the secret
+    /// never crosses the wire. `None` otherwise, a bearer included: its id is its secret.
+    pub(crate) fn secret_for(&self, id: &str) -> Option<&str> {
+        match self {
+            Auth::Basic { user, pass } if constant_eq(id.as_bytes(), user.as_bytes()) => Some(pass),
+            _ => None,
+        }
+    }
+
     /// The 401 challenge to return for an unauthenticated protected request.
     ///
     /// Each mode names its own scheme, unlike accounts mode, which challenges with `Basic`
@@ -73,8 +83,8 @@ impl Auth {
 pub(crate) const BASIC_CHALLENGE: &str = "Basic realm=\"vk-registry\"";
 const BEARER_CHALLENGE: &str = "Bearer realm=\"vk-registry\"";
 
-fn authorization(req: &Request<Incoming>) -> Option<&str> {
-    req.headers()
+fn authorization(headers: &HeaderMap) -> Option<&str> {
+    headers
         .get(hyper::header::AUTHORIZATION)
         .and_then(|v| v.to_str().ok())
 }
@@ -133,6 +143,20 @@ mod tests {
         assert!(base64_decode("not base64!").is_none());
     }
 
+    #[test]
+    fn only_the_basic_user_has_a_secret_other_than_itself() {
+        let basic = Auth::Basic {
+            user: "ci".into(),
+            pass: "pa55".into(),
+        };
+        assert_eq!(basic.secret_for("ci"), Some("pa55"));
+        assert_eq!(basic.secret_for("pa55"), None);
+        assert_eq!(basic.secret_for("c"), None);
+        let bearer = Auth::Bearer { token: "t".into() };
+        assert_eq!(bearer.secret_for("t"), None);
+        assert_eq!(Auth::None.secret_for("x"), None);
+    }
+
     #[test]
     fn constant_eq_matches_only_equal() {
         assert!(constant_eq(b"secret", b"secret"));
diff --git a/vk-registry/src/dav/mod.rs b/vk-registry/src/dav/mod.rs
index b22e0be0..21102d3d 100644
--- a/vk-registry/src/dav/mod.rs
+++ b/vk-registry/src/dav/mod.rs
@@ -175,7 +175,7 @@ pub(crate) fn parse(rest: &str) -> Option<(Vec<String>, bool)> {
 
 /// Percent-decode one path component: `%XX` escapes only, `+` being itself in a path, and
 /// the decoded bytes must be UTF-8. `None` for a malformed escape or invalid UTF-8.
-fn decode_segment(raw: &str) -> Option<String> {
+pub(crate) fn decode_segment(raw: &str) -> Option<String> {
     fn hex(c: u8) -> Option<u8> {
         match c {
             b'0'..=b'9' => Some(c - b'0'),
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index 5f885837..8fd1af22 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -352,6 +352,20 @@ where
     Ok((total, crate::hex_of(&hasher.finalize())))
 }
 
+/// Read and discard `body` up to `cap` bytes, and the frame that crosses it. For a refusal
+/// answered before the caller is known, which must not make the server read a whole
+/// upload: a body that ends within them is answered rather than reset, and what is left of a
+/// longer one closes the connection after the answer, as every refusal of a request with a
+/// body does.
+pub(crate) async fn drain_up_to<B>(body: B, cap: u64)
+where
+    B: hyper::body::Body<Data = Bytes> + Unpin,
+    B::Error: std::error::Error + Send + Sync + 'static,
+{
+    // Past `cap`, or unreadable: either way there is nothing more to read.
+    let _ = drain_into(&mut tokio::io::sink(), body, cap).await;
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index b8946db9..98aed77e 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -61,6 +61,7 @@ pub(crate) mod keys;
 pub mod lock;
 pub mod oidc;
 pub mod relay;
+pub(crate) mod s3;
 pub(crate) mod tags;
 pub(crate) mod upload;
 
@@ -135,7 +136,7 @@ impl ServerState {
 /// lock service, sign-ins, keys and captions (the accounts db, not the store) do not touch
 /// it, and the batched exists probe is a read sent as a POST; a tag deleted from the settings
 /// pages is a write.
-fn is_store_write(method: &Method, path: &str) -> bool {
+pub(crate) fn is_store_write(method: &Method, path: &str) -> bool {
     match method.as_str() {
         "GET" | "HEAD" | "OPTIONS" | "PROPFIND" => false,
         _ if path.starts_with("/lock/") || path == EXISTS_PATH => false,
@@ -4386,7 +4387,7 @@ fn closing_after_refusal(mut resp: Response<Body>, has_body: bool) -> Response<B
 
 /// Whether the browser says another site made this request (`Sec-Fetch-Site`). A browser
 /// that predates the header, and every non-browser client, sends none.
-fn cross_site(headers: &hyper::HeaderMap) -> bool {
+pub(crate) fn cross_site(headers: &hyper::HeaderMap) -> bool {
     headers
         .get("sec-fetch-site")
         .and_then(|v| v.to_str().ok())
@@ -4423,6 +4424,14 @@ async fn route(req: Request<Incoming>, state: Arc<ServerState>) -> Result<Respon
         return oidc::route(&state, req).await;
     }
 
+    // S3 clients get S3's answers from the gate too — a 403 in XML where the other routes
+    // challenge with a 401, and a SigV4 signature checked where they take a bearer — so
+    // `/s3/` passes through a gate of its own, built on the same resolvers. Disabled, it is
+    // the 404 below after this gate, as a disabled `/dav/` is.
+    if state.s3 && s3::is_path(&path) {
+        return s3::route(&state, req).await;
+    }
+
     // Client auth on every other path, including the `/v2/` version probe. Returning
     // 401 + WWW-Authenticate on `/v2/` is exactly how OCI clients discover they must
     // authenticate (oci_client's store_auth_if_needed probes `/v2/`): leaving it open
@@ -4503,7 +4512,7 @@ async fn route(req: Request<Incoming>, state: Arc<ServerState>) -> Result<Respon
             resolved
         }
         Authenticator::Shared(auth) => {
-            if auth.enabled() && !auth.allows(&req) {
+            if auth.enabled() && !auth.allows(req.headers()) {
                 return Ok(auth.challenge());
             }
             None
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
new file mode 100644
index 00000000..cf66de58
--- /dev/null
+++ b/vk-registry/src/s3/mod.rs
@@ -0,0 +1,443 @@
+//! S3 under `/s3/`, path-style: the gate S3 clients are answered by. A request is
+//! authenticated by a SigV4 `Authorization` header whose access key id is a credential this
+//! registry already takes (an API key, a hub token, the shared bearer, or the shared Basic
+//! user) and whose signing secret is that same string (the Basic password for the user), so
+//! nothing new is stored; or by the bearer, Basic or session credential the other routes
+//! take. Every answer carries an `x-amz-request-id`, and refusals are S3's XML `Error`.
+//! Presigned URLs and temporary credentials are refused.
+
+mod sigv4;
+mod xml;
+
+use anyhow::Result;
+use hyper::body::Incoming;
+use hyper::header::{
+    AUTHORIZATION, DATE, HeaderMap, HeaderValue, RETRY_AFTER, X_CONTENT_TYPE_OPTIONS,
+};
+use hyper::{Method, Request, Response, StatusCode};
+use vk_hub_proto::token::Claims;
+
+use crate::{Authenticator, Authz, Body, ServerState, accounts, hubtoken};
+
+/// Whether `path` is one this module answers.
+pub(crate) fn is_path(path: &str) -> bool {
+    path == "/s3" || path.starts_with("/s3/")
+}
+
+/// How much of a request body is read before answering a refusal decided before the caller
+/// is known: enough for a small write to see its answer rather than a reset, not so much
+/// that anyone who can reach the port can make the server read a large upload for nothing.
+const PRE_AUTH_DRAIN: u64 = 64 * 1024;
+
+/// The header naming each request, for a client's report to be matched to a server line.
+const REQUEST_ID: &str = "x-amz-request-id";
+
+/// Serve one `/s3/…` request, from its credentials on: [`crate::route`] hands every such
+/// request here before its own gate when S3 is on.
+pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result<Response<Body>> {
+    let id = accounts::random_token(8);
+    let path = req.uri().path().to_string();
+    let ctx = Ctx {
+        id: &id,
+        path: &path,
+    };
+    let mut resp = match serve(state, req, &ctx).await {
+        Ok(resp) => resp,
+        Err(e) => {
+            eprintln!("vk-registry: S3 request {id} failed: {e:#}");
+            internal_error(&ctx)
+        }
+    };
+    let headers = resp.headers_mut();
+    headers.insert(REQUEST_ID, HeaderValue::from_str(&id)?);
+    headers.insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));
+    Ok(resp)
+}
+
+/// What every answer to a request names: its id and the path it asked for.
+struct Ctx<'a> {
+    id: &'a str,
+    path: &'a str,
+}
+
+impl Ctx<'_> {
+    fn error(&self, status: StatusCode, code: &str, message: &str) -> Response<Body> {
+        xml::error(status, code, message, &[], self.path, self.id)
+    }
+}
+
+fn internal_error(ctx: &Ctx<'_>) -> Response<Body> {
+    ctx.error(
+        StatusCode::INTERNAL_SERVER_ERROR,
+        "InternalError",
+        "the server could not answer; its log names this request id",
+    )
+}
+
+/// Who a request was authenticated as: what [`Authz`] borrows from.
+enum Who {
+    /// Shared-secret or open mode, where the gate is the whole authorization model.
+    NoScopes,
+    Principal(accounts::Principal),
+    Token(Claims),
+}
+
+impl Who {
+    fn authz(&self) -> Authz<'_> {
+        match self {
+            Who::NoScopes => Authz::NoScopes,
+            Who::Principal(p) => Authz::Accounts(p),
+            Who::Token(c) => Authz::Token(c),
+        }
+    }
+}
+
+async fn serve(
+    state: &ServerState,
+    req: Request<Incoming>,
+    ctx: &Ctx<'_>,
+) -> Result<Response<Body>> {
+    let headers = req.headers();
+    // Browsers attach cookies or Basic credentials to cross-site requests, as on every
+    // other machine route.
+    if !matches!(req.method(), &Method::GET | &Method::HEAD) && crate::cross_site(headers) {
+        let resp = ctx.error(
+            StatusCode::FORBIDDEN,
+            "AccessDenied",
+            "a write to this registry cannot come from another site's page",
+        );
+        return before_auth(req, resp).await;
+    }
+    // A credential in a URL ends up in logs, proxies' included.
+    if is_presigned(req.uri().query().unwrap_or("")) {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "AuthorizationQueryParametersError",
+            "presigned URLs are not accepted: sign the Authorization header",
+        );
+        return before_auth(req, resp).await;
+    }
+    if headers.contains_key("x-amz-security-token") {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidToken",
+            "temporary credentials are not accepted: sign with a key of this registry",
+        );
+        return before_auth(req, resp).await;
+    }
+    let signed = headers
+        .get(AUTHORIZATION)
+        .is_some_and(|v| v.as_bytes().starts_with(b"AWS4-HMAC-SHA256 "));
+    let who = if signed {
+        signed_by(state, &req, ctx)
+    } else {
+        presented(state, &req, ctx)
+    };
+    let who = match who {
+        Ok(who) => who,
+        Err(resp) => return before_auth(req, *resp).await,
+    };
+
+    // A hub managing the registry may make it refuse writes for a while.
+    if state.store.read_only() && crate::is_store_write(req.method(), ctx.path) {
+        let mut resp = ctx.error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "ServiceUnavailable",
+            "the registry is read-only for now",
+        );
+        resp.headers_mut()
+            .insert(RETRY_AFTER, HeaderValue::from_static("60"));
+        return crate::dav::refuse(req, resp, ctx.path).await;
+    }
+    unserved(&who.authz(), req, ctx).await
+}
+
+/// The answer to an authenticated request while no S3 operation is served: a read of an
+/// object or a bucket finds nothing, whoever `_authz` names, and anything else is not
+/// implemented. The body is read through first, as after any authenticated refusal.
+async fn unserved(
+    _authz: &Authz<'_>,
+    req: Request<Incoming>,
+    ctx: &Ctx<'_>,
+) -> Result<Response<Body>> {
+    let rest = ctx.path.strip_prefix("/s3").unwrap_or_default();
+    let rest = rest.strip_prefix('/').unwrap_or(rest);
+    let read = matches!(req.method(), &Method::GET | &Method::HEAD);
+    let resp = match rest.split_once('/') {
+        _ if !read || rest.is_empty() => ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "this registry does not serve that operation",
+        ),
+        None | Some((_, "")) => ctx.error(
+            StatusCode::NOT_FOUND,
+            "NoSuchBucket",
+            "the specified bucket does not exist",
+        ),
+        Some(_) => ctx.error(
+            StatusCode::NOT_FOUND,
+            "NoSuchKey",
+            "the specified key does not exist",
+        ),
+    };
+    crate::dav::refuse(req, resp, ctx.path).await
+}
+
+/// Answer `resp` to a request refused before it was authenticated, having read at most
+/// [`PRE_AUTH_DRAIN`] of its body (and the frame that crossed it).
+async fn before_auth(req: Request<Incoming>, resp: Response<Body>) -> Result<Response<Body>> {
+    crate::files::drain_up_to(req.into_body(), PRE_AUTH_DRAIN).await;
+    Ok(resp)
+}
+
+/// Whether the query carries SigV4's query-string authentication.
+fn is_presigned(query: &str) -> bool {
+    query.split('&').any(|pair| {
+        let name = pair.split_once('=').map_or(pair, |(n, _)| n);
+        matches!(
+            name,
+            "X-Amz-Algorithm" | "X-Amz-Credential" | "X-Amz-Signature"
+        )
+    })
+}
+
+/// A request without a SigV4 header, authenticated as the other routes authenticate it: a
+/// hub token, then the mode's own bearer, Basic or session credential. Refused with S3's 403
+/// rather than the 401 challenge, which an S3 client does not answer.
+fn presented(
+    state: &ServerState,
+    req: &Request<Incoming>,
+    ctx: &Ctx<'_>,
+) -> std::result::Result<Who, Box<Response<Body>>> {
+    let denied = || {
+        let message = if req.headers().contains_key(AUTHORIZATION) {
+            "the credential was refused"
+        } else {
+            "this registry needs a credential: sign the request with a key of this registry"
+        };
+        Box::new(ctx.error(StatusCode::FORBIDDEN, "AccessDenied", message))
+    };
+    if let Some(claims) = token(state, req.headers(), denied)? {
+        return Ok(Who::Token(claims));
+    }
+    match &state.auth {
+        Authenticator::Accounts { db, .. } => {
+            match accounts::resolve_principal(db, req, state.cookies_are_secure()) {
+                Ok(Some(p)) => Ok(Who::Principal(p)),
+                Ok(None) => Err(denied()),
+                Err(e) => Err(resolve_failed(e, ctx)),
+            }
+        }
+        Authenticator::Shared(auth) if auth.allows(req.headers()) => Ok(Who::NoScopes),
+        Authenticator::Shared(_) => Err(denied()),
+    }
+}
+
+/// The hub token `headers` present, checked: `None` when they present none or tokens are
+/// not taken (the mode then decides), `refused` when the token is not good.
+fn token(
+    state: &ServerState,
+    headers: &HeaderMap,
+    refused: impl FnOnce() -> Box<Response<Body>>,
+) -> std::result::Result<Option<Claims>, Box<Response<Body>>> {
+    let Some(t) = hubtoken::presented(headers) else {
+        return Ok(None);
+    };
+    match state.tokens.check(&t, vk_peer::now_secs()) {
+        Some(Ok(claims)) => Ok(Some(claims)),
+        Some(Err(why)) => {
+            state.tokens.log_refusal(&why);
+            Err(refused())
+        }
+        None => Ok(None),
+    }
+}
+
+/// The answer when the accounts database could not be read: the release taking over is
+/// asked again, anything else is logged under the request's id.
+fn resolve_failed(e: anyhow::Error, ctx: &Ctx<'_>) -> Box<Response<Body>> {
+    if accounts::is_handed_over_error(&e) {
+        return Box::new(crate::ask_again(ctx.error(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "ServiceUnavailable",
+            "this registry is updating; retry",
+        )));
+    }
+    eprintln!(
+        "vk-registry: S3 request {}: resolving a credential: {e:#}",
+        ctx.id
+    );
+    Box::new(internal_error(ctx))
+}
+
+/// A request with a SigV4 header. In order: the header parses and names S3's scope; the
+/// request's time is on the scope's day and within [`sigv4::MAX_SKEW_SECS`] of the server's;
+/// the access key id is authenticated exactly as a bearer would be, by the resolvers the
+/// other routes use; only then is the secret it maps to used as a key, to check the
+/// signature. On a server with no credential configured, an id that is not a hub token is
+/// taken with its signature unchecked, as nothing else is checked there.
+fn signed_by(
+    state: &ServerState,
+    req: &Request<Incoming>,
+    ctx: &Ctx<'_>,
+) -> std::result::Result<Who, Box<Response<Body>>> {
+    let headers = req.headers();
+    let malformed = |why: &str| {
+        Box::new(ctx.error(StatusCode::BAD_REQUEST, "AuthorizationHeaderMalformed", why))
+    };
+    let value = headers
+        .get(AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .ok_or_else(|| malformed("the Authorization header is not text"))?;
+    let credential = sigv4::parse_authorization(value).map_err(malformed)?;
+    if let Some(why) = sigv4::s3_refusal(&credential) {
+        return Err(malformed(why));
+    }
+
+    let now = vk_peer::now_secs();
+    let stamp = headers
+        .get("x-amz-date")
+        .or_else(|| headers.get(DATE))
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or_default();
+    match sigv4::check_clock(stamp, credential.date, now) {
+        Ok(()) => {}
+        Err(sigv4::Clock::Unreadable) => {
+            return Err(Box::new(ctx.error(
+                StatusCode::FORBIDDEN,
+                "AccessDenied",
+                "a signed request needs an x-amz-date header as YYYYMMDDTHHMMSSZ",
+            )));
+        }
+        Err(sigv4::Clock::OtherDay) => {
+            return Err(malformed(
+                "the credential's date is not the day of x-amz-date",
+            ));
+        }
+        Err(sigv4::Clock::Skewed) => {
+            let server_time = sigv4::format_time(now);
+            let skew = (sigv4::MAX_SKEW_SECS * 1000).to_string();
+            return Err(Box::new(xml::error(
+                StatusCode::FORBIDDEN,
+                "RequestTimeTooSkewed",
+                "the difference between the request time and the server's time is too large",
+                &[
+                    ("RequestTime", stamp),
+                    ("ServerTime", &server_time),
+                    ("MaxAllowedSkewMilliseconds", &skew),
+                ],
+                ctx.path,
+                ctx.id,
+            )));
+        }
+    }
+
+    // The id, authenticated as the bearer it would be: the one header map built here holds
+    // nothing else, so no resolver can accept through it what it would not accept as sent.
+    let unknown = || {
+        Box::new(ctx.error(
+            StatusCode::FORBIDDEN,
+            "InvalidAccessKeyId",
+            "the access key id is not a credential of this registry",
+        ))
+    };
+    let as_bearer = bearer_of(credential.id).ok_or_else(unknown)?;
+    let (who, secret) = match (token(state, &as_bearer, unknown)?, &state.auth) {
+        (Some(claims), _) => (Who::Token(claims), Some(credential.id)),
+        (None, Authenticator::Accounts { db, .. }) => {
+            match accounts::resolve_headers(db, &as_bearer, state.cookies_are_secure()) {
+                Ok(Some(p)) => (Who::Principal(p), Some(credential.id)),
+                Ok(None) => return Err(unknown()),
+                Err(e) => return Err(resolve_failed(e, ctx)),
+            }
+        }
+        (None, Authenticator::Shared(auth)) if !auth.enabled() => (Who::NoScopes, None),
+        (None, Authenticator::Shared(auth)) => match auth.secret_for(credential.id) {
+            Some(password) => (Who::NoScopes, Some(password)),
+            None if auth.allows(&as_bearer) => (Who::NoScopes, Some(credential.id)),
+            None => return Err(unknown()),
+        },
+    };
+    let Some(secret) = secret else {
+        return Ok(who);
+    };
+
+    let payload_hash = headers
+        .get("x-amz-content-sha256")
+        .and_then(|v| v.to_str().ok())
+        .ok_or_else(|| malformed("the signed x-amz-content-sha256 header is missing"))?;
+    let canonical = sigv4::canonical_request(
+        req.method().as_str(),
+        req.uri().path(),
+        req.uri().query().unwrap_or(""),
+        headers,
+        &credential.signed_headers,
+        payload_hash,
+    )
+    .map_err(|why| match why {
+        sigv4::Canon::Path | sigv4::Canon::Query => Box::new(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidURI",
+            "the request's URI has a malformed escape or is not UTF-8",
+        )),
+        sigv4::Canon::Missing(name) => malformed(&format!("the signed header {name} is missing")),
+        sigv4::Canon::NotText(name) => malformed(&format!("the signed header {name} is not text")),
+    })?;
+    if !sigv4::signature_matches(secret, &credential, stamp, &canonical) {
+        let sts = sigv4::string_to_sign(stamp, &credential.scope(), &canonical);
+        return Err(Box::new(xml::error(
+            StatusCode::FORBIDDEN,
+            "SignatureDoesNotMatch",
+            "the request signature does not match the one computed with the key's secret",
+            &[("StringToSign", &sts), ("CanonicalRequest", &canonical)],
+            ctx.path,
+            ctx.id,
+        )));
+    }
+    Ok(who)
+}
+
+/// `Authorization: Bearer <id>`, alone; `None` when `id` cannot be a header value.
+fn bearer_of(id: &str) -> Option<HeaderMap> {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        AUTHORIZATION,
+        HeaderValue::from_str(&format!("Bearer {id}")).ok()?,
+    );
+    Some(headers)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_s3_paths_are_s3() {
+        for p in ["/s3", "/s3/", "/s3/b", "/s3/b/k"] {
+            assert!(is_path(p), "{p}");
+        }
+        for p in ["/s3x", "/s", "/dav/s3", "/S3/"] {
+            assert!(!is_path(p), "{p}");
+        }
+    }
+
+    #[test]
+    fn a_presigned_query_is_recognised() {
+        assert!(is_presigned(
+            "X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=00"
+        ));
+        assert!(is_presigned("list-type=2&X-Amz-Credential=a%2Fb"));
+        assert!(is_presigned("X-Amz-Signature"));
+        assert!(!is_presigned("list-type=2&prefix=X-Amz-Algorithm"));
+        assert!(!is_presigned("x-amz-algorithm=1"));
+        assert!(!is_presigned(""));
+    }
+
+    #[test]
+    fn the_id_becomes_one_bearer_header_or_nothing() {
+        let h = bearer_of("vkr_abc").unwrap();
+        assert_eq!(h.len(), 1);
+        assert_eq!(h[AUTHORIZATION], "Bearer vkr_abc");
+        assert!(bearer_of("a\nb").is_none());
+    }
+}
diff --git a/vk-registry/src/s3/sigv4.rs b/vk-registry/src/s3/sigv4.rs
new file mode 100644
index 00000000..80b6cb8b
--- /dev/null
+++ b/vk-registry/src/s3/sigv4.rs
@@ -0,0 +1,879 @@
+//! AWS Signature Version 4 over the `Authorization` header: parsing the header, the clock
+//! check, the canonical request, the string to sign and the signature. Pure functions: the
+//! region, the service and the payload hash are parameters, so AWS's generic signing suite
+//! (service `service`, no `x-amz-content-sha256`) drives them as it is; what S3 requires of a
+//! request on top of that is [`s3_refusal`], which the gate applies.
+//!
+//! The canonical request is S3's: the path is never normalised (`.`, `..` and `//` are part
+//! of a key), each segment is percent-decoded once and re-encoded with the unreserved set.
+
+use hmac::{Hmac, KeyInit, Mac};
+use hyper::HeaderMap;
+use sha2::{Digest, Sha256};
+use zeroize::Zeroizing;
+
+/// The one algorithm taken, which is also the scheme of the `Authorization` header.
+pub(crate) const ALGORITHM: &str = "AWS4-HMAC-SHA256";
+
+/// How far a request's time may be from the server's, either way: AWS's window.
+pub(crate) const MAX_SKEW_SECS: u64 = 15 * 60;
+
+/// The scope's last field, and the last HMAC of the signing key's chain.
+const TERMINATOR: &str = "aws4_request";
+
+/// A parsed `Authorization: AWS4-HMAC-SHA256 …` header, borrowing from its value.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Credential<'a> {
+    /// The access key id: everything before the scope's four fields, `/` included.
+    pub(crate) id: &'a str,
+    /// The scope's date, `YYYYMMDD`.
+    pub(crate) date: &'a str,
+    pub(crate) region: &'a str,
+    pub(crate) service: &'a str,
+    pub(crate) terminator: &'a str,
+    /// The signed header names, lowercase, sorted and without duplicates.
+    pub(crate) signed_headers: Vec<&'a str>,
+    /// The presented signature, 64 lowercase hex digits.
+    pub(crate) signature: &'a str,
+}
+
+impl Credential<'_> {
+    /// `date/region/service/terminator`, as the string to sign carries it.
+    pub(crate) fn scope(&self) -> String {
+        format!(
+            "{}/{}/{}/{}",
+            self.date, self.region, self.service, self.terminator
+        )
+    }
+}
+
+/// Parse an `Authorization` value: `AWS4-HMAC-SHA256 Credential=<id>/<date>/<region>/<service>/
+/// <terminator>, SignedHeaders=<a;b;…>, Signature=<hex>`, the fields in any order, separated
+/// by commas with or without spaces. The scope is split from the right, so an id may hold a
+/// `/` and a scope field may not. The reason a value is malformed otherwise.
+pub(crate) fn parse_authorization(value: &str) -> Result<Credential<'_>, &'static str> {
+    let fields = value
+        .strip_prefix(ALGORITHM)
+        .and_then(|r| r.strip_prefix(' '))
+        .ok_or("the algorithm must be AWS4-HMAC-SHA256")?;
+    let (mut credential, mut signed, mut signature) = (None, None, None);
+    for field in fields.split(',') {
+        let (name, v) = field
+            .trim()
+            .split_once('=')
+            .ok_or("each field must be Name=value")?;
+        let slot = match name {
+            "Credential" => &mut credential,
+            "SignedHeaders" => &mut signed,
+            "Signature" => &mut signature,
+            _ => return Err("unknown field: only Credential, SignedHeaders and Signature"),
+        };
+        if slot.replace(v).is_some() {
+            return Err("a field is given twice");
+        }
+    }
+    let credential = credential.ok_or("Credential is missing")?;
+    let signed = signed.ok_or("SignedHeaders is missing")?;
+    let signature = signature.ok_or("Signature is missing")?;
+
+    let mut scope = credential.rsplitn(5, '/');
+    let (Some(terminator), Some(service), Some(region), Some(date), Some(id)) = (
+        scope.next(),
+        scope.next(),
+        scope.next(),
+        scope.next(),
+        scope.next(),
+    ) else {
+        return Err("Credential must be <id>/<date>/<region>/<service>/aws4_request");
+    };
+    if id.is_empty() || region.is_empty() || service.is_empty() || terminator.is_empty() {
+        return Err("Credential has an empty field");
+    }
+    if date.len() != 8 || !date.bytes().all(|b| b.is_ascii_digit()) {
+        return Err("the credential's date must be YYYYMMDD");
+    }
+    let mut signed_headers = Vec::new();
+    for name in signed.split(';') {
+        if name.is_empty() || !name.bytes().all(is_lowercase_token) {
+            return Err("SignedHeaders must be lowercase header names separated by ';'");
+        }
+        signed_headers.push(name);
+    }
+    signed_headers.sort_unstable();
+    signed_headers.dedup();
+    if signature.len() != 64
+        || !signature
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    {
+        return Err("Signature must be 64 lowercase hex digits");
+    }
+    Ok(Credential {
+        id,
+        date,
+        region,
+        service,
+        terminator,
+        signed_headers,
+        signature,
+    })
+}
+
+/// A header-name byte (RFC 9110 `tchar`), lowercase.
+fn is_lowercase_token(b: u8) -> bool {
+    b.is_ascii_lowercase() || b.is_ascii_digit() || b"!#$%&'*+-.^_`|~".contains(&b)
+}
+
+/// What S3 requires of a SigV4 request beyond the signature: its scope names the service
+/// `s3` and ends in `aws4_request`, and it signs `host` (what it was sent to) and
+/// `x-amz-content-sha256` (what it carries). The reason, when it does not.
+pub(crate) fn s3_refusal(credential: &Credential<'_>) -> Option<&'static str> {
+    if credential.service != "s3" {
+        return Some("the credential's service must be s3");
+    }
+    if credential.terminator != TERMINATOR {
+        return Some("the credential must end in aws4_request");
+    }
+    for required in ["host", "x-amz-content-sha256"] {
+        if !credential.signed_headers.contains(&required) {
+            return Some(if required == "host" {
+                "SignedHeaders must include host"
+            } else {
+                "SignedHeaders must include x-amz-content-sha256"
+            });
+        }
+    }
+    None
+}
+
+/// Why a request's time is refused.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Clock {
+    /// Not ISO 8601 basic (`YYYYMMDDTHHMMSSZ`), or before 1970.
+    Unreadable,
+    /// Not on the credential scope's date.
+    OtherDay,
+    /// More than [`MAX_SKEW_SECS`] from `now`.
+    Skewed,
+}
+
+/// Check the request's time `stamp` against the scope's `date` and the server's `now`.
+pub(crate) fn check_clock(stamp: &str, date: &str, now: u64) -> Result<(), Clock> {
+    let at = parse_stamp(stamp).ok_or(Clock::Unreadable)?;
+    if stamp.get(..8) != Some(date) {
+        return Err(Clock::OtherDay);
+    }
+    if at.abs_diff(now) > MAX_SKEW_SECS {
+        return Err(Clock::Skewed);
+    }
+    Ok(())
+}
+
+/// Seconds since the epoch of an ISO 8601 basic UTC time, `YYYYMMDDTHHMMSSZ`.
+pub(crate) fn parse_stamp(stamp: &str) -> Option<u64> {
+    let b = stamp.as_bytes();
+    if b.len() != 16 || b.get(8) != Some(&b'T') || b.get(15) != Some(&b'Z') {
+        return None;
+    }
+    let num = |from: usize, to: usize| -> Option<u32> {
+        let digits = stamp.get(from..to)?;
+        digits
+            .bytes()
+            .all(|c| c.is_ascii_digit())
+            .then(|| digits.parse().ok())?
+    };
+    let (y, mo, d) = (num(0, 4)?, num(4, 6)?, num(6, 8)?);
+    let (h, mi, s) = (num(9, 11)?, num(11, 13)?, num(13, 15)?);
+    if !(1..=12).contains(&mo) || d == 0 || d > days_in_month(y, mo) || h > 23 || mi > 59 || s > 59
+    {
+        return None;
+    }
+    let days = u64::try_from(days_from_civil(i64::from(y), mo, d)).ok()?;
+    Some(days * 86_400 + u64::from(h) * 3600 + u64::from(mi) * 60 + u64::from(s))
+}
+
+/// `secs` since the epoch as ISO 8601 extended UTC, `YYYY-MM-DDTHH:MM:SSZ`: how S3 writes
+/// its `ServerTime`.
+pub(crate) fn format_time(secs: u64) -> String {
+    // `u64::MAX / 86_400` fits an `i64`: this never falls back.
+    let days = i64::try_from(secs / 86_400).unwrap_or(0);
+    let (y, m, d) = civil_from_days(days);
+    let rem = secs % 86_400;
+    format!(
+        "{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}Z",
+        rem / 3600,
+        rem / 60 % 60,
+        rem % 60
+    )
+}
+
+fn days_in_month(y: u32, m: u32) -> u32 {
+    match m {
+        2 if y.is_multiple_of(4) && (!y.is_multiple_of(100) || y.is_multiple_of(400)) => 29,
+        2 => 28,
+        4 | 6 | 9 | 11 => 30,
+        _ => 31,
+    }
+}
+
+/// Days since 1970-01-01 of a proleptic Gregorian date (H. Hinnant's `days_from_civil`).
+fn days_from_civil(y: i64, m: u32, d: u32) -> i64 {
+    let y = if m <= 2 { y - 1 } else { y };
+    let era = y.div_euclid(400);
+    let yoe = y - era * 400;
+    let (m, d) = (i64::from(m), i64::from(d));
+    let doy = (153 * (if m > 2 { m - 3 } else { m + 9 }) + 2) / 5 + d - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    era * 146_097 + doe - 719_468
+}
+
+/// The date `days` after 1970-01-01 (H. Hinnant's `civil_from_days`).
+fn civil_from_days(days: i64) -> (i64, i64, i64) {
+    let z = days + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z - era * 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = yoe + era * 400 + i64::from(m <= 2);
+    (y, m, d)
+}
+
+/// Why a request has no canonical form.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Canon<'a> {
+    /// A path segment with a malformed escape, or not UTF-8 once decoded.
+    Path,
+    /// The same, in a query name or value.
+    Query,
+    /// A signed header the request does not carry.
+    Missing(&'a str),
+    /// A signed header whose value is not text.
+    NotText(&'a str),
+}
+
+/// The canonical request: method, canonical URI, canonical query, canonical headers, signed
+/// header list and payload hash, one per line. `raw_path` and `raw_query` are as the request
+/// line carries them; `payload_hash` is what the string to sign binds the body by (for S3,
+/// the `x-amz-content-sha256` value as sent).
+pub(crate) fn canonical_request<'s>(
+    method: &str,
+    raw_path: &str,
+    raw_query: &str,
+    headers: &HeaderMap,
+    signed: &[&'s str],
+    payload_hash: &str,
+) -> Result<String, Canon<'s>> {
+    let uri = canonical_uri(raw_path).ok_or(Canon::Path)?;
+    let query = canonical_query(raw_query).ok_or(Canon::Query)?;
+    let mut out = format!("{method}\n{uri}\n{query}\n");
+    for &name in signed {
+        let mut values = headers.get_all(name).iter().peekable();
+        if values.peek().is_none() {
+            return Err(Canon::Missing(name));
+        }
+        out.push_str(name);
+        out.push(':');
+        for (i, v) in values.enumerate() {
+            let v = std::str::from_utf8(v.as_bytes()).map_err(|_| Canon::NotText(name))?;
+            if i > 0 {
+                out.push(',');
+            }
+            push_collapsed(&mut out, v);
+        }
+        out.push('\n');
+    }
+    out.push('\n');
+    out.push_str(&signed.join(";"));
+    out.push('\n');
+    out.push_str(payload_hash);
+    Ok(out)
+}
+
+/// `value` trimmed, each inner run of spaces and tabs written as one space.
+fn push_collapsed(out: &mut String, value: &str) {
+    for (i, word) in value
+        .split([' ', '\t'])
+        .filter(|w| !w.is_empty())
+        .enumerate()
+    {
+        if i > 0 {
+            out.push(' ');
+        }
+        out.push_str(word);
+    }
+}
+
+/// The path, each `/`-separated segment percent-decoded then re-encoded, never normalised.
+/// Splitting before decoding keeps an encoded `%2F` inside its segment.
+pub(crate) fn canonical_uri(raw_path: &str) -> Option<String> {
+    let mut out = String::with_capacity(raw_path.len());
+    for (i, segment) in raw_path.split('/').enumerate() {
+        if i > 0 {
+            out.push('/');
+        }
+        out.push_str(&reencode(segment)?);
+    }
+    Some(out)
+}
+
+/// The query's pairs, each name and value decoded then re-encoded, a bare name as `name=`,
+/// sorted by name then value.
+pub(crate) fn canonical_query(raw_query: &str) -> Option<String> {
+    let mut pairs = Vec::new();
+    for pair in raw_query.split('&').filter(|p| !p.is_empty()) {
+        let (name, value) = pair.split_once('=').unwrap_or((pair, ""));
+        pairs.push((reencode(name)?, reencode(value)?));
+    }
+    pairs.sort_unstable();
+    let mut out = String::with_capacity(raw_query.len());
+    for (i, (name, value)) in pairs.iter().enumerate() {
+        if i > 0 {
+            out.push('&');
+        }
+        out.push_str(name);
+        out.push('=');
+        out.push_str(value);
+    }
+    Some(out)
+}
+
+/// One URI component in SigV4's encoding: `%XX` escapes decoded (a `+` is itself), the
+/// result encoded again with everything but the unreserved set escaped.
+fn reencode(raw: &str) -> Option<String> {
+    Some(crate::percent_encode(&crate::dav::decode_segment(raw)?))
+}
+
+/// The string to sign for a request made at `stamp` under `scope`.
+pub(crate) fn string_to_sign(stamp: &str, scope: &str, canonical_request: &str) -> String {
+    let hashed = crate::hex_of(&Sha256::digest(canonical_request.as_bytes()));
+    format!("{ALGORITHM}\n{stamp}\n{scope}\n{hashed}")
+}
+
+/// HMAC-SHA256 of `data` under `key`, in a buffer wiped on drop. `None` never happens for
+/// HMAC, which takes a key of any length; it is not turned into a key of zeros instead.
+fn hmac(key: &[u8], data: &[u8]) -> Option<Zeroizing<[u8; 32]>> {
+    let mut mac = <Hmac<Sha256> as KeyInit>::new_from_slice(key).ok()?;
+    mac.update(data);
+    let mut out = Zeroizing::new([0u8; 32]);
+    out.copy_from_slice(&mac.finalize().into_bytes());
+    Some(out)
+}
+
+/// The hex signature of `string_to_sign` under the key derived from `secret` for the scope
+/// `date/region/service/aws4_request`. The derived keys live in this call only, each wiped
+/// when dropped; nothing but the signature leaves it.
+pub(crate) fn signature(
+    secret: &str,
+    date: &str,
+    region: &str,
+    service: &str,
+    string_to_sign: &str,
+) -> Option<String> {
+    let seed = Zeroizing::new(format!("AWS4{secret}").into_bytes());
+    let k_date = hmac(&seed, date.as_bytes())?;
+    let k_region = hmac(&*k_date, region.as_bytes())?;
+    let k_service = hmac(&*k_region, service.as_bytes())?;
+    let k_signing = hmac(&*k_service, TERMINATOR.as_bytes())?;
+    let signed = hmac(&*k_signing, string_to_sign.as_bytes())?;
+    Some(crate::hex_of(&*signed))
+}
+
+/// Whether `credential`'s signature is the one `secret` gives `canonical_request` made at
+/// `stamp`, compared in constant time.
+pub(crate) fn signature_matches(
+    secret: &str,
+    credential: &Credential<'_>,
+    stamp: &str,
+    canonical_request: &str,
+) -> bool {
+    let sts = string_to_sign(stamp, &credential.scope(), canonical_request);
+    signature(
+        secret,
+        credential.date,
+        credential.region,
+        credential.service,
+        &sts,
+    )
+    .is_some_and(|ours| crate::auth::constant_eq(ours.as_bytes(), credential.signature.as_bytes()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hyper::header::{HeaderName, HeaderValue};
+
+    const EMPTY_SHA256: &str = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+
+    /// A request as the suite writes one: the request line, `Name:value` headers (a line
+    /// starting with whitespace continues the one above), a blank line, the body.
+    struct Request {
+        method: String,
+        path: String,
+        query: String,
+        headers: HeaderMap,
+        body: String,
+    }
+
+    fn parse_request(text: &str) -> Request {
+        let (head, body) = text.split_once("\n\n").unwrap_or((text, ""));
+        let mut lines = head.lines();
+        let line = lines.next().unwrap();
+        let (method, target) = line.split_once(' ').unwrap();
+        let target = target.strip_suffix(" HTTP/1.1").unwrap();
+        let (path, query) = target.split_once('?').unwrap_or((target, ""));
+        let mut fields: Vec<(String, String)> = Vec::new();
+        for line in lines {
+            if line.starts_with([' ', '\t']) {
+                let last = fields.last_mut().unwrap();
+                last.1.push(' ');
+                last.1.push_str(line.trim());
+            } else {
+                // As an HTTP parser does, the value without its surrounding whitespace.
+                let (name, value) = line.split_once(':').unwrap();
+                fields.push((name.to_string(), value.trim().to_string()));
+            }
+        }
+        let mut headers = HeaderMap::new();
+        for (name, value) in fields {
+            headers.append(
+                HeaderName::from_bytes(name.as_bytes()).unwrap(),
+                HeaderValue::from_str(&value).unwrap(),
+            );
+        }
+        Request {
+            method: method.to_string(),
+            path: path.to_string(),
+            query: query.to_string(),
+            headers,
+            body: body.to_string(),
+        }
+    }
+
+    /// Everything a header-signed request yields: its canonical request, string to sign and
+    /// signature under `secret`, and whether the signature it carries verifies.
+    struct Signed {
+        canonical: String,
+        string_to_sign: String,
+        signature: String,
+        verifies: bool,
+    }
+
+    fn sign(req: &Request, secret: &str, payload_hash: &str) -> Signed {
+        let auth = req.headers["authorization"].to_str().unwrap();
+        let cred = parse_authorization(auth).unwrap();
+        let stamp = req.headers["x-amz-date"].to_str().unwrap();
+        let canonical = canonical_request(
+            &req.method,
+            &req.path,
+            &req.query,
+            &req.headers,
+            &cred.signed_headers,
+            payload_hash,
+        )
+        .unwrap();
+        let string_to_sign = string_to_sign(stamp, &cred.scope(), &canonical);
+        let signature = signature(
+            secret,
+            cred.date,
+            cred.region,
+            cred.service,
+            &string_to_sign,
+        )
+        .unwrap();
+        let verifies = signature_matches(secret, &cred, stamp, &canonical);
+        Signed {
+            canonical,
+            string_to_sign,
+            signature,
+            verifies,
+        }
+    }
+
+    /// Every case of AWS's signing suite (see `testdata/sigv4/README`) reproduces its
+    /// canonical request, string to sign and signature, and its signed request verifies. A
+    /// `-normalized` case is the request its `-unnormalized` twin signs, with the path
+    /// normalised as services other than S3 do: S3 does not, so its canonical request must be
+    /// the twin's.
+    #[test]
+    fn the_aws_signing_suite_verifies() {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("src/s3/testdata/sigv4");
+        let mut cases: Vec<_> = std::fs::read_dir(&root)
+            .unwrap()
+            .map(|e| e.unwrap().path())
+            .filter(|p| p.is_dir())
+            .collect();
+        cases.sort();
+        assert_eq!(cases.len(), 38, "the vendored suite is whole");
+        let read = |case: &std::path::Path, file: &str| {
+            std::fs::read_to_string(case.join(file))
+                .unwrap_or_else(|e| panic!("{}/{file}: {e}", case.display()))
+        };
+        let mut twinned = 0;
+        for case in &cases {
+            let name = case.file_name().unwrap().to_str().unwrap();
+            let context: serde_json::Value =
+                serde_json::from_str(&read(case, "context.json")).unwrap();
+            let secret = context["credentials"]["secret_access_key"]
+                .as_str()
+                .unwrap();
+            let req = parse_request(&read(case, "header-signed-request.txt"));
+            let payload_hash = match req.headers.get("x-amz-content-sha256") {
+                Some(v) => v.to_str().unwrap().to_string(),
+                None if context["sign_body"] == true => {
+                    crate::hex_of(&Sha256::digest(req.body.as_bytes()))
+                }
+                None => EMPTY_SHA256.to_string(),
+            };
+            let signed = sign(&req, secret, &payload_hash);
+            if let Some(stem) = name.strip_suffix("-normalized") {
+                assert_eq!(context["normalize"], true, "{name}");
+                let twin = root.join(format!("{stem}-unnormalized"));
+                assert_eq!(
+                    signed.canonical,
+                    read(&twin, "header-canonical-request.txt"),
+                    "{name}: S3 signs the path as sent"
+                );
+                twinned += 1;
+                continue;
+            }
+            assert_eq!(
+                signed.canonical,
+                read(case, "header-canonical-request.txt"),
+                "{name}"
+            );
+            assert_eq!(
+                signed.string_to_sign,
+                read(case, "header-string-to-sign.txt"),
+                "{name}"
+            );
+            assert_eq!(
+                signed.signature,
+                read(case, "header-signature.txt").trim(),
+                "{name}"
+            );
+            assert!(signed.verifies, "{name}");
+        }
+        assert_eq!(twinned, 7, "every -normalized case has its twin");
+    }
+
+    const S3_SECRET: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+
+    /// AWS's S3 examples ("Signature Calculations for the Authorization Header: Transferring
+    /// Payload in a Single Chunk"): each request, as written there with its Authorization
+    /// header, parses, passes S3's policy, and verifies to the documented canonical request
+    /// and signature. Virtual-hosted, as AWS signs them, which changes nothing here: the
+    /// signature covers the `Host` and path as sent.
+    #[test]
+    fn the_aws_s3_examples_verify() {
+        let date = "x-amz-date:20130524T000000Z";
+        let empty = format!("x-amz-content-sha256:{EMPTY_SHA256}");
+        let put_hash = "44ce7dd67c959e0d3524ffac1771dfbba87d2b6b4b4e99e42034a8b803f8b072";
+        let cases: [(&str, &str, Vec<String>, &str, &str); 4] = [
+            (
+                "GET /test.txt",
+                "host;range;x-amz-content-sha256;x-amz-date",
+                vec!["range:bytes=0-9".into(), empty.clone(), date.into()],
+                "GET\n/test.txt\n\nhost:examplebucket.s3.amazonaws.com\nrange:bytes=0-9\n\
+                 x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n\
+                 x-amz-date:20130524T000000Z\n\nhost;range;x-amz-content-sha256;x-amz-date\n\
+                 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41",
+            ),
+            (
+                "PUT /test$file.text",
+                "date;host;x-amz-content-sha256;x-amz-date;x-amz-storage-class",
+                vec![
+                    "date:Fri, 24 May 2013 00:00:00 GMT".into(),
+                    date.into(),
+                    "x-amz-storage-class:REDUCED_REDUNDANCY".into(),
+                    format!("x-amz-content-sha256:{put_hash}"),
+                ],
+                "PUT\n/test%24file.text\n\ndate:Fri, 24 May 2013 00:00:00 GMT\n\
+                 host:examplebucket.s3.amazonaws.com\n\
+                 x-amz-content-sha256:44ce7dd67c959e0d3524ffac1771dfbba87d2b6b4b4e99e42034a8b803f8b072\n\
+                 x-amz-date:20130524T000000Z\nx-amz-storage-class:REDUCED_REDUNDANCY\n\n\
+                 date;host;x-amz-content-sha256;x-amz-date;x-amz-storage-class\n\
+                 44ce7dd67c959e0d3524ffac1771dfbba87d2b6b4b4e99e42034a8b803f8b072",
+                "98ad721746da40c64f1a55b78f14c238d841ea1380cd77a1b5971af0ece108bd",
+            ),
+            (
+                "GET /?lifecycle",
+                "host;x-amz-content-sha256;x-amz-date",
+                vec![date.into(), empty.clone()],
+                "GET\n/\nlifecycle=\nhost:examplebucket.s3.amazonaws.com\n\
+                 x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n\
+                 x-amz-date:20130524T000000Z\n\nhost;x-amz-content-sha256;x-amz-date\n\
+                 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "fea454ca298b7da1c68078a5d1bdbfbbe0d65c699e0f91ac7a200a0136783543",
+            ),
+            (
+                "GET /?max-keys=2&prefix=J",
+                "host;x-amz-content-sha256;x-amz-date",
+                vec![date.into(), empty.clone()],
+                "GET\n/\nmax-keys=2&prefix=J\nhost:examplebucket.s3.amazonaws.com\n\
+                 x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n\
+                 x-amz-date:20130524T000000Z\n\nhost;x-amz-content-sha256;x-amz-date\n\
+                 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                "34b48302e7b5fa45bde8084f4b7868a86f0a534bc59db6670ed5711ef69dc6f7",
+            ),
+        ];
+        for (line, signed, extra, canonical, sig) in cases {
+            let mut text = format!(
+                "{line} HTTP/1.1\nHost: examplebucket.s3.amazonaws.com\nAuthorization: \
+                 AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/\
+                 aws4_request,SignedHeaders={signed},Signature={sig}\n"
+            );
+            for h in &extra {
+                text.push_str(h);
+                text.push('\n');
+            }
+            let req = parse_request(&text);
+            let cred = parse_authorization(req.headers["authorization"].to_str().unwrap()).unwrap();
+            assert_eq!(cred.id, "AKIAIOSFODNN7EXAMPLE");
+            assert_eq!(s3_refusal(&cred), None, "{line}");
+            let payload = req.headers["x-amz-content-sha256"].to_str().unwrap();
+            let signed = sign(&req, S3_SECRET, payload);
+            assert_eq!(signed.canonical, canonical, "{line}");
+            assert_eq!(signed.signature, sig, "{line}");
+            assert!(signed.verifies, "{line}");
+            // Another secret, or one byte of the request changed, and it no longer does.
+            assert!(!sign(&req, "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEz", payload).verifies);
+            let moved = parse_request(&text.replacen(" /", " /x", 1));
+            assert!(!sign(&moved, S3_SECRET, payload).verifies, "{line}");
+        }
+    }
+
+    fn header(pairs: &[(&str, &str)]) -> HeaderMap {
+        let mut h = HeaderMap::new();
+        for (n, v) in pairs {
+            h.append(
+                HeaderName::from_bytes(n.as_bytes()).unwrap(),
+                HeaderValue::from_str(v).unwrap(),
+            );
+        }
+        h
+    }
+
+    #[test]
+    fn a_query_is_canonical_whatever_its_order_and_encoding() {
+        let want = "%E1%88%B4=v&a=1&a=2&b=x%20y&c=&d=%2B";
+        for q in [
+            "b=x%20y&a=2&a=1&c=&d=%2B&%E1%88%B4=v",
+            "a=1&%e1%88%b4=v&b=x%20y&a=2&c&d=%2b",
+            "d=%2B&c&&b=x%20y&a=%32&a=%31&ሴ=v",
+        ] {
+            assert_eq!(canonical_query(q).as_deref(), Some(want), "{q}");
+        }
+        // A `+` is itself, encoded, not a space; a bare key and an empty value are the same.
+        assert_eq!(canonical_query("k=a+b").as_deref(), Some("k=a%2Bb"));
+        assert_eq!(canonical_query("uploads").as_deref(), Some("uploads="));
+        assert_eq!(canonical_query("uploads=").as_deref(), Some("uploads="));
+        assert_eq!(canonical_query("").as_deref(), Some(""));
+        // Sorted by name, then by value, on the encoded bytes.
+        assert_eq!(
+            canonical_query("x=b&x=a&X=c").as_deref(),
+            Some("X=c&x=a&x=b")
+        );
+        assert_eq!(canonical_query("a=%zz"), None);
+        assert_eq!(canonical_query("a=%ff"), None, "not UTF-8 once decoded");
+    }
+
+    #[test]
+    fn a_path_is_encoded_once_and_never_normalised() {
+        for (raw, want) in [
+            ("/", "/"),
+            ("/b/a%20b/c", "/b/a%20b/c"),
+            ("/b/a b", "/b/a%20b"),
+            ("/b/%7Ex~", "/b/~x~"),
+            ("/b/a%2Fb", "/b/a%2Fb"),
+            ("/b//./../k/", "/b//./../k/"),
+            ("/b/a+b$", "/b/a%2Bb%24"),
+        ] {
+            assert_eq!(canonical_uri(raw).as_deref(), Some(want), "{raw}");
+        }
+        assert_eq!(canonical_uri("/b/%2"), None);
+        assert_eq!(canonical_uri("/b/%C3%28"), None);
+    }
+
+    #[test]
+    fn header_values_are_trimmed_collapsed_and_joined() {
+        let h = header(&[
+            ("host", "h"),
+            ("x-amz-meta-a", "  one \t two   three  "),
+            ("x-amz-meta-b", "1"),
+            ("x-amz-meta-b", " 2 "),
+            ("x-amz-meta-b", "3"),
+            ("x-amz-meta-unsigned", "ignored"),
+        ]);
+        let creq = canonical_request(
+            "GET",
+            "/",
+            "",
+            &h,
+            &["host", "x-amz-meta-a", "x-amz-meta-b"],
+            "UNSIGNED-PAYLOAD",
+        )
+        .unwrap();
+        assert_eq!(
+            creq,
+            "GET\n/\n\nhost:h\nx-amz-meta-a:one two three\nx-amz-meta-b:1,2,3\n\n\
+             host;x-amz-meta-a;x-amz-meta-b\nUNSIGNED-PAYLOAD"
+        );
+        assert_eq!(
+            canonical_request("GET", "/", "", &h, &["host", "x-amz-date"], "-"),
+            Err(Canon::Missing("x-amz-date"))
+        );
+        let mut binary = HeaderMap::new();
+        binary.insert("x-b", HeaderValue::from_bytes(&[0xff, b'a']).unwrap());
+        assert_eq!(
+            canonical_request("GET", "/", "", &binary, &["x-b"], "-"),
+            Err(Canon::NotText("x-b"))
+        );
+    }
+
+    const SIG: &str = "f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41";
+
+    fn authorization(credential: &str, signed: &str) -> String {
+        format!("AWS4-HMAC-SHA256 Credential={credential}, SignedHeaders={signed}, Signature={SIG}")
+    }
+
+    #[test]
+    fn the_scope_is_split_from_the_right() {
+        let value = authorization(
+            "team/ci/key/20130524/auto/s3/aws4_request",
+            "x-amz-date;host;x-amz-content-sha256",
+        );
+        let cred = parse_authorization(&value).unwrap();
+        assert_eq!(cred.id, "team/ci/key");
+        assert_eq!(cred.date, "20130524");
+        assert_eq!(cred.region, "auto");
+        assert_eq!(cred.service, "s3");
+        assert_eq!(cred.terminator, "aws4_request");
+        assert_eq!(cred.scope(), "20130524/auto/s3/aws4_request");
+        assert_eq!(
+            cred.signed_headers,
+            ["host", "x-amz-content-sha256", "x-amz-date"],
+            "sorted"
+        );
+        assert_eq!(cred.signature, SIG);
+        assert_eq!(s3_refusal(&cred), None);
+    }
+
+    #[test]
+    fn a_malformed_authorization_is_refused() {
+        let ok = "id/20130524/us-east-1/s3/aws4_request";
+        let signed = "host;x-amz-content-sha256";
+        for bad in [
+            format!("AWS4-HMAC-SHA1 Credential={ok}, SignedHeaders={signed}, Signature={SIG}"),
+            format!("AWS4-HMAC-SHA256 Credential={ok}, SignedHeaders={signed}"),
+            format!("AWS4-HMAC-SHA256 Credential={ok}, Signature={SIG}"),
+            format!("AWS4-HMAC-SHA256 SignedHeaders={signed}, Signature={SIG}"),
+            format!("{}, Signature={SIG}", authorization(ok, signed)),
+            format!("{}, Other=1", authorization(ok, signed)),
+            format!("{} junk", authorization(ok, signed)),
+            authorization("20130524/us-east-1/s3/aws4_request", signed),
+            authorization("/20130524/us-east-1/s3/aws4_request", signed),
+            authorization("id/2013052/us-east-1/s3/aws4_request", signed),
+            authorization("id/2013O524/us-east-1/s3/aws4_request", signed),
+            authorization("id/20130524//s3/aws4_request", signed),
+            authorization(ok, "Host;x-amz-content-sha256"),
+            authorization(ok, "host;;x-amz-content-sha256"),
+            authorization(ok, "host x-amz-content-sha256"),
+            authorization(ok, signed).replace(SIG, &SIG.to_uppercase()),
+            authorization(ok, signed).replace(SIG, &SIG[1..]),
+            String::new(),
+            "AWS4-HMAC-SHA256".to_string(),
+            "AWS4-HMAC-SHA256 ".to_string(),
+        ] {
+            assert!(parse_authorization(&bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn s3_requires_its_service_and_both_headers_signed() {
+        let refusal = |credential: &str, signed: &str| {
+            s3_refusal(&parse_authorization(&authorization(credential, signed)).unwrap())
+        };
+        let ok = "id/20130524/us-east-1/s3/aws4_request";
+        assert_eq!(refusal(ok, "host;x-amz-content-sha256;x-amz-date"), None);
+        assert!(refusal(ok, "x-amz-content-sha256;x-amz-date").is_some());
+        assert!(refusal(ok, "host;x-amz-date").is_some());
+        assert!(
+            refusal(
+                "id/20130524/us-east-1/service/aws4_request",
+                "host;x-amz-content-sha256"
+            )
+            .is_some()
+        );
+        assert!(
+            refusal(
+                "id/20130524/us-east-1/s3/aws4_requesT",
+                "host;x-amz-content-sha256"
+            )
+            .is_some()
+        );
+    }
+
+    #[test]
+    fn the_clock_must_be_on_the_scope_day_and_within_fifteen_minutes() {
+        let at = parse_stamp("20130524T120000Z").unwrap();
+        assert_eq!(at, 1_369_396_800);
+        assert_eq!(format_time(at), "2013-05-24T12:00:00Z");
+        assert_eq!(check_clock("20130524T120000Z", "20130524", at), Ok(()));
+        for ok in [14 * 60 + 59, 15 * 60] {
+            assert_eq!(check_clock("20130524T120000Z", "20130524", at + ok), Ok(()));
+            assert_eq!(check_clock("20130524T120000Z", "20130524", at - ok), Ok(()));
+        }
+        assert_eq!(
+            check_clock("20130524T120000Z", "20130524", at + 15 * 60 + 1),
+            Err(Clock::Skewed)
+        );
+        assert_eq!(
+            check_clock("20130524T120000Z", "20130524", at - 15 * 60 - 1),
+            Err(Clock::Skewed)
+        );
+        // On the day after the scope's, even within the window.
+        assert_eq!(
+            check_clock("20130525T000100Z", "20130524", at + 12 * 3600),
+            Err(Clock::OtherDay)
+        );
+        for bad in [
+            "",
+            "20130524T120000",
+            "20130524 120000Z",
+            "2013-05-24T12:00:00Z",
+            "20131324T120000Z",
+            "20130230T120000Z",
+            "20130524T240000Z",
+            "20130524T126000Z",
+            "+0130524T120000Z",
+            "Fri, 24 May 2013 12:00:00 GMT",
+        ] {
+            assert_eq!(
+                check_clock(bad, "20130524", at),
+                Err(Clock::Unreadable),
+                "{bad}"
+            );
+        }
+        assert_eq!(parse_stamp("19700101T000000Z"), Some(0));
+        assert_eq!(parse_stamp("20000229T235959Z"), Some(951_868_799));
+        assert_eq!(format_time(951_868_799), "2000-02-29T23:59:59Z");
+    }
+
+    /// What signing hands back is the hex signature and nothing else: no derived key is
+    /// returned or kept, so none outlives the call.
+    #[test]
+    fn signing_returns_the_signature_only() {
+        let f: fn(&str, &str, &str, &str, &str) -> Option<String> = signature;
+        let sig = f(S3_SECRET, "20130524", "us-east-1", "s3", "x").unwrap();
+        assert_eq!(sig.len(), 64);
+        assert_ne!(
+            sig,
+            f(S3_SECRET, "20130525", "us-east-1", "s3", "x").unwrap()
+        );
+        assert_ne!(sig, f(S3_SECRET, "20130524", "auto", "s3", "x").unwrap());
+    }
+}
diff --git a/vk-registry/src/s3/testdata/sigv4/LICENSE b/vk-registry/src/s3/testdata/sigv4/LICENSE
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vk-registry/src/s3/testdata/sigv4/README b/vk-registry/src/s3/testdata/sigv4/README
new file mode 100644
index 00000000..468e6028
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/README
@@ -0,0 +1,14 @@
+AWS Signature Version 4 signing test suite, header-signing cases
+
+Source: awslabs/aws-c-auth, tests/aws-signing-test-suite/v4
+https://github.com/awslabs/aws-c-auth/tree/3281f8692e6fd10562c4585a4dded5c16b322698/tests/aws-signing-test-suite/v4
+(the last commit touching that directory). Licensed under the Apache License 2.0; see
+LICENSE beside this file.
+
+Each directory is one case, copied unchanged: context.json (credentials, region, service,
+timestamp, whether the path is normalised and the body signed), request.txt (the request
+before signing), header-signed-request.txt (the same, signed in the Authorization header),
+header-canonical-request.txt, header-string-to-sign.txt and header-signature.txt. The
+query-* files (presigned URLs, which vk-registry refuses) are left out.
+
+s3::sigv4's tests read them from here (the_aws_signing_suite_verifies).
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/context.json b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-canonical-request.txt
new file mode 100644
index 00000000..fa8f49a1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-canonical-request.txt
@@ -0,0 +1,9 @@
+GET
+/
+
+host:example.amazonaws.com
+my-header1:value2,value2,value1
+x-amz-date:20150830T123600Z
+
+host;my-header1;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signature.txt
new file mode 100644
index 00000000..7fc5d7ac
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signature.txt
@@ -0,0 +1 @@
+c9d5ea9f3f72853aea855b47ea873832890dbdd183b4468f858259531a5138ea
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signed-request.txt
new file mode 100644
index 00000000..36a12051
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-signed-request.txt
@@ -0,0 +1,8 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value2
+My-Header1:value2
+My-Header1:value1
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;x-amz-date, Signature=c9d5ea9f3f72853aea855b47ea873832890dbdd183b4468f858259531a5138ea
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-string-to-sign.txt
new file mode 100644
index 00000000..48a135ec
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+dc7f04a3abfde8d472b0ab1a418b741b7c67174dad1551b4117b15527fbe966c
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/request.txt
new file mode 100644
index 00000000..40455cec
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-key-duplicate/request.txt
@@ -0,0 +1,5 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value2
+My-Header1:value2
+My-Header1:value1
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/context.json b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-canonical-request.txt
new file mode 100644
index 00000000..8cb54769
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-canonical-request.txt
@@ -0,0 +1,9 @@
+GET
+/
+
+host:example.amazonaws.com
+my-header1:value1 value2 value3
+x-amz-date:20150830T123600Z
+
+host;my-header1;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signature.txt
new file mode 100644
index 00000000..e6ff7a91
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signature.txt
@@ -0,0 +1 @@
+cfd34249e4b1c8d6b91ef74165d41a32e5fab3306300901bb65a51a73575eefd
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signed-request.txt
new file mode 100644
index 00000000..b5ef6a00
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-signed-request.txt
@@ -0,0 +1,8 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value1
+  value2
+     value3
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;x-amz-date, Signature=cfd34249e4b1c8d6b91ef74165d41a32e5fab3306300901bb65a51a73575eefd
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-string-to-sign.txt
new file mode 100644
index 00000000..97c74309
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+e99419459a677bc11de234014be3c4e72c1ea5b454ceb58b613061f5d7a162e8
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/request.txt
new file mode 100644
index 00000000..b5026cd0
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-multiline/request.txt
@@ -0,0 +1,5 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value1
+  value2
+     value3
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/context.json b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-canonical-request.txt
new file mode 100644
index 00000000..e336bc94
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-canonical-request.txt
@@ -0,0 +1,9 @@
+GET
+/
+
+host:example.amazonaws.com
+my-header1:value4,value1,value3,value2
+x-amz-date:20150830T123600Z
+
+host;my-header1;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signature.txt
new file mode 100644
index 00000000..8ef04944
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signature.txt
@@ -0,0 +1 @@
+08c7e5a9acfcfeb3ab6b2185e75ce8b1deb5e634ec47601a50643f830c755c01
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signed-request.txt
new file mode 100644
index 00000000..b786dc92
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-signed-request.txt
@@ -0,0 +1,9 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value4
+My-Header1:value1
+My-Header1:value3
+My-Header1:value2
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;x-amz-date, Signature=08c7e5a9acfcfeb3ab6b2185e75ce8b1deb5e634ec47601a50643f830c755c01
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-string-to-sign.txt
new file mode 100644
index 00000000..711a8d4d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+31ce73cd3f3d9f66977ad3dd957dc47af14df92fcd8509f59b349e9137c58b86
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-order/request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/request.txt
new file mode 100644
index 00000000..2c6f49d3
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-order/request.txt
@@ -0,0 +1,6 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value4
+My-Header1:value1
+My-Header1:value3
+My-Header1:value2
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/context.json b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-canonical-request.txt
new file mode 100644
index 00000000..a59087c9
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-canonical-request.txt
@@ -0,0 +1,10 @@
+GET
+/
+
+host:example.amazonaws.com
+my-header1:value1
+my-header2:"a b c"
+x-amz-date:20150830T123600Z
+
+host;my-header1;my-header2;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signature.txt
new file mode 100644
index 00000000..36081a9d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signature.txt
@@ -0,0 +1 @@
+acc3ed3afb60bb290fc8d2dd0098b9911fcaa05412b367055dee359757a9c736
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signed-request.txt
new file mode 100644
index 00000000..6331d16d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-signed-request.txt
@@ -0,0 +1,7 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1: value1
+My-Header2: "a   b   c"
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;my-header2;x-amz-date, Signature=acc3ed3afb60bb290fc8d2dd0098b9911fcaa05412b367055dee359757a9c736
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-string-to-sign.txt
new file mode 100644
index 00000000..a0b15cc7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+a726db9b0df21c14f559d0a978e563112acb1b9e05476f0a6a1c7d68f28605c7
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/request.txt b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/request.txt
new file mode 100644
index 00000000..ad1ea986
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-header-value-trim/request.txt
@@ -0,0 +1,4 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1: value1
+My-Header2: "a   b   c"
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signed-request.txt
new file mode 100644
index 00000000..0de83271
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example/.. HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/request.txt
new file mode 100644
index 00000000..6aa9f995
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-normalized/request.txt
@@ -0,0 +1,2 @@
+GET /example/.. HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signed-request.txt
new file mode 100644
index 00000000..f9b38158
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example1/example2/../.. HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/request.txt
new file mode 100644
index 00000000..a856c107
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-normalized/request.txt
@@ -0,0 +1,2 @@
+GET /example1/example2/../.. HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..6919c44e
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example1/example2/../..
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signature.txt
new file mode 100644
index 00000000..4092d83d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+dc33e0856fd4baca4d7aa2146c38958283844764f38c74252a333df5e613003b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..e731b35d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example1/example2/../.. HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=dc33e0856fd4baca4d7aa2146c38958283844764f38c74252a333df5e613003b
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..4f457522
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+76115030c0f3ff06c20fdff5ceb6d5e0b835a1743e00b94fea7c7f381269437b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/request.txt
new file mode 100644
index 00000000..a856c107
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-relative-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET /example1/example2/../.. HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..f640bc2c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example/..
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signature.txt
new file mode 100644
index 00000000..d957303b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+eca7ead57bb5aa5c8e28007acd4ff04e1ff9a0ff3b237ec1554a184887ff9282
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..4f42ffca
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example/.. HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=eca7ead57bb5aa5c8e28007acd4ff04e1ff9a0ff3b237ec1554a184887ff9282
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..ca54bda2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+0511f456aa502b456d135fcb9d749374a55228f9dbeedda1eacf659e05b0615b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/request.txt
new file mode 100644
index 00000000..6aa9f995
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-relative-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET /example/.. HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signed-request.txt
new file mode 100644
index 00000000..99c8eebb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /./ HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/request.txt
new file mode 100644
index 00000000..2c5ff385
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-normalized/request.txt
@@ -0,0 +1,2 @@
+GET /./ HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..51590482
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/./
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signature.txt
new file mode 100644
index 00000000..b49ff0ee
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+68714168e6557f8f2de0ef956fc24dc2593a4bd2961f8df51898d8a134695145
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..aeb1ffa1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /./ HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=68714168e6557f8f2de0ef956fc24dc2593a4bd2961f8df51898d8a134695145
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..b7d8caf2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+d67825e2268bd77a97c7688b8d72c31a3c1855b309808505ba0a9747d2465aa7
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/request.txt
new file mode 100644
index 00000000..2c5ff385
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-dot-slash-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET /./ HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signed-request.txt
new file mode 100644
index 00000000..b91087b1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET // HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/request.txt
new file mode 100644
index 00000000..25bc21e3
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-normalized/request.txt
@@ -0,0 +1,2 @@
+GET // HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..915c57f2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signature.txt
new file mode 100644
index 00000000..8f892bfa
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signature.txt
@@ -0,0 +1 @@
+ef75d96142cf21edca26f06005da7988e4f8dc83a165a80865db7089db637ec5
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signed-request.txt
new file mode 100644
index 00000000..2a1895ca
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /./example HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=ef75d96142cf21edca26f06005da7988e4f8dc83a165a80865db7089db637ec5
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..7429923e
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+214d50c111a8edc4819da6a636336472c916b5240f51e9a51b5c3305180cf702
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/request.txt
new file mode 100644
index 00000000..5d919c9b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-normalized/request.txt
@@ -0,0 +1,2 @@
+GET /./example HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..36698c70
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/./example
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signature.txt
new file mode 100644
index 00000000..4a4b8f24
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+beb03f223f7deae4146464f06e29eebbee9c8afbe15c290cf07aa8b119e14cff
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..d462bcd6
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /./example HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=beb03f223f7deae4146464f06e29eebbee9c8afbe15c290cf07aa8b119e14cff
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..8be78c9c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+73895e0e829507e28e39fd24669aedc2434a8e179e547e3c075b42921f952cdb
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/request.txt
new file mode 100644
index 00000000..5d919c9b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-pointless-dot-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET /./example HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..5860c8a7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+//
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signature.txt
new file mode 100644
index 00000000..83104716
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+c88bcd3d312d75078c0cd961d6deae3f4c754924b01669efcfcb439fd5e5b76e
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..2a7afef5
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET // HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=c88bcd3d312d75078c0cd961d6deae3f4c754924b01669efcfcb439fd5e5b76e
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..06059dd1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+80cb39203d058af815de2b79250ff56e1b73eb9b4718c86556cdc6f150c5d209
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/request.txt
new file mode 100644
index 00000000..25bc21e3
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slash-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET // HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..2bdaf747
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signature.txt
new file mode 100644
index 00000000..71c7bac1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signature.txt
@@ -0,0 +1 @@
+9a624bd73a37c9a373b5312afbebe7a714a789de108f0bdfe846570885f57e84
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signed-request.txt
new file mode 100644
index 00000000..0add1f15
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET //example// HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=9a624bd73a37c9a373b5312afbebe7a714a789de108f0bdfe846570885f57e84
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..95d1fc25
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+cb96b4ac96d501f7c5c15bc6d67b3035061cfced4af6585ad927f7e6c985c015
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/request.txt
new file mode 100644
index 00000000..12e09319
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-normalized/request.txt
@@ -0,0 +1,2 @@
+GET //example// HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..dfffaafb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+//example//
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signature.txt
new file mode 100644
index 00000000..edbcc0d7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+87cca117541a147f6df867677d98a7d80dff226d2bfca9e4ffa899665623c7e5
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..4cc12ddb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET //example// HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=87cca117541a147f6df867677d98a7d80dff226d2bfca9e4ffa899665623c7e5
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..3eba3905
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+528ec3105ee1f34ab014bb0a1a45da0ed2742a4fea3555149e5b4d5d201eb240
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/request.txt
new file mode 100644
index 00000000..12e09319
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-slashes-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET //example// HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-canonical-request.txt
new file mode 100644
index 00000000..124a7096
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example%20space/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signature.txt
new file mode 100644
index 00000000..f63892bb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signature.txt
@@ -0,0 +1 @@
+652487583200325589f1fba4c7e578f72c47cb61beeca81406b39ddec1366741
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signed-request.txt
new file mode 100644
index 00000000..19cd5cb5
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example space/ HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=652487583200325589f1fba4c7e578f72c47cb61beeca81406b39ddec1366741
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-string-to-sign.txt
new file mode 100644
index 00000000..a633f0c0
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+63ee75631ed7234ae61b5f736dfc7754cdccfedbff4b5128a915706ee9390d86
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-normalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/request.txt
new file mode 100644
index 00000000..ab509ab7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-normalized/request.txt
@@ -0,0 +1,2 @@
+GET /example space/ HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/context.json b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/context.json
new file mode 100644
index 00000000..7bee5c78
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": false,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-canonical-request.txt
new file mode 100644
index 00000000..124a7096
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/example%20space/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signature.txt
new file mode 100644
index 00000000..f63892bb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signature.txt
@@ -0,0 +1 @@
+652487583200325589f1fba4c7e578f72c47cb61beeca81406b39ddec1366741
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signed-request.txt
new file mode 100644
index 00000000..19cd5cb5
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /example space/ HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=652487583200325589f1fba4c7e578f72c47cb61beeca81406b39ddec1366741
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-string-to-sign.txt
new file mode 100644
index 00000000..a633f0c0
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+63ee75631ed7234ae61b5f736dfc7754cdccfedbff4b5128a915706ee9390d86
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/request.txt b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/request.txt
new file mode 100644
index 00000000..ab509ab7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-space-unnormalized/request.txt
@@ -0,0 +1,2 @@
+GET /example space/ HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/context.json b/vk-registry/src/s3/testdata/sigv4/get-unreserved/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-canonical-request.txt
new file mode 100644
index 00000000..8af54df2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signature.txt
new file mode 100644
index 00000000..e5033549
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signature.txt
@@ -0,0 +1 @@
+07ef7494c76fa4850883e2b006601f940f8a34d404d0cfa977f52a65bbf5f24f
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signed-request.txt
new file mode 100644
index 00000000..43678920
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=07ef7494c76fa4850883e2b006601f940f8a34d404d0cfa977f52a65bbf5f24f
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-string-to-sign.txt
new file mode 100644
index 00000000..e9dc5414
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+6a968768eefaa713e2a6b16b589a8ea192661f098f37349f4e2c0082757446f9
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-unreserved/request.txt b/vk-registry/src/s3/testdata/sigv4/get-unreserved/request.txt
new file mode 100644
index 00000000..a149694b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-unreserved/request.txt
@@ -0,0 +1,2 @@
+GET /-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/context.json b/vk-registry/src/s3/testdata/sigv4/get-utf8/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-canonical-request.txt
new file mode 100644
index 00000000..5d4b9f61
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/%E1%88%B4
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signature.txt
new file mode 100644
index 00000000..9a136766
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signature.txt
@@ -0,0 +1 @@
+8318018e0b0f223aa2bbf98705b62bb787dc9c0e678f255a891fd03141be5d85
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signed-request.txt
new file mode 100644
index 00000000..5aaf47c3
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /ሴ HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=8318018e0b0f223aa2bbf98705b62bb787dc9c0e678f255a891fd03141be5d85
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-string-to-sign.txt
new file mode 100644
index 00000000..5edc8f45
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+2a0a97d02205e45ce2e994789806b19270cfbbb0921b278ccf58f5249ac42102
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-utf8/request.txt b/vk-registry/src/s3/testdata/sigv4/get-utf8/request.txt
new file mode 100644
index 00000000..9e273f69
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-utf8/request.txt
@@ -0,0 +1,2 @@
+GET /ሴ HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-canonical-request.txt
new file mode 100644
index 00000000..c6cdceda
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+Param1=value1
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signature.txt
new file mode 100644
index 00000000..d7f1c1c9
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signature.txt
@@ -0,0 +1 @@
+a67d582fa61cc504c4bae71f336f98b97f1ea3c7a6bfe1b6e45aec72011b9aeb
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signed-request.txt
new file mode 100644
index 00000000..1c607902
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=a67d582fa61cc504c4bae71f336f98b97f1ea3c7a6bfe1b6e45aec72011b9aeb
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-string-to-sign.txt
new file mode 100644
index 00000000..c4ed216c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+1e24db194ed7d0eec2de28d7369675a243488e08526e8c1c73571282f7c517ab
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/request.txt
new file mode 100644
index 00000000..f4a03bb0
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-empty-query-key/request.txt
@@ -0,0 +1,2 @@
+GET /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-canonical-request.txt
new file mode 100644
index 00000000..0c8ba21f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+%E1%88%B4=Value1&Param=Value2&Param-3=Value3
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signature.txt
new file mode 100644
index 00000000..9ab65edb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signature.txt
@@ -0,0 +1 @@
+371d3713e185cc334048618a97f809c9ffe339c62934c032af5a0e595648fcac
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signed-request.txt
new file mode 100644
index 00000000..0bcdf987
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /?Param-3=Value3&Param=Value2&%E1%88%B4=Value1 HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=371d3713e185cc334048618a97f809c9ffe339c62934c032af5a0e595648fcac
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-string-to-sign.txt
new file mode 100644
index 00000000..bf674ad6
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+868294f5c38bd141c4972a373a76654f1418a8e4fc18b2e7903ae45e8ae0ec71
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/request.txt
new file mode 100644
index 00000000..368c6e3d
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-encoded/request.txt
@@ -0,0 +1,2 @@
+GET /?Param-3=Value3&Param=Value2&%E1%88%B4=Value1 HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-canonical-request.txt
new file mode 100644
index 00000000..8ae02cd6
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+Param1=value1&Param2=value2
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signature.txt
new file mode 100644
index 00000000..6a8cb9d1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signature.txt
@@ -0,0 +1 @@
+b97d918cfa904a5beff61c982a1b6f458b799221646efd99d3219ec94cdf2500
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signed-request.txt
new file mode 100644
index 00000000..f78a9d2f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /?Param2=value2&Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=b97d918cfa904a5beff61c982a1b6f458b799221646efd99d3219ec94cdf2500
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-string-to-sign.txt
new file mode 100644
index 00000000..f773de59
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+816cd5b414d056048ba4f7c5386d6e0533120fb1fcfa93762cf0fc39e2cf19e0
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/request.txt
new file mode 100644
index 00000000..1158ac4e
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-order-key-case/request.txt
@@ -0,0 +1,2 @@
+GET /?Param2=value2&Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-canonical-request.txt
new file mode 100644
index 00000000..5249be3b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signature.txt
new file mode 100644
index 00000000..876a64b9
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signature.txt
@@ -0,0 +1 @@
+9c3e54bfcdf0b19771a7f523ee5669cdf59bc7cc0884027167c21bb143a40197
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signed-request.txt
new file mode 100644
index 00000000..9d0d9932
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /?-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=9c3e54bfcdf0b19771a7f523ee5669cdf59bc7cc0884027167c21bb143a40197
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-string-to-sign.txt
new file mode 100644
index 00000000..24a97d20
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+c30d4703d9f799439be92736156d47ccfb2d879ddf56f5befa6d1d6aab979177
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/request.txt
new file mode 100644
index 00000000..36b2fe3e
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query-unreserved/request.txt
@@ -0,0 +1,2 @@
+GET /?-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz=-._~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signed-request.txt
new file mode 100644
index 00000000..36b86e79
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/request.txt
new file mode 100644
index 00000000..e659c3be
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-query/request.txt
@@ -0,0 +1,2 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-canonical-request.txt
new file mode 100644
index 00000000..a835c9e4
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+%E1%88%B4=bar
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signature.txt
new file mode 100644
index 00000000..19a2cc99
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signature.txt
@@ -0,0 +1 @@
+2cdec8eed098649ff3a119c94853b13c643bcf08f8b0a1d91e12c9027818dd04
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signed-request.txt
new file mode 100644
index 00000000..acb13eeb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET /?ሴ=bar HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=2cdec8eed098649ff3a119c94853b13c643bcf08f8b0a1d91e12c9027818dd04
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-string-to-sign.txt
new file mode 100644
index 00000000..51ee71b7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+eb30c5bed55734080471a834cc727ae56beb50e5f39d1bff6d0d38cb192a7073
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/request.txt
new file mode 100644
index 00000000..aff333aa
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-utf8-query/request.txt
@@ -0,0 +1,2 @@
+GET /?ሴ=bar HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/context.json
new file mode 100644
index 00000000..a334e18c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/context.json
@@ -0,0 +1,13 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+        "token": "6e86291e8372ff2a2260956d9b8aae1d763fbf315fa00fa31553b73ebf194267"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-canonical-request.txt
new file mode 100644
index 00000000..ccacdeb4
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-canonical-request.txt
@@ -0,0 +1,9 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+x-amz-security-token:6e86291e8372ff2a2260956d9b8aae1d763fbf315fa00fa31553b73ebf194267
+
+host;x-amz-date;x-amz-security-token
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signature.txt
new file mode 100644
index 00000000..083e30d5
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signature.txt
@@ -0,0 +1 @@
+07ec1639c89043aa0e3e2de82b96708f198cceab042d4a97044c66dd9f74e7f8
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signed-request.txt
new file mode 100644
index 00000000..52879328
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-signed-request.txt
@@ -0,0 +1,6 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Security-Token:6e86291e8372ff2a2260956d9b8aae1d763fbf315fa00fa31553b73ebf194267
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=07ec1639c89043aa0e3e2de82b96708f198cceab042d4a97044c66dd9f74e7f8
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-string-to-sign.txt
new file mode 100644
index 00000000..742b880c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+067b36aa60031588cea4a4cde1f21215227a047690c72247f1d70b32fbbfad2b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/request.txt
new file mode 100644
index 00000000..e659c3be
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla-with-session-token/request.txt
@@ -0,0 +1,2 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/context.json b/vk-registry/src/s3/testdata/sigv4/get-vanilla/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-canonical-request.txt
new file mode 100644
index 00000000..ed91561f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-canonical-request.txt
@@ -0,0 +1,8 @@
+GET
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signature.txt
new file mode 100644
index 00000000..87f295fb
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signature.txt
@@ -0,0 +1 @@
+5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signed-request.txt
new file mode 100644
index 00000000..36b86e79
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-signed-request.txt
@@ -0,0 +1,5 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31
+
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-string-to-sign.txt
new file mode 100644
index 00000000..b187649c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+bb579772317eb040ac9ed261061d46c1f17a8133879d6129b6e1c25292927e63
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/get-vanilla/request.txt b/vk-registry/src/s3/testdata/sigv4/get-vanilla/request.txt
new file mode 100644
index 00000000..e659c3be
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/get-vanilla/request.txt
@@ -0,0 +1,2 @@
+GET / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/context.json b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-canonical-request.txt
new file mode 100644
index 00000000..5c3a9434
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-canonical-request.txt
@@ -0,0 +1,8 @@
+POST
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signature.txt
new file mode 100644
index 00000000..629487fd
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signature.txt
@@ -0,0 +1 @@
+5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signed-request.txt
new file mode 100644
index 00000000..0d99b1c8
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-signed-request.txt
@@ -0,0 +1,5 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-string-to-sign.txt
new file mode 100644
index 00000000..a6367039
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+553f88c9e4d10fc9e109e2aeb65f030801b70c2f6468faca261d401ae622fc87
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-case/request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/request.txt
new file mode 100644
index 00000000..3f0a82a2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-case/request.txt
@@ -0,0 +1,2 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/context.json b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-canonical-request.txt
new file mode 100644
index 00000000..ebe943e8
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-canonical-request.txt
@@ -0,0 +1,9 @@
+POST
+/
+
+host:example.amazonaws.com
+my-header1:value1
+x-amz-date:20150830T123600Z
+
+host;my-header1;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signature.txt
new file mode 100644
index 00000000..e4e64285
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signature.txt
@@ -0,0 +1 @@
+c5410059b04c1ee005303aed430f6e6645f61f4dc9e1461ec8f8916fdf18852c
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signed-request.txt
new file mode 100644
index 00000000..e3778f5f
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-signed-request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value1
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;x-amz-date, Signature=c5410059b04c1ee005303aed430f6e6645f61f4dc9e1461ec8f8916fdf18852c
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-string-to-sign.txt
new file mode 100644
index 00000000..eb663626
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+9368318c2967cf6de74404b30c65a91e8f6253e0a8659d6d5319f1a812f87d65
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/request.txt
new file mode 100644
index 00000000..917720ef
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-key-sort/request.txt
@@ -0,0 +1,3 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:value1
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/context.json b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-canonical-request.txt
new file mode 100644
index 00000000..af824c88
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-canonical-request.txt
@@ -0,0 +1,9 @@
+POST
+/
+
+host:example.amazonaws.com
+my-header1:VALUE1
+x-amz-date:20150830T123600Z
+
+host;my-header1;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signature.txt
new file mode 100644
index 00000000..bb3809cf
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signature.txt
@@ -0,0 +1 @@
+cdbc9802e29d2942e5e10b5bccfdd67c5f22c7c4e8ae67b53629efa58b974b7d
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signed-request.txt
new file mode 100644
index 00000000..10f67615
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-signed-request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:VALUE1
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;my-header1;x-amz-date, Signature=cdbc9802e29d2942e5e10b5bccfdd67c5f22c7c4e8ae67b53629efa58b974b7d
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-string-to-sign.txt
new file mode 100644
index 00000000..40062c79
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+d51ced243e649e3de6ef63afbbdcbca03131a21a7103a1583706a64618606a93
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-header-value-case/request.txt b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/request.txt
new file mode 100644
index 00000000..5f14c915
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-header-value-case/request.txt
@@ -0,0 +1,3 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+My-Header1:VALUE1
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/context.json b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/context.json
new file mode 100644
index 00000000..8f1d5ced
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/context.json
@@ -0,0 +1,14 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+        "token": "AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA=="
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z",
+    "omit_session_token": true
+}
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-canonical-request.txt
new file mode 100644
index 00000000..5c3a9434
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-canonical-request.txt
@@ -0,0 +1,8 @@
+POST
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signature.txt
new file mode 100644
index 00000000..629487fd
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signature.txt
@@ -0,0 +1 @@
+5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signed-request.txt
new file mode 100644
index 00000000..f96ff9e1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-signed-request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Security-Token:AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-string-to-sign.txt
new file mode 100644
index 00000000..a6367039
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+553f88c9e4d10fc9e109e2aeb65f030801b70c2f6468faca261d401ae622fc87
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/request.txt
new file mode 100644
index 00000000..3f0a82a2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-after/request.txt
@@ -0,0 +1,2 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/context.json b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/context.json
new file mode 100644
index 00000000..5187392c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/context.json
@@ -0,0 +1,14 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+        "token": "AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA=="
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z",
+    "omit_session_token": false
+}
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-canonical-request.txt
new file mode 100644
index 00000000..1d5a462e
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-canonical-request.txt
@@ -0,0 +1,9 @@
+POST
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+x-amz-security-token:AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
+
+host;x-amz-date;x-amz-security-token
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signature.txt
new file mode 100644
index 00000000..85a7c29c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signature.txt
@@ -0,0 +1 @@
+85d96828115b5dc0cfc3bd16ad9e210dd772bbebba041836c64533a82be05ead
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signed-request.txt
new file mode 100644
index 00000000..4d0b1435
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-signed-request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Security-Token:AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=85d96828115b5dc0cfc3bd16ad9e210dd772bbebba041836c64533a82be05ead
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-string-to-sign.txt
new file mode 100644
index 00000000..bc39ccfc
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+c237e1b440d4c63c32ca95b5b99481081cb7b13c7e40434868e71567c1a882f6
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/request.txt b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/request.txt
new file mode 100644
index 00000000..3f0a82a2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-sts-header-before/request.txt
@@ -0,0 +1,2 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/context.json b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-canonical-request.txt
new file mode 100644
index 00000000..f5058d43
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-canonical-request.txt
@@ -0,0 +1,8 @@
+POST
+/
+Param1=value1
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signature.txt
new file mode 100644
index 00000000..80ed4337
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signature.txt
@@ -0,0 +1 @@
+28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signed-request.txt
new file mode 100644
index 00000000..4e614f88
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-signed-request.txt
@@ -0,0 +1,5 @@
+POST /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-string-to-sign.txt
new file mode 100644
index 00000000..ca7cc661
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+9d659678c1756bb3113e2ce898845a0a79dbbc57b740555917687f1b3340fbbd
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/request.txt
new file mode 100644
index 00000000..c9d6e5df
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-empty-query-value/request.txt
@@ -0,0 +1,2 @@
+POST /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/context.json b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-canonical-request.txt
new file mode 100644
index 00000000..f5058d43
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-canonical-request.txt
@@ -0,0 +1,8 @@
+POST
+/
+Param1=value1
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signature.txt
new file mode 100644
index 00000000..80ed4337
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signature.txt
@@ -0,0 +1 @@
+28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signed-request.txt
new file mode 100644
index 00000000..4e614f88
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-signed-request.txt
@@ -0,0 +1,5 @@
+POST /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-string-to-sign.txt
new file mode 100644
index 00000000..ca7cc661
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+9d659678c1756bb3113e2ce898845a0a79dbbc57b740555917687f1b3340fbbd
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/request.txt
new file mode 100644
index 00000000..c9d6e5df
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla-query/request.txt
@@ -0,0 +1,2 @@
+POST /?Param1=value1 HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/context.json b/vk-registry/src/s3/testdata/sigv4/post-vanilla/context.json
new file mode 100644
index 00000000..0468d800
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": false,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-canonical-request.txt
new file mode 100644
index 00000000..5c3a9434
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-canonical-request.txt
@@ -0,0 +1,8 @@
+POST
+/
+
+host:example.amazonaws.com
+x-amz-date:20150830T123600Z
+
+host;x-amz-date
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signature.txt
new file mode 100644
index 00000000..629487fd
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signature.txt
@@ -0,0 +1 @@
+5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signed-request.txt
new file mode 100644
index 00000000..0d99b1c8
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-signed-request.txt
@@ -0,0 +1,5 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
+X-Amz-Date:20150830T123600Z
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=5da7c1a2acd57cee7505fc6676e4e544621c30862966e37dddb68e92efbe5d6b
+
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-string-to-sign.txt
new file mode 100644
index 00000000..a6367039
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+553f88c9e4d10fc9e109e2aeb65f030801b70c2f6468faca261d401ae622fc87
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-vanilla/request.txt b/vk-registry/src/s3/testdata/sigv4/post-vanilla/request.txt
new file mode 100644
index 00000000..3f0a82a2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-vanilla/request.txt
@@ -0,0 +1,2 @@
+POST / HTTP/1.1
+Host:example.amazonaws.com
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/context.json b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/context.json
new file mode 100644
index 00000000..0db1df10
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": true,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-canonical-request.txt
new file mode 100644
index 00000000..c218fdf2
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-canonical-request.txt
@@ -0,0 +1,11 @@
+POST
+/
+
+content-length:13
+content-type:application/x-www-form-urlencoded; charset=utf-8
+host:example.amazonaws.com
+x-amz-content-sha256:9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
+x-amz-date:20150830T123600Z
+
+content-length;content-type;host;x-amz-content-sha256;x-amz-date
+9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signature.txt
new file mode 100644
index 00000000..836aa8b9
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signature.txt
@@ -0,0 +1 @@
+328d1b9eaadca9f5818ef05e8392801e091653bafec24fcab71e7344e7f51422
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signed-request.txt
new file mode 100644
index 00000000..9262d53b
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-signed-request.txt
@@ -0,0 +1,9 @@
+POST / HTTP/1.1
+Content-Type:application/x-www-form-urlencoded; charset=utf-8
+Host:example.amazonaws.com
+Content-Length:13
+X-Amz-Date:20150830T123600Z
+x-amz-content-sha256:9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=328d1b9eaadca9f5818ef05e8392801e091653bafec24fcab71e7344e7f51422
+
+Param1=value1
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-string-to-sign.txt
new file mode 100644
index 00000000..ddbdccc4
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+a89f1a5b53e37702ee6363ce1da3ce8f54386f3c8f352ae652153c2982a0bc4d
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/request.txt
new file mode 100644
index 00000000..8289eaa5
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded-parameters/request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Content-Type:application/x-www-form-urlencoded; charset=utf-8
+Host:example.amazonaws.com
+Content-Length:13
+
+Param1=value1
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/context.json b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/context.json
new file mode 100644
index 00000000..0db1df10
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/context.json
@@ -0,0 +1,12 @@
+{
+    "credentials": {
+        "access_key_id": "AKIDEXAMPLE",
+        "secret_access_key": "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY"
+    },
+    "expiration_in_seconds": 3600,
+    "normalize": true,
+    "region": "us-east-1",
+    "service": "service",
+    "sign_body": true,
+    "timestamp": "2015-08-30T12:36:00Z"
+}
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-canonical-request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-canonical-request.txt
new file mode 100644
index 00000000..4d116a56
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-canonical-request.txt
@@ -0,0 +1,11 @@
+POST
+/
+
+content-length:13
+content-type:application/x-www-form-urlencoded
+host:example.amazonaws.com
+x-amz-content-sha256:9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
+x-amz-date:20150830T123600Z
+
+content-length;content-type;host;x-amz-content-sha256;x-amz-date
+9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signature.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signature.txt
new file mode 100644
index 00000000..0d2ac374
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signature.txt
@@ -0,0 +1 @@
+d3875051da38690788ef43de4db0d8f280229d82040bfac253562e56c3f20e0b
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signed-request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signed-request.txt
new file mode 100644
index 00000000..bd5e49c7
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-signed-request.txt
@@ -0,0 +1,9 @@
+POST / HTTP/1.1
+Content-Type:application/x-www-form-urlencoded
+Host:example.amazonaws.com
+Content-Length:13
+X-Amz-Date:20150830T123600Z
+x-amz-content-sha256:9095672bbd1f56dfc5b65f3e153adc8731a4a654192329106275f4c7b24d0b6e
+Authorization:AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=d3875051da38690788ef43de4db0d8f280229d82040bfac253562e56c3f20e0b
+
+Param1=value1
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-string-to-sign.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-string-to-sign.txt
new file mode 100644
index 00000000..f1c599c1
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/header-string-to-sign.txt
@@ -0,0 +1,4 @@
+AWS4-HMAC-SHA256
+20150830T123600Z
+20150830/us-east-1/service/aws4_request
+b1edd1d03544c25390e32085d55b57acc9a3961bb59415ff86c45c3d89d16cfb
\ No newline at end of file
diff --git a/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/request.txt b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/request.txt
new file mode 100644
index 00000000..760b2d3c
--- /dev/null
+++ b/vk-registry/src/s3/testdata/sigv4/post-x-www-form-urlencoded/request.txt
@@ -0,0 +1,6 @@
+POST / HTTP/1.1
+Content-Type:application/x-www-form-urlencoded
+Host:example.amazonaws.com
+Content-Length:13
+
+Param1=value1
\ No newline at end of file
diff --git a/vk-registry/src/s3/xml.rs b/vk-registry/src/s3/xml.rs
new file mode 100644
index 00000000..6217ecf7
--- /dev/null
+++ b/vk-registry/src/s3/xml.rs
@@ -0,0 +1,74 @@
+//! The XML S3 answers in: the `Error` document every refusal carries.
+
+use bytes::Bytes;
+use hyper::header::CONTENT_TYPE;
+use hyper::{Response, StatusCode};
+
+use crate::{Body, body_of};
+
+/// Escape a string for XML text: [`crate::html_escape`]'s five characters are XML's too.
+/// What reaches it is a request path, a header value or a message of ours, none of which
+/// can hold a control character XML 1.0 has no way to write.
+pub(crate) fn escape(s: &str) -> String {
+    crate::html_escape(s)
+}
+
+/// An S3 `Error` document: `code`, `message`, then each of `extra` as an element of its
+/// own (`ServerTime` and the like), the `resource` the request named and its `request_id`.
+/// Every string is escaped.
+pub(crate) fn error(
+    status: StatusCode,
+    code: &str,
+    message: &str,
+    extra: &[(&str, &str)],
+    resource: &str,
+    request_id: &str,
+) -> Response<Body> {
+    let mut body = format!(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>{}</Code><Message>{}</Message>",
+        escape(code),
+        escape(message)
+    );
+    for (name, value) in extra {
+        body.push_str(&format!("<{name}>{}</{name}>", escape(value)));
+    }
+    body.push_str(&format!(
+        "<Resource>{}</Resource><RequestId>{}</RequestId></Error>",
+        escape(resource),
+        escape(request_id)
+    ));
+    Response::builder()
+        .status(status)
+        .header(CONTENT_TYPE, "application/xml")
+        .body(body_of(Bytes::from(body)))
+        .expect("building an S3 error")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use http_body_util::BodyExt as _;
+
+    #[tokio::test]
+    async fn every_caller_string_is_escaped() {
+        let resp = error(
+            StatusCode::FORBIDDEN,
+            "AccessDenied",
+            "a <b> & 'c' \"d\"",
+            &[("RequestTime", "<t>")],
+            "/s3/</Resource><x>",
+            "0123456789abcdef",
+        );
+        assert_eq!(resp.status(), 403);
+        assert_eq!(resp.headers()[CONTENT_TYPE], "application/xml");
+        let body = resp.into_body().collect().await.unwrap().to_bytes();
+        assert_eq!(
+            std::str::from_utf8(&body).unwrap(),
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>AccessDenied</Code>\
+             <Message>a &lt;b&gt; &amp; &#39;c&#39; &quot;d&quot;</Message>\
+             <RequestTime>&lt;t&gt;</RequestTime>\
+             <Resource>/s3/&lt;/Resource&gt;&lt;x&gt;</Resource>\
+             <RequestId>0123456789abcdef</RequestId></Error>"
+        );
+    }
+}
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
new file mode 100644
index 00000000..b2ea66ef
--- /dev/null
+++ b/vk-registry/tests/s3_e2e.rs
@@ -0,0 +1,809 @@
+//! S3 over real HTTP: the gate `/s3/` requests pass, under every authentication mode the
+//! server has. SigV4 requests are signed here by a signer of the tests' own, checked against
+//! AWS's published example; responses are read off a raw socket, so a test sees exactly what
+//! a connection carries and can send a second request on it.
+
+use std::sync::Arc;
+use std::time::{Duration, SystemTime};
+
+use hmac::{KeyInit as _, Mac as _};
+use sha2::Digest as _;
+use tokio::io::{AsyncBufReadExt as _, AsyncReadExt as _, AsyncWriteExt as _, BufReader};
+use tokio::net::tcp::{OwnedReadHalf, OwnedWriteHalf};
+use vk_hub_proto::token::{Claims, Grant};
+use vk_peer::token::Signer;
+use vk_registry::accounts::{Action, Db, EmailUpdate, Scope};
+use vk_registry::auth::Auth;
+use vk_registry::config::{AuthMode, OidcSpec};
+use vk_registry::lock::LockManager;
+use vk_registry::{Authenticator, ServerConfig, ServerState, Store};
+
+const AUD: &str = "9c2f4e1a7b3d5e60f1a2b3c4d5e6f708";
+const UNSIGNED: &str = "UNSIGNED-PAYLOAD";
+
+fn tmp(tag: &str) -> std::path::PathBuf {
+    let p = std::env::temp_dir().join(format!(
+        "vk-registry-s3-e2e-{tag}-{}-{:?}",
+        std::process::id(),
+        SystemTime::now()
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    let _ = std::fs::remove_dir_all(&p);
+    std::fs::create_dir_all(&p).unwrap();
+    p
+}
+
+/// Run serve_on in a separate thread with an ephemeral listener; the address it took.
+fn spawn(state: Arc<ServerState>) -> String {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    listener.set_nonblocking(true).unwrap();
+    let addr = listener.local_addr().unwrap();
+    std::thread::spawn(move || {
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        rt.block_on(async move {
+            let l = tokio::net::TcpListener::from_std(listener).unwrap();
+            let _ = vk_registry::serve_on(l, state).await;
+        });
+    });
+    addr.to_string()
+}
+
+/// A server with no credential configured; `s3` as given.
+fn open_state(dir: &std::path::Path, s3: bool) -> Arc<ServerState> {
+    let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), dir.join("store"));
+    cfg.s3 = s3;
+    Arc::new(cfg.into_state().expect("a local config starts"))
+}
+
+/// A shared-secret server with `auth`, taking hub tokens signed by a fresh key.
+fn shared(dir: &std::path::Path, auth: Auth, s3: bool) -> (Arc<ServerState>, Signer) {
+    let signer = Signer::generate(&dir.join("token-key")).unwrap();
+    let state = Arc::new(ServerState {
+        store: Arc::new(Store::new(dir.join("store")).unwrap()),
+        upstreams: vec![],
+        locks: LockManager::new(),
+        auth: Authenticator::Shared(auth),
+        tls: None,
+        webdav: true,
+        s3,
+        tokens: Default::default(),
+        handover: Default::default(),
+    });
+    state.tokens.open(AUD, vec![signer.public().clone()]);
+    (state, signer)
+}
+
+/// Accounts-mode state built the way `serve` builds it, as in `dav_e2e.rs`.
+fn accounts_state(dir: &std::path::Path) -> Arc<ServerState> {
+    let secret = dir.join("oidc-secret");
+    std::fs::write(&secret, "s3cr3t\n").unwrap();
+    let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), dir.join("store"));
+    cfg.mode = AuthMode::Accounts;
+    cfg.oidc = Some(OidcSpec {
+        issuer: "https://login.example.com".to_string(),
+        client_id: "vk-registry".to_string(),
+        client_secret_file: secret,
+        public_url: "https://registry.internal".to_string(),
+    });
+    Arc::new(cfg.into_state().expect("a valid accounts config starts"))
+}
+
+fn accounts_db(state: &ServerState) -> &Db {
+    match &state.auth {
+        Authenticator::Accounts { db, .. } => db,
+        _ => panic!("not accounts mode"),
+    }
+}
+
+fn hub_claims(aud: &str, iat: u64, exp: u64) -> Claims {
+    Claims {
+        kid: String::new(),
+        aud: aud.into(),
+        sub: "job:j1".into(),
+        jti: vk_peer::token::new_jti().unwrap(),
+        pipeline: None,
+        iat,
+        exp,
+        grants: vec![Grant {
+            prefix: "p/gl/42".into(),
+            read: true,
+            write: true,
+            lock: false,
+        }],
+    }
+}
+
+// ---- the test-side SigV4 signer ----
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+fn hmac(key: &[u8], data: &str) -> Vec<u8> {
+    let mut mac = hmac::Hmac::<sha2::Sha256>::new_from_slice(key).unwrap();
+    mac.update(data.as_bytes());
+    mac.finalize().into_bytes().to_vec()
+}
+
+/// `secs` since the epoch as SigV4's `YYYYMMDDTHHMMSSZ`.
+fn stamp(secs: u64) -> String {
+    let (days, rem) = ((secs / 86_400) as i64, secs % 86_400);
+    let z = days + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z - era * 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = yoe + era * 400 + i64::from(m <= 2);
+    let (h, mi, s) = (rem / 3600, rem / 60 % 60, rem % 60);
+    format!("{y:04}{m:02}{d:02}T{h:02}{mi:02}{s:02}Z")
+}
+
+/// The `Authorization` value for a request with an already canonical `query` and `headers`
+/// (lowercase names, sorted, every one signed), signed by `id` with `secret` at `at`.
+fn authorization(
+    method: &str,
+    path: &str,
+    query: &str,
+    headers: &[(&str, &str)],
+    payload: &str,
+    (id, secret): (&str, &str),
+    at: &str,
+) -> String {
+    let date = &at[..8];
+    let scope = format!("{date}/us-east-1/s3/aws4_request");
+    let names: Vec<&str> = headers.iter().map(|(n, _)| *n).collect();
+    let mut canonical = format!("{method}\n{path}\n{query}\n");
+    for (n, v) in headers {
+        canonical.push_str(&format!("{n}:{}\n", v.trim()));
+    }
+    canonical.push_str(&format!("\n{}\n{payload}", names.join(";")));
+    let sts = format!(
+        "AWS4-HMAC-SHA256\n{at}\n{scope}\n{}",
+        hex(&sha2::Sha256::digest(canonical.as_bytes()))
+    );
+    let mut key = hmac(format!("AWS4{secret}").as_bytes(), date);
+    for part in ["us-east-1", "s3", "aws4_request"] {
+        key = hmac(&key, part);
+    }
+    format!(
+        "AWS4-HMAC-SHA256 Credential={id}/{scope}, SignedHeaders={}, Signature={}",
+        names.join(";"),
+        hex(&hmac(&key, &sts))
+    )
+}
+
+/// The signer reproduces AWS's GET Object example, signature and all.
+#[test]
+fn the_test_signer_reproduces_the_aws_get_object_example() {
+    let empty = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+    let at = "20130524T000000Z";
+    let auth = authorization(
+        "GET",
+        "/test.txt",
+        "",
+        &[
+            ("host", "examplebucket.s3.amazonaws.com"),
+            ("range", "bytes=0-9"),
+            ("x-amz-content-sha256", empty),
+            ("x-amz-date", at),
+        ],
+        empty,
+        (
+            "AKIAIOSFODNN7EXAMPLE",
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        ),
+        at,
+    );
+    assert_eq!(
+        auth,
+        "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/s3/aws4_request, \
+         SignedHeaders=host;range;x-amz-content-sha256;x-amz-date, \
+         Signature=f0e8bdb87c964420e857bd35b5d6ed310bd44f0170aba48dd91039c6036bdb41"
+    );
+    assert_eq!(stamp(1_369_353_600), at);
+}
+
+// ---- requests over a raw connection ----
+
+/// One request: its line, its headers beyond `Host`, its body.
+struct Req {
+    method: &'static str,
+    path: String,
+    query: String,
+    headers: Vec<(String, String)>,
+    body: Vec<u8>,
+}
+
+impl Req {
+    fn new(method: &'static str, path: &str) -> Self {
+        Req {
+            method,
+            path: path.to_string(),
+            query: String::new(),
+            headers: Vec::new(),
+            body: Vec::new(),
+        }
+    }
+
+    fn query(mut self, q: &str) -> Self {
+        self.query = q.to_string();
+        self
+    }
+
+    fn header(mut self, name: &str, value: &str) -> Self {
+        self.headers.push((name.to_string(), value.to_string()));
+        self
+    }
+
+    fn body(mut self, body: Vec<u8>) -> Self {
+        self.body = body;
+        self
+    }
+
+    /// Signed for `host` by `key` (id, secret), `skew` seconds off now (UNSIGNED-PAYLOAD).
+    fn signed(self, host: &str, key: (&str, &str), skew: i64) -> Self {
+        let at = stamp(vk_peer::now_secs().saturating_add_signed(skew));
+        let auth = authorization(
+            self.method,
+            &self.path,
+            &self.query,
+            &[
+                ("host", host),
+                ("x-amz-content-sha256", UNSIGNED),
+                ("x-amz-date", &at),
+            ],
+            UNSIGNED,
+            key,
+            &at,
+        );
+        self.header("x-amz-content-sha256", UNSIGNED)
+            .header("x-amz-date", &at)
+            .header("Authorization", &auth)
+    }
+
+    fn head(&self, host: &str) -> String {
+        let target = if self.query.is_empty() {
+            self.path.clone()
+        } else {
+            format!("{}?{}", self.path, self.query)
+        };
+        let mut head = format!("{} {target} HTTP/1.1\r\nHost: {host}\r\n", self.method);
+        for (n, v) in &self.headers {
+            head.push_str(&format!("{n}: {v}\r\n"));
+        }
+        head.push_str(&format!("Content-Length: {}\r\n\r\n", self.body.len()));
+        head
+    }
+}
+
+/// A response: its status, headers (names lowercase) and body.
+#[derive(Debug)]
+struct Resp {
+    status: u16,
+    headers: Vec<(String, String)>,
+    body: String,
+}
+
+impl Resp {
+    fn header(&self, name: &str) -> Option<&str> {
+        self.headers
+            .iter()
+            .find(|(n, _)| n == name)
+            .map(|(_, v)| v.as_str())
+    }
+
+    /// The status, the S3 headers every `/s3/` answer carries, and for an error its XML
+    /// `Code` and the request id the header names.
+    #[track_caller]
+    fn is(&self, status: u16, code: &str) -> &Self {
+        assert_eq!(self.status, status, "{self:?}");
+        let id = self.header("x-amz-request-id").expect("a request id");
+        assert!(
+            id.len() == 16 && id.bytes().all(|b| b.is_ascii_hexdigit()),
+            "{id}"
+        );
+        assert_eq!(self.header("x-content-type-options"), Some("nosniff"));
+        assert_eq!(self.header("content-type"), Some("application/xml"));
+        assert!(
+            self.body
+                .starts_with("<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>"),
+            "{}",
+            self.body
+        );
+        assert!(
+            self.body.contains(&format!("<Code>{code}</Code>")),
+            "{}",
+            self.body
+        );
+        assert!(
+            self.body
+                .contains(&format!("<RequestId>{id}</RequestId></Error>")),
+            "{}",
+            self.body
+        );
+        self
+    }
+}
+
+/// A kept-alive connection to the server.
+struct Conn {
+    host: String,
+    read: BufReader<OwnedReadHalf>,
+    write: Option<OwnedWriteHalf>,
+}
+
+impl Conn {
+    async fn open(host: &str) -> Self {
+        let sock = tokio::net::TcpStream::connect(host).await.unwrap();
+        let (read, write) = sock.into_split();
+        Conn {
+            host: host.to_string(),
+            read: BufReader::new(read),
+            write: Some(write),
+        }
+    }
+
+    async fn send(&mut self, req: &Req) -> Resp {
+        let write = self.write.as_mut().expect("the connection's writing half");
+        write
+            .write_all(req.head(&self.host).as_bytes())
+            .await
+            .unwrap();
+        write.write_all(&req.body).await.unwrap();
+        self.response().await
+    }
+
+    async fn response(&mut self) -> Resp {
+        let mut line = String::new();
+        self.read.read_line(&mut line).await.unwrap();
+        let status = line
+            .split_whitespace()
+            .nth(1)
+            .and_then(|s| s.parse().ok())
+            .unwrap_or_else(|| panic!("no status in {line:?}"));
+        let mut headers = Vec::new();
+        loop {
+            line.clear();
+            self.read.read_line(&mut line).await.unwrap();
+            let l = line.trim_end();
+            if l.is_empty() {
+                break;
+            }
+            let (n, v) = l.split_once(':').unwrap();
+            headers.push((n.to_ascii_lowercase(), v.trim().to_string()));
+        }
+        let len: usize = headers
+            .iter()
+            .find(|(n, _)| n == "content-length")
+            .map_or(0, |(_, v)| v.parse().unwrap());
+        let mut body = vec![0; len];
+        self.read.read_exact(&mut body).await.unwrap();
+        Resp {
+            status,
+            headers,
+            body: String::from_utf8(body).unwrap(),
+        }
+    }
+
+    /// Whether the server closed the connection: end of stream, or a reset.
+    async fn closed(&mut self) -> bool {
+        let mut byte = [0u8; 1];
+        match tokio::time::timeout(Duration::from_secs(10), self.read.read(&mut byte))
+            .await
+            .expect("the server closes or answers")
+        {
+            Ok(n) => n == 0,
+            Err(_) => true,
+        }
+    }
+}
+
+/// One request on a connection of its own.
+async fn send(host: &str, req: Req) -> Resp {
+    Conn::open(host).await.send(&req).await
+}
+
+/// Every SigV4 refusal a server with credentials answers before knowing the caller, with
+/// the key it takes as `good`: each one's answer, over a mode's `host`.
+async fn sigv4_refusals(host: &str, good: (&str, &str)) {
+    let get = || Req::new("GET", "/s3/b/k");
+    // An id it does not know, whose signature is consistent with it.
+    send(host, get().signed(host, ("AKIDNOTAKEY", "AKIDNOTAKEY"), 0))
+        .await
+        .is(403, "InvalidAccessKeyId");
+    // A good id, signed with another secret.
+    let resp = send(host, get().signed(host, (good.0, "not-the-secret"), 0)).await;
+    resp.is(403, "SignatureDoesNotMatch");
+    assert!(
+        resp.body.contains("<CanonicalRequest>GET\n/s3/b/k\n"),
+        "{}",
+        resp.body
+    );
+    // A clock 15 minutes and a second off, either way.
+    for skew in [-15 * 60 - 1, 15 * 60 + 1] {
+        let resp = send(host, get().signed(host, good, skew)).await;
+        resp.is(403, "RequestTimeTooSkewed");
+        assert!(resp.body.contains("<ServerTime>"), "{}", resp.body);
+    }
+    // Presigned, and temporary credentials.
+    send(
+        host,
+        get()
+            .query("X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=00")
+            .signed(host, good, 0),
+    )
+    .await
+    .is(400, "AuthorizationQueryParametersError");
+    send(
+        host,
+        get()
+            .header("x-amz-security-token", "t")
+            .signed(host, good, 0),
+    )
+    .await
+    .is(400, "InvalidToken");
+    // A signature that does not bind the payload.
+    let at = stamp(vk_peer::now_secs());
+    let auth = authorization(
+        "GET",
+        "/s3/b/k",
+        "",
+        &[("host", host), ("x-amz-date", &at)],
+        UNSIGNED,
+        good,
+        &at,
+    );
+    send(
+        host,
+        get()
+            .header("x-amz-content-sha256", UNSIGNED)
+            .header("x-amz-date", &at)
+            .header("Authorization", &auth),
+    )
+    .await
+    .is(400, "AuthorizationHeaderMalformed");
+    // And the good key passes the gate, to find nothing yet.
+    send(host, get().signed(host, good, 0))
+        .await
+        .is(404, "NoSuchKey");
+}
+
+#[tokio::test]
+async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
+    let dir = tmp("open");
+    let host = spawn(open_state(&dir, true));
+    let get = |path: &str| Req::new("GET", path);
+    send(&host, get("/s3/b/k")).await.is(404, "NoSuchKey");
+    send(&host, get("/s3/b/k/deeper"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, get("/s3/b")).await.is(404, "NoSuchBucket");
+    send(&host, get("/s3/b/")).await.is(404, "NoSuchBucket");
+    send(&host, get("/s3/")).await.is(501, "NotImplemented");
+    send(&host, get("/s3")).await.is(501, "NotImplemented");
+    send(
+        &host,
+        Req::new("PUT", "/s3/b/k").body(b"Hello, World!".to_vec()),
+    )
+    .await
+    .is(501, "NotImplemented");
+    // Any key will do, its signature unchecked.
+    send(
+        &host,
+        get("/s3/b/k").signed(&host, ("anyone", "anything"), 0),
+    )
+    .await
+    .is(404, "NoSuchKey");
+    // The clock still is, and what is refused everywhere is refused here.
+    send(
+        &host,
+        get("/s3/b/k").signed(&host, ("anyone", "anything"), 3600),
+    )
+    .await
+    .is(403, "RequestTimeTooSkewed");
+    send(&host, get("/s3/b/k").query("X-Amz-Credential=a"))
+        .await
+        .is(400, "AuthorizationQueryParametersError");
+    send(&host, get("/s3/b/k").header("X-Amz-Security-Token", "t"))
+        .await
+        .is(400, "InvalidToken");
+}
+
+#[tokio::test]
+async fn a_shared_bearer_is_the_access_key_and_its_secret() {
+    let dir = tmp("bearer");
+    let (state, signer) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    let get = || Req::new("GET", "/s3/b/k");
+    // No credential, or a refused one: S3's 403, not the 401 challenge.
+    let resp = send(&host, get()).await;
+    resp.is(403, "AccessDenied");
+    assert_eq!(resp.header("www-authenticate"), None);
+    send(&host, get().header("Authorization", "Bearer nope"))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, get().header("Authorization", "AWS AKID:sig"))
+        .await
+        .is(403, "AccessDenied");
+    // The bearer itself still works, as on `/dav/`.
+    send(&host, get().header("Authorization", "Bearer s3cret"))
+        .await
+        .is(404, "NoSuchKey");
+    sigv4_refusals(&host, ("s3cret", "s3cret")).await;
+
+    // A hub token is a key too, signed or as a bearer; an expired one, or one for another
+    // registry, is not.
+    let now = vk_peer::now_secs();
+    let token = signer.sign(hub_claims(AUD, now - 1, now + 600)).unwrap();
+    send(&host, get().signed(&host, (&token, &token), 0))
+        .await
+        .is(404, "NoSuchKey");
+    send(
+        &host,
+        get().header("Authorization", &format!("Bearer {token}")),
+    )
+    .await
+    .is(404, "NoSuchKey");
+    send(&host, get().signed(&host, (&token, "other"), 0))
+        .await
+        .is(403, "SignatureDoesNotMatch");
+    for bad in [
+        signer
+            .sign(hub_claims(AUD, now - 7200, now - 3600))
+            .unwrap(),
+        signer
+            .sign(hub_claims(
+                "0123456789abcdef0123456789abcdef",
+                now - 1,
+                now + 600,
+            ))
+            .unwrap(),
+    ] {
+        send(&host, get().signed(&host, (&bad, &bad), 0))
+            .await
+            .is(403, "InvalidAccessKeyId");
+        send(
+            &host,
+            get().header("Authorization", &format!("Bearer {bad}")),
+        )
+        .await
+        .is(403, "AccessDenied");
+    }
+}
+
+#[tokio::test]
+async fn the_shared_basic_user_is_the_access_key_and_the_password_its_secret() {
+    let dir = tmp("basic");
+    let (state, _) = shared(
+        &dir,
+        Auth::Basic {
+            user: "ci".into(),
+            pass: "pa55".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    let get = || Req::new("GET", "/s3/b/k");
+    send(&host, get()).await.is(403, "AccessDenied");
+    sigv4_refusals(&host, ("ci", "pa55")).await;
+    // The password is no access key, alone or as its own secret.
+    send(&host, get().signed(&host, ("pa55", "pa55"), 0))
+        .await
+        .is(403, "InvalidAccessKeyId");
+    // Basic credentials still work.
+    send(&host, get().header("Authorization", "Basic Y2k6cGE1NQ=="))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, get().header("Authorization", "Basic Y2k6bm9wZQ=="))
+        .await
+        .is(403, "AccessDenied");
+}
+
+#[tokio::test]
+async fn an_api_key_is_the_access_key_and_its_secret_until_revoked_or_expired() {
+    let dir = tmp("accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let scopes = [Scope {
+        action: Action::Read,
+        repo_pattern: "files/*".to_string(),
+    }];
+    let (_, key) = db
+        .create_api_key(Some(&user.id), "s3", &scopes, None)
+        .unwrap();
+    let (revoked, revoked_key) = db
+        .create_api_key(Some(&user.id), "gone", &scopes, None)
+        .unwrap();
+    assert!(db.revoke_api_key(&user.id, &revoked.id).unwrap());
+    let past = SystemTime::now() - Duration::from_secs(60);
+    let (_, expired_key) = db
+        .create_api_key(Some(&user.id), "old", &scopes, Some(past))
+        .unwrap();
+    let host = spawn(state.clone());
+    let get = || Req::new("GET", "/s3/b/k");
+
+    send(&host, get()).await.is(403, "AccessDenied");
+    send(&host, get().header("Authorization", "Bearer vkr_nope"))
+        .await
+        .is(403, "AccessDenied");
+    send(
+        &host,
+        get().header("Authorization", &format!("Bearer {key}")),
+    )
+    .await
+    .is(404, "NoSuchKey");
+    sigv4_refusals(&host, (&key, &key)).await;
+    send(&host, get().signed(&host, ("vkr_0123", "vkr_0123"), 0))
+        .await
+        .is(403, "InvalidAccessKeyId");
+    for gone in [&revoked_key, &expired_key] {
+        send(&host, get().signed(&host, (gone, gone), 0))
+            .await
+            .is(403, "InvalidAccessKeyId");
+        send(
+            &host,
+            get().header("Authorization", &format!("Bearer {gone}")),
+        )
+        .await
+        .is(403, "AccessDenied");
+    }
+}
+
+/// A refusal before authentication reads up to 64 KiB of the body, so a write sees its answer
+/// rather than a reset, a large one while it is still sending; the connection then closes,
+/// as after any refusal of a request with a body, rather than the server reading the rest.
+/// Without a body, the connection goes on.
+#[tokio::test]
+async fn a_refused_body_is_read_up_to_64_kib() {
+    let dir = tmp("drain");
+    let (state, _) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    let put = |body: Vec<u8>| Req::new("PUT", "/s3/b/k").body(body);
+    type Refusal<'a> = (Box<dyn Fn(Vec<u8>) -> Req + 'a>, u16, &'a str);
+    let refusals: Vec<Refusal<'_>> = vec![
+        (Box::new(put), 403, "AccessDenied"),
+        (
+            Box::new(|b| put(b).header("Authorization", "Bearer nope")),
+            403,
+            "AccessDenied",
+        ),
+        (
+            Box::new(|b| put(b).signed(&host, ("AKIDNOTAKEY", "AKIDNOTAKEY"), 0)),
+            403,
+            "InvalidAccessKeyId",
+        ),
+        (
+            Box::new(|b| put(b).signed(&host, ("s3cret", "wrong"), 0)),
+            403,
+            "SignatureDoesNotMatch",
+        ),
+        (
+            Box::new(|b| put(b).signed(&host, ("s3cret", "s3cret"), 3600)),
+            403,
+            "RequestTimeTooSkewed",
+        ),
+        (
+            Box::new(|b| put(b).query("X-Amz-Signature=00")),
+            400,
+            "AuthorizationQueryParametersError",
+        ),
+        (
+            Box::new(|b| put(b).header("x-amz-security-token", "t")),
+            400,
+            "InvalidToken",
+        ),
+    ];
+    for (req, status, code) in &refusals {
+        let mut conn = Conn::open(&host).await;
+        let resp = conn.send(&req(Vec::new())).await;
+        resp.is(*status, code);
+        assert_eq!(resp.header("connection"), None, "{code}");
+        conn.send(&Req::new("GET", "/s3/b/k").signed(&host, ("s3cret", "s3cret"), 0))
+            .await
+            .is(404, "NoSuchKey");
+
+        // sccache's probe: 13 bytes, answered.
+        let mut conn = Conn::open(&host).await;
+        let resp = conn.send(&req(b"Hello, World!".to_vec())).await;
+        resp.is(*status, code);
+        assert_eq!(resp.header("connection"), Some("close"), "{code}");
+        assert!(conn.closed().await, "{code}");
+
+        // A MiB of a body declared 64 MiB long, the rest never sent: the answer comes all
+        // the same, so the server did not wait for the body's end.
+        let req = req(vec![b'x'; 1 << 20]);
+        let mut conn = Conn::open(&host).await;
+        let head = req.head(&host).replace(
+            &format!("Content-Length: {}", 1 << 20),
+            &format!("Content-Length: {}", 64 << 20),
+        );
+        let mut write = conn.write.take().unwrap();
+        let writer = tokio::spawn(async move {
+            // The server stops reading: the write may fail once it closes. The writing half
+            // is kept open until then.
+            let _ = write.write_all(head.as_bytes()).await;
+            let _ = write.write_all(&req.body).await;
+            write
+        });
+        let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
+            .await
+            .expect("answered before the body ends");
+        resp.is(*status, code);
+        assert_eq!(resp.header("connection"), Some("close"), "{code}");
+        assert!(conn.closed().await, "{code}");
+        drop(writer.await.unwrap());
+    }
+}
+
+/// `s3 = false`: `/s3/` is the 404 any unknown path is, after the usual gate.
+#[tokio::test]
+async fn s3_off_is_the_catch_all_404_after_authentication() {
+    let dir = tmp("off");
+    let host = spawn(open_state(&dir, false));
+    let off = send(&host, Req::new("GET", "/s3/b/k")).await;
+    let unknown = send(&host, Req::new("GET", "/nowhere")).await;
+    assert_eq!(off.status, 404);
+    assert_eq!(off.header("x-amz-request-id"), None);
+    assert_eq!(off.body, unknown.body);
+    assert_eq!(off.header("content-type"), unknown.header("content-type"));
+
+    let dir = tmp("off-bearer");
+    let (state, _) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        false,
+    );
+    let host = spawn(state);
+    let resp = send(&host, Req::new("GET", "/s3/b/k")).await;
+    assert_eq!(resp.status, 401, "the mode's own challenge");
+    let resp = send(
+        &host,
+        Req::new("GET", "/s3/b/k").header("Authorization", "Bearer s3cret"),
+    )
+    .await;
+    assert_eq!(resp.status, 404);
+    assert_eq!(resp.body, unknown.body);
+}
+
+/// A registry its hub made read-only refuses S3 writes in S3's form, and reads go on.
+#[tokio::test]
+async fn a_read_only_registry_refuses_writes_with_retry_after() {
+    let dir = tmp("ro");
+    let state = open_state(&dir, true);
+    state.store.set_read_only(true);
+    let host = spawn(state);
+    for method in ["PUT", "DELETE", "POST"] {
+        let resp = send(&host, Req::new(method, "/s3/b/k").body(b"x".to_vec())).await;
+        resp.is(503, "ServiceUnavailable");
+        assert_eq!(resp.header("retry-after"), Some("60"));
+    }
+    send(&host, Req::new("GET", "/s3/b/k"))
+        .await
+        .is(404, "NoSuchKey");
+}

From ca2301f7d28d351f0a82497a09410ff676368cd3 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 10:55:46 +0100
Subject: [PATCH 04/54] vk-registry/files: let a write carry annotations and a
 precondition

A front over the object layer can now see a body's bytes as they stream
(for digests of its own), have annotations written on the object's
manifest, and have a precondition on what is at the path checked under
the namespace and store locks the tag is written under, so a
create-only or compare-and-swap write cannot race another. WebDAV asks
for none of it; its behaviour is unchanged.
---
 vk-registry/src/dav/files.rs |  17 ++++-
 vk-registry/src/files.rs     | 136 ++++++++++++++++++++++++++++++-----
 vk-registry/src/lib.rs       |   5 +-
 3 files changed, 136 insertions(+), 22 deletions(-)

diff --git a/vk-registry/src/dav/files.rs b/vk-registry/src/dav/files.rs
index 021ccc74..5c370003 100644
--- a/vk-registry/src/dav/files.rs
+++ b/vk-registry/src/dav/files.rs
@@ -332,7 +332,7 @@ async fn put(
     }
 
     // Stream uploads to bound memory use; the digest falls out of the same pass.
-    let staged = match crate::files::stage(&state.store, req.into_body()).await {
+    let staged = match crate::files::stage(&state.store, req.into_body(), &mut |_| {}).await {
         Ok(staged) => staged,
         Err(PutError::TooLarge) => {
             return Ok(error_response(
@@ -344,10 +344,14 @@ async fn put(
         Err(PutError::Failed(e)) => return Err(e),
     };
     Ok(
-        match crate::files::commit(Arc::clone(&state.store), segs, staged).await? {
+        match crate::files::commit(Arc::clone(&state.store), segs, staged, Default::default())
+            .await?
+        {
             Written::Created => created(),
             Written::Replaced => no_content(),
             Written::Refused(why) => put_refusal(why, href),
+            // Unreachable: no precondition was asked for.
+            Written::PreconditionFailed => no_content(),
         },
     )
 }
@@ -355,7 +359,14 @@ async fn put(
 /// Read a request's body through and discard it: a status sent with request bytes unread
 /// resets the connection. `Some(413)` if the body crosses the object cap on the way.
 pub(super) async fn drain(req: Request<Incoming>, href: &str) -> Result<Option<Response<Body>>> {
-    match drain_into(&mut tokio::io::sink(), req.into_body(), MAX_OBJECT).await {
+    match drain_into(
+        &mut tokio::io::sink(),
+        req.into_body(),
+        MAX_OBJECT,
+        &mut |_| {},
+    )
+    .await
+    {
         Ok(_) => Ok(None),
         Err(PutError::TooLarge) => Ok(Some(error_response(
             StatusCode::PAYLOAD_TOO_LARGE,
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index 8fd1af22..2dd729e5 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -7,6 +7,7 @@
 //! today, an S3 view in later work. Entries expire under gc's tag retention and blob grace
 //! windows.
 
+use std::collections::BTreeMap;
 use std::path::PathBuf;
 use std::sync::{Arc, Mutex, PoisonError};
 use std::time::{Duration, SystemTime};
@@ -227,8 +228,13 @@ pub(crate) struct Staged {
 }
 
 /// Stream `body` into a staging file under `uploads/`, hashing it on the way, up to
-/// [`MAX_OBJECT`]. Memory use is bounded by the coalescing buffer whatever the size.
-pub(crate) async fn stage<B>(store: &Store, body: B) -> std::result::Result<Staged, PutError>
+/// [`MAX_OBJECT`]; `tap` sees every byte as it goes, for a front's own digests. Memory use is
+/// bounded by the coalescing buffer whatever the size.
+pub(crate) async fn stage<B>(
+    store: &Store,
+    body: B,
+    tap: &mut impl FnMut(&[u8]),
+) -> std::result::Result<Staged, PutError>
 where
     B: hyper::body::Body<Data = Bytes> + Unpin,
     B::Error: std::error::Error + Send + Sync + 'static,
@@ -236,7 +242,7 @@ where
     let (path, file) = store.stage_file().map_err(PutError::Failed)?;
     let staging = Staging { path, armed: true };
     let mut file = tokio::fs::File::from_std(file);
-    let written = drain_into(&mut file, body, MAX_OBJECT).await;
+    let written = drain_into(&mut file, body, MAX_OBJECT, tap).await;
     let flushed = file
         .flush()
         .await
@@ -255,16 +261,34 @@ pub(crate) enum Written {
     /// the path changed while the body streamed and no longer takes an object; nothing was
     /// written
     Refused(Unwritable),
+    /// [`Commit::precondition`] refused the object found there, or its absence; nothing was
+    /// written
+    PreconditionFailed,
+}
+
+/// Whether a [`commit`] goes ahead, given the object at its path or `None`.
+pub(crate) type Precondition = Box<dyn FnOnce(Option<&Object>) -> bool + Send>;
+
+/// What a front asks of a [`commit`] beyond the bytes.
+#[derive(Default)]
+pub(crate) struct Commit {
+    /// written on the object's manifest
+    pub(crate) annotations: BTreeMap<String, String>,
+    /// checked under the locks the tag is written under, so no other write of this server
+    /// comes between the check and the write
+    pub(crate) precondition: Option<Precondition>,
 }
 
 /// Promote a [`stage`]d body into the pool and tag it at `segs` as a raw file, re-checking
-/// [`unwritable`] under [`NAMESPACE`] and the shared store lock first. Off the runtime:
-/// staging compresses, and a large object would otherwise block a tokio worker for seconds.
-/// The locks are taken inside, after that pass — the store lock as the relay takes it.
+/// [`unwritable`], then `how`'s precondition, under [`NAMESPACE`] and the shared store lock
+/// first. Off the runtime: staging compresses, and a large object would otherwise block a
+/// tokio worker for seconds. The locks are taken inside, after that pass — the store lock as
+/// the relay takes it.
 pub(crate) async fn commit(
     store: Arc<Store>,
     segs: Vec<String>,
     staged: Staged,
+    how: Commit,
 ) -> Result<Written> {
     tokio::task::spawn_blocking(move || -> Result<Written> {
         let Staged {
@@ -278,11 +302,14 @@ pub(crate) async fn commit(
         // references it; see Store::lock_shared. Another write may have changed the path
         // while the body streamed, so it is checked again.
         let checked = store.lock_shared().and_then(|lock| {
-            let existed = matches!(resolve(&store, &segs)?, Some(Node::Object(_)));
-            Ok((lock, unwritable(&store, &segs)?, existed))
+            let existing = match resolve(&store, &segs)? {
+                Some(Node::Object(obj)) => Some(obj),
+                _ => None,
+            };
+            Ok((lock, unwritable(&store, &segs)?, existing))
         });
-        let (_lock, existed) = match checked {
-            Ok((lock, None, existed)) => (lock, existed),
+        let (_lock, existing) = match checked {
+            Ok((lock, None, existing)) => (lock, existing),
             Ok((_, Some(why), _)) => {
                 promotion.discard();
                 return Ok(Written::Refused(why));
@@ -292,10 +319,17 @@ pub(crate) async fn commit(
                 return Err(e);
             }
         };
+        if let Some(precondition) = how.precondition
+            && !precondition(existing.as_ref())
+        {
+            promotion.discard();
+            return Ok(Written::PreconditionFailed);
+        }
+        let existed = existing.is_some();
         store.promote_staged(&hex, promotion)?;
         staging.armed = false;
         let (repo, tag) = object_of(&segs).context("a write past its checks names an object")?;
-        store.put_raw_file(&repo, tag, &hex, size, None)?;
+        store.put_raw_file_annotated(&repo, tag, &hex, size, None, &how.annotations)?;
         Ok(if existed {
             Written::Replaced
         } else {
@@ -307,12 +341,14 @@ pub(crate) async fn commit(
 }
 
 /// Stream `body` to `out`, coalescing small frames and enforcing `cap`, including for chunked
-/// bodies; `(bytes written, sha256 hex)` on success. `out` may be a sink when draining a
-/// refused request. The generic body allows tests with a small cap.
+/// bodies; `(bytes written, sha256 hex)` on success. `tap` sees each frame's bytes as they are
+/// hashed, before they are written. `out` may be a sink when draining a refused request. The
+/// generic body allows tests with a small cap.
 pub(crate) async fn drain_into<B>(
     out: &mut (impl AsyncWrite + Unpin),
     mut body: B,
     cap: u64,
+    tap: &mut impl FnMut(&[u8]),
 ) -> std::result::Result<(u64, String), PutError>
 where
     B: hyper::body::Body<Data = Bytes> + Unpin,
@@ -334,6 +370,7 @@ where
             return Err(PutError::TooLarge);
         }
         hasher.update(&data);
+        tap(&data);
         // A frame already worth a write goes straight out rather than through the
         // coalescing buffer, which is there for the small ones.
         if buf.is_empty() && data.len() >= STREAM_CHUNK {
@@ -363,7 +400,7 @@ where
     B::Error: std::error::Error + Send + Sync + 'static,
 {
     // Past `cap`, or unreadable: either way there is nothing more to read.
-    let _ = drain_into(&mut tokio::io::sink(), body, cap).await;
+    let _ = drain_into(&mut tokio::io::sink(), body, cap, &mut |_| {}).await;
 }
 
 #[cfg(test)]
@@ -410,7 +447,7 @@ mod tests {
 
         let mut file = tokio::fs::File::create(&path).await.unwrap();
         assert!(matches!(
-            drain_into(&mut file, frames(), 250).await,
+            drain_into(&mut file, frames(), 250, &mut |_| {}).await,
             Err(PutError::TooLarge)
         ));
         drop(file);
@@ -421,16 +458,81 @@ mod tests {
 
         // Exactly at the cap is not over it, and the digest is the body's.
         let mut file = tokio::fs::File::create(&path).await.unwrap();
-        let (n, hex) = drain_into(&mut file, frames(), 400).await.ok().unwrap();
+        let mut tapped = 0;
+        let (n, hex) = drain_into(&mut file, frames(), 400, &mut |b| tapped += b.len())
+            .await
+            .ok()
+            .unwrap();
         file.flush().await.unwrap();
         drop(file);
-        assert_eq!(n, 400);
+        assert_eq!((n, tapped), (400, 400));
         assert_eq!(std::fs::metadata(&path).unwrap().len(), 400);
         assert_eq!(hex, crate::sha256_hex_raw(&vec![1u8; 400]));
 
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// A commit writes the annotations it is given on the manifest, and its precondition sees
+    /// what is at the path, under the locks: refused, nothing is tagged and the staging file
+    /// goes.
+    #[tokio::test]
+    async fn a_commit_carries_annotations_and_honours_its_precondition() {
+        let dir = std::env::temp_dir().join(format!("vk-reg-files-commit-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Arc::new(Store::new(dir.clone()).unwrap());
+        let body = |b: &'static [u8]| {
+            let frame: std::result::Result<_, std::io::Error> =
+                Ok(hyper::body::Frame::data(Bytes::from_static(b)));
+            http_body_util::StreamBody::new(futures::stream::iter([frame]))
+        };
+        let segs = vec!["b".to_string(), "k".to_string()];
+        let write = async |b: &'static [u8], how: Commit| {
+            let staged = stage(&store, body(b), &mut |_| {}).await.ok().unwrap();
+            commit(Arc::clone(&store), segs.clone(), staged, how)
+                .await
+                .unwrap()
+        };
+        let absent =
+            || -> Option<Precondition> { Some(Box::new(|o: Option<&Object>| o.is_none())) };
+        let annotations = BTreeMap::from([("org.example.k".to_string(), "v".to_string())]);
+
+        let how = Commit {
+            annotations: annotations.clone(),
+            precondition: absent(),
+        };
+        assert!(matches!(write(b"one", how).await, Written::Created));
+        let (hex, _) = store.tag_target("files/b", "k").unwrap();
+        let manifest: serde_json::Value =
+            serde_json::from_slice(&store.get_blob(&hex).unwrap().unwrap()).unwrap();
+        assert_eq!(manifest["annotations"]["org.example.k"], "v");
+        assert!(crate::raw_file_layer(&serde_json::to_vec(&manifest).unwrap()).is_some());
+
+        let how = Commit {
+            precondition: absent(),
+            ..Commit::default()
+        };
+        assert!(matches!(
+            write(b"two", how).await,
+            Written::PreconditionFailed
+        ));
+        assert_eq!(store.tag_target("files/b", "k").unwrap().0, hex);
+        let staged = std::fs::read_dir(dir.join("uploads"))
+            .unwrap()
+            .filter(|e| e.as_ref().unwrap().file_type().unwrap().is_file())
+            .count();
+        assert_eq!(staged, 0, "the refused body's staging file is gone");
+
+        let layer = crate::sha256_hex_raw(b"one");
+        let how = Commit {
+            precondition: Some(Box::new(move |o: Option<&Object>| {
+                o.is_some_and(|o| o.layer == layer && o.size == 3)
+            })),
+            ..Commit::default()
+        };
+        assert!(matches!(write(b"three", how).await, Written::Replaced));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn paths_map_onto_repositories_and_tags() {
         let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 98aed77e..021dbcb7 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -746,8 +746,9 @@ impl Store {
         self.put_raw_file_annotated(name, tag, layer_hex, size, title, &BTreeMap::new())
     }
 
-    /// [`Store::put_raw_file`] with `annotations` on the manifest: a [`Retention`].
-    fn put_raw_file_annotated(
+    /// [`Store::put_raw_file`] with `annotations` on the manifest: a [`Retention`], or what
+    /// a `files/` front keeps beside an object.
+    pub(crate) fn put_raw_file_annotated(
         &self,
         name: &str,
         tag: &str,

From 964fcadab775f627820a0f8b1fa57a5d6403e8bd Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 11:06:17 +0100
Subject: [PATCH 05/54] vk-registry/s3: serve, store and delete objects

Serve the plain-file area's objects under /s3/: PutObject, GetObject,
HeadObject, GetObjectAttributes and DeleteObject, with HeadBucket,
GetBucketLocation and ListBuckets, over the object layer WebDAV uses and
under its authorization and disclosure rules. A key maps onto the
store's names as they are; anything else is refused naming the rule.

A write records the object's MD5 (its ETag) and user metadata on the
manifest, checks the signed payload digest and the checksums it is
sent, and checks If-None-Match/If-Match under the namespace lock; reads
take the four conditional headers and the checksum mode. No content
type is kept. Listings, aws-chunked bodies, ranges, copies and
multipart answer NotImplemented until they land.
---
 CHANGELOG.md                      |  12 +
 Cargo.lock                        |   3 +
 Cargo.toml                        |   9 +-
 README.md                         |  18 +-
 vk-registry/Cargo.toml            |   5 +
 vk-registry/DESIGN.md             | 112 +++-
 vk-registry/src/dav/mod.rs        |   2 +-
 vk-registry/src/files.rs          |  11 +-
 vk-registry/src/lib.rs            |  20 +
 vk-registry/src/s3/bucket.rs      | 128 +++++
 vk-registry/src/s3/conditional.rs | 324 ++++++++++++
 vk-registry/src/s3/meta.rs        | 160 ++++++
 vk-registry/src/s3/mod.rs         | 200 ++++++--
 vk-registry/src/s3/object.rs      | 654 ++++++++++++++++++++++++
 vk-registry/src/s3/path.rs        | 259 ++++++++++
 vk-registry/src/s3/xml.rs         |  62 ++-
 vk-registry/tests/s3_e2e.rs       | 813 +++++++++++++++++++++++++++++-
 17 files changed, 2701 insertions(+), 91 deletions(-)
 create mode 100644 vk-registry/src/s3/bucket.rs
 create mode 100644 vk-registry/src/s3/conditional.rs
 create mode 100644 vk-registry/src/s3/meta.rs
 create mode 100644 vk-registry/src/s3/object.rs
 create mode 100644 vk-registry/src/s3/path.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7be659b..cdc633e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to virtkit will be documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- **The registry's plain-file area is also served as S3.** Under `/s3/` on `vk-registry`,
+  each top-level directory of the WebDAV `files/` area is a bucket, so `sccache`'s S3 backend
+  and other S3 clients can share a compiler cache or files with it: point them at
+  `https://<registry>/s3` with any region, and use the registry credential (an API key, a hub
+  token or the shared bearer) as both the access key and the secret access key, or the shared
+  Basic user and its password. Objects can be written, read with conditional headers and
+  checksums, given metadata and deleted, and are the same files WebDAV and `vk registry get`
+  see. Listing objects, multipart and chunked uploads, ranges and copies are not served yet.
+  Set `s3 = false` in the server config to turn it off.
+
 ## [0.106.0] - 2026-11-05
 
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index 096ef156..9cd85fb4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4304,6 +4304,7 @@ dependencies = [
  "anyhow",
  "bytes",
  "clap",
+ "crc32fast",
  "futures",
  "hmac",
  "http-body-util",
@@ -4312,6 +4313,7 @@ dependencies = [
  "hyper-util",
  "jemallocator",
  "libc",
+ "md5",
  "oci-client",
  "rand",
  "redb",
@@ -4319,6 +4321,7 @@ dependencies = [
  "rustls",
  "serde",
  "serde_json",
+ "sha1",
  "sha2",
  "tokio",
  "tokio-rustls",
diff --git a/Cargo.toml b/Cargo.toml
index 8124b74f..d1a8bce5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -128,9 +128,14 @@ oci-client = { version = "0.18", default-features = false }
 flate2 = "1"
 # docker-hash: content hashing of a (Dockerfile, stage) for image-tag resolution
 sha2 = "0.11"
-# vk-tpm's SHA-1 PCR bank (TPM 2.0 keeps one for compatibility). RustCrypto, like sha2; already
-# in the tree via russh.
+# vk-tpm's SHA-1 PCR bank (TPM 2.0 keeps one for compatibility), and vk-registry's check of an
+# S3 upload's x-amz-checksum-sha1. RustCrypto, like sha2; already in the tree via russh.
 sha1 = "0.11"
+# vk-registry: the MD5 an S3 object's ETag is, and the check of a Content-MD5. Already in the
+# tree via russh.
+md5 = "0.8"
+# vk-registry: the check of an S3 upload's x-amz-checksum-crc32. Already in the tree via flate2.
+crc32fast = "1.5"
 # vk-tpm: the TPM's entropy (TPM2_GetRandom, its seeds) from the OS. Already in the tree via rand.
 getrandom = "0.4"
 # vk-tpm: constant-time comparison of authorization values. Already in the tree via the
diff --git a/README.md b/README.md
index fe7872ab..58636f40 100644
--- a/README.md
+++ b/README.md
@@ -855,6 +855,22 @@ with `read:files/<dir>/*` only reads it. Cached files expire under `vk-registry
 retention like any other tag, unless their manifest keeps or expires them. Set
 `webdav = false` in the server config to disable WebDAV.
 
+The same plain-file area is served as S3 under `/s3/`, a bucket being a top-level directory
+of `/dav/files/`, so `sccache`'s S3 backend, the AWS CLI and SDKs and other S3 clients can use
+it. The access key is the registry credential — an API key, a hub token, or the shared bearer —
+and the secret access key is the same string; with a shared Basic user, the user name and its
+password. For `sccache`:
+
+```bash
+SCCACHE_BUCKET=sccache SCCACHE_ENDPOINT=https://<registry>/s3 SCCACHE_REGION=auto \
+SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sccache …
+```
+
+Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
+bytes); objects are at most 4 GiB; presigned URLs are refused. Listing a bucket's objects,
+multipart and chunked uploads, ranges and copies are not served yet. Set `s3 = false` to
+disable it.
+
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
 `vk registry get <sha256:hex | dir/name>` fetches one back, checked against its digest;
@@ -883,7 +899,7 @@ See [`docs/registry-hub.md`](docs/registry-hub.md).
 | --- | --- |
 | `vk` | Host CLI, VMM, image builder, userspace network, compose runner, and GitLab executor. It embeds the default guest kernel and `vk-agent`. |
 | `vk-agent` | Guest PID 1 and command server. It configures mounts, networking, hostname, shared directories, optional SSH, and host-driven execution over vsock. |
-| `vk-registry` | Optional OCI-distribution server with a pull-through cache, a WebDAV view of the store with a plain-file area for compiler caches, and build-once locking. |
+| `vk-registry` | Optional OCI-distribution server with a pull-through cache, a WebDAV view of the store with a plain-file area for compiler caches, also served as S3, and build-once locking. |
 | `vk-hub` | Experimental hub for a fleet of `vk node` hosts, and a web UI for the VMs on this machine: `vk-hub local` serves it on loopback. See the [fleet design](docs/fleet-design.md) and [prototype reference](docs/fleet-prototype.md). |
 | `vk-gitlab` | Experimental GitLab runner for a `vk-hub` fleet: takes jobs from GitLab and has the hub run each on a `vk node`. See [GitLab dispatch](docs/gitlab-dispatch.md). |
 | `vk-runnerctl` | Optional root-side helper that adjusts GitLab runner concurrency within an administrator-configured range. |
diff --git a/vk-registry/Cargo.toml b/vk-registry/Cargo.toml
index 894afe18..93908a47 100644
--- a/vk-registry/Cargo.toml
+++ b/vk-registry/Cargo.toml
@@ -35,6 +35,11 @@ rustls.workspace = true
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging", "tls12"] }
 oci-client.workspace = true
 sha2.workspace = true
+# The digests S3 clients send or expect beside SHA-256: an object's MD5 (its ETag), and the
+# SHA-1 and CRC32 an upload may be checked against.
+md5.workspace = true
+sha1.workspace = true
+crc32fast.workspace = true
 # SigV4's HMAC chain for /s3/; zeroize wipes the keys it derives.
 hmac.workspace = true
 zeroize.workspace = true
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 367422c4..6383bee2 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -558,6 +558,112 @@ an entry alive as a writer's do. There is no per-directory policy and no size ca
 replaced or deleted object frees no disk until the next `gc`. A staging file a crashed `PUT`
 left in `uploads/` goes with the idle uploads.
 
+## S3 view (`/s3/`)
+
+The `files/` area is also served as S3, path-style, under `/s3/`, through the same listener,
+TLS and credentials: a bucket is a top-level `files/` directory and an object key the path
+below it, so `PUT /s3/sccache/a/b/abcdef` writes the same tag `/dav/files/sccache/a/b/abcdef`
+names. Nothing new is stored, and the WebDAV view, `/v2/`, `/browse`, `vk registry get` and
+the gc see the same entries. S3 is enabled by default. Set `s3 = false` to disable it: `/s3/`
+requests then return the 404 any unknown path returns, after the usual authentication, and
+the server logs this setting at startup.
+
+```text
+/s3/                          the buckets: top-level directories of files/
+/s3/<bucket>                  files/<bucket>
+/s3/<bucket>/<key…>           the object files/<bucket>/<key…> names, as in /dav/files/
+```
+
+Clients take `endpoint = https://<registry>/s3` and any region: `sccache` with
+`SCCACHE_BUCKET=<bucket> SCCACHE_ENDPOINT=https://<registry>/s3 SCCACHE_REGION=auto`
+(`SCCACHE_S3_KEY_PREFIX` names a directory inside the bucket). Virtual-hosted style, which
+needs wildcard DNS, is not served.
+
+**Credentials.** SigV4 needs the server to hold the signing secret, and this registry stores
+API keys only as hashes and never mints hub tokens, so no new secret is introduced: the
+access key id is a credential the registry already takes, and the secret access key is the
+same string. In accounts mode `AWS_ACCESS_KEY_ID=vkr_…` and `AWS_SECRET_ACCESS_KEY=vkr_…`,
+the same value; a hub token likewise, in either mode, when the registry takes them; the
+shared bearer likewise. With a shared Basic user, the access key id is the user name and the
+secret its password, which then never crosses the wire; a user name holding `/` cannot be an
+access key id, since the credential scope is split from the right. The access key id is
+authenticated first, exactly as the bearer it would be, so revocation, expiry and scopes
+apply unchanged, and only then is its secret used to check the signature; an unknown id is
+403 `InvalidAccessKeyId`, a wrong signature 403 `SignatureDoesNotMatch` (with the string to
+sign and canonical request, as AWS answers). The request's time must be on the scope's day
+and within 15 minutes of the server's (403 `RequestTimeTooSkewed`, naming the server's
+time). The usual `Authorization: Bearer|Basic` and the session cookie keep working on `/s3/`;
+a request with no credential on a server that requires one is S3's 403 `AccessDenied`, not
+the 401 challenge. On a server with no credential configured, signatures are not checked, as
+nothing else is. Presigned (query-string) URLs are refused with 400
+`AuthorizationQueryParametersError`, since they put a credential in a URL and so in logs, and
+temporary credentials (`x-amz-security-token`) with 400 `InvalidToken`.
+
+The exposure is today's: a bearer travels in clear under TLS and so does an access key id,
+while the signature also binds the method, path, query, signed headers and a timestamp. With
+`UNSIGNED-PAYLOAD`, which OpenDAL and most SDKs send, a captured `Authorization` header can be
+replayed with another body to the same key for those 15 minutes, as a captured bearer can be
+for as long as it is good.
+
+**Keys** follow the store's name rules as they are; there is no escaping scheme. A bucket is
+one component; a key is 1 to 14 components (16 counting `files` and the bucket), each a run of
+`[A-Za-z0-9._-]` of at most 255 bytes, not `.`, `..`, `tags`, `manifests` or `blobs`, the whole
+key at most 1024 bytes, no empty component and no trailing slash, so there are no "directory
+marker" objects. Paths are split before they are percent-decoded, as WebDAV's are, so `%2F`
+cannot smuggle a separator. Anything else is 400 `InvalidArgument`, `KeyTooLongError` or
+`InvalidBucketName`, with a message naming the rule. `sccache`'s keys (`a/b/c/<hex>`,
+`.sccache_check`) pass.
+
+**Authorization** is the WebDAV view's: a `PUT` needs `Write` on the key's parent repository,
+a read `Read` on the repository the key resolves to, and a `DELETE` `Write` there; a caller
+holding the action on neither the key's own name nor its parent's is 403 `AccessDenied` before
+anything is looked up, and what it may not read is otherwise absent (`NoSuchKey`). A write
+refused over a clash answers 409 and so reveals that the name exists, as WebDAV's does. A
+bucket authorizes as `files/<bucket>`. Listing the buckets needs a configured credential, as
+`/dav/`'s root listing does, and shows only those the caller may read.
+
+**Objects are bytes.** Every object is served `application/octet-stream`,
+`Content-Disposition: attachment` and `nosniff`, whatever its writer sent: a `Content-Type`
+is not stored, for the reason manifest media types are restricted (this origin also serves
+`/browse` and holds the session cookie). An object's ETag is the MD5 of its bytes, quoted,
+which a `PutObject` computes in the same pass as the SHA-256 and records on the manifest as
+`org.virtkit.md5`; an object written otherwise (WebDAV, `vk registry put`, `/upload`) has no
+MD5 and its ETag is its SHA-256, quoted — 64 hex digits, which a client checking an ETag as
+an MD5 sees is not one. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
+of names and values) is kept on the manifest as `org.virtkit.s3-meta.<name>` and sent back on
+reads; a replaced object keeps only what its own write sent.
+
+| Request | Answer |
+|---|---|
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD` or the body's SHA-256, else 400 `XAmzContentSHA256Mismatch` and nothing is tagged. `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. `Range` is ignored and no `Accept-Ranges` is sent: a whole 200 is a legal answer. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does; a `HEAD` touches nothing |
+| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
+| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
+| `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 without `Read` on `files/<b>` |
+| `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
+| `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
+| anything else | 501 `NotImplemented`: listing a bucket's objects, creating and deleting buckets, copies, batch deletes, multipart uploads, `aws-chunked` bodies (`STREAMING-*` payloads, `Content-Encoding: aws-chunked`), tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+
+**`LastModified` moves on reads**, as `getlastmodified` does over WebDAV: a `GET` refreshes
+the tag's mtime once it is an hour old, which is what keeps a hot cache entry from the gc's
+retention. Sync tools that compare modification times (`aws s3 sync`, rclone `--update`) see
+it; they keep the source file's own time in user metadata.
+
+**Errors** are S3's XML `Error` documents (`Code`, `Message`, `Resource`, `RequestId`, and
+the extra elements AWS sends, such as `ServerTime` or `Condition`), so a client shows a code
+rather than a bare status. Every `/s3/` response carries an `x-amz-request-id` of 16 hex
+digits and `nosniff`; an internal error logs its request id, so a client's report can be
+matched to the server's line. A refusal decided before the caller is authenticated reads at
+most 64 KiB of the body first, enough for `sccache`'s 13-byte probe to see its answer rather
+than a reset; every refusal after it reads the body through, up to the 4 GiB cap, as
+WebDAV's do. A refusal of a request with a body then closes the connection. A registry its
+hub made read-only answers writes 503 `ServiceUnavailable` with `Retry-After`.
+
+S3 writes into `files/` take the WebDAV view's namespace lock, run their store work on the
+blocking pool and stream their bodies on the runtime. Objects expire under the gc's tag
+retention like every `files/` entry ("Lifecycle" above): a PutObject writes no retention
+annotation.
+
 ## Accounts administration
 
 `vk-registry accounts` manages users, sessions, administrators, and API keys. The command
@@ -813,7 +919,9 @@ when that is still below `max_connections` plus 256. The unit `install-service`
   `/browse`, `status` and `gc`.
 - The `files/` area trusts its writers: a stored compiler-cache entry is linked into every
   project computing the same key, so write access belongs to trusted pipelines only (see
-  "WebDAV view").
+  "WebDAV view"). A key reaches exactly the same content over `/v2/`, `/dav/` and `/s3/`.
+- SigV4 needs the server's clock within 15 minutes of its clients'. A reverse proxy in front
+  of `/s3/` must pass `Host` and the path unchanged, since the signature covers both.
 - The store directory must be writable only by trusted local users. Requests can follow
   symlinks in parent directories under `repos/files/`; checks reject only a symlink at the
   final path component. Preventing this requires descriptor-relative path resolution.
@@ -825,6 +933,6 @@ when that is still below `max_connections` plus 256. The unit `install-service`
 - The server has no durable request audit log. Administrative changes are logged to stderr:
   `accounts admin: <peer>:` identifies the admin socket peer; `accounts web: <identity>:`
   identifies the session for browse and settings changes (tag deletion, API key minting and
-  revocation, captions, uploads). Writes through `/v2/` and WebDAV, including tag removal
+  revocation, captions, uploads). Writes through `/v2/`, WebDAV and S3, including tag removal
   and replacement, are not audited.
 - OIDC trusts platform roots only and caches discovery until restart.
diff --git a/vk-registry/src/dav/mod.rs b/vk-registry/src/dav/mod.rs
index 21102d3d..06714308 100644
--- a/vk-registry/src/dav/mod.rs
+++ b/vk-registry/src/dav/mod.rs
@@ -228,7 +228,7 @@ pub(crate) fn href(segments: &[&str], collection: bool) -> String {
 
 /// Root enumeration requires configured credentials. Accounts-mode listings also filter by
 /// scope.
-fn may_enumerate(state: &ServerState) -> bool {
+pub(crate) fn may_enumerate(state: &ServerState) -> bool {
     match &state.auth {
         Authenticator::Accounts { .. } => true,
         Authenticator::Shared(auth) => auth.enabled(),
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index 2dd729e5..c1da7212 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -3,8 +3,8 @@
 //! single-layer raw-file manifest, as written by `/upload`, whose layer holds the file bytes.
 //! A write streams to `uploads/` while hashing ([`stage`]), then promotes the blob and writes
 //! the manifest and tag under the namespace lock ([`commit`]). Each wire protocol over this
-//! layer keeps its own status codes and bodies: WebDAV under `/dav/files/` (`crate::dav`)
-//! today, an S3 view in later work. Entries expire under gc's tag retention and blob grace
+//! layer keeps its own status codes and bodies: WebDAV under `/dav/files/` (`crate::dav`) and
+//! S3 under `/s3/` (`crate::s3`). Entries expire under gc's tag retention and blob grace
 //! windows.
 
 use std::collections::BTreeMap;
@@ -75,6 +75,8 @@ pub(crate) struct Object {
     pub(crate) size: u64,
     /// the tag's mtime
     pub(crate) modified: SystemTime,
+    /// the manifest's annotations: what a front stored beside the bytes
+    pub(crate) annotations: BTreeMap<String, String>,
 }
 
 impl Node {
@@ -118,16 +120,17 @@ pub(crate) fn resolve(store: &Store, segs: &[String]) -> Result<Option<Node>> {
         return Ok(None);
     };
     let layer = match store.get_blob(&manifest_hex)? {
-        Some(manifest) => crate::raw_file_layer(&manifest),
+        Some(manifest) => crate::raw_file_parts(&manifest),
         None => None,
     };
     Ok(Some(match layer {
-        Some((layer, size)) => Node::Object(Object {
+        Some((layer, size, annotations)) => Node::Object(Object {
             repo,
             tag: tag.to_string(),
             layer,
             size,
             modified,
+            annotations,
         }),
         None => Node::Foreign(repo),
     }))
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 021dbcb7..38bb187a 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -2935,7 +2935,27 @@ pub fn raw_file_title(manifest: &[u8]) -> Option<String> {
 /// any other shape: an image pushed over `/v2/` into a `files/` repository is not a file
 /// the WebDAV view serves.
 pub fn raw_file_layer(manifest: &[u8]) -> Option<(String, u64)> {
+    raw_file_layer_of(&serde_json::from_slice(manifest).ok()?)
+}
+
+/// [`raw_file_layer`] and the manifest's string annotations, from one parse; an annotation
+/// whose value is not a string is left out.
+pub(crate) fn raw_file_parts(manifest: &[u8]) -> Option<(String, u64, BTreeMap<String, String>)> {
     let v: serde_json::Value = serde_json::from_slice(manifest).ok()?;
+    let (hex, size) = raw_file_layer_of(&v)?;
+    let annotations = v
+        .pointer("/annotations")
+        .and_then(|a| a.as_object())
+        .map(|a| {
+            a.iter()
+                .filter_map(|(k, v)| Some((k.clone(), v.as_str()?.to_string())))
+                .collect()
+        })
+        .unwrap_or_default();
+    Some((hex, size, annotations))
+}
+
+fn raw_file_layer_of(v: &serde_json::Value) -> Option<(String, u64)> {
     let [layer] = v.pointer("/layers")?.as_array()?.as_slice() else {
         return None;
     };
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
new file mode 100644
index 00000000..e6a87a77
--- /dev/null
+++ b/vk-registry/src/s3/bucket.rs
@@ -0,0 +1,128 @@
+//! The service and its buckets: ListBuckets, HeadBucket and GetBucketLocation. A bucket is a
+//! top-level directory of `files/`, authorized as the repository `files/<bucket>`; one the
+//! caller may not read is absent to it, as in the WebDAV view.
+
+use hyper::body::Incoming;
+use hyper::header::{AUTHORIZATION, CONTENT_LENGTH};
+use hyper::{Request, Response, StatusCode};
+
+use super::{Ctx, refuse, sigv4, xml};
+use crate::files::{FILES_REPO, allowed};
+use crate::{Authz, Body, ServerState, accounts, body_of};
+
+/// The owner every listing names: the registry, whoever wrote what it holds.
+pub(super) const OWNER: &str = "vk-registry";
+
+/// `<Owner>` as S3's listings carry it.
+pub(super) fn owner() -> String {
+    format!(
+        "<Owner>{}{}</Owner>",
+        xml::element("ID", OWNER),
+        xml::element("DisplayName", OWNER)
+    )
+}
+
+/// `GET /s3/`: the top-level directories the caller may read. Refused, as `/dav/`'s root
+/// listing is, on a server without a credential, where it would list for anyone.
+pub(super) async fn list(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    if !crate::dav::may_enumerate(state) {
+        let resp = ctx.error(
+            StatusCode::FORBIDDEN,
+            "AccessDenied",
+            "listing the buckets needs a configured credential",
+        );
+        return refuse(req, resp, ctx).await;
+    }
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let mut buckets = String::new();
+        for name in store.repo_children(FILES_REPO)? {
+            let repo = format!("{FILES_REPO}/{name}");
+            if !authz.may_read(&repo) {
+                continue;
+            }
+            let created = store
+                .repos_path_modified(&repo)
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |d| d.as_secs());
+            buckets.push_str(&format!(
+                "<Bucket>{}{}</Bucket>",
+                xml::element("Name", &name),
+                xml::element("CreationDate", &sigv4::format_time(created))
+            ));
+        }
+        Ok(xml::document(
+            "ListAllMyBucketsResult",
+            &format!("{}<Buckets>{buckets}</Buckets>", owner()),
+        ))
+    })
+    .await
+}
+
+/// Whether `bucket` is there for this caller: `Err` with the answer when it is not — 403 when
+/// the caller may not read the bucket at all, 404 `NoSuchBucket` when it may but no such
+/// directory exists.
+async fn check(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: &str,
+    ctx: &Ctx,
+) -> anyhow::Result<Option<Response<Body>>> {
+    let repo = format!("{FILES_REPO}/{bucket}");
+    if !allowed(authz, accounts::Action::Read, &repo) {
+        return Ok(Some(ctx.access_denied()));
+    }
+    let store = std::sync::Arc::clone(&state.store);
+    let exists = tokio::task::spawn_blocking(move || store.repo_dir_exists(&repo)).await?;
+    Ok((!exists).then(|| {
+        ctx.error(
+            StatusCode::NOT_FOUND,
+            "NoSuchBucket",
+            "the specified bucket does not exist",
+        )
+    }))
+}
+
+/// `HEAD /s3/<bucket>`.
+pub(super) async fn head(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    if let Some(resp) = check(state, authz, &bucket, ctx).await? {
+        return refuse(req, resp, ctx).await;
+    }
+    Ok(Response::builder()
+        .status(StatusCode::OK)
+        .header(CONTENT_LENGTH, "0")
+        .body(body_of(bytes::Bytes::new()))?)
+}
+
+/// `GET /s3/<bucket>?location`: the region the request was signed for, which is any the
+/// client chose; empty when it was not signed.
+pub(super) async fn location(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    if let Some(resp) = check(state, authz, &bucket, ctx).await? {
+        return refuse(req, resp, ctx).await;
+    }
+    // The gate parsed this header already; a request it let through without one parsing is
+    // one that was not signed.
+    let region = req
+        .headers()
+        .get(AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| sigv4::parse_authorization(v).ok())
+        .map_or(String::new(), |c| xml::escape(c.region));
+    Ok(xml::document("LocationConstraint", &region))
+}
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
new file mode 100644
index 00000000..1887178e
--- /dev/null
+++ b/vk-registry/src/s3/conditional.rs
@@ -0,0 +1,324 @@
+//! ETags and the conditional headers S3 takes on them: on a read, `If-Match`,
+//! `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since`, in RFC 9110's order (S3's
+//! too); on a write, `If-None-Match: *` (create only) and `If-Match` (replace only that
+//! object), checked where the tag is written.
+
+use std::collections::BTreeMap;
+use std::time::{Duration, SystemTime};
+
+use hyper::header::{HeaderMap, IF_MATCH, IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_UNMODIFIED_SINCE};
+
+use crate::files::{Object, Precondition};
+
+/// The manifest annotation holding an S3-written object's MD5, as lowercase hex.
+pub(crate) const MD5_ANNOTATION: &str = "org.virtkit.md5";
+
+/// An object's ETag, quoted: the MD5 an S3 write recorded, or the SHA-256 of its bytes for
+/// one written otherwise (WebDAV, `vk registry put`). 64 hex digits, so a client that checks
+/// an ETag as an MD5 sees it is not one rather than a mismatch.
+pub(crate) fn etag(layer: &str, annotations: &BTreeMap<String, String>) -> String {
+    match annotations.get(MD5_ANNOTATION) {
+        Some(md5)
+            if md5.len() == 32
+                && md5
+                    .bytes()
+                    .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)) =>
+        {
+            format!("\"{md5}\"")
+        }
+        _ => format!("\"{layer}\""),
+    }
+}
+
+/// [`etag`] of an object.
+pub(crate) fn etag_of(obj: &Object) -> String {
+    etag(&obj.layer, &obj.annotations)
+}
+
+/// Whether an `If-Match`/`If-None-Match` list names `etag` (quoted): `*` names any, a weak
+/// `W/` tag compares as its strong form, and an unquoted entry as if it were quoted.
+pub(crate) fn names(list: &str, etag: &str) -> bool {
+    list.split(',').map(str::trim).any(|entry| {
+        let entry = entry.strip_prefix("W/").unwrap_or(entry);
+        entry == "*"
+            || entry == etag
+            || etag.strip_prefix('"').and_then(|e| e.strip_suffix('"')) == Some(entry)
+    })
+}
+
+/// A read's conditional headers. A date that does not parse is ignored, as RFC 9110 has it.
+#[derive(Debug, Default)]
+pub(crate) struct Conditions {
+    if_match: Option<String>,
+    if_none_match: Option<String>,
+    if_modified_since: Option<SystemTime>,
+    if_unmodified_since: Option<SystemTime>,
+}
+
+/// What a read's [`Conditions`] decide.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Outcome {
+    Serve,
+    /// 304
+    NotModified,
+    /// 412, naming the header that failed
+    Failed(&'static str),
+}
+
+impl Conditions {
+    pub(crate) fn of(headers: &HeaderMap) -> Self {
+        let text = |name| {
+            let values: Vec<&str> = headers
+                .get_all(name)
+                .iter()
+                .filter_map(|v| v.to_str().ok())
+                .collect();
+            (!values.is_empty()).then(|| values.join(","))
+        };
+        let date = |name| {
+            headers
+                .get(name)
+                .and_then(|v| v.to_str().ok())
+                .and_then(|v| httpdate::parse_http_date(v.trim()).ok())
+        };
+        Conditions {
+            if_match: text(IF_MATCH),
+            if_none_match: text(IF_NONE_MATCH),
+            if_modified_since: date(IF_MODIFIED_SINCE),
+            if_unmodified_since: date(IF_UNMODIFIED_SINCE),
+        }
+    }
+
+    /// Decide on an object with this `etag` (quoted) last modified at `modified`. Times
+    /// compare to the second, the precision an HTTP date has. `If-Unmodified-Since` counts
+    /// only without `If-Match`, `If-Modified-Since` only without `If-None-Match`.
+    pub(crate) fn evaluate(&self, etag: &str, modified: SystemTime) -> Outcome {
+        let modified = whole_seconds(modified);
+        match (&self.if_match, self.if_unmodified_since) {
+            (Some(list), _) if !names(list, etag) => return Outcome::Failed("If-Match"),
+            (None, Some(t)) if modified > whole_seconds(t) => {
+                return Outcome::Failed("If-Unmodified-Since");
+            }
+            _ => {}
+        }
+        match (&self.if_none_match, self.if_modified_since) {
+            (Some(list), _) if names(list, etag) => Outcome::NotModified,
+            (None, Some(t)) if modified <= whole_seconds(t) => Outcome::NotModified,
+            _ => Outcome::Serve,
+        }
+    }
+}
+
+fn whole_seconds(t: SystemTime) -> u64 {
+    t.duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap_or(Duration::ZERO)
+        .as_secs()
+}
+
+/// A write's conditional headers.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub(crate) struct WriteConditions {
+    /// `If-None-Match: *`: only where no object is
+    pub(crate) absent: bool,
+    /// `If-Match`: only over an object it names
+    pub(crate) if_match: Option<String>,
+}
+
+/// Why a write's conditional headers are not served: an `If-None-Match` other than `*`.
+pub(crate) struct Unsupported;
+
+impl WriteConditions {
+    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, Unsupported> {
+        let text = |name| {
+            let values: Vec<&str> = headers
+                .get_all(name)
+                .iter()
+                .map(|v| v.to_str().map_err(|_| Unsupported))
+                .collect::<Result<_, _>>()?;
+            Ok((!values.is_empty()).then(|| values.join(",")))
+        };
+        let absent = match text(IF_NONE_MATCH)? {
+            None => false,
+            Some(v) if v.trim() == "*" => true,
+            Some(_) => return Err(Unsupported),
+        };
+        Ok(WriteConditions {
+            absent,
+            if_match: text(IF_MATCH)?,
+        })
+    }
+
+    /// What [`crate::files::commit`] checks, or `None` when nothing is asked.
+    pub(crate) fn precondition(self) -> Option<Precondition> {
+        if !self.absent && self.if_match.is_none() {
+            return None;
+        }
+        Some(Box::new(move |existing: Option<&Object>| {
+            (!self.absent || existing.is_none())
+                && self
+                    .if_match
+                    .as_deref()
+                    .is_none_or(|list| existing.is_some_and(|o| names(list, &etag_of(o))))
+        }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hyper::header::HeaderValue;
+
+    const SHA: &str = "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0";
+    const MD5: &str = "65a8e27d8879283831b664bd8b7f0ad4";
+
+    fn object(annotations: &[(&str, &str)]) -> Object {
+        Object {
+            repo: "files/b".into(),
+            tag: "k".into(),
+            layer: SHA.into(),
+            size: 13,
+            modified: at(1_000_000),
+            annotations: annotations
+                .iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect(),
+        }
+    }
+
+    fn at(secs: u64) -> SystemTime {
+        SystemTime::UNIX_EPOCH + Duration::from_secs(secs)
+    }
+
+    fn headers(pairs: &[(hyper::header::HeaderName, &str)]) -> HeaderMap {
+        let mut h = HeaderMap::new();
+        for (n, v) in pairs {
+            h.append(n.clone(), HeaderValue::from_str(v).unwrap());
+        }
+        h
+    }
+
+    #[test]
+    fn an_etag_is_the_recorded_md5_or_the_sha256() {
+        assert_eq!(
+            etag_of(&object(&[(MD5_ANNOTATION, MD5)])),
+            format!("\"{MD5}\"")
+        );
+        assert_eq!(etag_of(&object(&[])), format!("\"{SHA}\""));
+        assert_eq!(
+            etag_of(&object(&[(MD5_ANNOTATION, "\"x\"")])),
+            format!("\"{SHA}\"")
+        );
+        let upper = MD5.to_ascii_uppercase();
+        assert_eq!(
+            etag_of(&object(&[(MD5_ANNOTATION, &upper)])),
+            format!("\"{SHA}\"")
+        );
+        assert_eq!(
+            etag_of(&object(&[(MD5_ANNOTATION, &MD5[1..])])),
+            format!("\"{SHA}\"")
+        );
+    }
+
+    #[test]
+    fn a_list_names_an_etag_quoted_weak_or_bare() {
+        let e = format!("\"{MD5}\"");
+        assert!(names("*", &e));
+        assert!(names(&e, &e));
+        assert!(names(&format!("W/{e}"), &e));
+        assert!(names(MD5, &e));
+        assert!(names(&format!("\"other\", {e}"), &e));
+        assert!(!names("\"other\"", &e));
+        assert!(!names("", &e));
+        assert!(!names(&format!("\"{MD5}"), &e));
+    }
+
+    /// The eight combinations a read's headers can take on one object, and the order they
+    /// are weighed in.
+    #[test]
+    fn reads_are_decided_in_rfc_order() {
+        let e = format!("\"{MD5}\"");
+        let modified = at(1_000_000) + Duration::from_millis(700);
+        let before = httpdate::fmt_http_date(at(999_999));
+        let same = httpdate::fmt_http_date(at(1_000_000));
+        let decide = |pairs: &[(hyper::header::HeaderName, &str)]| {
+            Conditions::of(&headers(pairs)).evaluate(&e, modified)
+        };
+        assert_eq!(decide(&[]), Outcome::Serve);
+        // If-Match
+        assert_eq!(decide(&[(IF_MATCH, &e)]), Outcome::Serve);
+        assert_eq!(decide(&[(IF_MATCH, "\"x\"")]), Outcome::Failed("If-Match"));
+        // If-Unmodified-Since, to the second
+        assert_eq!(decide(&[(IF_UNMODIFIED_SINCE, &same)]), Outcome::Serve);
+        assert_eq!(
+            decide(&[(IF_UNMODIFIED_SINCE, &before)]),
+            Outcome::Failed("If-Unmodified-Since")
+        );
+        // a matching If-Match overrides a failing If-Unmodified-Since
+        assert_eq!(
+            decide(&[(IF_MATCH, &e), (IF_UNMODIFIED_SINCE, &before)]),
+            Outcome::Serve
+        );
+        // If-None-Match
+        assert_eq!(decide(&[(IF_NONE_MATCH, &e)]), Outcome::NotModified);
+        assert_eq!(decide(&[(IF_NONE_MATCH, "*")]), Outcome::NotModified);
+        assert_eq!(decide(&[(IF_NONE_MATCH, "\"x\"")]), Outcome::Serve);
+        // If-Modified-Since, to the second
+        assert_eq!(decide(&[(IF_MODIFIED_SINCE, &same)]), Outcome::NotModified);
+        assert_eq!(decide(&[(IF_MODIFIED_SINCE, &before)]), Outcome::Serve);
+        // a non-matching If-None-Match overrides a met If-Modified-Since; a matching one
+        // answers 304 whatever the date says
+        assert_eq!(
+            decide(&[(IF_NONE_MATCH, "\"x\""), (IF_MODIFIED_SINCE, &same)]),
+            Outcome::Serve
+        );
+        assert_eq!(
+            decide(&[(IF_NONE_MATCH, &e), (IF_MODIFIED_SINCE, &before)]),
+            Outcome::NotModified
+        );
+        // a failed precondition outranks a 304
+        assert_eq!(
+            decide(&[(IF_MATCH, "\"x\""), (IF_NONE_MATCH, &e)]),
+            Outcome::Failed("If-Match")
+        );
+        // a date that does not parse is no condition
+        assert_eq!(decide(&[(IF_MODIFIED_SINCE, "yesterday")]), Outcome::Serve);
+        assert_eq!(
+            decide(&[(IF_UNMODIFIED_SINCE, "yesterday")]),
+            Outcome::Serve
+        );
+    }
+
+    #[test]
+    fn writes_create_only_or_replace_only_what_they_name() {
+        let md5 = object(&[(MD5_ANNOTATION, MD5)]);
+        let sha = object(&[]);
+        let check = |pairs: &[(hyper::header::HeaderName, &str)], existing: Option<&Object>| {
+            WriteConditions::of(&headers(pairs))
+                .ok()
+                .unwrap()
+                .precondition()
+                .is_none_or(|p| p(existing))
+        };
+        assert!(
+            WriteConditions::of(&headers(&[]))
+                .ok()
+                .unwrap()
+                .precondition()
+                .is_none()
+        );
+        assert!(check(&[], Some(&md5)));
+        // create only
+        assert!(check(&[(IF_NONE_MATCH, "*")], None));
+        assert!(!check(&[(IF_NONE_MATCH, "*")], Some(&md5)));
+        // compare and swap, on either ETag form
+        let e = format!("\"{MD5}\"");
+        assert!(check(&[(IF_MATCH, &e)], Some(&md5)));
+        assert!(!check(&[(IF_MATCH, &e)], Some(&sha)));
+        assert!(check(&[(IF_MATCH, &format!("\"{SHA}\""))], Some(&sha)));
+        assert!(!check(&[(IF_MATCH, &e)], None));
+        assert!(check(&[(IF_MATCH, "*")], Some(&sha)));
+        assert!(!check(&[(IF_MATCH, "*")], None));
+        // only `*` is served for If-None-Match
+        assert!(WriteConditions::of(&headers(&[(IF_NONE_MATCH, &e)])).is_err());
+    }
+}
diff --git a/vk-registry/src/s3/meta.rs b/vk-registry/src/s3/meta.rs
new file mode 100644
index 00000000..b4fe2c5c
--- /dev/null
+++ b/vk-registry/src/s3/meta.rs
@@ -0,0 +1,160 @@
+//! User metadata: the `x-amz-meta-<name>` headers of a write, kept as manifest annotations
+//! `org.virtkit.s3-meta.<name>` and sent back on reads. Sync tools keep a file's own
+//! modification time there.
+
+use std::collections::BTreeMap;
+
+use hyper::header::{HeaderMap, HeaderName, HeaderValue};
+
+/// The prefix of a user metadata header.
+const HEADER_PREFIX: &str = "x-amz-meta-";
+
+/// The prefix of the annotation each one is kept as.
+const ANNOTATION_PREFIX: &str = "org.virtkit.s3-meta.";
+
+/// Most bytes of user metadata, names and values together: S3's own bound.
+pub(crate) const MAX_METADATA: usize = 2048;
+
+/// Why a write's metadata is refused: an S3 error code and the rule.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Refusal {
+    pub(crate) code: &'static str,
+    pub(crate) message: &'static str,
+}
+
+/// The annotations a write's `x-amz-meta-*` headers become. A name is `[a-z0-9-]`, matched
+/// without regard to case (header names arrive lowercase) and kept lowercase; a value is text;
+/// a name sent twice is one value, the two joined by a comma, as HTTP joins them.
+pub(crate) fn annotations(headers: &HeaderMap) -> Result<BTreeMap<String, String>, Refusal> {
+    let mut out = BTreeMap::new();
+    let mut total = 0usize;
+    for name in headers.keys() {
+        let Some(short) = name.as_str().strip_prefix(HEADER_PREFIX) else {
+            continue;
+        };
+        let short = short.to_ascii_lowercase();
+        if short.is_empty()
+            || !short
+                .bytes()
+                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
+        {
+            return Err(Refusal {
+                code: "InvalidArgument",
+                message: "a metadata name is x-amz-meta- then a run of a-z 0-9 -",
+            });
+        }
+        let values = headers
+            .get_all(name)
+            .iter()
+            .map(|v| v.to_str())
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(|_| Refusal {
+                code: "InvalidArgument",
+                message: "a metadata value is printable ASCII",
+            })?;
+        let value = values.join(",");
+        total = total
+            .saturating_add(short.len())
+            .saturating_add(value.len());
+        if total > MAX_METADATA {
+            return Err(Refusal {
+                code: "MetadataTooLarge",
+                message: "user metadata is at most 2 KiB, names and values together",
+            });
+        }
+        out.insert(format!("{ANNOTATION_PREFIX}{short}"), value);
+    }
+    Ok(out)
+}
+
+/// The `x-amz-meta-*` headers an object's annotations hold; one that cannot be a header any
+/// more is left out.
+pub(crate) fn headers(
+    annotations: &BTreeMap<String, String>,
+) -> impl Iterator<Item = (HeaderName, HeaderValue)> + '_ {
+    annotations.iter().filter_map(|(k, v)| {
+        let short = k.strip_prefix(ANNOTATION_PREFIX)?;
+        let name = HeaderName::from_bytes(format!("{HEADER_PREFIX}{short}").as_bytes()).ok()?;
+        Some((name, HeaderValue::from_str(v).ok()?))
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn of(pairs: &[(&str, &str)]) -> Result<BTreeMap<String, String>, Refusal> {
+        let mut h = HeaderMap::new();
+        for (n, v) in pairs {
+            h.append(
+                HeaderName::from_bytes(n.as_bytes()).unwrap(),
+                HeaderValue::from_str(v).unwrap(),
+            );
+        }
+        annotations(&h)
+    }
+
+    #[test]
+    fn metadata_round_trips_through_annotations() {
+        let a = of(&[
+            ("X-Amz-Meta-Mtime", "1700000000"),
+            ("x-amz-meta-a-1", "x"),
+            ("x-amz-meta-a-1", "y"),
+            ("content-type", "text/html"),
+            ("x-amz-date", "20260101T000000Z"),
+        ])
+        .unwrap();
+        assert_eq!(
+            a,
+            BTreeMap::from([
+                ("org.virtkit.s3-meta.a-1".to_string(), "x,y".to_string()),
+                (
+                    "org.virtkit.s3-meta.mtime".to_string(),
+                    "1700000000".to_string()
+                ),
+            ])
+        );
+        let mut all = a.clone();
+        all.insert("org.virtkit.md5".into(), "00".into());
+        let back: Vec<(String, String)> = headers(&all)
+            .map(|(n, v)| (n.to_string(), v.to_str().unwrap().to_string()))
+            .collect();
+        assert_eq!(
+            back,
+            [
+                ("x-amz-meta-a-1".to_string(), "x,y".to_string()),
+                ("x-amz-meta-mtime".to_string(), "1700000000".to_string()),
+            ]
+        );
+        assert_eq!(of(&[]).unwrap(), BTreeMap::new());
+    }
+
+    #[test]
+    fn names_and_sizes_are_bounded() {
+        for bad in ["x-amz-meta-", "x-amz-meta-a_b", "x-amz-meta-a.b"] {
+            assert_eq!(
+                of(&[(bad, "v")]).unwrap_err().code,
+                "InvalidArgument",
+                "{bad}"
+            );
+        }
+        let mut h = HeaderMap::new();
+        h.insert("x-amz-meta-v", HeaderValue::from_bytes(b"caf\xe9").unwrap());
+        assert_eq!(annotations(&h).unwrap_err().code, "InvalidArgument");
+        // 2 KiB exactly, names counted without their prefix
+        let fill = "v".repeat(MAX_METADATA - 2);
+        assert!(of(&[("x-amz-meta-ab", &fill)]).is_ok());
+        let over = "v".repeat(MAX_METADATA - 1);
+        assert_eq!(
+            of(&[("x-amz-meta-ab", &over)]).unwrap_err().code,
+            "MetadataTooLarge"
+        );
+        let half = "v".repeat(MAX_METADATA / 2);
+        assert_eq!(
+            of(&[("x-amz-meta-a", &half), ("x-amz-meta-b", &half)])
+                .unwrap_err()
+                .code,
+            "MetadataTooLarge"
+        );
+    }
+}
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index cf66de58..eab98bec 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -5,7 +5,17 @@
 //! nothing new is stored; or by the bearer, Basic or session credential the other routes
 //! take. Every answer carries an `x-amz-request-id`, and refusals are S3's XML `Error`.
 //! Presigned URLs and temporary credentials are refused.
+//!
+//! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
+//! one, served over the object layer the WebDAV view shares ([`crate::files`]): [`bucket`]
+//! answers the service and its buckets, [`object`] the objects. Operations not served yet
+//! answer `NotImplemented`.
 
+mod bucket;
+mod conditional;
+mod meta;
+mod object;
+mod path;
 mod sigv4;
 mod xml;
 
@@ -17,6 +27,7 @@ use hyper::header::{
 use hyper::{Method, Request, Response, StatusCode};
 use vk_hub_proto::token::Claims;
 
+use crate::files::{MAX_OBJECT, PutError};
 use crate::{Authenticator, Authz, Body, ServerState, accounts, hubtoken};
 
 /// Whether `path` is one this module answers.
@@ -35,12 +46,11 @@ const REQUEST_ID: &str = "x-amz-request-id";
 /// Serve one `/s3/…` request, from its credentials on: [`crate::route`] hands every such
 /// request here before its own gate when S3 is on.
 pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result<Response<Body>> {
-    let id = accounts::random_token(8);
-    let path = req.uri().path().to_string();
     let ctx = Ctx {
-        id: &id,
-        path: &path,
+        id: accounts::random_token(8),
+        path: req.uri().path().to_string(),
     };
+    let id = &ctx.id;
     let mut resp = match serve(state, req, &ctx).await {
         Ok(resp) => resp,
         Err(e) => {
@@ -49,24 +59,49 @@ pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result
         }
     };
     let headers = resp.headers_mut();
-    headers.insert(REQUEST_ID, HeaderValue::from_str(&id)?);
+    headers.insert(REQUEST_ID, HeaderValue::from_str(id)?);
     headers.insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));
     Ok(resp)
 }
 
 /// What every answer to a request names: its id and the path it asked for.
-struct Ctx<'a> {
-    id: &'a str,
-    path: &'a str,
+#[derive(Clone)]
+struct Ctx {
+    id: String,
+    path: String,
 }
 
-impl Ctx<'_> {
+impl Ctx {
     fn error(&self, status: StatusCode, code: &str, message: &str) -> Response<Body> {
-        xml::error(status, code, message, &[], self.path, self.id)
+        xml::error(status, code, message, &[], &self.path, &self.id)
+    }
+
+    fn not_implemented(&self) -> Response<Body> {
+        self.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "this registry does not serve that operation",
+        )
+    }
+
+    fn access_denied(&self) -> Response<Body> {
+        self.error(
+            StatusCode::FORBIDDEN,
+            "AccessDenied",
+            "the credential grants nothing for this bucket or key",
+        )
+    }
+
+    fn too_large(&self) -> Response<Body> {
+        self.error(
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "EntityTooLarge",
+            "an object is at most 4 GiB",
+        )
     }
 }
 
-fn internal_error(ctx: &Ctx<'_>) -> Response<Body> {
+fn internal_error(ctx: &Ctx) -> Response<Body> {
     ctx.error(
         StatusCode::INTERNAL_SERVER_ERROR,
         "InternalError",
@@ -92,11 +127,7 @@ impl Who {
     }
 }
 
-async fn serve(
-    state: &ServerState,
-    req: Request<Incoming>,
-    ctx: &Ctx<'_>,
-) -> Result<Response<Body>> {
+async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result<Response<Body>> {
     let headers = req.headers();
     // Browsers attach cookies or Basic credentials to cross-site requests, as on every
     // other machine route.
@@ -139,7 +170,7 @@ async fn serve(
     };
 
     // A hub managing the registry may make it refuse writes for a while.
-    if state.store.read_only() && crate::is_store_write(req.method(), ctx.path) {
+    if state.store.read_only() && crate::is_store_write(req.method(), &ctx.path) {
         let mut resp = ctx.error(
             StatusCode::SERVICE_UNAVAILABLE,
             "ServiceUnavailable",
@@ -147,40 +178,88 @@ async fn serve(
         );
         resp.headers_mut()
             .insert(RETRY_AFTER, HeaderValue::from_static("60"));
-        return crate::dav::refuse(req, resp, ctx.path).await;
+        return refuse(req, resp, ctx).await;
     }
-    unserved(&who.authz(), req, ctx).await
+    operate(state, &who.authz(), req, ctx).await
+}
+
+/// The query parameter an AWS SDK adds to name the operation it calls, which says nothing
+/// the method and path do not.
+const OPERATION_HINT: &str = "x-id";
+
+/// The subresource a query names (`location`, `attributes`, `uploads`…): `None` for a query
+/// of [`OPERATION_HINT`] at most, `Some("")` when it names more than one parameter or names
+/// one with a value — which nothing served here takes.
+fn subresource(query: &str) -> Option<&str> {
+    let mut names = query
+        .split('&')
+        .filter(|p| !p.is_empty())
+        .filter(|p| p.split_once('=').map_or(*p, |(n, _)| n) != OPERATION_HINT);
+    let first = names.next()?;
+    Some(match (first.split_once('='), names.next()) {
+        (None | Some((_, "")), None) => first.trim_end_matches('='),
+        _ => "",
+    })
 }
 
-/// The answer to an authenticated request while no S3 operation is served: a read of an
-/// object or a bucket finds nothing, whoever `_authz` names, and anything else is not
-/// implemented. The body is read through first, as after any authenticated refusal.
-async fn unserved(
-    _authz: &Authz<'_>,
+/// An authenticated request, to the operation its method, path and query name. What is not
+/// served answers `NotImplemented` once the body is read, as every refusal past the gate does.
+async fn operate(
+    state: &ServerState,
+    authz: &Authz<'_>,
     req: Request<Incoming>,
-    ctx: &Ctx<'_>,
+    ctx: &Ctx,
 ) -> Result<Response<Body>> {
-    let rest = ctx.path.strip_prefix("/s3").unwrap_or_default();
-    let rest = rest.strip_prefix('/').unwrap_or(rest);
-    let read = matches!(req.method(), &Method::GET | &Method::HEAD);
-    let resp = match rest.split_once('/') {
-        _ if !read || rest.is_empty() => ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "this registry does not serve that operation",
-        ),
-        None | Some((_, "")) => ctx.error(
-            StatusCode::NOT_FOUND,
-            "NoSuchBucket",
-            "the specified bucket does not exist",
-        ),
-        Some(_) => ctx.error(
-            StatusCode::NOT_FOUND,
-            "NoSuchKey",
-            "the specified key does not exist",
-        ),
+    let target = match path::parse(&ctx.path) {
+        Ok(target) => target,
+        Err(why) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
+            return refuse(req, resp, ctx).await;
+        }
     };
-    crate::dav::refuse(req, resp, ctx.path).await
+    let query = req.uri().query().unwrap_or("").to_string();
+    let sub = subresource(&query);
+    let method = req.method().clone();
+    match (target, &method, sub) {
+        (path::Target::Service, &Method::GET, None) => bucket::list(state, authz, req, ctx).await,
+        (path::Target::Bucket(b), &Method::HEAD, None) => {
+            bucket::head(state, authz, b, req, ctx).await
+        }
+        (path::Target::Bucket(b), &Method::GET, Some("location")) => {
+            bucket::location(state, authz, b, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, &Method::GET | &Method::HEAD, None) => {
+            object::get(state, authz, segs, method == Method::HEAD, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, &Method::GET, Some("attributes")) => {
+            object::attributes(state, authz, segs, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, &Method::PUT, None) => {
+            object::put(state, authz, segs, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, &Method::DELETE, None) => {
+            object::delete(state, authz, segs, req, ctx).await
+        }
+        _ => refuse(req, ctx.not_implemented(), ctx).await,
+    }
+}
+
+/// Answer `resp` once the request body has been read through, as after every refusal of an
+/// authenticated request: a status sent with request bytes unread resets the connection,
+/// which a client sees instead of the answer. A body past the object cap is refused with 413
+/// instead.
+async fn refuse(req: Request<Incoming>, resp: Response<Body>, ctx: &Ctx) -> Result<Response<Body>> {
+    Ok(drain(req, ctx).await?.unwrap_or(resp))
+}
+
+/// Read a request's body through and discard it: `Some(413)` if it crosses the object cap.
+async fn drain(req: Request<Incoming>, ctx: &Ctx) -> Result<Option<Response<Body>>> {
+    let sink = &mut tokio::io::sink();
+    match crate::files::drain_into(sink, req.into_body(), MAX_OBJECT, &mut |_| {}).await {
+        Ok(_) => Ok(None),
+        Err(PutError::TooLarge) => Ok(Some(ctx.too_large())),
+        Err(PutError::Failed(e)) => Err(e),
+    }
 }
 
 /// Answer `resp` to a request refused before it was authenticated, having read at most
@@ -207,7 +286,7 @@ fn is_presigned(query: &str) -> bool {
 fn presented(
     state: &ServerState,
     req: &Request<Incoming>,
-    ctx: &Ctx<'_>,
+    ctx: &Ctx,
 ) -> std::result::Result<Who, Box<Response<Body>>> {
     let denied = || {
         let message = if req.headers().contains_key(AUTHORIZATION) {
@@ -255,7 +334,7 @@ fn token(
 
 /// The answer when the accounts database could not be read: the release taking over is
 /// asked again, anything else is logged under the request's id.
-fn resolve_failed(e: anyhow::Error, ctx: &Ctx<'_>) -> Box<Response<Body>> {
+fn resolve_failed(e: anyhow::Error, ctx: &Ctx) -> Box<Response<Body>> {
     if accounts::is_handed_over_error(&e) {
         return Box::new(crate::ask_again(ctx.error(
             StatusCode::SERVICE_UNAVAILABLE,
@@ -279,7 +358,7 @@ fn resolve_failed(e: anyhow::Error, ctx: &Ctx<'_>) -> Box<Response<Body>> {
 fn signed_by(
     state: &ServerState,
     req: &Request<Incoming>,
-    ctx: &Ctx<'_>,
+    ctx: &Ctx,
 ) -> std::result::Result<Who, Box<Response<Body>>> {
     let headers = req.headers();
     let malformed = |why: &str| {
@@ -326,8 +405,8 @@ fn signed_by(
                     ("ServerTime", &server_time),
                     ("MaxAllowedSkewMilliseconds", &skew),
                 ],
-                ctx.path,
-                ctx.id,
+                &ctx.path,
+                &ctx.id,
             )));
         }
     }
@@ -390,8 +469,8 @@ fn signed_by(
             "SignatureDoesNotMatch",
             "the request signature does not match the one computed with the key's secret",
             &[("StringToSign", &sts), ("CanonicalRequest", &canonical)],
-            ctx.path,
-            ctx.id,
+            &ctx.path,
+            &ctx.id,
         )));
     }
     Ok(who)
@@ -433,6 +512,23 @@ mod tests {
         assert!(!is_presigned(""));
     }
 
+    #[test]
+    fn a_query_names_one_subresource_or_none() {
+        assert_eq!(subresource(""), None);
+        assert_eq!(subresource("x-id=GetObject"), None);
+        assert_eq!(subresource("location"), Some("location"));
+        assert_eq!(subresource("location="), Some("location"));
+        assert_eq!(
+            subresource("attributes&x-id=GetObjectAttributes"),
+            Some("attributes")
+        );
+        assert_eq!(subresource("x-id=PutObject&tagging"), Some("tagging"));
+        assert_eq!(subresource("list-type=2"), Some(""));
+        assert_eq!(subresource("partNumber=1&uploadId=a"), Some(""));
+        assert_eq!(subresource("location&acl"), Some(""));
+        assert_eq!(subresource("versionId=null"), Some(""));
+    }
+
     #[test]
     fn the_id_becomes_one_bearer_header_or_nothing() {
         let h = bearer_of("vkr_abc").unwrap();
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
new file mode 100644
index 00000000..42d2337a
--- /dev/null
+++ b/vk-registry/src/s3/object.rs
@@ -0,0 +1,654 @@
+//! Objects: PutObject, GetObject and HeadObject, GetObjectAttributes and DeleteObject, over
+//! the object layer the WebDAV view shares. Authorized as that view authorizes: a write needs
+//! `Write` on the key's parent repository, a read `Read` on the repository the key resolves
+//! to; a caller holding the action on neither the key's path nor its parent is refused before
+//! any lookup, and what it may not read is absent (`NoSuchKey`).
+//!
+//! An object is served as bytes and nothing else: `application/octet-stream`, `attachment`
+//! and `nosniff` whatever its writer said, since this origin also serves `/browse` and holds
+//! the session cookie. Its ETag is the MD5 its S3 write recorded, or its SHA-256 (see
+//! [`conditional::etag`]).
+
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use hyper::body::Incoming;
+use hyper::header::{
+    CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LENGTH, ETAG, HeaderMap, HeaderValue,
+    LAST_MODIFIED,
+};
+use hyper::{Request, Response, StatusCode};
+use sha1::Digest as _;
+
+use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::{Ctx, drain, meta, refuse, xml};
+use crate::dav::http_date;
+use crate::files::{
+    self, Commit, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, object_of,
+    repo_name,
+};
+use crate::{Authz, Body, ServerState, Store, accounts, body_of};
+
+/// The header asking a read for the object's checksum.
+const CHECKSUM_MODE: &str = "x-amz-checksum-mode";
+
+/// The checksum a read answers with, when asked: the SHA-256 the store names the bytes by.
+const CHECKSUM_SHA256: &str = "x-amz-checksum-sha256";
+
+/// Whether this caller may `action` on the key at `segs` or on its parent: what admits a
+/// request to the lookup that then decides on the repository the key resolves to.
+fn admitted(authz: &Authz<'_>, action: accounts::Action, segs: &[String]) -> bool {
+    allowed(authz, action, &repo_name(segs))
+        || object_of(segs).is_some_and(|(parent, _)| allowed(authz, action, &parent))
+}
+
+fn no_such_key(ctx: &Ctx) -> Response<Body> {
+    ctx.error(
+        StatusCode::NOT_FOUND,
+        "NoSuchKey",
+        "the specified key does not exist",
+    )
+}
+
+/// The object at `segs` as this caller may read it: `None` when nothing is there, when a
+/// directory or a foreign tag is, or when the caller may not read the repository it is in or
+/// its bytes through it.
+fn readable(store: &Store, authz: &Authz<'_>, segs: &[String]) -> Result<Option<Object>> {
+    Ok(match files::resolve(store, segs)? {
+        Some(Node::Object(obj))
+            if allowed(authz, accounts::Action::Read, &obj.repo)
+                && crate::readable_through(authz, store, &obj.repo, &obj.layer) =>
+        {
+            Some(obj)
+        }
+        _ => None,
+    })
+}
+
+/// The SHA-256 of an object, as S3's checksum headers and elements carry it: base64.
+fn sha256_base64(layer: &str) -> String {
+    vk_hub_proto::to_base64(&hex_bytes(layer).unwrap_or_default())
+}
+
+fn hex_bytes(hex: &str) -> Option<Vec<u8>> {
+    let b = hex.as_bytes();
+    if !b.len().is_multiple_of(2) {
+        return None;
+    }
+    b.chunks(2)
+        .map(|pair| {
+            std::str::from_utf8(pair)
+                .ok()
+                .and_then(|p| u8::from_str_radix(p, 16).ok())
+        })
+        .collect()
+}
+
+fn insert(headers: &mut HeaderMap, name: hyper::header::HeaderName, value: &str) {
+    if let Ok(v) = HeaderValue::from_str(value) {
+        headers.insert(name, v);
+    }
+}
+
+/// `GET`/`HEAD /s3/<bucket>/<key>`: the object's bytes, after its conditional headers. A GET
+/// served refreshes an idle object's tag, as a WebDAV GET does; a HEAD touches nothing.
+/// `Range` is ignored: a whole 200 is a legal answer to it.
+pub(super) async fn get(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    head: bool,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !admitted(authz, accounts::Action::Read, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let conditions = Conditions::of(req.headers());
+    let checksum = req
+        .headers()
+        .get(CHECKSUM_MODE)
+        .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"ENABLED"));
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let Some(obj) = readable(store, authz, &segs)? else {
+            return Ok(no_such_key(&ctx));
+        };
+        let etag = conditional::etag_of(&obj);
+        let modified = http_date(obj.modified);
+        match conditions.evaluate(&etag, obj.modified) {
+            Outcome::Serve => {}
+            Outcome::NotModified => {
+                let mut resp = Response::builder()
+                    .status(StatusCode::NOT_MODIFIED)
+                    .body(body_of(bytes::Bytes::new()))?;
+                insert(resp.headers_mut(), ETAG, &etag);
+                insert(resp.headers_mut(), LAST_MODIFIED, &modified);
+                return Ok(resp);
+            }
+            Outcome::Failed(condition) => {
+                return Ok(xml::error(
+                    StatusCode::PRECONDITION_FAILED,
+                    "PreconditionFailed",
+                    "at least one of the preconditions you specified did not hold",
+                    &[("Condition", condition)],
+                    &ctx.path,
+                    &ctx.id,
+                ));
+            }
+        }
+        let mut resp =
+            crate::serve_blob(store, &format!("sha256:{}", obj.layer), head, false, false)?;
+        // The layer gone under the tag (a gc between the two reads) is no object either.
+        if resp.status() != StatusCode::OK {
+            return Ok(no_such_key(&ctx));
+        }
+        if !head {
+            files::touch_if_idle(store, &obj);
+        }
+        let headers = resp.headers_mut();
+        headers.remove("docker-content-digest");
+        headers.insert(CONTENT_DISPOSITION, HeaderValue::from_static("attachment"));
+        insert(headers, ETAG, &etag);
+        insert(headers, LAST_MODIFIED, &modified);
+        if checksum {
+            insert(
+                headers,
+                hyper::header::HeaderName::from_static(CHECKSUM_SHA256),
+                &sha256_base64(&obj.layer),
+            );
+        }
+        for (name, value) in meta::headers(&obj.annotations) {
+            headers.append(name, value);
+        }
+        Ok(resp)
+    })
+    .await
+}
+
+/// `GET /s3/<bucket>/<key>?attributes`: what `x-amz-object-attributes` asks of `ETag`,
+/// `Checksum`, `ObjectSize` and `StorageClass` (`ObjectParts` has nothing to say of an object
+/// written whole), with `Last-Modified`. A metadata read, so it touches nothing.
+pub(super) async fn attributes(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !admitted(authz, accounts::Action::Read, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let mut asked = Vec::new();
+    for value in req.headers().get_all("x-amz-object-attributes") {
+        let Ok(value) = value.to_str() else {
+            asked.clear();
+            break;
+        };
+        asked.extend(value.split(',').map(|a| a.trim().to_string()));
+    }
+    let known = [
+        "ETag",
+        "Checksum",
+        "ObjectParts",
+        "StorageClass",
+        "ObjectSize",
+    ];
+    if asked.is_empty() || asked.iter().any(|a| !known.contains(&a.as_str())) {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidArgument",
+            "x-amz-object-attributes names some of ETag, Checksum, ObjectParts, StorageClass \
+             and ObjectSize",
+        );
+        return refuse(req, resp, ctx).await;
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let Some(obj) = readable(store, authz, &segs)? else {
+            return Ok(no_such_key(&ctx));
+        };
+        let has = |a: &str| asked.iter().any(|x| x == a);
+        let mut inner = String::new();
+        if has("ETag") {
+            // Unquoted here, as S3 writes it in this document.
+            inner.push_str(&xml::element(
+                "ETag",
+                conditional::etag_of(&obj).trim_matches('"'),
+            ));
+        }
+        if has("Checksum") {
+            inner.push_str(&format!(
+                "<Checksum>{}</Checksum>",
+                xml::element("ChecksumSHA256", &sha256_base64(&obj.layer))
+            ));
+        }
+        if has("StorageClass") {
+            inner.push_str(&xml::element("StorageClass", "STANDARD"));
+        }
+        if has("ObjectSize") {
+            inner.push_str(&xml::element("ObjectSize", &obj.size.to_string()));
+        }
+        let mut resp = xml::document("GetObjectAttributesResponse", &inner);
+        insert(resp.headers_mut(), LAST_MODIFIED, &http_date(obj.modified));
+        Ok(resp)
+    })
+    .await
+}
+
+/// How a PutObject's body is bound to its signature, by `x-amz-content-sha256`.
+enum Payload {
+    /// `UNSIGNED-PAYLOAD`, or no header (an unsigned request)
+    Unsigned,
+    /// the body's SHA-256, lowercase hex
+    Sha256(String),
+}
+
+/// The digests a PutObject asks to be checked against what arrives, each as bytes.
+#[derive(Default)]
+struct Expected {
+    md5: Option<Vec<u8>>,
+    sha256: Option<Vec<u8>>,
+    sha1: Option<Vec<u8>>,
+    crc32: Option<Vec<u8>>,
+    /// the `x-amz-checksum-*` headers to echo once they held
+    echo: Vec<(&'static str, String)>,
+}
+
+/// What a PutObject's headers ask that cannot be served, or are malformed: a status, a code
+/// and a message.
+type Refused = (StatusCode, &'static str, &'static str);
+
+fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
+    let chunked = headers.get_all(CONTENT_ENCODING).iter().any(|v| {
+        v.to_str().is_ok_and(|v| {
+            v.split(',')
+                .any(|e| e.trim().eq_ignore_ascii_case("aws-chunked"))
+        })
+    });
+    let streaming = (
+        StatusCode::NOT_IMPLEMENTED,
+        "NotImplemented",
+        "aws-chunked uploads are not served yet: send UNSIGNED-PAYLOAD or the body's SHA-256",
+    );
+    if chunked {
+        return Err(streaming);
+    }
+    let Some(value) = headers.get("x-amz-content-sha256") else {
+        return Ok(Payload::Unsigned);
+    };
+    let value = value.to_str().unwrap_or_default();
+    if value == "UNSIGNED-PAYLOAD" {
+        return Ok(Payload::Unsigned);
+    }
+    if value.starts_with("STREAMING-") {
+        return Err(streaming);
+    }
+    if value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return Ok(Payload::Sha256(value.to_ascii_lowercase()));
+    }
+    Err((
+        StatusCode::BAD_REQUEST,
+        "InvalidArgument",
+        "x-amz-content-sha256 is UNSIGNED-PAYLOAD or the body's SHA-256 in hex",
+    ))
+}
+
+fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
+    // The header's text and the bytes it decodes to, `len` of them.
+    let decoded = |name: &str, len: usize| -> std::result::Result<Option<(String, Vec<u8>)>, ()> {
+        let Some(v) = headers.get(name) else {
+            return Ok(None);
+        };
+        let text = v.to_str().map_err(|_| ())?.trim();
+        let bytes = crate::auth::base64_decode(text)
+            .filter(|b| b.len() == len)
+            .ok_or(())?;
+        Ok(Some((text.to_string(), bytes)))
+    };
+    let md5 = decoded("content-md5", 16).map_err(|()| {
+        (
+            StatusCode::BAD_REQUEST,
+            "InvalidDigest",
+            "Content-MD5 is the body's MD5 in base64",
+        )
+    })?;
+    let mut out = Expected {
+        md5: md5.map(|(_, b)| b),
+        ..Expected::default()
+    };
+    for (name, len) in [
+        ("x-amz-checksum-sha256", 32),
+        ("x-amz-checksum-sha1", 20),
+        ("x-amz-checksum-crc32", 4),
+    ] {
+        let value = decoded(name, len).map_err(|()| {
+            (
+                StatusCode::BAD_REQUEST,
+                "InvalidRequest",
+                "an x-amz-checksum header is the checksum of the body in base64",
+            )
+        })?;
+        if let Some((text, value)) = value {
+            out.echo.push((name, text));
+            match name {
+                "x-amz-checksum-sha256" => out.sha256 = Some(value),
+                "x-amz-checksum-sha1" => out.sha1 = Some(value),
+                _ => out.crc32 = Some(value),
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// The digests computed while a body streams: MD5 always (the ETag), SHA-1 and CRC32 only
+/// when the request asks to be checked against them.
+struct Digests {
+    md5: md5::Context,
+    sha1: Option<sha1::Sha1>,
+    crc32: Option<crc32fast::Hasher>,
+}
+
+impl Digests {
+    fn for_(expected: &Expected) -> Self {
+        Digests {
+            md5: md5::Context::new(),
+            sha1: expected.sha1.is_some().then(sha1::Sha1::new),
+            crc32: expected.crc32.is_some().then(crc32fast::Hasher::new),
+        }
+    }
+
+    fn update(&mut self, data: &[u8]) {
+        self.md5.consume(data);
+        if let Some(h) = &mut self.sha1 {
+            h.update(data);
+        }
+        if let Some(h) = &mut self.crc32 {
+            h.update(data);
+        }
+    }
+}
+
+/// The answer to a write at a path that takes no object, with what is in the way.
+fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
+    let message = match why {
+        Unwritable::TopLevel => "a bucket takes no object of its own name",
+        Unwritable::Directory => "this key is a prefix of other keys, and cannot be an object",
+        Unwritable::Foreign => "this key holds content that is not a file, pushed over /v2/",
+        Unwritable::UnderObject => "a prefix of this key is an object, which cannot hold keys",
+    };
+    ctx.error(StatusCode::CONFLICT, "OperationAborted", message)
+}
+
+/// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
+/// what the request said of it, then tag it under the namespace lock, with its MD5 and user
+/// metadata on the manifest and the request's `If-None-Match: *`/`If-Match` checked there.
+/// Its `Content-Type` is not kept: every object is served as bytes.
+pub(super) async fn put(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let parent = object_of(&segs).map(|(parent, _)| parent);
+    if !parent.is_some_and(|p| allowed(authz, accounts::Action::Write, &p)) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let headers = req.headers();
+    // A declared length over the cap is refused unread; the connection then closes.
+    if headers
+        .get(CONTENT_LENGTH)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.parse::<u64>().ok())
+        .is_some_and(|n| n > MAX_OBJECT)
+    {
+        return Ok(ctx.too_large());
+    }
+    if headers.contains_key("x-amz-copy-source") {
+        return refuse(req, ctx.not_implemented(), ctx).await;
+    }
+    let checked = payload(headers).and_then(|p| Ok((p, expected(headers)?)));
+    let (payload, expected) = match checked {
+        Ok(checked) => checked,
+        Err((status, code, message)) => {
+            return refuse(req, ctx.error(status, code, message), ctx).await;
+        }
+    };
+    let mut annotations = match meta::annotations(headers) {
+        Ok(a) => a,
+        Err(why) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    let Ok(conditions) = WriteConditions::of(headers) else {
+        let resp = ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "a write's If-None-Match is * or nothing",
+        );
+        return refuse(req, resp, ctx).await;
+    };
+    // Refused before the body is staged when the answer is already known; checked again
+    // once it is, under the namespace lock.
+    let early = {
+        let (store, segs) = (Arc::clone(&state.store), segs.clone());
+        tokio::task::spawn_blocking(move || files::unwritable(&store, &segs))
+            .await
+            .context("checking a PUT panicked")??
+    };
+    if let Some(why) = early {
+        return refuse(req, unwritable(why, ctx), ctx).await;
+    }
+
+    let mut digests = Digests::for_(&expected);
+    let staged = match files::stage(&state.store, req.into_body(), &mut |d| digests.update(d)).await
+    {
+        Ok(staged) => staged,
+        Err(PutError::TooLarge) => return Ok(ctx.too_large()),
+        Err(PutError::Failed(e)) => return Err(e),
+    };
+    // A refusal from here on drops `staged`, which unlinks it: nothing is tagged.
+    if let Payload::Sha256(signed) = &payload
+        && *signed != staged.hex
+    {
+        return Ok(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "XAmzContentSHA256Mismatch",
+            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
+        ));
+    }
+    let md5 = digests.md5.finalize().0;
+    let sha1 = digests.sha1.map(|h| h.finalize().to_vec());
+    let crc32 = digests.crc32.map(|h| h.finalize().to_be_bytes().to_vec());
+    if expected.md5.as_deref().is_some_and(|m| m != md5) {
+        return Ok(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "BadDigest",
+            "the Content-MD5 you specified did not match what was received",
+        ));
+    }
+    let sha256 = hex_bytes(&staged.hex);
+    let mismatch = |expected: &Option<Vec<u8>>, got: &Option<Vec<u8>>| {
+        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
+    };
+    if mismatch(&expected.sha256, &sha256)
+        || mismatch(&expected.sha1, &sha1)
+        || mismatch(&expected.crc32, &crc32)
+    {
+        return Ok(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "BadDigest",
+            "the x-amz-checksum you specified did not match the checksum of what was received",
+        ));
+    }
+    let md5_hex = crate::hex_of(&md5);
+    annotations.insert(MD5_ANNOTATION.to_string(), md5_hex.clone());
+    let how = Commit {
+        annotations,
+        precondition: conditions.precondition(),
+    };
+    let written = files::commit(Arc::clone(&state.store), segs, staged, how).await?;
+    match written {
+        Written::Created | Written::Replaced => {}
+        Written::Refused(why) => return Ok(unwritable(why, ctx)),
+        Written::PreconditionFailed => {
+            return Ok(ctx.error(
+                StatusCode::PRECONDITION_FAILED,
+                "PreconditionFailed",
+                "at least one of the preconditions you specified did not hold",
+            ));
+        }
+    }
+    let mut resp = Response::builder()
+        .status(StatusCode::OK)
+        .header(CONTENT_LENGTH, "0")
+        .body(body_of(bytes::Bytes::new()))?;
+    let headers = resp.headers_mut();
+    insert(headers, ETAG, &format!("\"{md5_hex}\""));
+    for (name, value) in expected.echo {
+        insert(
+            headers,
+            hyper::header::HeaderName::from_static(name),
+            &value,
+        );
+    }
+    Ok(resp)
+}
+
+/// `DELETE /s3/<bucket>/<key>`: 204 whether or not the key held an object, as S3 answers;
+/// a key that is a directory has no object to delete, and is 204 too. A foreign tag is not
+/// this view's to delete (409), and a caller that may read the object but not write it is
+/// refused (403). Under the namespace lock, as every change of `files/` is.
+pub(super) async fn delete(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !admitted(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let _namespace = files::namespace(store)?;
+        let node = match files::resolve(store, &segs)? {
+            Some(node) if allowed(authz, accounts::Action::Read, node.repo()) => node,
+            // Nothing there, as far as this caller can tell.
+            _ => return Ok(no_content()),
+        };
+        if !allowed(authz, accounts::Action::Write, node.repo()) {
+            return Ok(ctx.access_denied());
+        }
+        match node {
+            Node::Object(obj) => {
+                store.delete_tag(&obj.repo, &obj.tag)?;
+            }
+            Node::Foreign(_) => {
+                return Ok(unwritable(Unwritable::Foreign, &ctx));
+            }
+            Node::Dir(_) => {}
+        }
+        Ok(no_content())
+    })
+    .await
+}
+
+fn no_content() -> Response<Body> {
+    Response::builder()
+        .status(StatusCode::NO_CONTENT)
+        .body(body_of(bytes::Bytes::new()))
+        .expect("building a 204")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn headers(pairs: &[(&str, &str)]) -> HeaderMap {
+        let mut h = HeaderMap::new();
+        for (n, v) in pairs {
+            h.append(
+                hyper::header::HeaderName::from_bytes(n.as_bytes()).unwrap(),
+                HeaderValue::from_str(v).unwrap(),
+            );
+        }
+        h
+    }
+
+    #[test]
+    fn a_payload_is_unsigned_or_its_sha256_and_streaming_waits() {
+        let code = |pairs: &[(&str, &str)]| payload(&headers(pairs)).err().map(|e| e.1);
+        assert!(matches!(payload(&headers(&[])), Ok(Payload::Unsigned)));
+        assert!(matches!(
+            payload(&headers(&[("x-amz-content-sha256", "UNSIGNED-PAYLOAD")])),
+            Ok(Payload::Unsigned)
+        ));
+        let hex = "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855";
+        assert!(matches!(
+            payload(&headers(&[("x-amz-content-sha256", hex)])),
+            Ok(Payload::Sha256(h)) if h == hex.to_ascii_lowercase()
+        ));
+        for streaming in [
+            "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
+            "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+        ] {
+            assert_eq!(
+                code(&[("x-amz-content-sha256", streaming)]),
+                Some("NotImplemented")
+            );
+        }
+        assert_eq!(
+            code(&[("content-encoding", "gzip, aws-chunked")]),
+            Some("NotImplemented")
+        );
+        assert_eq!(
+            code(&[("x-amz-content-sha256", "abc")]),
+            Some("InvalidArgument")
+        );
+    }
+
+    #[test]
+    fn checksums_are_base64_of_their_length() {
+        let md5 = vk_hub_proto::to_base64(&[0u8; 16]);
+        let sha = vk_hub_proto::to_base64(&[1u8; 32]);
+        let e = expected(&headers(&[
+            ("content-md5", &md5),
+            ("x-amz-checksum-sha256", &sha),
+            ("x-amz-checksum-crc32c", "AAAAAA=="),
+        ]))
+        .ok()
+        .unwrap();
+        assert_eq!(e.md5, Some(vec![0u8; 16]));
+        assert_eq!(e.sha256, Some(vec![1u8; 32]));
+        assert_eq!(e.echo, [("x-amz-checksum-sha256", sha.clone())]);
+        let code = |pairs: &[(&str, &str)]| expected(&headers(pairs)).err().map(|e| e.1);
+        assert_eq!(code(&[("content-md5", "AAAA")]), Some("InvalidDigest"));
+        assert_eq!(code(&[("content-md5", "!!")]), Some("InvalidDigest"));
+        assert_eq!(
+            code(&[("x-amz-checksum-sha256", &md5)]),
+            Some("InvalidRequest")
+        );
+        assert_eq!(
+            code(&[("x-amz-checksum-crc32", &md5)]),
+            Some("InvalidRequest")
+        );
+    }
+
+    #[test]
+    fn hex_decodes_whole_bytes_only() {
+        assert_eq!(hex_bytes("00ff10"), Some(vec![0, 255, 16]));
+        assert_eq!(hex_bytes("0"), None);
+        assert_eq!(hex_bytes("zz"), None);
+        let sha = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+        assert_eq!(
+            sha256_base64(sha),
+            "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="
+        );
+    }
+}
diff --git a/vk-registry/src/s3/path.rs b/vk-registry/src/s3/path.rs
new file mode 100644
index 00000000..c8a26690
--- /dev/null
+++ b/vk-registry/src/s3/path.rs
@@ -0,0 +1,259 @@
+//! The path of an `/s3/` request as what it names in `files/`: the service, a bucket (a
+//! top-level directory) or an object (a key below one). Split before percent-decoding, so an
+//! escaped `/` cannot make one component two, and decoded as the WebDAV view decodes its
+//! paths. A key maps onto the store's names as they are, so it has to be one: each component
+//! a repository name's component, the leaf a tag, no empty component and no trailing slash.
+//! Arbitrary keys would need an escaping scheme, which this view deliberately does not have.
+
+use crate::dav::decode_segment;
+
+/// Most components a key may have: a repository name's bound less `files` and the bucket.
+pub(crate) const MAX_KEY_COMPONENTS: usize = crate::MAX_NAME_SEGMENTS - 2;
+
+/// Longest key, in bytes once decoded: S3's own bound.
+pub(crate) const MAX_KEY: usize = 1024;
+
+/// Longest key component, in bytes: a filename's.
+const MAX_COMPONENT: usize = 255;
+
+/// What a path names.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Target {
+    /// `/s3` or `/s3/`
+    Service,
+    /// `/s3/<bucket>`, with or without a trailing slash
+    Bucket(String),
+    /// `/s3/<bucket>/<key>`: `segs` are the bucket then the key's components, the path below
+    /// `files/` the object layer takes
+    Object { key: String, segs: Vec<String> },
+}
+
+/// Why a path names nothing this view serves: an S3 error code and the rule it broke.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Refusal {
+    pub(crate) code: &'static str,
+    pub(crate) message: &'static str,
+}
+
+const fn refusal(code: &'static str, message: &'static str) -> Refusal {
+    Refusal { code, message }
+}
+
+const BAD_BUCKET: Refusal = refusal(
+    "InvalidBucketName",
+    "a bucket name is one run of A-Z a-z 0-9 . _ - and not tags, manifests or blobs",
+);
+const BAD_ESCAPE: Refusal = refusal(
+    "InvalidArgument",
+    "the key has a malformed percent escape or is not UTF-8",
+);
+const EMPTY_COMPONENT: Refusal = refusal(
+    "InvalidArgument",
+    "a key has no empty component and does not end in a slash",
+);
+const BAD_CHARACTER: Refusal = refusal(
+    "InvalidArgument",
+    "a key's components are runs of A-Z a-z 0-9 . _ - only",
+);
+const DOT_COMPONENT: Refusal = refusal("InvalidArgument", "a key component cannot be . or ..");
+const RESERVED_COMPONENT: Refusal = refusal(
+    "InvalidArgument",
+    "a key component cannot be tags, manifests or blobs",
+);
+const TOO_DEEP: Refusal = refusal("InvalidArgument", "a key has at most 14 components");
+const COMPONENT_TOO_LONG: Refusal =
+    refusal("KeyTooLongError", "a key component is at most 255 bytes");
+const KEY_TOO_LONG: Refusal = refusal("KeyTooLongError", "a key is at most 1024 bytes");
+
+/// What the path of a request under `/s3` names; the caller dispatches only `/s3` paths here.
+pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
+    let rest = path.strip_prefix("/s3").unwrap_or(path);
+    let rest = rest.strip_prefix('/').unwrap_or(rest);
+    if rest.is_empty() {
+        return Ok(Target::Service);
+    }
+    let (raw_bucket, raw_key) = match rest.split_once('/') {
+        Some((b, k)) => (b, Some(k)),
+        None => (rest, None),
+    };
+    let bucket = decode_segment(raw_bucket)
+        .filter(|b| crate::valid_name(b) && !b.contains('/') && b.len() <= MAX_COMPONENT)
+        .ok_or(BAD_BUCKET)?;
+    let raw_key = match raw_key {
+        None | Some("") => return Ok(Target::Bucket(bucket)),
+        Some(k) => k,
+    };
+    let mut segs = vec![bucket];
+    for raw in raw_key.split('/') {
+        if segs.len() > MAX_KEY_COMPONENTS {
+            return Err(TOO_DEEP);
+        }
+        segs.push(component(raw)?);
+    }
+    let key = segs.get(1..).unwrap_or_default().join("/");
+    if key.len() > MAX_KEY {
+        return Err(KEY_TOO_LONG);
+    }
+    Ok(Target::Object { key, segs })
+}
+
+/// One key component, decoded and held to a repository name's component rule (which the
+/// leaf, as a tag, also passes).
+fn component(raw: &str) -> Result<String, Refusal> {
+    if raw.is_empty() {
+        return Err(EMPTY_COMPONENT);
+    }
+    let seg = decode_segment(raw).ok_or(BAD_ESCAPE)?;
+    if seg.len() > MAX_COMPONENT {
+        return Err(COMPONENT_TOO_LONG);
+    }
+    if seg.is_empty() {
+        return Err(EMPTY_COMPONENT);
+    }
+    if !seg
+        .bytes()
+        .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'))
+    {
+        return Err(BAD_CHARACTER);
+    }
+    if seg == "." || seg == ".." {
+        return Err(DOT_COMPONENT);
+    }
+    if !crate::valid_name(&seg) {
+        return Err(RESERVED_COMPONENT);
+    }
+    Ok(seg)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn object(key: &str) -> Result<Target, Refusal> {
+        parse(&format!("/s3/b/{key}"))
+    }
+
+    #[track_caller]
+    fn refused(key: &str, code: &str) -> &'static str {
+        match object(key) {
+            Err(r) => {
+                assert_eq!(r.code, code, "{key:?}: {}", r.message);
+                r.message
+            }
+            Ok(t) => panic!("accepted {key:?} as {t:?}"),
+        }
+    }
+
+    #[test]
+    fn the_service_and_buckets_are_named_by_one_component() {
+        assert_eq!(parse("/s3"), Ok(Target::Service));
+        assert_eq!(parse("/s3/"), Ok(Target::Service));
+        assert_eq!(parse("/s3/sccache"), Ok(Target::Bucket("sccache".into())));
+        assert_eq!(parse("/s3/sccache/"), Ok(Target::Bucket("sccache".into())));
+        assert_eq!(parse("/s3/a%2Db"), Ok(Target::Bucket("a-b".into())));
+        for bad in [
+            "/s3//",
+            "/s3//k",
+            "/s3/a%2Fb",
+            "/s3/..",
+            "/s3/.",
+            "/s3/tags",
+            "/s3/blobs/k",
+            "/s3/a b",
+            "/s3/a%20b",
+            "/s3/%C3%A9",
+            "/s3/a%2",
+        ] {
+            let r = parse(bad).unwrap_err();
+            assert_eq!(r.code, "InvalidBucketName", "{bad}");
+        }
+    }
+
+    #[test]
+    fn sccache_keys_map_onto_the_files_tree() {
+        assert_eq!(
+            object(".sccache_check"),
+            Ok(Target::Object {
+                key: ".sccache_check".into(),
+                segs: vec!["b".into(), ".sccache_check".into()],
+            })
+        );
+        let hex = "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0";
+        let Ok(Target::Object { key, segs }) = object(&format!("a/b/c/{hex}")) else {
+            panic!("a sharded key");
+        };
+        assert_eq!(key, format!("a/b/c/{hex}"));
+        assert_eq!(segs, ["b", "a", "b", "c", hex]);
+        let (repo, tag) = crate::files::object_of(&segs).unwrap();
+        assert_eq!((repo.as_str(), tag), ("files/b/a/b/c", hex));
+        assert!(crate::valid_name(&crate::files::repo_name(&segs)));
+        // An escape of an allowed character is that character.
+        assert!(matches!(object("a%2Db"), Ok(Target::Object { key, .. }) if key == "a-b"));
+    }
+
+    #[test]
+    fn the_deepest_and_longest_keys_pass() {
+        let deepest = vec!["x"; MAX_KEY_COMPONENTS].join("/");
+        let Ok(Target::Object { segs, .. }) = object(&deepest) else {
+            panic!("14 components");
+        };
+        assert_eq!(segs.len(), crate::MAX_NAME_SEGMENTS - 1);
+        assert!(crate::valid_name(&crate::files::repo_name(&segs)));
+        assert!(object(&"x".repeat(255)).is_ok());
+        assert_eq!(longest().len(), MAX_KEY);
+        assert!(object(&longest()).is_ok());
+    }
+
+    /// A key of exactly [`MAX_KEY`] bytes, no component over 255.
+    fn longest() -> String {
+        format!("{0}/{0}/{0}/{1}/y", "x".repeat(255), "x".repeat(254))
+    }
+
+    #[test]
+    fn keys_outside_the_store_s_names_are_refused_naming_the_rule() {
+        let too_deep = vec!["x"; MAX_KEY_COMPONENTS + 1].join("/");
+        assert!(refused(&too_deep, "InvalidArgument").contains("14"));
+        assert!(refused(&"x".repeat(256), "KeyTooLongError").contains("255"));
+        let over = format!("{}y", longest());
+        assert_eq!(over.len(), MAX_KEY + 1);
+        assert!(refused(&over, "KeyTooLongError").contains("1024"));
+        for empty in ["a//b", "a/", "a/b/", "/a"] {
+            assert!(
+                refused(empty, "InvalidArgument").contains("empty"),
+                "{empty}"
+            );
+        }
+        for dot in [".", "..", "a/./b", "a/../b", "%2E%2E/x"] {
+            assert!(refused(dot, "InvalidArgument").contains(". or .."), "{dot}");
+        }
+        for reserved in ["tags", "a/manifests/b", "blobs/x", "a/blobs"] {
+            assert!(
+                refused(reserved, "InvalidArgument").contains("tags, manifests or blobs"),
+                "{reserved}"
+            );
+        }
+        for bad in [
+            "a%2Fb",
+            "a%5Cb",
+            "%C3%A9",
+            "caf\u{e9}",
+            "a b",
+            "a%20b",
+            "a%00b",
+            "a%0Ab",
+            "a%7F",
+            "a+b",
+            "a~b",
+            "a:b",
+            "a*b",
+        ] {
+            assert!(
+                refused(bad, "InvalidArgument").contains("A-Z a-z 0-9 . _ -"),
+                "{bad}"
+            );
+        }
+        for bad in ["a%2", "a%G0", "%FF", "%C3"] {
+            assert!(refused(bad, "InvalidArgument").contains("escape"), "{bad}");
+        }
+    }
+}
diff --git a/vk-registry/src/s3/xml.rs b/vk-registry/src/s3/xml.rs
index 6217ecf7..721e126c 100644
--- a/vk-registry/src/s3/xml.rs
+++ b/vk-registry/src/s3/xml.rs
@@ -1,11 +1,39 @@
-//! The XML S3 answers in: the `Error` document every refusal carries.
+//! The XML S3 answers in: the `Error` document every refusal carries, and the documents of
+//! the operations that answer with one.
 
 use bytes::Bytes;
-use hyper::header::CONTENT_TYPE;
+use hyper::header::{CONTENT_LENGTH, CONTENT_TYPE};
 use hyper::{Response, StatusCode};
 
 use crate::{Body, body_of};
 
+/// The namespace of S3's documents.
+pub(crate) const NS: &str = "http://s3.amazonaws.com/doc/2006-03-01/";
+
+/// The XML declaration every document starts with.
+const DECLARATION: &str = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>";
+
+/// A 200 answer whose document is `root`, in S3's namespace, holding `inner`: elements
+/// already built, every caller string in them escaped.
+pub(crate) fn document(root: &str, inner: &str) -> Response<Body> {
+    let body = if inner.is_empty() {
+        format!("{DECLARATION}<{root} xmlns=\"{NS}\"/>")
+    } else {
+        format!("{DECLARATION}<{root} xmlns=\"{NS}\">{inner}</{root}>")
+    };
+    Response::builder()
+        .status(StatusCode::OK)
+        .header(CONTENT_TYPE, "application/xml")
+        .header(CONTENT_LENGTH, body.len().to_string())
+        .body(body_of(Bytes::from(body)))
+        .expect("building an S3 document")
+}
+
+/// `<name>text</name>`, the text escaped.
+pub(crate) fn element(name: &str, text: &str) -> String {
+    format!("<{name}>{}</{name}>", escape(text))
+}
+
 /// Escape a string for XML text: [`crate::html_escape`]'s five characters are XML's too.
 /// What reaches it is a request path, a header value or a message of ours, none of which
 /// can hold a control character XML 1.0 has no way to write.
@@ -25,12 +53,12 @@ pub(crate) fn error(
     request_id: &str,
 ) -> Response<Body> {
     let mut body = format!(
-        "<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>{}</Code><Message>{}</Message>",
+        "{DECLARATION}<Error><Code>{}</Code><Message>{}</Message>",
         escape(code),
         escape(message)
     );
     for (name, value) in extra {
-        body.push_str(&format!("<{name}>{}</{name}>", escape(value)));
+        body.push_str(&element(name, value));
     }
     body.push_str(&format!(
         "<Resource>{}</Resource><RequestId>{}</RequestId></Error>",
@@ -71,4 +99,30 @@ mod tests {
              <RequestId>0123456789abcdef</RequestId></Error>"
         );
     }
+
+    #[tokio::test]
+    async fn a_document_is_in_s3_s_namespace() {
+        let body = async |resp: Response<Body>| {
+            assert_eq!(resp.status(), 200);
+            assert_eq!(resp.headers()[CONTENT_TYPE], "application/xml");
+            let len: usize = resp.headers()[CONTENT_LENGTH]
+                .to_str()
+                .unwrap()
+                .parse()
+                .unwrap();
+            let body = resp.into_body().collect().await.unwrap().to_bytes();
+            assert_eq!(body.len(), len);
+            String::from_utf8(body.to_vec()).unwrap()
+        };
+        assert_eq!(
+            body(document("LocationConstraint", "")).await,
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+             <LocationConstraint xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"/>"
+        );
+        assert_eq!(
+            body(document("R", &element("Name", "a<b"))).await,
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+             <R xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"><Name>a&lt;b</Name></R>"
+        );
+    }
 }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index b2ea66ef..12879658 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1,7 +1,8 @@
 //! S3 over real HTTP: the gate `/s3/` requests pass, under every authentication mode the
-//! server has. SigV4 requests are signed here by a signer of the tests' own, checked against
-//! AWS's published example; responses are read off a raw socket, so a test sees exactly what
-//! a connection carries and can send a second request on it.
+//! server has, and the operations on buckets and objects behind it. SigV4 requests are signed
+//! here by a signer of the tests' own, checked against AWS's published example; responses are
+//! read off a raw socket, so a test sees exactly what a connection carries and can send a
+//! second request on it.
 
 use std::sync::Arc;
 use std::time::{Duration, SystemTime};
@@ -251,6 +252,11 @@ impl Req {
 
     /// Signed for `host` by `key` (id, secret), `skew` seconds off now (UNSIGNED-PAYLOAD).
     fn signed(self, host: &str, key: (&str, &str), skew: i64) -> Self {
+        self.signed_payload(host, key, skew, UNSIGNED)
+    }
+
+    /// [`Req::signed`] with `payload` as the `x-amz-content-sha256` the signature binds.
+    fn signed_payload(self, host: &str, key: (&str, &str), skew: i64, payload: &str) -> Self {
         let at = stamp(vk_peer::now_secs().saturating_add_signed(skew));
         let auth = authorization(
             self.method,
@@ -258,14 +264,14 @@ impl Req {
             &self.query,
             &[
                 ("host", host),
-                ("x-amz-content-sha256", UNSIGNED),
+                ("x-amz-content-sha256", payload),
                 ("x-amz-date", &at),
             ],
-            UNSIGNED,
+            payload,
             key,
             &at,
         );
-        self.header("x-amz-content-sha256", UNSIGNED)
+        self.header("x-amz-content-sha256", payload)
             .header("x-amz-date", &at)
             .header("Authorization", &auth)
     }
@@ -285,12 +291,13 @@ impl Req {
     }
 }
 
-/// A response: its status, headers (names lowercase) and body.
+/// A response: its status, headers (names lowercase) and body, also as text.
 #[derive(Debug)]
 struct Resp {
     status: u16,
     headers: Vec<(String, String)>,
     body: String,
+    bytes: Vec<u8>,
 }
 
 impl Resp {
@@ -301,10 +308,9 @@ impl Resp {
             .map(|(_, v)| v.as_str())
     }
 
-    /// The status, the S3 headers every `/s3/` answer carries, and for an error its XML
-    /// `Code` and the request id the header names.
+    /// The status and the S3 headers every `/s3/` answer carries.
     #[track_caller]
-    fn is(&self, status: u16, code: &str) -> &Self {
+    fn ok(&self, status: u16) -> &Self {
         assert_eq!(self.status, status, "{self:?}");
         let id = self.header("x-amz-request-id").expect("a request id");
         assert!(
@@ -312,6 +318,14 @@ impl Resp {
             "{id}"
         );
         assert_eq!(self.header("x-content-type-options"), Some("nosniff"));
+        self
+    }
+
+    /// [`Resp::ok`], and for an error its XML `Code` and the request id the header names.
+    #[track_caller]
+    fn is(&self, status: u16, code: &str) -> &Self {
+        self.ok(status);
+        let id = self.header("x-amz-request-id").expect("a request id");
         assert_eq!(self.header("content-type"), Some("application/xml"));
         assert!(
             self.body
@@ -359,10 +373,16 @@ impl Conn {
             .await
             .unwrap();
         write.write_all(&req.body).await.unwrap();
-        self.response().await
+        self.response_to(req.method == "HEAD").await
     }
 
     async fn response(&mut self) -> Resp {
+        self.response_to(false).await
+    }
+
+    /// The next response; `head` when it answers a HEAD, which has no body whatever its
+    /// `Content-Length` says.
+    async fn response_to(&mut self, head: bool) -> Resp {
         let mut line = String::new();
         self.read.read_line(&mut line).await.unwrap();
         let status = line
@@ -384,13 +404,15 @@ impl Conn {
         let len: usize = headers
             .iter()
             .find(|(n, _)| n == "content-length")
+            .filter(|_| !head)
             .map_or(0, |(_, v)| v.parse().unwrap());
-        let mut body = vec![0; len];
-        self.read.read_exact(&mut body).await.unwrap();
+        let mut bytes = vec![0; len];
+        self.read.read_exact(&mut bytes).await.unwrap();
         Resp {
             status,
             headers,
-            body: String::from_utf8(body).unwrap(),
+            body: String::from_utf8_lossy(&bytes).into_owned(),
+            bytes,
         }
     }
 
@@ -486,20 +508,24 @@ async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
     send(&host, get("/s3/b/k/deeper"))
         .await
         .is(404, "NoSuchKey");
-    send(&host, get("/s3/b")).await.is(404, "NoSuchBucket");
-    send(&host, get("/s3/b/")).await.is(404, "NoSuchBucket");
-    send(&host, get("/s3/")).await.is(501, "NotImplemented");
-    send(&host, get("/s3")).await.is(501, "NotImplemented");
+    // Listing a bucket is not served yet; listing the buckets is not on an open server.
+    send(&host, get("/s3/b")).await.is(501, "NotImplemented");
+    send(&host, get("/s3/b/")).await.is(501, "NotImplemented");
+    send(&host, get("/s3/")).await.is(403, "AccessDenied");
+    send(&host, get("/s3")).await.is(403, "AccessDenied");
     send(
         &host,
         Req::new("PUT", "/s3/b/k").body(b"Hello, World!".to_vec()),
     )
     .await
-    .is(501, "NotImplemented");
+    .ok(200);
+    let resp = send(&host, get("/s3/b/k")).await;
+    resp.ok(200);
+    assert_eq!(resp.body, "Hello, World!");
     // Any key will do, its signature unchecked.
     send(
         &host,
-        get("/s3/b/k").signed(&host, ("anyone", "anything"), 0),
+        get("/s3/b/absent").signed(&host, ("anyone", "anything"), 0),
     )
     .await
     .is(404, "NoSuchKey");
@@ -546,20 +572,24 @@ async fn a_shared_bearer_is_the_access_key_and_its_secret() {
         .is(404, "NoSuchKey");
     sigv4_refusals(&host, ("s3cret", "s3cret")).await;
 
-    // A hub token is a key too, signed or as a bearer; an expired one, or one for another
-    // registry, is not.
+    // A hub token is a key too, signed or as a bearer, for what its grants cover; an expired
+    // one, or one for another registry, is not.
     let now = vk_peer::now_secs();
     let token = signer.sign(hub_claims(AUD, now - 1, now + 600)).unwrap();
-    send(&host, get().signed(&host, (&token, &token), 0))
+    let granted = || Req::new("GET", "/s3/p/gl/42/k");
+    send(&host, granted().signed(&host, (&token, &token), 0))
         .await
         .is(404, "NoSuchKey");
     send(
         &host,
-        get().header("Authorization", &format!("Bearer {token}")),
+        granted().header("Authorization", &format!("Bearer {token}")),
     )
     .await
     .is(404, "NoSuchKey");
-    send(&host, get().signed(&host, (&token, "other"), 0))
+    send(&host, get().signed(&host, (&token, &token), 0))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, granted().signed(&host, (&token, "other"), 0))
         .await
         .is(403, "SignatureDoesNotMatch");
     for bad in [
@@ -807,3 +837,736 @@ async fn a_read_only_registry_refuses_writes_with_retry_after() {
         .await
         .is(404, "NoSuchKey");
 }
+
+// ---- objects and buckets ----
+
+const HELLO: &[u8] = b"Hello, World!";
+const MANIFEST_TYPE: &str = "application/vnd.oci.image.manifest.v1+json";
+
+fn md5_hex(b: &[u8]) -> String {
+    hex(&md5::compute(b).0)
+}
+
+fn sha256_hex(b: &[u8]) -> String {
+    hex(&sha2::Sha256::digest(b))
+}
+
+fn b64(b: &[u8]) -> String {
+    vk_hub_proto::to_base64(b)
+}
+
+/// Files in `uploads/`, where a PUT stages its object.
+fn staging_left(dir: &std::path::Path) -> usize {
+    std::fs::read_dir(dir.join("store/uploads")).map_or(0, |d| {
+        d.filter_map(|e| e.ok())
+            .filter(|e| e.file_type().is_ok_and(|t| t.is_file()))
+            .count()
+    })
+}
+
+/// How a test's requests are authenticated: a function from a request to the signed one.
+type Sign<'a> = &'a dyn Fn(Req) -> Req;
+
+/// What every served object carries, beside its bytes.
+#[track_caller]
+fn is_object(resp: &Resp, body: &[u8]) {
+    resp.ok(200);
+    assert_eq!(resp.bytes, body);
+    assert_eq!(
+        resp.header("content-length"),
+        Some(&*body.len().to_string())
+    );
+    assert_eq!(
+        resp.header("content-type"),
+        Some("application/octet-stream")
+    );
+    assert_eq!(resp.header("content-disposition"), Some("attachment"));
+    assert!(resp.header("last-modified").is_some(), "{resp:?}");
+    assert_eq!(resp.header("accept-ranges"), None);
+    assert_eq!(resp.header("docker-content-digest"), None);
+}
+
+/// What `sccache` does with its S3 backend, OpenDAL's requests: its startup probe of
+/// `.sccache_check`, the probe written, a cache entry written and read back, and the HEAD
+/// OpenDAL's `stat` sends.
+async fn sccache_sequence(host: &str, sign: Sign<'_>, prefix: &str) {
+    let check = format!("/s3/sccache/{prefix}.sccache_check");
+    send(host, sign(Req::new("GET", &check)))
+        .await
+        .is(404, "NoSuchKey");
+    let resp = send(host, sign(Req::new("PUT", &check).body(HELLO.to_vec()))).await;
+    resp.ok(200);
+    let etag = format!("\"{}\"", md5_hex(HELLO));
+    assert_eq!(resp.header("etag"), Some(&*etag));
+    let resp = send(host, sign(Req::new("GET", &check))).await;
+    is_object(&resp, HELLO);
+    assert_eq!(resp.header("etag"), Some(&*etag));
+
+    let entry: Vec<u8> = (0..70_000u32).map(|i| (i % 251) as u8).collect();
+    let key = format!(
+        "/s3/sccache/{prefix}a/b/c/{}",
+        sha256_hex(b"an entry's key")
+    );
+    send(host, sign(Req::new("PUT", &key).body(entry.clone())))
+        .await
+        .ok(200);
+    let resp = send(host, sign(Req::new("GET", &key))).await;
+    is_object(&resp, &entry);
+    assert_eq!(
+        resp.header("etag"),
+        Some(&*format!("\"{}\"", md5_hex(&entry)))
+    );
+    let resp = send(host, sign(Req::new("HEAD", &key))).await;
+    resp.ok(200);
+    assert!(resp.bytes.is_empty());
+    assert_eq!(
+        resp.header("content-length"),
+        Some(&*entry.len().to_string())
+    );
+    assert_eq!(resp.header("content-disposition"), Some("attachment"));
+}
+
+#[tokio::test]
+async fn the_sccache_sequence_round_trips_on_an_open_server() {
+    let dir = tmp("sccache-open");
+    let host = spawn(open_state(&dir, true));
+    sccache_sequence(&host, &|r| r, "").await;
+    let signed = |r: Req| r.signed(&host, ("anyone", "anything"), 0);
+    sccache_sequence(&host, &signed, "ci/").await;
+    assert_eq!(staging_left(&dir), 0);
+}
+
+#[tokio::test]
+async fn the_sccache_sequence_round_trips_with_an_api_key() {
+    let dir = tmp("sccache-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let scopes = [Scope {
+        action: Action::Write,
+        repo_pattern: "files/*".to_string(),
+    }];
+    let (_, key) = db
+        .create_api_key(Some(&user.id), "s3", &scopes, None)
+        .unwrap();
+    let host = spawn(state.clone());
+    let signed = |r: Req| r.signed(&host, (&key, &key), 0);
+    sccache_sequence(&host, &signed, "ci/").await;
+    // The bearer on the same paths still works.
+    let bearer = |r: Req| r.header("Authorization", &format!("Bearer {key}"));
+    sccache_sequence(&host, &bearer, "other/").await;
+}
+
+/// The payload modes: unsigned, or the body's SHA-256, which the body must then have. A
+/// streamed `aws-chunked` body is not decoded yet, so it is refused and its framing never
+/// becomes an object.
+#[tokio::test]
+async fn a_put_body_is_unsigned_or_its_signed_sha256_and_streaming_waits() {
+    let dir = tmp("payload");
+    let (state, _) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    let key = ("s3cret", "s3cret");
+    let put = |path: &str, body: &[u8]| Req::new("PUT", path).body(body.to_vec());
+    let get = |path: &str| Req::new("GET", path).signed(&host, key, 0);
+
+    send(&host, put("/s3/b/unsigned", HELLO).signed(&host, key, 0))
+        .await
+        .ok(200);
+    is_object(&send(&host, get("/s3/b/unsigned")).await, HELLO);
+
+    // The body's own digest, any case.
+    let hex = sha256_hex(HELLO);
+    for (path, digest) in [
+        ("/s3/b/hex", hex.clone()),
+        ("/s3/b/HEX", hex.to_uppercase()),
+    ] {
+        let req = put(path, HELLO).signed_payload(&host, key, 0, &digest);
+        send(&host, req).await.ok(200);
+        is_object(&send(&host, get(path)).await, HELLO);
+    }
+    // Another body's: refused, and nothing tagged.
+    let req = put("/s3/b/mismatch", b"Hello, World?").signed_payload(&host, key, 0, &hex);
+    send(&host, req).await.is(400, "XAmzContentSHA256Mismatch");
+    send(&host, get("/s3/b/mismatch"))
+        .await
+        .is(404, "NoSuchKey");
+    let req = put("/s3/b/garbage", HELLO).signed_payload(&host, key, 0, "not-a-digest");
+    send(&host, req).await.is(400, "InvalidArgument");
+
+    // AWS's chunked framing, signed or announced: not stored as the object it would become.
+    let framed = b"d;chunk-signature=ad80c730a21e5b8d04586a2213dd63b9a0e99e0e2307b0ade35a65485a288648\r\n\
+Hello, World!\r\n0;chunk-signature=b6c6ea8a5354eaf15b3cb7646744f4275b71ea724fed81ceb9323e279d449df9\r\n\r\n";
+    for (path, req) in [
+        (
+            "/s3/b/streaming",
+            put("/s3/b/streaming", framed).signed_payload(
+                &host,
+                key,
+                0,
+                "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
+            ),
+        ),
+        (
+            "/s3/b/trailer",
+            put("/s3/b/trailer", framed).signed_payload(
+                &host,
+                key,
+                0,
+                "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+            ),
+        ),
+        (
+            "/s3/b/chunked",
+            put("/s3/b/chunked", framed)
+                .header("Content-Encoding", "aws-chunked")
+                .header("x-amz-decoded-content-length", "13")
+                .signed(&host, key, 0),
+        ),
+    ] {
+        send(&host, req).await.is(501, "NotImplemented");
+        send(&host, get(path)).await.is(404, "NoSuchKey");
+    }
+    assert!(
+        !dir.join("store/repos/files/b/tags/streaming").exists()
+            && !dir.join("store/repos/files/b/tags/chunked").exists()
+    );
+    assert_eq!(staging_left(&dir), 0);
+
+    // A declared length past 4 GiB is refused before a byte is read.
+    let req = put("/s3/b/big", b"").signed(&host, key, 0);
+    let head = req.head(&host).replace(
+        "Content-Length: 0",
+        &format!("Content-Length: {}", (4u64 << 30) + 1),
+    );
+    let mut conn = Conn::open(&host).await;
+    conn.write
+        .as_mut()
+        .unwrap()
+        .write_all(head.as_bytes())
+        .await
+        .unwrap();
+    let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
+        .await
+        .expect("answered unread");
+    resp.is(413, "EntityTooLarge");
+    assert_eq!(staging_left(&dir), 0);
+}
+
+#[tokio::test]
+async fn a_put_checks_the_digests_it_is_sent() {
+    let dir = tmp("digests");
+    let host = spawn(open_state(&dir, true));
+    let put = |path: &str, (name, value): (&str, &str)| {
+        Req::new("PUT", path)
+            .header(name, value)
+            .body(HELLO.to_vec())
+    };
+    let get = |path: &str| Req::new("GET", path);
+    let other = b"Hello, World?";
+    let sha1 = |b: &[u8]| {
+        use sha1::Digest as _;
+        sha1::Sha1::digest(b).to_vec()
+    };
+    let crc = |b: &[u8]| crc32fast::hash(b).to_be_bytes().to_vec();
+    let good: Vec<(&str, String)> = vec![
+        ("Content-MD5", b64(&md5::compute(HELLO).0)),
+        ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(HELLO))),
+        ("x-amz-checksum-sha1", b64(&sha1(HELLO))),
+        ("x-amz-checksum-crc32", b64(&crc(HELLO))),
+    ];
+    let bad: Vec<(&str, String)> = vec![
+        ("Content-MD5", b64(&md5::compute(other).0)),
+        ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(other))),
+        ("x-amz-checksum-sha1", b64(&sha1(other))),
+        ("x-amz-checksum-crc32", b64(&crc(other))),
+    ];
+    for (i, (name, value)) in good.iter().enumerate() {
+        let path = format!("/s3/b/good{i}");
+        let resp = send(&host, put(&path, (name, value))).await;
+        resp.ok(200);
+        if name.starts_with("x-amz-checksum") {
+            assert_eq!(resp.header(name), Some(value.as_str()), "{name}");
+        }
+        is_object(&send(&host, get(&path)).await, HELLO);
+    }
+    for (i, (name, value)) in bad.iter().enumerate() {
+        let path = format!("/s3/b/bad{i}");
+        send(&host, put(&path, (name, value)))
+            .await
+            .is(400, "BadDigest");
+        send(&host, get(&path)).await.is(404, "NoSuchKey");
+    }
+    send(&host, put("/s3/b/x", ("Content-MD5", "AAAA")))
+        .await
+        .is(400, "InvalidDigest");
+    send(&host, put("/s3/b/x", ("x-amz-checksum-sha256", "AAAA")))
+        .await
+        .is(400, "InvalidRequest");
+    // Not checked, so taken.
+    send(&host, put("/s3/b/c", ("x-amz-checksum-crc32c", "AAAAAA==")))
+        .await
+        .ok(200);
+    assert_eq!(staging_left(&dir), 0);
+
+    // On a read, the SHA-256 the store has, when asked.
+    let resp = send(&host, get("/s3/b/good0")).await;
+    assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+    let asked = get("/s3/b/good0").header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, asked).await;
+    is_object(&resp, HELLO);
+    assert_eq!(
+        resp.header("x-amz-checksum-sha256"),
+        Some(&*b64(&sha2::Sha256::digest(HELLO)))
+    );
+    let asked = Req::new("HEAD", "/s3/b/good0").header("x-amz-checksum-mode", "enabled");
+    let resp = send(&host, asked).await;
+    resp.ok(200);
+    assert_eq!(
+        resp.header("x-amz-checksum-sha256"),
+        Some(&*b64(&sha2::Sha256::digest(HELLO)))
+    );
+}
+
+#[tokio::test]
+async fn user_metadata_round_trips_and_no_content_type_is_kept() {
+    let dir = tmp("meta");
+    let host = spawn(open_state(&dir, true));
+    let resp = send(
+        &host,
+        Req::new("PUT", "/s3/b/m")
+            .header("Content-Type", "text/html")
+            .header("x-amz-meta-mtime", "1700000000")
+            .header("X-Amz-Meta-Foo-Bar", "baz qux")
+            .body(b"<script>".to_vec()),
+    )
+    .await;
+    resp.ok(200);
+    for method in ["GET", "HEAD"] {
+        let resp = send(&host, Req::new(method, "/s3/b/m")).await;
+        resp.ok(200);
+        assert_eq!(resp.header("x-amz-meta-mtime"), Some("1700000000"));
+        assert_eq!(resp.header("x-amz-meta-foo-bar"), Some("baz qux"));
+        assert_eq!(
+            resp.header("content-type"),
+            Some("application/octet-stream")
+        );
+        assert_eq!(resp.header("content-disposition"), Some("attachment"));
+    }
+    // Replaced whole: metadata not sent again is gone.
+    send(&host, Req::new("PUT", "/s3/b/m").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    let resp = send(&host, Req::new("GET", "/s3/b/m")).await;
+    assert_eq!(resp.header("x-amz-meta-mtime"), None);
+
+    let put = |name: &str, value: &str| {
+        Req::new("PUT", "/s3/b/refused")
+            .header(name, value)
+            .body(HELLO.to_vec())
+    };
+    send(&host, put("x-amz-meta-big", &"v".repeat(2048)))
+        .await
+        .is(400, "MetadataTooLarge");
+    send(&host, put("x-amz-meta-a_b", "v"))
+        .await
+        .is(400, "InvalidArgument");
+    send(&host, Req::new("GET", "/s3/b/refused"))
+        .await
+        .is(404, "NoSuchKey");
+}
+
+#[tokio::test]
+async fn conditional_headers_decide_reads_and_writes() {
+    let dir = tmp("conditional");
+    let host = spawn(open_state(&dir, true));
+    let put = |path: &str, body: &[u8]| Req::new("PUT", path).body(body.to_vec());
+    // Create only.
+    let create = |path: &str, body: &[u8]| put(path, body).header("If-None-Match", "*");
+    send(&host, create("/s3/b/k", HELLO)).await.ok(200);
+    send(&host, create("/s3/b/k", b"again"))
+        .await
+        .is(412, "PreconditionFailed");
+    let etag = format!("\"{}\"", md5_hex(HELLO));
+    // Compare and swap.
+    send(
+        &host,
+        put("/s3/b/k", b"swapped").header("If-Match", "\"0000\""),
+    )
+    .await
+    .is(412, "PreconditionFailed");
+    send(&host, put("/s3/b/absent", HELLO).header("If-Match", &etag))
+        .await
+        .is(412, "PreconditionFailed");
+    let resp = send(&host, put("/s3/b/k", b"swapped").header("If-Match", &etag)).await;
+    resp.ok(200);
+    let etag = format!("\"{}\"", md5_hex(b"swapped"));
+    assert_eq!(resp.header("etag"), Some(&*etag));
+    send(&host, put("/s3/b/k", HELLO).header("If-None-Match", &etag))
+        .await
+        .is(501, "NotImplemented");
+    assert_eq!(staging_left(&dir), 0);
+
+    let modified = send(&host, Req::new("GET", "/s3/b/k"))
+        .await
+        .header("last-modified")
+        .unwrap()
+        .to_string();
+    let past = "Mon, 01 Jan 2001 00:00:00 GMT";
+    let future = "Fri, 01 Jan 2100 00:00:00 GMT";
+    for method in ["GET", "HEAD"] {
+        let read = |name: &str, value: &str| Req::new(method, "/s3/b/k").header(name, value);
+        let served = |r: &Resp| {
+            r.ok(200);
+            assert_eq!(r.header("etag"), Some(&*etag));
+        };
+        let not_modified = |r: &Resp| {
+            r.ok(304);
+            assert_eq!(r.header("etag"), Some(&*etag));
+            assert!(r.bytes.is_empty());
+        };
+        let failed = |r: &Resp| {
+            r.ok(412);
+            if method == "GET" {
+                r.is(412, "PreconditionFailed");
+            }
+        };
+        served(&send(&host, read("If-Match", &etag)).await);
+        failed(&send(&host, read("If-Match", "\"other\"")).await);
+        not_modified(&send(&host, read("If-None-Match", &etag)).await);
+        served(&send(&host, read("If-None-Match", "\"other\"")).await);
+        not_modified(&send(&host, read("If-Modified-Since", &modified)).await);
+        not_modified(&send(&host, read("If-Modified-Since", future)).await);
+        served(&send(&host, read("If-Modified-Since", past)).await);
+        served(&send(&host, read("If-Unmodified-Since", &modified)).await);
+        failed(&send(&host, read("If-Unmodified-Since", past)).await);
+        // If-Match outranks a failing If-Unmodified-Since.
+        let both = read("If-Match", &etag).header("If-Unmodified-Since", past);
+        served(&send(&host, both).await);
+    }
+}
+
+#[tokio::test]
+async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
+    let dir = tmp("objects");
+    let state = open_state(&dir, true);
+    let store = state.store.clone();
+    let host = spawn(state);
+    let put = |path: &str| Req::new("PUT", path).body(HELLO.to_vec());
+    send(&host, put("/s3/b/k")).await.ok(200);
+    send(&host, put("/s3/b/d/x")).await.ok(200);
+
+    // GetObjectAttributes.
+    let attrs = |which: &str| {
+        Req::new("GET", "/s3/b/k")
+            .query("attributes")
+            .header("x-amz-object-attributes", which)
+    };
+    let resp = send(&host, attrs("ETag,ObjectSize, Checksum")).await;
+    resp.ok(200);
+    assert!(resp.header("last-modified").is_some());
+    assert_eq!(
+        resp.body,
+        format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><GetObjectAttributesResponse \
+             xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"><ETag>{}</ETag><Checksum>\
+             <ChecksumSHA256>{}</ChecksumSHA256></Checksum><ObjectSize>13</ObjectSize>\
+             </GetObjectAttributesResponse>",
+            md5_hex(HELLO),
+            b64(&sha2::Sha256::digest(HELLO))
+        )
+    );
+    send(&host, attrs("Nonsense"))
+        .await
+        .is(400, "InvalidArgument");
+    send(&host, Req::new("GET", "/s3/b/k").query("attributes"))
+        .await
+        .is(400, "InvalidArgument");
+    send(&host, attrs("ETag").path_of("/s3/b/absent"))
+        .await
+        .is(404, "NoSuchKey");
+
+    // Not served yet: other subresources, other verbs, copies.
+    for req in [
+        Req::new("GET", "/s3/b/k").query("tagging"),
+        Req::new("GET", "/s3/b/k").query("partNumber=1"),
+        Req::new("POST", "/s3/b/k").query("uploads"),
+        Req::new("GET", "/s3/b").query("list-type=2"),
+        put("/s3/b/copy").header("x-amz-copy-source", "/b/k"),
+    ] {
+        send(&host, req).await.is(501, "NotImplemented");
+    }
+    send(&host, Req::new("GET", "/s3/b/copy"))
+        .await
+        .is(404, "NoSuchKey");
+    // The SDK's operation hint is no subresource.
+    let resp = send(&host, Req::new("GET", "/s3/b/k").query("x-id=GetObject")).await;
+    is_object(&resp, HELLO);
+
+    // Keys the store cannot name.
+    for (path, code) in [
+        ("/s3/b/a%2Fb", "InvalidArgument"),
+        ("/s3/b/a%20b", "InvalidArgument"),
+        ("/s3/b/k/", "InvalidArgument"),
+        ("/s3/b/tags/x", "InvalidArgument"),
+        ("/s3/b/%2E%2E/x", "InvalidArgument"),
+        ("/s3/b/a+b", "InvalidArgument"),
+        ("/s3/tags/x", "InvalidBucketName"),
+    ] {
+        send(&host, put(path)).await.is(400, code);
+    }
+    let long = format!("/s3/b/{}", "x".repeat(256));
+    send(&host, put(&long)).await.is(400, "KeyTooLongError");
+
+    // Where an object cannot go: a directory, below an object, over a foreign tag.
+    store
+        .put_manifest(
+            "files/b/img",
+            "v1",
+            MANIFEST_TYPE,
+            br#"{"schemaVersion":2}"#,
+        )
+        .unwrap();
+    for path in ["/s3/b/d", "/s3/b/k/below", "/s3/b/img/v1"] {
+        let resp = send(&host, put(path)).await;
+        resp.is(409, "OperationAborted");
+    }
+    send(&host, Req::new("GET", "/s3/b/img/v1"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, Req::new("GET", "/s3/b/d"))
+        .await
+        .is(404, "NoSuchKey");
+
+    // DeleteObject: 204 there or not; a directory has no object to delete; a foreign tag is
+    // not this view's.
+    send(&host, Req::new("DELETE", "/s3/b/k")).await.ok(204);
+    send(&host, Req::new("GET", "/s3/b/k"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, Req::new("DELETE", "/s3/b/k")).await.ok(204);
+    send(&host, Req::new("DELETE", "/s3/nobucket/k"))
+        .await
+        .ok(204);
+    send(&host, Req::new("DELETE", "/s3/b/d")).await.ok(204);
+    is_object(&send(&host, Req::new("GET", "/s3/b/d/x")).await, HELLO);
+    send(&host, Req::new("DELETE", "/s3/b/img/v1"))
+        .await
+        .is(409, "OperationAborted");
+    assert!(dir.join("store/repos/files/b/img/tags/v1").is_file());
+    assert_eq!(staging_left(&dir), 0);
+}
+
+impl Req {
+    /// The same request at another path.
+    fn path_of(mut self, path: &str) -> Self {
+        self.path = path.to_string();
+        self
+    }
+}
+
+#[tokio::test]
+async fn buckets_are_the_top_level_directories() {
+    let dir = tmp("buckets");
+    let host = spawn(open_state(&dir, true));
+    send(&host, Req::new("PUT", "/s3/b/k").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    send(&host, Req::new("HEAD", "/s3/b")).await.ok(200);
+    send(&host, Req::new("HEAD", "/s3/b/")).await.ok(200);
+    send(&host, Req::new("HEAD", "/s3/none")).await.ok(404);
+    let location = |path: &str| Req::new("GET", path).query("location");
+    let resp = send(&host, location("/s3/b")).await;
+    resp.ok(200);
+    assert_eq!(
+        resp.body,
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+         <LocationConstraint xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"/>"
+    );
+    let resp = send(&host, location("/s3/b").signed(&host, ("any", "any"), 0)).await;
+    assert!(
+        resp.body.ends_with(">us-east-1</LocationConstraint>"),
+        "{}",
+        resp.body
+    );
+    send(&host, location("/s3/none"))
+        .await
+        .is(404, "NoSuchBucket");
+}
+
+/// Accounts mode: what each key may do follows its scopes, as on `/dav/files/`.
+#[tokio::test]
+async fn api_keys_reach_what_their_scopes_cover() {
+    let dir = tmp("scopes");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let key = |action, pattern: &str| {
+        let scopes = [Scope {
+            action,
+            repo_pattern: pattern.to_string(),
+        }];
+        db.create_api_key(Some(&user.id), pattern, &scopes, None)
+            .unwrap()
+            .1
+    };
+    let writer = key(Action::Write, "files/*");
+    let reader = key(Action::Read, "files/*");
+    let prefix = key(Action::Read, "files/b/p/*");
+    let on_key = key(Action::Read, "files/b/k/*");
+    let bucket_b = key(Action::Read, "files/b/*");
+    let host = spawn(state.clone());
+    let as_ = |k: &str, r: Req| r.signed(&host, (k, k), 0);
+    let put = |path: &str| Req::new("PUT", path).body(HELLO.to_vec());
+    let get = |path: &str| Req::new("GET", path);
+    for path in ["/s3/b/p/x", "/s3/b/q/y", "/s3/b/k", "/s3/c/z"] {
+        send(&host, as_(&writer, put(path))).await.ok(200);
+    }
+
+    // A read-only key's write is refused, its body read through first.
+    let resp = send(
+        &host,
+        as_(&reader, put("/s3/b/p/new").body(vec![7; 1 << 20])),
+    )
+    .await;
+    resp.is(403, "AccessDenied");
+    send(&host, as_(&reader, Req::new("DELETE", "/s3/b/k")))
+        .await
+        .is(403, "AccessDenied");
+    is_object(&send(&host, as_(&reader, get("/s3/b/k"))).await, HELLO);
+
+    // A prefix-scoped key reads its prefix and nothing beside it.
+    is_object(&send(&host, as_(&prefix, get("/s3/b/p/x"))).await, HELLO);
+    send(&host, as_(&prefix, get("/s3/b/p/absent")))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, as_(&prefix, get("/s3/b/q/y")))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, as_(&prefix, Req::new("HEAD", "/s3/b")))
+        .await
+        .ok(403);
+    // Holding the key's own path but not the bucket it is in: absent, not refused.
+    send(&host, as_(&on_key, get("/s3/b/k")))
+        .await
+        .is(404, "NoSuchKey");
+
+    // The buckets listed are those the key may read.
+    let buckets = |k: &str| {
+        let k = k.to_string();
+        let host = host.clone();
+        async move {
+            let resp = send(&host, get("/s3/").signed(&host, (&k, &k), 0)).await;
+            resp.ok(200);
+            assert!(
+                resp.body.contains(
+                    "<Owner><ID>vk-registry</ID><DisplayName>vk-registry</DisplayName></Owner>"
+                ),
+                "{}",
+                resp.body
+            );
+            resp.body
+                .split("<Name>")
+                .skip(1)
+                .map(|s| s.split('<').next().unwrap().to_string())
+                .collect::<Vec<_>>()
+        }
+    };
+    assert_eq!(buckets(&writer).await, ["b", "c"]);
+    assert_eq!(buckets(&bucket_b).await, ["b"]);
+    assert!(buckets(&prefix).await.is_empty());
+    let resp = send(&host, as_(&writer, get("/s3/"))).await;
+    assert!(resp.body.contains("<CreationDate>"), "{}", resp.body);
+}
+
+/// A hub token's grants cover `files/<prefix>`.
+#[tokio::test]
+async fn a_hub_token_writes_and_reads_below_its_grant() {
+    let dir = tmp("hub");
+    let (state, signer) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    let now = vk_peer::now_secs();
+    let token = signer.sign(hub_claims(AUD, now - 1, now + 600)).unwrap();
+    let as_token = |r: Req| r.signed(&host, (&token, &token), 0);
+    send(
+        &host,
+        as_token(Req::new("PUT", "/s3/p/gl/42/k").body(HELLO.to_vec())),
+    )
+    .await
+    .ok(200);
+    is_object(
+        &send(&host, as_token(Req::new("GET", "/s3/p/gl/42/k"))).await,
+        HELLO,
+    );
+    send(
+        &host,
+        as_token(Req::new("PUT", "/s3/p/gl/43/k").body(HELLO.to_vec())),
+    )
+    .await
+    .is(403, "AccessDenied");
+}
+
+/// One object, three views: what S3 writes WebDAV and `/v2/` read, and the other way round.
+#[tokio::test]
+async fn s3_dav_and_v2_see_the_same_objects() {
+    let dir = tmp("views");
+    let host = spawn(open_state(&dir, true));
+    send(&host, Req::new("PUT", "/s3/b/d/k").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    let resp = send(
+        &host,
+        Req::new("PROPFIND", "/dav/files/b/d/").header("Depth", "1"),
+    )
+    .await;
+    assert_eq!(resp.status, 207);
+    assert!(
+        resp.body.contains("<D:href>/dav/files/b/d/k</D:href>"),
+        "{}",
+        resp.body
+    );
+    let resp = send(&host, Req::new("GET", "/dav/files/b/d/k")).await;
+    assert_eq!((resp.status, resp.bytes.as_slice()), (200, HELLO));
+    let resp = send(&host, Req::new("GET", "/v2/files/b/d/manifests/k")).await;
+    assert_eq!(resp.status, 200);
+    assert!(
+        resp.body
+            .contains(&format!("\"org.virtkit.md5\":\"{}\"", md5_hex(HELLO))),
+        "{}",
+        resp.body
+    );
+
+    // Written over WebDAV: the SHA-256 is its ETag.
+    let resp = send(
+        &host,
+        Req::new("PUT", "/dav/files/b/dav").body(HELLO.to_vec()),
+    )
+    .await;
+    assert_eq!(resp.status, 201);
+    let resp = send(&host, Req::new("GET", "/s3/b/dav")).await;
+    is_object(&resp, HELLO);
+    assert_eq!(
+        resp.header("etag"),
+        Some(&*format!("\"{}\"", sha256_hex(HELLO)))
+    );
+    let resp = send(&host, Req::new("DELETE", "/dav/files/b/dav")).await;
+    assert_eq!(resp.status, 204);
+    send(&host, Req::new("GET", "/s3/b/dav"))
+        .await
+        .is(404, "NoSuchKey");
+}

From cd018703fb014d0c254abb2120d2e585064a03a1 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 11:28:33 +0100
Subject: [PATCH 06/54] vk-registry/s3: list a bucket's objects

Serve ListObjectsV2 and ListObjects over the files/ tree: a depth-first
walk in byte order of the whole key, bounded by one page, that passes
over every subtree before its resume point and folds delimited
directories without walking them, showing only what a read would serve.

A listing is admitted on the bucket or on the directory its prefix
names, and HeadBucket and GetBucketLocation on anything readable below
the bucket, so a key scoped to one directory can probe and list it.
---
 CHANGELOG.md                 |   7 +-
 README.md                    |   5 +-
 vk-registry/DESIGN.md        |  31 +-
 vk-registry/src/lib.rs       |  82 +++
 vk-registry/src/s3/bucket.rs |  13 +-
 vk-registry/src/s3/list.rs   | 971 +++++++++++++++++++++++++++++++++++
 vk-registry/src/s3/mod.rs    |   8 +-
 vk-registry/tests/s3_e2e.rs  | 337 +++++++++++-
 8 files changed, 1431 insertions(+), 23 deletions(-)
 create mode 100644 vk-registry/src/s3/list.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cdc633e6..62d1c447 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,9 +12,10 @@ All notable changes to virtkit will be documented in this file.
   `https://<registry>/s3` with any region, and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
-  checksums, given metadata and deleted, and are the same files WebDAV and `vk registry get`
-  see. Listing objects, multipart and chunked uploads, ranges and copies are not served yet.
-  Set `s3 = false` in the server config to turn it off.
+  checksums, given metadata and deleted, and listed page by page, and are the same files WebDAV
+  and `vk registry get` see; a key limited to a directory of a bucket can list that directory.
+  Multipart and chunked uploads, ranges and copies are not served yet. Set `s3 = false` in the
+  server config to turn it off.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/README.md b/README.md
index 58636f40..ebdcc130 100644
--- a/README.md
+++ b/README.md
@@ -867,9 +867,8 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 ```
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
-bytes); objects are at most 4 GiB; presigned URLs are refused. Listing a bucket's objects,
-multipart and chunked uploads, ranges and copies are not served yet. Set `s3 = false` to
-disable it.
+bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart and chunked uploads,
+ranges and copies are not served yet. Set `s3 = false` to disable it.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 6383bee2..7e47db5a 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -619,8 +619,16 @@ a read `Read` on the repository the key resolves to, and a `DELETE` `Write` ther
 holding the action on neither the key's own name nor its parent's is 403 `AccessDenied` before
 anything is looked up, and what it may not read is otherwise absent (`NoSuchKey`). A write
 refused over a clash answers 409 and so reveals that the name exists, as WebDAV's does. A
-bucket authorizes as `files/<bucket>`. Listing the buckets needs a configured credential, as
-`/dav/`'s root listing does, and shows only those the caller may read.
+bucket authorizes as `files/<bucket>`, except that HeadBucket and GetBucketLocation also
+admit a caller that may read only a directory inside it, which clients probe before listing
+the prefix they were given. Listing the buckets needs a configured credential, as `/dav/`'s
+root listing does, and shows only those the caller may read. Listing a bucket's objects is
+admitted when the caller may read the bucket or the directory the prefix's whole components
+name (`prefix=proj/` for a `read:files/team/proj/*` key over bucket `team`; `prefix=proj`
+names no directory and is refused), and shows only what a read would serve: a directory the
+caller may not read is passed over with everything below it, as `PROPFIND` passes it over,
+and neither a foreign tag nor an object whose bytes the caller may not read through it is
+listed.
 
 **Objects are bytes.** Every object is served `application/octet-stream`,
 `Content-Disposition: attachment` and `nosniff`, whatever its writer sent: a `Content-Type`
@@ -639,10 +647,23 @@ reads; a replaced object keeps only what its own write sent.
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. `Range` is ignored and no `Accept-Ranges` is sent: a whole 200 is a legal answer. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
-| `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 without `Read` on `files/<b>` |
+| `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
+| `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
+| `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| anything else | 501 `NotImplemented`: listing a bucket's objects, creating and deleting buckets, copies, batch deletes, multipart uploads, `aws-chunked` bodies (`STREAMING-*` payloads, `Content-Encoding: aws-chunked`), tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+| anything else | 501 `NotImplemented`: creating and deleting buckets, copies, batch deletes, multipart uploads, `aws-chunked` bodies (`STREAMING-*` payloads, `Content-Encoding: aws-chunked`), tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+
+**A listing's cost** is bounded by its page. The walk runs on the blocking pool, starts at the
+directory the prefix's whole components name, lists each directory it enters once (its
+subdirectories and tags), and stops one entry past `max-keys`, to know whether the page is
+truncated; memory is the page and a directory listing per level. A resumed page passes over
+every subtree that sorts before its resume point unread, so it costs the directories on the
+way down to that point plus the page, however deep into the bucket it is. Each key listed
+costs a manifest read and a membership `stat`, as a `PROPFIND` entry does: about a thousand
+small reads for a full page. A listing with `delimiter=/` never walks below the level it
+lists; one without a delimiter over a sharded `sccache` directory walks its thousands of
+repositories across its pages (see "Operational constraints and deferred work").
 
 **`LastModified` moves on reads**, as `getlastmodified` does over WebDAV: a `GET` refreshes
 the tag's mtime once it is an hour old, which is what keeps a hot cache entry from the gc's
@@ -916,7 +937,7 @@ when that is still below `max_connections` plus 256. The unit `install-service`
   marker and the pool's manifest and layer blobs, the last two shared with identical
   entries. Everything that walks every repository name pays for those directories: a
   membership miss on `/v2/` (`readable_through`), a `/dav/repos/` prefix lookup or listing,
-  `/browse`, `status` and `gc`.
+  an S3 listing of such a directory without a delimiter, `/browse`, `status` and `gc`.
 - The `files/` area trusts its writers: a stored compiler-cache entry is linked into every
   project computing the same key, so write access belongs to trusted pipelines only (see
   "WebDAV view"). A key reaches exactly the same content over `/v2/`, `/dav/` and `/s3/`.
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 38bb187a..e66dcc10 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -5331,6 +5331,34 @@ impl Authz<'_> {
         self.may(accounts::Action::Read, repo)
     }
 
+    /// Whether this caller may read `repo` or a repository below it: what a probe of a
+    /// directory needs, whose contents the caller may see only part of. A scope or grant
+    /// reaches below `repo` when what it covers starts there.
+    fn may_read_below(&self, repo: &str) -> bool {
+        use vk_hub_proto::token::under;
+        if self.may_read(repo) {
+            return true;
+        }
+        match self {
+            Authz::NoScopes => true,
+            Authz::Accounts(accounts::Principal::Session(_)) => false,
+            // Either action reads; `*` and every pattern above `repo` passed `may_read`.
+            Authz::Accounts(accounts::Principal::ApiKey(key)) => key.scopes.iter().any(|s| {
+                let root = s.repo_pattern.strip_suffix("/*").unwrap_or(&s.repo_pattern);
+                under(repo, root)
+            }),
+            // A grant covers `<prefix>` and `files/<prefix>`, as `Claims::allows_repo` reads it.
+            Authz::Token(claims) => claims.grants.iter().any(|g| {
+                g.read
+                    && (under(repo, &g.prefix)
+                        || repo
+                            .strip_prefix(files::FILES_REPO)
+                            .and_then(|r| r.strip_prefix('/'))
+                            .is_some_and(|r| under(r, &g.prefix)))
+            }),
+        }
+    }
+
     /// Whether this caller may do `action` on `repo`.
     fn may(&self, action: accounts::Action, repo: &str) -> bool {
         match self {
@@ -10011,6 +10039,60 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// A caller may read below a repository when it may read the repository, or when a
+    /// scope or grant covers something that starts below it, cut at a component.
+    #[test]
+    fn reading_below_a_repository_follows_what_scopes_and_grants_cover() {
+        let key = |scopes: &[(accounts::Action, &str)]| {
+            accounts::Principal::ApiKey(accounts::ApiKey {
+                id: "hash".to_string(),
+                owner_user_id: None,
+                name: "k".to_string(),
+                token_prefix: "0123abcd".to_string(),
+                scopes: scopes
+                    .iter()
+                    .map(|(action, pattern)| accounts::Scope {
+                        action: *action,
+                        repo_pattern: pattern.to_string(),
+                    })
+                    .collect(),
+                created_at: SystemTime::UNIX_EPOCH,
+                expires_at: None,
+                last_used_at: None,
+                revoked_at: None,
+            })
+        };
+        let read = accounts::Action::Read;
+        let prefix = key(&[(read, "files/b/p/*")]);
+        let authz = Authz::Accounts(&prefix);
+        assert!(authz.may_read_below("files/b"));
+        assert!(authz.may_read_below("files"));
+        assert!(authz.may_read_below("files/b/p"));
+        assert!(authz.may_read_below("files/b/p/q"));
+        assert!(!authz.may_read("files/b"));
+        assert!(!authz.may_read_below("files/c"));
+        assert!(!authz.may_read_below("files/bb"));
+        assert!(!authz.may_read_below("files/b/pp"));
+        let exact = key(&[(accounts::Action::Write, "files/b/p")]);
+        assert!(Authz::Accounts(&exact).may_read_below("files/b"));
+        assert!(!Authz::Accounts(&exact).may_read_below("files/b/p/q"));
+        let any = key(&[(read, "*")]);
+        assert!(Authz::Accounts(&any).may_read_below("files/x"));
+        let none = key(&[]);
+        assert!(!Authz::Accounts(&none).may_read_below("files/b"));
+        assert!(Authz::NoScopes.may_read_below("files/b"));
+
+        let c = claims(&[("b/p", "r"), ("w/only", "w"), ("images", "r")]);
+        let authz = Authz::Token(&c);
+        assert!(authz.may_read_below("files/b"));
+        assert!(authz.may_read_below("files/b/p/q"));
+        assert!(authz.may_read_below("b"));
+        assert!(authz.may_read_below("files/images"));
+        assert!(!authz.may_read_below("files/w"));
+        assert!(!authz.may_read_below("files/bp"));
+        assert!(!authz.may_read_below("files/c"));
+    }
+
     /// A prefix's window drops its idle tags well inside the store-wide one, and holds a far
     /// `expires` annotation to itself, and a `keep` too under a window the config sets; under
     /// one the hub added, `keep` and a far `expires` hold, and a past `expires` does not.
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index e6a87a77..b9a172a0 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -1,14 +1,14 @@
 //! The service and its buckets: ListBuckets, HeadBucket and GetBucketLocation. A bucket is a
 //! top-level directory of `files/`, authorized as the repository `files/<bucket>`; one the
-//! caller may not read is absent to it, as in the WebDAV view.
+//! caller may read nothing in is absent to it, as in the WebDAV view.
 
 use hyper::body::Incoming;
 use hyper::header::{AUTHORIZATION, CONTENT_LENGTH};
 use hyper::{Request, Response, StatusCode};
 
 use super::{Ctx, refuse, sigv4, xml};
-use crate::files::{FILES_REPO, allowed};
-use crate::{Authz, Body, ServerState, accounts, body_of};
+use crate::files::FILES_REPO;
+use crate::{Authz, Body, ServerState, body_of};
 
 /// The owner every listing names: the registry, whoever wrote what it holds.
 pub(super) const OWNER: &str = "vk-registry";
@@ -64,8 +64,9 @@ pub(super) async fn list(
 }
 
 /// Whether `bucket` is there for this caller: `Err` with the answer when it is not — 403 when
-/// the caller may not read the bucket at all, 404 `NoSuchBucket` when it may but no such
-/// directory exists.
+/// the caller may read nothing in the bucket, 404 `NoSuchBucket` when it may but no such
+/// directory exists. A caller that may read only a directory inside the bucket passes, since
+/// clients probe the bucket before they list the prefix they were given.
 async fn check(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -73,7 +74,7 @@ async fn check(
     ctx: &Ctx,
 ) -> anyhow::Result<Option<Response<Body>>> {
     let repo = format!("{FILES_REPO}/{bucket}");
-    if !allowed(authz, accounts::Action::Read, &repo) {
+    if !authz.may_read_below(&repo) {
         return Ok(Some(ctx.access_denied()));
     }
     let store = std::sync::Arc::clone(&state.store);
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
new file mode 100644
index 00000000..712237da
--- /dev/null
+++ b/vk-registry/src/s3/list.rs
@@ -0,0 +1,971 @@
+//! A bucket's objects: ListObjectsV2 (`?list-type=2`) and ListObjects (v1, `marker`). The
+//! listing is a depth-first walk of the bucket's directories that yields keys in byte order
+//! of the whole key: a directory's members all start with `<name>/`, so at each level the
+//! directories sort as `<name>/` among the tags, which puts tag `a-b` and `a.b` before
+//! directory `a/` and that before tag `a_b`. Walked in that order, a page resumes by passing
+//! over every subtree that sorts before its resume point unread, and stops at `max-keys + 1`
+//! entries, so a page costs the directories on the way to the resume point and the page.
+//!
+//! A listing is admitted when the caller may read the bucket or the directory its prefix
+//! names, and shows only what a read would serve: a directory the caller may not read is
+//! passed over with everything below it, as `PROPFIND` passes it over, and an object only
+//! when its bytes are readable through it.
+
+use anyhow::Result;
+use hyper::body::Incoming;
+use hyper::{Request, Response, StatusCode};
+
+use super::path::MAX_KEY;
+use super::{Ctx, bucket, conditional, refuse, sigv4, xml};
+use crate::files::{self, FILES_REPO, Node, Object, allowed, repo_name};
+use crate::{Authz, Body, ServerState, Store, accounts};
+
+/// Most entries a page holds, and what `max-keys` is clamped to: S3's bound.
+const MAX_KEYS: usize = 1000;
+
+/// The query parameters a listing takes, of either version; an SDK's `x-id` hint too.
+const PARAMS: &[&str] = &[
+    "list-type",
+    "prefix",
+    "delimiter",
+    "max-keys",
+    "continuation-token",
+    "start-after",
+    "marker",
+    "encoding-type",
+    "fetch-owner",
+    "x-id",
+];
+
+/// Whether a bucket `GET` with this query is a listing: one that names only [`PARAMS`].
+pub(super) fn is_listing(query: &str) -> bool {
+    query
+        .split('&')
+        .filter(|p| !p.is_empty())
+        .all(|p| PARAMS.contains(&p.split_once('=').map_or(p, |(n, _)| n)))
+}
+
+/// What a listing asks for.
+#[derive(Debug, Default, PartialEq, Eq)]
+struct Query {
+    /// `list-type=2`
+    v2: bool,
+    prefix: String,
+    delimiter: Option<String>,
+    max_keys: usize,
+    /// the continuation token as sent, to echo
+    token: Option<String>,
+    /// `start-after` (v2) or `marker` (v1), as sent
+    start: Option<String>,
+    /// the key the page starts after: the token's, else `start`
+    after: Option<String>,
+    /// `encoding-type=url`
+    url: bool,
+    /// `fetch-owner=true`, or any v1 listing
+    owner: bool,
+}
+
+/// The listing a query asks for, or why it is refused (400 `InvalidArgument`).
+fn parse(query: &str) -> std::result::Result<Query, &'static str> {
+    let mut q = Query {
+        max_keys: MAX_KEYS,
+        ..Query::default()
+    };
+    let (mut start_after, mut marker) = (None, None);
+    let mut seen: Vec<&str> = Vec::new();
+    for pair in query.split('&').filter(|p| !p.is_empty()) {
+        let (name, raw) = pair.split_once('=').unwrap_or((pair, ""));
+        // The first of a repeated parameter is the one taken.
+        if seen.contains(&name) {
+            continue;
+        }
+        seen.push(name);
+        let value = crate::dav::decode_segment(raw)
+            .ok_or("a query parameter has a malformed percent escape or is not UTF-8")?;
+        match name {
+            "list-type" if value == "2" => q.v2 = true,
+            "list-type" => return Err("list-type is 2, or absent for the first version"),
+            "prefix" => q.prefix = text(value)?,
+            "delimiter" => q.delimiter = Some(text(value)?).filter(|d| !d.is_empty()),
+            "max-keys" => {
+                let n: usize = value
+                    .parse()
+                    .map_err(|_| "max-keys is a whole number from 0")?;
+                q.max_keys = n.min(MAX_KEYS);
+            }
+            "continuation-token" => q.token = Some(value),
+            "start-after" => start_after = Some(text(value)?),
+            "marker" => marker = Some(text(value)?),
+            "encoding-type" if value == "url" => q.url = true,
+            "encoding-type" => return Err("encoding-type is url, or absent"),
+            "fetch-owner" => q.owner = value == "true",
+            _ => {}
+        }
+    }
+    // Each version resumes its own way; a first-version listing always names the owner.
+    if q.v2 {
+        q.start = start_after;
+    } else {
+        (q.start, q.token, q.owner) = (marker, None, true);
+    }
+    q.after = match &q.token {
+        Some(token) => Some(
+            resume_point(token).ok_or("the continuation token is not one this registry gave")?,
+        ),
+        None => q.start.clone(),
+    };
+    Ok(q)
+}
+
+/// A prefix, delimiter or start key, which a listing echoes in XML: no control character,
+/// which XML 1.0 cannot carry, and no longer than a key.
+fn text(v: String) -> std::result::Result<String, &'static str> {
+    if v.chars().any(char::is_control) {
+        Err("a prefix, delimiter or start key holds no control character")
+    } else if v.len() > MAX_KEY {
+        Err("a prefix, delimiter or start key is at most 1024 bytes")
+    } else {
+        Ok(v)
+    }
+}
+
+/// The key a continuation token names: the last entry of the page it ended, which is a key
+/// or a common prefix, so only the characters keys have.
+fn resume_point(token: &str) -> Option<String> {
+    let bytes = vk_hub_proto::token::from_base64url(token)?;
+    let key = String::from_utf8(bytes).ok()?;
+    let fits = !key.is_empty()
+        && key.len() <= MAX_KEY
+        && key
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-' | b'/'));
+    fits.then_some(key)
+}
+
+/// One entry of a page.
+enum Item {
+    Object(String, Object),
+    /// a common prefix, every key below which the delimiter folded into it
+    Prefix(String),
+}
+
+impl Item {
+    fn key(&self) -> &str {
+        match self {
+            Item::Object(key, _) | Item::Prefix(key) => key,
+        }
+    }
+}
+
+/// What a walk lists: the keys starting with `prefix`, after `after`, folded at the first
+/// `delimiter` past the prefix, at most `limit` of them.
+struct Walk<'a> {
+    prefix: &'a str,
+    delimiter: Option<&'a str>,
+    after: Option<&'a str>,
+    limit: usize,
+}
+
+/// The first [`Walk::limit`] entries of `bucket` the walk asks for, in key order, as this
+/// caller may read them. The walk starts at the directory the prefix's whole components name,
+/// which is the one directory every matching key is below: one the caller may not read, or
+/// that is not there, holds nothing. Memory is a page and a directory listing per level.
+fn walk(store: &Store, authz: &Authz<'_>, bucket: &str, how: &Walk<'_>) -> Result<Vec<Item>> {
+    Ok(walked(store, authz, bucket, how)?.items)
+}
+
+/// [`walk`], handing back the walker with its entries.
+fn walked<'a, 'b>(
+    store: &'a Store,
+    authz: &'a Authz<'b>,
+    bucket: &str,
+    how: &'a Walk<'a>,
+) -> Result<Walker<'a, 'b>> {
+    let mut segs = vec![bucket.to_string()];
+    let mut key = String::new();
+    if let Some((dirs, _)) = how.prefix.rsplit_once('/') {
+        segs.extend(dirs.split('/').map(str::to_string));
+        key = format!("{dirs}/");
+    }
+    let mut walker = Walker {
+        store,
+        authz,
+        how,
+        items: Vec::new(),
+        #[cfg(test)]
+        dirs_read: 0,
+    };
+    let start = repo_name(&segs);
+    if how.limit > 0
+        && crate::valid_name(&start)
+        && authz.may_read(&start)
+        && store.repo_dir_exists(&start)
+    {
+        walker.dir(&mut segs, &key)?;
+    }
+    Ok(walker)
+}
+
+struct Walker<'a, 'b> {
+    store: &'a Store,
+    authz: &'a Authz<'b>,
+    how: &'a Walk<'a>,
+    items: Vec<Item>,
+    /// how many directories were listed, which resuming is to keep to the path down to the
+    /// resume point
+    #[cfg(test)]
+    dirs_read: usize,
+}
+
+impl Walker<'_, '_> {
+    fn full(&self) -> bool {
+        self.items.len() >= self.how.limit
+    }
+
+    /// The directory at `segs`, whose members' keys start with `key`: its subdirectories and
+    /// tags merged in key order.
+    fn dir(&mut self, segs: &mut Vec<String>, key: &str) -> Result<()> {
+        #[cfg(test)]
+        {
+            self.dirs_read += 1;
+        }
+        let repo = repo_name(segs);
+        let mut members: Vec<String> = self
+            .store
+            .repo_children(&repo)?
+            .into_iter()
+            .map(|d| format!("{d}/"))
+            .chain(self.store.list_tags(&repo))
+            .collect();
+        // A tag holds no `/`, so a directory and a tag never compare equal.
+        members.sort_unstable();
+        for member in members {
+            if self.full() {
+                break;
+            }
+            let full = format!("{key}{member}");
+            match member.strip_suffix('/') {
+                Some(name) => self.subtree(segs, &repo, name, &full)?,
+                None => self.tag(segs, &member, &full)?,
+            }
+        }
+        Ok(())
+    }
+
+    /// The subdirectory `name` of `repo`, whose members' keys start with `full`.
+    fn subtree(
+        &mut self,
+        segs: &mut Vec<String>,
+        repo: &str,
+        name: &str,
+        full: &str,
+    ) -> Result<()> {
+        let how = self.how;
+        // Every key below starts with `full`: none can match a prefix that diverges from it.
+        if !full.starts_with(how.prefix) && !how.prefix.starts_with(full) {
+            return Ok(());
+        }
+        // Every key below sorts before the resume point unless that point is below too.
+        if how.after.is_some_and(|a| !a.starts_with(full) && full < a) {
+            return Ok(());
+        }
+        if !self.authz.may_read(&format!("{repo}/{name}")) {
+            return Ok(());
+        }
+        // The delimiter folds the whole subtree into one prefix when it falls inside `full`.
+        if full.len() >= how.prefix.len()
+            && let Some(prefix) = self.folded(full)
+        {
+            self.common(prefix);
+            return Ok(());
+        }
+        segs.push(name.to_string());
+        let walked = self.dir(segs, full);
+        segs.pop();
+        walked
+    }
+
+    /// The tag `tag` at `segs`, whose key is `full`: listed when a read would serve it.
+    fn tag(&mut self, segs: &[String], tag: &str, full: &str) -> Result<()> {
+        let how = self.how;
+        if !full.starts_with(how.prefix) || how.after.is_some_and(|a| full <= a) {
+            return Ok(());
+        }
+        let folded = self.folded(full);
+        if let Some(prefix) = &folded
+            && !self.fresh(prefix)
+        {
+            return Ok(());
+        }
+        let mut path = segs.to_vec();
+        path.push(tag.to_string());
+        let Some(Node::Object(obj)) = files::resolve(self.store, &path)? else {
+            return Ok(());
+        };
+        if !crate::readable_through(self.authz, self.store, &obj.repo, &obj.layer) {
+            return Ok(());
+        }
+        self.items.push(match folded {
+            Some(prefix) => Item::Prefix(prefix.to_string()),
+            None => Item::Object(full.to_string(), obj),
+        });
+        Ok(())
+    }
+
+    /// The common prefix `key` folds into: up to and including the first delimiter past the
+    /// listing's prefix. `key` starts with the prefix.
+    fn folded<'k>(&self, key: &'k str) -> Option<&'k str> {
+        let delimiter = self.how.delimiter?;
+        let at = key.get(self.how.prefix.len()..)?.find(delimiter)?;
+        key.get(..self.how.prefix.len() + at + delimiter.len())
+    }
+
+    /// Whether the common prefix `prefix` is still to be listed: past the resume point, and
+    /// not the entry just listed.
+    fn fresh(&self, prefix: &str) -> bool {
+        self.how.after.is_none_or(|a| prefix > a)
+            && !matches!(self.items.last(), Some(Item::Prefix(p)) if p == prefix)
+    }
+
+    fn common(&mut self, prefix: &str) {
+        if self.fresh(prefix) {
+            self.items.push(Item::Prefix(prefix.to_string()));
+        }
+    }
+}
+
+/// `key` for a document asking `encoding-type=url`: each component percent-encoded, the
+/// slashes kept.
+fn url_encode(key: &str) -> String {
+    key.split('/')
+        .map(crate::percent_encode)
+        .collect::<Vec<_>>()
+        .join("/")
+}
+
+/// An object's `LastModified` as S3's listings write it.
+fn iso8601(t: std::time::SystemTime) -> String {
+    let secs = t
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |d| d.as_secs());
+    let stamp = sigv4::format_time(secs);
+    format!("{}.000Z", stamp.trim_end_matches('Z'))
+}
+
+/// `GET /s3/<bucket>` with a listing's query: the page of keys it asks for.
+pub(super) async fn list(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    query: &str,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let q = match parse(query) {
+        Ok(q) => q,
+        Err(message) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if !admitted(authz, &bucket, &q.prefix) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        if !store.repo_dir_exists(&format!("{FILES_REPO}/{bucket}")) {
+            return Ok(ctx.error(
+                StatusCode::NOT_FOUND,
+                "NoSuchBucket",
+                "the specified bucket does not exist",
+            ));
+        }
+        let (items, truncated) = page(store, authz, &bucket, &q)?;
+        Ok(xml::document(
+            "ListBucketResult",
+            &render(&bucket, &q, &items, truncated),
+        ))
+    })
+    .await
+}
+
+/// The page `q` asks for and whether more follow it: one entry past `max-keys` is walked to
+/// know. A page of none is empty and complete.
+fn page(store: &Store, authz: &Authz<'_>, bucket: &str, q: &Query) -> Result<(Vec<Item>, bool)> {
+    if q.max_keys == 0 {
+        return Ok((Vec::new(), false));
+    }
+    let how = Walk {
+        prefix: &q.prefix,
+        delimiter: q.delimiter.as_deref(),
+        after: q.after.as_deref(),
+        limit: q.max_keys.saturating_add(1),
+    };
+    let mut items = walk(store, authz, bucket, &how)?;
+    let truncated = items.len() > q.max_keys;
+    items.truncate(q.max_keys);
+    Ok((items, truncated))
+}
+
+/// Whether this caller may list `bucket` with `prefix`: it may read the bucket, or the
+/// directory the prefix's whole components name; the walk then shows what it may read.
+fn admitted(authz: &Authz<'_>, bucket: &str, prefix: &str) -> bool {
+    let read = |repo: &str| allowed(authz, accounts::Action::Read, repo);
+    let bucket = format!("{FILES_REPO}/{bucket}");
+    read(&bucket)
+        || prefix.rsplit_once('/').is_some_and(|(dirs, _)| {
+            let repo = format!("{bucket}/{dirs}");
+            crate::valid_name(&repo) && read(&repo)
+        })
+}
+
+/// The `ListBucketResult` of a page: its parameters, then the objects, then the common
+/// prefixes, every caller string escaped and, under `encoding-type=url`, encoded.
+fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
+    let enc = |s: &str| if q.url { url_encode(s) } else { s.to_string() };
+    let mut out = xml::element("Name", bucket);
+    out.push_str(&xml::element("Prefix", &enc(&q.prefix)));
+    let next = truncated.then(|| items.last().map(Item::key)).flatten();
+    if !q.v2 {
+        out.push_str(&xml::element(
+            "Marker",
+            &enc(q.start.as_deref().unwrap_or("")),
+        ));
+        if let Some(next) = next {
+            out.push_str(&xml::element("NextMarker", &enc(next)));
+        }
+    }
+    out.push_str(&xml::element("MaxKeys", &q.max_keys.to_string()));
+    if let Some(d) = &q.delimiter {
+        out.push_str(&xml::element("Delimiter", &enc(d)));
+    }
+    if q.url {
+        out.push_str(&xml::element("EncodingType", "url"));
+    }
+    if q.v2 {
+        out.push_str(&xml::element("KeyCount", &items.len().to_string()));
+    }
+    out.push_str(&xml::element(
+        "IsTruncated",
+        if truncated { "true" } else { "false" },
+    ));
+    if q.v2 {
+        if let Some(token) = &q.token {
+            out.push_str(&xml::element("ContinuationToken", token));
+        }
+        if let Some(next) = next {
+            let token = vk_hub_proto::token::to_base64url(next.as_bytes());
+            out.push_str(&xml::element("NextContinuationToken", &token));
+        }
+        if let Some(start) = &q.start {
+            out.push_str(&xml::element("StartAfter", &enc(start)));
+        }
+    }
+    for item in items {
+        if let Item::Object(key, obj) = item {
+            out.push_str("<Contents>");
+            out.push_str(&xml::element("Key", &enc(key)));
+            out.push_str(&xml::element("LastModified", &iso8601(obj.modified)));
+            out.push_str(&xml::element("ETag", &conditional::etag_of(obj)));
+            out.push_str(&xml::element("Size", &obj.size.to_string()));
+            if q.owner {
+                out.push_str(&bucket::owner());
+            }
+            out.push_str(&xml::element("StorageClass", "STANDARD"));
+            out.push_str("</Contents>");
+        }
+    }
+    for item in items {
+        if let Item::Prefix(prefix) = item {
+            out.push_str(&format!(
+                "<CommonPrefixes>{}</CommonPrefixes>",
+                xml::element("Prefix", &enc(prefix))
+            ));
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::SystemTime;
+
+    const MANIFEST_TYPE: &str = "application/vnd.oci.image.manifest.v1+json";
+
+    struct Tree {
+        dir: std::path::PathBuf,
+        store: Store,
+    }
+
+    impl Drop for Tree {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.dir);
+        }
+    }
+
+    /// A store holding `keys` as objects of bucket `b`.
+    fn tree(name: &str, keys: &[&str]) -> Tree {
+        let dir =
+            std::env::temp_dir().join(format!("vk-reg-s3-list-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Store::new(dir.clone()).unwrap();
+        store.create_repo("files/b").unwrap();
+        for key in keys {
+            put(&store, &format!("b/{key}"));
+        }
+        Tree { dir, store }
+    }
+
+    /// An object at `path` below `files/`, its bytes its path.
+    fn put(store: &Store, path: &str) {
+        let (dirs, tag) = path.rsplit_once('/').unwrap();
+        let hex = store.put_blob(path.as_bytes()).unwrap();
+        let hex = hex.trim_start_matches("sha256:");
+        store
+            .put_raw_file(&format!("files/{dirs}"), tag, hex, path.len() as u64, None)
+            .unwrap();
+    }
+
+    fn api_key(patterns: &[&str]) -> accounts::Principal {
+        accounts::Principal::ApiKey(accounts::ApiKey {
+            id: "hash".to_string(),
+            owner_user_id: None,
+            name: "k".to_string(),
+            token_prefix: "0123abcd".to_string(),
+            scopes: patterns
+                .iter()
+                .map(|p| accounts::Scope {
+                    action: accounts::Action::Read,
+                    repo_pattern: p.to_string(),
+                })
+                .collect(),
+            created_at: SystemTime::UNIX_EPOCH,
+            expires_at: None,
+            last_used_at: None,
+            revoked_at: None,
+        })
+    }
+
+    /// The entries as text, a common prefix in brackets.
+    fn names(items: &[Item]) -> Vec<String> {
+        items
+            .iter()
+            .map(|i| match i {
+                Item::Object(k, _) => k.clone(),
+                Item::Prefix(p) => format!("[{p}]"),
+            })
+            .collect()
+    }
+
+    fn list_as(
+        t: &Tree,
+        authz: &Authz<'_>,
+        prefix: &str,
+        delimiter: Option<&str>,
+        after: Option<&str>,
+    ) -> Vec<String> {
+        let how = Walk {
+            prefix,
+            delimiter,
+            after,
+            limit: usize::MAX,
+        };
+        names(&walk(&t.store, authz, "b", &how).unwrap())
+    }
+
+    fn list(t: &Tree, prefix: &str, delimiter: Option<&str>, after: Option<&str>) -> Vec<String> {
+        list_as(t, &Authz::NoScopes, prefix, delimiter, after)
+    }
+
+    #[test]
+    fn keys_come_in_byte_order_of_the_whole_key() {
+        let t = tree("order", &["a_b", "a/x", "a.b", "a-b", "a/y/z", "A", "c"]);
+        assert_eq!(
+            list(&t, "", None, None),
+            ["A", "a-b", "a.b", "a/x", "a/y/z", "a_b", "c"]
+        );
+        // A directory sorts as its name and a slash, not as its name: `a-c/` and `a.c/`
+        // before `a/`.
+        put(&t.store, "b/a-c/k");
+        put(&t.store, "b/a.c/k");
+        let all = list(&t, "", None, None);
+        assert_eq!(
+            all,
+            [
+                "A", "a-b", "a-c/k", "a.b", "a.c/k", "a/x", "a/y/z", "a_b", "c"
+            ]
+        );
+        let mut sorted = all.clone();
+        sorted.sort();
+        assert_eq!(all, sorted);
+        // A tag a directory of its name hides, as a read finds the directory, is not listed.
+        put(&t.store, "b/a");
+        assert_eq!(list(&t, "", None, None), all);
+    }
+
+    #[test]
+    fn a_delimiter_folds_directories_without_descending_them() {
+        let t = tree("fold", &["a-b", "a.b", "a/x", "a/y/z", "a_b"]);
+        assert_eq!(list(&t, "", Some("/"), None), ["a-b", "a.b", "[a/]", "a_b"]);
+        assert_eq!(list(&t, "a/", Some("/"), None), ["a/x", "[a/y/]"]);
+        assert_eq!(list(&t, "a/y/", Some("/"), None), ["a/y/z"]);
+        // A delimiter of any text, folding at its first occurrence past the prefix.
+        assert_eq!(
+            list(&t, "", Some("-"), None),
+            ["[a-]", "a.b", "a/x", "a/y/z", "a_b"]
+        );
+        assert_eq!(
+            list(&t, "", Some("y/"), None),
+            ["a-b", "a.b", "a/x", "[a/y/]", "a_b"]
+        );
+        assert_eq!(
+            list(&t, "", Some("."), None),
+            ["a-b", "[a.]", "a/x", "a/y/z", "a_b"]
+        );
+        // Folding stops the walk there: a folded directory is not listed.
+        let dirs_read = |prefix: &str, delimiter| {
+            let how = Walk {
+                prefix,
+                delimiter,
+                after: None,
+                limit: usize::MAX,
+            };
+            walked(&t.store, &Authz::NoScopes, "b", &how)
+                .unwrap()
+                .dirs_read
+        };
+        assert_eq!(dirs_read("", Some("/")), 1);
+        assert_eq!(dirs_read("", None), 3);
+        // An empty directory is a prefix too, as WebDAV shows it.
+        t.store.create_repo("files/b/empty").unwrap();
+        assert_eq!(
+            list(&t, "", Some("/"), None),
+            ["a-b", "a.b", "[a/]", "a_b", "[empty/]"]
+        );
+    }
+
+    #[test]
+    fn a_prefix_may_end_inside_a_component() {
+        let t = tree(
+            "inside",
+            &["a/b/x", "a/bc/x", "a/bc/y/z", "a/bd", "a/c", "ab"],
+        );
+        assert_eq!(
+            list(&t, "a/b", Some("/"), None),
+            ["[a/b/]", "[a/bc/]", "a/bd"]
+        );
+        assert_eq!(
+            list(&t, "a/b", None, None),
+            ["a/b/x", "a/bc/x", "a/bc/y/z", "a/bd"]
+        );
+        assert_eq!(list(&t, "a/bc/", Some("/"), None), ["a/bc/x", "[a/bc/y/]"]);
+        assert_eq!(list(&t, "a", Some("/"), None), ["[a/]", "ab"]);
+        assert_eq!(list(&t, "a/bc/y/z", None, None), ["a/bc/y/z"]);
+        assert!(list(&t, "a/none/", None, None).is_empty());
+        assert!(list(&t, "a b/", None, None).is_empty());
+        assert!(list(&t, "a//", None, None).is_empty());
+    }
+
+    /// Every page size from one past the whole listing down to one, resumed from the last
+    /// entry of each page as a continuation token does: nothing repeated, nothing skipped.
+    #[test]
+    fn pages_resume_where_the_last_one_ended() {
+        let mut keys = vec!["a-b", "a.b", "a_b", "z"];
+        let sharded: Vec<String> = (0..3)
+            .flat_map(|x| (0..3).map(move |y| format!("s/{x}/{y}/k{x}{y}")))
+            .collect();
+        keys.extend(sharded.iter().map(String::as_str));
+        keys.extend(["a/x", "a/y/z", "s/1/t", "s/1-t"]);
+        let t = tree("pages", &keys);
+        for (prefix, delimiter) in [
+            ("", None),
+            ("", Some("/")),
+            ("s/", Some("/")),
+            ("s/1", None),
+            ("s/1", Some("/")),
+            ("", Some("-")),
+        ] {
+            let whole = list(&t, prefix, delimiter, None);
+            assert!(!whole.is_empty());
+            for size in 1..=whole.len() + 1 {
+                let mut seen = Vec::new();
+                let mut after: Option<String> = None;
+                loop {
+                    let q = Query {
+                        prefix: prefix.to_string(),
+                        delimiter: delimiter.map(str::to_string),
+                        max_keys: size,
+                        after: after.clone(),
+                        ..Query::default()
+                    };
+                    let (items, truncated) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+                    assert!(items.len() <= size);
+                    seen.extend(names(&items));
+                    if !truncated {
+                        break;
+                    }
+                    after = items.last().map(|i| i.key().to_string());
+                }
+                assert_eq!(seen, whole, "{prefix:?} {delimiter:?} by {size}");
+            }
+        }
+    }
+
+    #[test]
+    fn max_keys_bounds_a_page_and_none_is_an_empty_complete_one() {
+        let t = tree("max", &["a", "b", "c"]);
+        let page_of = |max_keys| {
+            let q = Query {
+                max_keys,
+                ..Query::default()
+            };
+            let (items, truncated) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+            (names(&items), truncated)
+        };
+        assert_eq!(page_of(0), (vec![], false));
+        assert_eq!(page_of(1), (vec!["a".to_string()], true));
+        assert_eq!(
+            page_of(3),
+            (vec!["a".into(), "b".into(), "c".into()], false)
+        );
+        assert!(!page_of(4).1);
+    }
+
+    /// A start key inside a subtree resumes inside it; one past it passes over it whole,
+    /// listing only the directories on the way down to it.
+    #[test]
+    fn a_page_starts_after_its_start_key_reading_only_the_way_there() {
+        let sharded: Vec<String> = (0..4)
+            .flat_map(|x| (0..4).map(move |y| format!("s/{x}/{y}/t")))
+            .collect();
+        let mut keys: Vec<&str> = sharded.iter().map(String::as_str).collect();
+        keys.extend(["a", "s0", "z"]);
+        let t = tree("after", &keys);
+        assert_eq!(list(&t, "", None, Some("s/3/2/t")), ["s/3/3/t", "s0", "z"]);
+        assert_eq!(
+            list(&t, "", None, Some("s/3/2")),
+            ["s/3/2/t", "s/3/3/t", "s0", "z"]
+        );
+        assert_eq!(list(&t, "", None, Some("s/")).first().unwrap(), "s/0/0/t");
+        assert_eq!(list(&t, "", None, Some("s/9")), ["s0", "z"]);
+        assert_eq!(list(&t, "", None, Some("s0")), ["z"]);
+        assert_eq!(list(&t, "", Some("/"), Some("a")), ["[s/]", "s0", "z"]);
+        // Past a folded prefix, or inside it, the prefix has been listed.
+        assert_eq!(list(&t, "", Some("/"), Some("s/")), ["s0", "z"]);
+        assert_eq!(list(&t, "", Some("/"), Some("s/1/0/t")), ["s0", "z"]);
+
+        let how = Walk {
+            prefix: "",
+            delimiter: None,
+            after: Some("s/3/2/t"),
+            limit: 2,
+        };
+        let w = walked(&t.store, &Authz::NoScopes, "b", &how).unwrap();
+        assert_eq!(names(&w.items), ["s/3/3/t", "s0"]);
+        // The bucket, `s`, `s/3`, `s/3/2` and `s/3/3`, of its 22 directories.
+        assert_eq!(w.dirs_read, 5);
+    }
+
+    #[test]
+    fn what_the_caller_may_not_read_is_not_listed() {
+        let t = tree("authz", &["a/x", "a/y/z", "k", "s/1/k"]);
+        // Bucket `b` itself and `b/a` with what is below it: not `b/s`.
+        let key = api_key(&["files/b", "files/b/a/*"]);
+        let authz = Authz::Accounts(&key);
+        assert_eq!(list_as(&t, &authz, "", None, None), ["a/x", "a/y/z", "k"]);
+        assert_eq!(list_as(&t, &authz, "", Some("/"), None), ["[a/]", "k"]);
+        assert!(list_as(&t, &authz, "s/", None, None).is_empty());
+        // Only `b/a`: the walk starts there for its prefix, and nothing else is listed.
+        let key = api_key(&["files/b/a/*"]);
+        let authz = Authz::Accounts(&key);
+        assert!(list_as(&t, &authz, "", None, None).is_empty());
+        assert_eq!(list_as(&t, &authz, "a/", None, None), ["a/x", "a/y/z"]);
+        assert!(admitted(&authz, "b", "a/"));
+        assert!(admitted(&authz, "b", "a/y"));
+        assert!(!admitted(&authz, "b", "a"));
+        assert!(!admitted(&authz, "b", ""));
+        assert!(!admitted(&authz, "b", "s/"));
+        assert!(!admitted(&authz, "c", "a/"));
+        assert!(admitted(&Authz::NoScopes, "b", ""));
+    }
+
+    #[test]
+    fn foreign_tags_and_bytes_unreadable_through_the_key_are_not_listed() {
+        let t = tree("foreign", &["k"]);
+        let image = br#"{"schemaVersion":2,"layers":[]}"#;
+        t.store
+            .put_manifest("files/b", "img", MANIFEST_TYPE, image)
+            .unwrap();
+        t.store
+            .put_manifest("files/b", "x-1", MANIFEST_TYPE, image)
+            .unwrap();
+        assert_eq!(list(&t, "", None, None), ["k"]);
+        // A foreign tag is no key for a delimiter to fold either.
+        assert_eq!(list(&t, "", Some("-"), None), ["k"]);
+
+        // A manifest tagged in `files/b` whose layer only another repository holds.
+        put(&t.store, "secret/s");
+        let (manifest, _) = t.store.tag_target("files/secret", "s").unwrap();
+        let body = t.store.get_blob(&manifest).unwrap().unwrap();
+        t.store
+            .put_manifest("files/b", "stolen", MANIFEST_TYPE, &body)
+            .unwrap();
+        assert_eq!(list(&t, "", None, None), ["k", "stolen"]);
+        let key = api_key(&["files/b/*"]);
+        assert_eq!(list_as(&t, &Authz::Accounts(&key), "", None, None), ["k"]);
+        let key = api_key(&["files/b/*", "files/secret/*"]);
+        assert_eq!(
+            list_as(&t, &Authz::Accounts(&key), "", None, None),
+            ["k", "stolen"]
+        );
+    }
+
+    #[test]
+    fn a_query_names_a_listing_of_either_version() {
+        assert!(is_listing(""));
+        assert!(is_listing("list-type=2&prefix=a%2F&delimiter=%2F"));
+        assert!(is_listing("marker=a&max-keys=2&x-id=ListObjects"));
+        assert!(!is_listing("location"));
+        assert!(!is_listing("list-type=2&acl"));
+        assert!(!is_listing("uploads"));
+
+        let q =
+            parse("list-type=2&prefix=a%2F&delimiter=%2F&max-keys=5000&fetch-owner=true").unwrap();
+        assert!(q.v2 && q.owner);
+        assert_eq!(
+            (q.prefix.as_str(), q.delimiter.as_deref(), q.max_keys),
+            ("a/", Some("/"), 1000)
+        );
+        let q = parse("list-type=2&start-after=a&marker=b").unwrap();
+        assert_eq!(
+            (q.start.as_deref(), q.after.as_deref()),
+            (Some("a"), Some("a"))
+        );
+        let token = vk_hub_proto::token::to_base64url(b"s/1/");
+        let q = parse(&format!(
+            "list-type=2&start-after=a&continuation-token={token}"
+        ))
+        .unwrap();
+        assert_eq!(q.after.as_deref(), Some("s/1/"));
+        assert_eq!(q.token.as_deref(), Some(token.as_str()));
+        let q = parse("marker=b&start-after=a&delimiter=").unwrap();
+        assert!(!q.v2 && q.owner);
+        assert_eq!((q.after.as_deref(), q.delimiter), (Some("b"), None));
+        assert_eq!(parse("").unwrap().max_keys, 1000);
+        assert_eq!(parse("max-keys=0").unwrap().max_keys, 0);
+        assert!(parse("encoding-type=url").unwrap().url);
+
+        let bad_token = |t: &[u8]| {
+            let token = vk_hub_proto::token::to_base64url(t);
+            parse(&format!("list-type=2&continuation-token={token}")).is_err()
+        };
+        assert!(bad_token(b"a b"));
+        assert!(bad_token(b""));
+        assert!(bad_token(&[0xff]));
+        assert!(bad_token(&[b'a'; 1025]));
+        assert!(!bad_token(&[b'a'; 1024]));
+        for bad in [
+            "list-type=2&continuation-token=!!",
+            "list-type=2&continuation-token=YQ==",
+            "list-type=1",
+            "max-keys=-1",
+            "max-keys=x",
+            "encoding-type=base64",
+            "prefix=%0A",
+            "prefix=%FF",
+            "delimiter=%2",
+        ] {
+            assert!(parse(bad).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_page_is_escaped_and_url_encoded_when_asked() {
+        let t = tree("render", &["d/k"]);
+        let q = Query {
+            v2: true,
+            prefix: "d/".to_string(),
+            max_keys: 1000,
+            ..Query::default()
+        };
+        let (items, _) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+        let xml = render("b", &q, &items, false);
+        let Some(Item::Object(_, obj)) = items.first() else {
+            panic!("an object");
+        };
+        assert!(
+            xml.starts_with(
+                "<Name>b</Name><Prefix>d/</Prefix><MaxKeys>1000</MaxKeys><KeyCount>1</KeyCount>\
+                 <IsTruncated>false</IsTruncated><Contents><Key>d/k</Key><LastModified>"
+            ),
+            "{xml}"
+        );
+        assert!(
+            xml.contains(&format!(
+                ".000Z</LastModified><ETag>{}</ETag><Size>5</Size>\
+                 <StorageClass>STANDARD</StorageClass></Contents>",
+                xml::escape(&conditional::etag_of(obj))
+            )),
+            "{xml}"
+        );
+        assert!(!xml.contains("<Owner>"));
+
+        let q = Query {
+            v2: true,
+            prefix: "<a b>/".to_string(),
+            delimiter: Some("&".to_string()),
+            start: Some("\"x".to_string()),
+            max_keys: 2,
+            ..Query::default()
+        };
+        let items = vec![Item::Prefix("<a b>/c&".to_string())];
+        let xml = render("b", &q, &items, true);
+        assert!(xml.contains("<Prefix>&lt;a b&gt;/</Prefix>"), "{xml}");
+        assert!(xml.contains("<Delimiter>&amp;</Delimiter>"), "{xml}");
+        assert!(xml.contains("<StartAfter>&quot;x</StartAfter>"), "{xml}");
+        let token = vk_hub_proto::token::to_base64url(b"<a b>/c&");
+        assert!(xml.contains(&format!(
+            "<NextContinuationToken>{token}</NextContinuationToken>"
+        )));
+        assert!(
+            xml.contains("<CommonPrefixes><Prefix>&lt;a b&gt;/c&amp;</Prefix></CommonPrefixes>")
+        );
+
+        let q = Query { url: true, ..q };
+        let xml = render("b", &q, &items, true);
+        assert!(xml.contains("<Prefix>%3Ca%20b%3E/</Prefix>"), "{xml}");
+        assert!(xml.contains("<Delimiter>%26</Delimiter><EncodingType>url</EncodingType>"));
+        assert!(xml.contains("<StartAfter>%22x</StartAfter>"), "{xml}");
+        assert!(xml.contains("<Prefix>%3Ca%20b%3E/c%26</Prefix></CommonPrefixes>"));
+
+        // The first version: a marker, the next one, and every object's owner.
+        put(&t.store, "b/d/m");
+        let q = Query {
+            prefix: "d/".to_string(),
+            start: Some("d/a".to_string()),
+            after: Some("d/a".to_string()),
+            max_keys: 1,
+            owner: true,
+            ..Query::default()
+        };
+        let (items, truncated) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+        let xml = render("b", &q, &items, truncated);
+        assert!(
+            xml.starts_with(
+                "<Name>b</Name><Prefix>d/</Prefix><Marker>d/a</Marker>\
+                 <NextMarker>d/k</NextMarker><MaxKeys>1</MaxKeys><IsTruncated>true</IsTruncated>"
+            ),
+            "{xml}"
+        );
+        assert!(
+            xml.contains(&format!("</Size>{}<StorageClass>", bucket::owner())),
+            "{xml}"
+        );
+        assert!(!xml.contains("KeyCount"));
+        assert_eq!(
+            iso8601(SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(86_401)),
+            "1970-01-02T00:00:01.000Z"
+        );
+    }
+}
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index eab98bec..6bbfc478 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -8,11 +8,12 @@
 //!
 //! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
 //! one, served over the object layer the WebDAV view shares ([`crate::files`]): [`bucket`]
-//! answers the service and its buckets, [`object`] the objects. Operations not served yet
-//! answer `NotImplemented`.
+//! answers the service and its buckets, [`list`] a bucket's listings, [`object`] the
+//! objects. Operations not served yet answer `NotImplemented`.
 
 mod bucket;
 mod conditional;
+mod list;
 mod meta;
 mod object;
 mod path;
@@ -228,6 +229,9 @@ async fn operate(
         (path::Target::Bucket(b), &Method::GET, Some("location")) => {
             bucket::location(state, authz, b, req, ctx).await
         }
+        (path::Target::Bucket(b), &Method::GET, _) if list::is_listing(&query) => {
+            list::list(state, authz, b, &query, req, ctx).await
+        }
         (path::Target::Object { segs, .. }, &Method::GET | &Method::HEAD, None) => {
             object::get(state, authz, segs, method == Method::HEAD, req, ctx).await
         }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 12879658..15d247a9 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -508,9 +508,9 @@ async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
     send(&host, get("/s3/b/k/deeper"))
         .await
         .is(404, "NoSuchKey");
-    // Listing a bucket is not served yet; listing the buckets is not on an open server.
-    send(&host, get("/s3/b")).await.is(501, "NotImplemented");
-    send(&host, get("/s3/b/")).await.is(501, "NotImplemented");
+    // A bucket that is not there; listing the buckets is not on an open server.
+    send(&host, get("/s3/b")).await.is(404, "NoSuchBucket");
+    send(&host, get("/s3/b/")).await.is(404, "NoSuchBucket");
     send(&host, get("/s3/")).await.is(403, "AccessDenied");
     send(&host, get("/s3")).await.is(403, "AccessDenied");
     send(
@@ -800,6 +800,8 @@ async fn s3_off_is_the_catch_all_404_after_authentication() {
     assert_eq!(off.header("x-amz-request-id"), None);
     assert_eq!(off.body, unknown.body);
     assert_eq!(off.header("content-type"), unknown.header("content-type"));
+    let list = send(&host, Req::new("GET", "/s3/b").query("list-type=2")).await;
+    assert_eq!((list.status, list.body), (404, unknown.body.clone()));
 
     let dir = tmp("off-bearer");
     let (state, _) = shared(
@@ -1298,7 +1300,7 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         Req::new("GET", "/s3/b/k").query("tagging"),
         Req::new("GET", "/s3/b/k").query("partNumber=1"),
         Req::new("POST", "/s3/b/k").query("uploads"),
-        Req::new("GET", "/s3/b").query("list-type=2"),
+        Req::new("GET", "/s3/b").query("versioning"),
         put("/s3/b/copy").header("x-amz-copy-source", "/b/k"),
     ] {
         send(&host, req).await.is(501, "NotImplemented");
@@ -1452,9 +1454,16 @@ async fn api_keys_reach_what_their_scopes_cover() {
     send(&host, as_(&prefix, get("/s3/b/q/y")))
         .await
         .is(403, "AccessDenied");
+    // It may probe the bucket its prefix is in, as clients do before listing, and no other.
     send(&host, as_(&prefix, Req::new("HEAD", "/s3/b")))
+        .await
+        .ok(200);
+    send(&host, as_(&prefix, Req::new("HEAD", "/s3/c")))
         .await
         .ok(403);
+    send(&host, as_(&prefix, get("/s3/b").query("location=")))
+        .await
+        .ok(200);
     // Holding the key's own path but not the bucket it is in: absent, not refused.
     send(&host, as_(&on_key, get("/s3/b/k")))
         .await
@@ -1486,6 +1495,309 @@ async fn api_keys_reach_what_their_scopes_cover() {
     assert!(buckets(&prefix).await.is_empty());
     let resp = send(&host, as_(&writer, get("/s3/"))).await;
     assert!(resp.body.contains("<CreationDate>"), "{}", resp.body);
+
+    // Listings: admitted on the bucket or on the directory the prefix names, and showing
+    // what the key may read.
+    let list = |k: &str, q: &str| {
+        let (k, q, host) = (k.to_string(), q.to_string(), host.clone());
+        async move { send(&host, get("/s3/b").query(&q).signed(&host, (&k, &k), 0)).await }
+    };
+    let resp = list(&prefix, "list-type=2&prefix=p%2F").await;
+    resp.ok(200);
+    assert_eq!(keys(&resp.body), ["p/x"]);
+    assert_eq!(keys(&list(&prefix, "prefix=p%2F").await.body), ["p/x"]);
+    assert_eq!(
+        keys(&list(&prefix, "list-type=2&prefix=p%2Fx").await.body),
+        ["p/x"]
+    );
+    for refused in [
+        "list-type=2",
+        "list-type=2&prefix=p",
+        "list-type=2&prefix=q%2F",
+    ] {
+        list(&prefix, refused).await.is(403, "AccessDenied");
+    }
+    assert_eq!(
+        keys(&list(&bucket_b, "list-type=2").await.body),
+        ["k", "p/x", "q/y"]
+    );
+    let resp = list(&writer, "delimiter=%2F&list-type=2").await;
+    assert_eq!(keys(&resp.body), ["k"]);
+    assert_eq!(prefixes(&resp.body), ["p/", "q/"]);
+    send(&host, as_(&writer, get("/s3/none").query("list-type=2")))
+        .await
+        .is(404, "NoSuchBucket");
+
+    // A tag in the prefix whose bytes only bucket `c` holds: listed to a key that may read
+    // them there, absent to the others, as a read of it is.
+    send(
+        &host,
+        as_(&writer, put("/s3/c/secret").body(b"only in c".to_vec())),
+    )
+    .await
+    .ok(200);
+    let resp = send(
+        &host,
+        get("/v2/files/c/manifests/secret").header("Authorization", &format!("Bearer {writer}")),
+    )
+    .await;
+    assert_eq!(resp.status, 200);
+    state
+        .store
+        .put_manifest("files/b/p", "stolen", MANIFEST_TYPE, &resp.bytes)
+        .unwrap();
+    assert_eq!(
+        keys(&list(&writer, "list-type=2&prefix=p%2F").await.body),
+        ["p/stolen", "p/x"]
+    );
+    assert_eq!(
+        keys(&list(&prefix, "list-type=2&prefix=p%2F").await.body),
+        ["p/x"]
+    );
+    assert_eq!(
+        keys(&list(&bucket_b, "list-type=2").await.body),
+        ["k", "p/x", "q/y"]
+    );
+    send(&host, as_(&prefix, get("/s3/b/p/stolen")))
+        .await
+        .is(404, "NoSuchKey");
+}
+
+/// The text of each `<name>` element of a document, in order.
+fn elements(body: &str, name: &str) -> Vec<String> {
+    let open = format!("<{name}>");
+    body.split(&open)
+        .skip(1)
+        .map(|s| s.split(&format!("</{name}>")).next().unwrap().to_string())
+        .collect()
+}
+
+/// A listing's keys.
+fn keys(body: &str) -> Vec<String> {
+    elements(body, "Key")
+}
+
+/// A listing's common prefixes.
+fn prefixes(body: &str) -> Vec<String> {
+    elements(body, "CommonPrefixes")
+        .iter()
+        .flat_map(|p| elements(p, "Prefix"))
+        .collect()
+}
+
+/// The text of a document's one `<name>` element.
+#[track_caller]
+fn element(body: &str, name: &str) -> String {
+    let all = elements(body, name);
+    assert_eq!(all.len(), 1, "{name} in {body}");
+    all.into_iter().next().unwrap()
+}
+
+/// What `sccache` leaves in its bucket, sharded `a/b/c/<key>`, listed the ways the AWS CLI
+/// and rclone list it: whole, by directory, by pages of two, and by the first version's
+/// markers.
+async fn sharded_listing(host: &str, sign: Sign<'_>) {
+    let mut written: Vec<String> = [".sccache_check"].map(String::from).to_vec();
+    for i in 0..6u8 {
+        let hex = sha256_hex(&[i]);
+        let (a, b, c) = (&hex[..1], &hex[1..2], &hex[2..3]);
+        written.push(format!("ci/{a}/{b}/{c}/{hex}"));
+    }
+    for key in &written {
+        let put = Req::new("PUT", &format!("/s3/sccache/{key}")).body(key.as_bytes().to_vec());
+        send(host, sign(put)).await.ok(200);
+    }
+    written.sort();
+    let list = |q: &str| sign(Req::new("GET", "/s3/sccache").query(q));
+
+    let resp = send(host, list("list-type=2")).await;
+    resp.ok(200);
+    assert_eq!(resp.header("content-type"), Some("application/xml"));
+    assert!(
+        resp.body.starts_with(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+             <ListBucketResult xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
+             <Name>sccache</Name><Prefix></Prefix><MaxKeys>1000</MaxKeys><KeyCount>7</KeyCount>\
+             <IsTruncated>false</IsTruncated><Contents>"
+        ),
+        "{}",
+        resp.body
+    );
+    assert_eq!(keys(&resp.body), written);
+    assert_eq!(
+        elements(&resp.body, "ETag").first().unwrap(),
+        &format!("&quot;{}&quot;", md5_hex(b".sccache_check"))
+    );
+    assert_eq!(elements(&resp.body, "Size").first().unwrap(), "14");
+    let modified = elements(&resp.body, "LastModified");
+    assert!(
+        modified
+            .iter()
+            .all(|m| m.len() == 24 && m.ends_with(".000Z")),
+        "{modified:?}"
+    );
+    assert_eq!(elements(&resp.body, "StorageClass").len(), 7);
+    assert!(!resp.body.contains("<Owner>"));
+
+    // By directory, as `aws s3 ls` and rclone walk it.
+    let resp = send(host, list("delimiter=%2F&list-type=2")).await;
+    assert_eq!(keys(&resp.body), [".sccache_check"]);
+    assert_eq!(prefixes(&resp.body), ["ci/"]);
+    assert_eq!(element(&resp.body, "KeyCount"), "2");
+    let first = &written[1];
+    let shard = format!("ci/{}/", &first[3..4]);
+    let resp = send(
+        host,
+        list(&format!(
+            "delimiter=%2F&list-type=2&prefix={}",
+            shard.replace('/', "%2F")
+        )),
+    )
+    .await;
+    assert!(keys(&resp.body).is_empty());
+    assert!(
+        prefixes(&resp.body)
+            .iter()
+            .all(|p| p.starts_with(&shard) && p.len() == shard.len() + 2),
+        "{}",
+        resp.body
+    );
+    assert_eq!(element(&resp.body, "Delimiter"), "/");
+
+    // By pages of two: each token resumes where the last page ended.
+    let mut seen = Vec::new();
+    let mut token: Option<String> = None;
+    let mut pages = 0;
+    loop {
+        let q = match &token {
+            Some(t) => format!("continuation-token={t}&list-type=2&max-keys=2"),
+            None => "list-type=2&max-keys=2".to_string(),
+        };
+        let resp = send(host, list(&q)).await;
+        resp.ok(200);
+        pages += 1;
+        let page = keys(&resp.body);
+        assert_eq!(element(&resp.body, "KeyCount"), page.len().to_string());
+        assert_eq!(element(&resp.body, "MaxKeys"), "2");
+        if let Some(t) = &token {
+            assert_eq!(&element(&resp.body, "ContinuationToken"), t);
+        }
+        seen.extend(page);
+        if element(&resp.body, "IsTruncated") == "false" {
+            assert!(!resp.body.contains("NextContinuationToken"));
+            break;
+        }
+        token = Some(element(&resp.body, "NextContinuationToken"));
+    }
+    assert_eq!((pages, seen.as_slice()), (4, written.as_slice()));
+
+    // The first version: markers, and every object's owner.
+    let mut seen = Vec::new();
+    let mut marker = String::new();
+    loop {
+        let q = if marker.is_empty() {
+            "max-keys=3".to_string()
+        } else {
+            format!("marker={}&max-keys=3", marker.replace('/', "%2F"))
+        };
+        let resp = send(host, list(&q)).await;
+        resp.ok(200);
+        assert_eq!(element(&resp.body, "Marker"), marker);
+        assert!(!resp.body.contains("KeyCount"));
+        let page = keys(&resp.body);
+        assert_eq!(elements(&resp.body, "Owner").len(), page.len());
+        seen.extend(page);
+        if element(&resp.body, "IsTruncated") == "false" {
+            break;
+        }
+        marker = element(&resp.body, "NextMarker");
+        assert_eq!(&marker, seen.last().unwrap());
+    }
+    assert_eq!(seen, written);
+
+    // The other parameters.
+    let start = &written[3];
+    let resp = send(
+        host,
+        list(&format!(
+            "list-type=2&start-after={}",
+            start.replace('/', "%2F")
+        )),
+    )
+    .await;
+    assert_eq!(keys(&resp.body), &written[4..]);
+    assert_eq!(&element(&resp.body, "StartAfter"), start);
+    let resp = send(host, list("fetch-owner=true&list-type=2&max-keys=1")).await;
+    assert!(
+        resp.body.contains(
+            "<Size>14</Size><Owner><ID>vk-registry</ID><DisplayName>vk-registry</DisplayName>\
+             </Owner><StorageClass>STANDARD</StorageClass>"
+        ),
+        "{}",
+        resp.body
+    );
+    let resp = send(host, list("list-type=2&max-keys=0")).await;
+    assert!(keys(&resp.body).is_empty());
+    assert_eq!(element(&resp.body, "IsTruncated"), "false");
+    assert_eq!(element(&resp.body, "KeyCount"), "0");
+    let resp = send(host, list("list-type=2&max-keys=5000")).await;
+    assert_eq!(element(&resp.body, "MaxKeys"), "1000");
+    let resp = send(
+        host,
+        list("delimiter=%2F&encoding-type=url&list-type=2&prefix=x%20y"),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "Prefix"), "x%20y");
+    assert_eq!(element(&resp.body, "EncodingType"), "url");
+    let resp = send(host, list("encoding-type=url&list-type=2&max-keys=1")).await;
+    assert_eq!(keys(&resp.body), [".sccache_check"]);
+
+    // Refused: a token this registry did not give, a malformed parameter.
+    for bad in [
+        "continuation-token=bm90IGEga2V5&list-type=2",
+        "continuation-token=%21%21&list-type=2",
+        "list-type=2&max-keys=-1",
+        "encoding-type=base64&list-type=2",
+        "list-type=3",
+    ] {
+        send(host, list(bad)).await.is(400, "InvalidArgument");
+    }
+    send(host, sign(Req::new("GET", "/s3/none").query("list-type=2")))
+        .await
+        .is(404, "NoSuchBucket");
+    // A query naming something else is not a listing.
+    send(host, list("acl=")).await.is(501, "NotImplemented");
+    send(host, list("acl=&list-type=2"))
+        .await
+        .is(501, "NotImplemented");
+}
+
+#[tokio::test]
+async fn a_sharded_bucket_lists_on_an_open_server() {
+    let dir = tmp("list-open");
+    let host = spawn(open_state(&dir, true));
+    sharded_listing(&host, &|r| r).await;
+}
+
+#[tokio::test]
+async fn a_sharded_bucket_lists_with_an_api_key() {
+    let dir = tmp("list-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let scopes = [Scope {
+        action: Action::Write,
+        repo_pattern: "files/*".to_string(),
+    }];
+    let (_, key) = db
+        .create_api_key(Some(&user.id), "s3", &scopes, None)
+        .unwrap();
+    let host = spawn(state.clone());
+    let signed = |r: Req| r.signed(&host, (&key, &key), 0);
+    sharded_listing(&host, &signed).await;
 }
 
 /// A hub token's grants cover `files/<prefix>`.
@@ -1513,6 +1825,23 @@ async fn a_hub_token_writes_and_reads_below_its_grant() {
         &send(&host, as_token(Req::new("GET", "/s3/p/gl/42/k"))).await,
         HELLO,
     );
+    // The bucket its grant is in, probed and listed down its grant.
+    send(&host, as_token(Req::new("HEAD", "/s3/p")))
+        .await
+        .ok(200);
+    let resp = send(
+        &host,
+        as_token(Req::new("GET", "/s3/p").query("list-type=2&prefix=gl%2F42%2F")),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(keys(&resp.body), ["gl/42/k"]);
+    send(
+        &host,
+        as_token(Req::new("GET", "/s3/p").query("list-type=2")),
+    )
+    .await
+    .is(403, "AccessDenied");
     send(
         &host,
         as_token(Req::new("PUT", "/s3/p/gl/43/k").body(HELLO.to_vec())),

From 0fb92b70148ed7d70d881ec26aaea53535ce8cde Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 11:52:31 +0100
Subject: [PATCH 07/54] vk-registry/s3: decode aws-chunked uploads and check
 checksums

Decode the aws-chunked bodies AWS SDKs and the CLI send, in one
streaming pass under the staging write: signed chunks, signed and
unsigned trailers, and plain aws-chunked framing. Chunk and trailer
signatures chain from the request's signature and are checked with its
signing key; a body sent under a bearer or to an open server has its
framing decoded and its signatures left unchecked. The trailer's
checksum is checked like a header's. Framing is bounded as it is read,
and a body refused anywhere leaves nothing tagged.
---
 CHANGELOG.md                  |    3 +-
 README.md                     |    4 +-
 vk-registry/DESIGN.md         |   31 +-
 vk-registry/src/s3/chunked.rs | 1058 +++++++++++++++++++++++++++++++++
 vk-registry/src/s3/mod.rs     |   31 +-
 vk-registry/src/s3/object.rs  |  385 +++++++++---
 vk-registry/src/s3/sigv4.rs   |   31 +-
 vk-registry/tests/s3_e2e.rs   |  516 ++++++++++++++--
 8 files changed, 1919 insertions(+), 140 deletions(-)
 create mode 100644 vk-registry/src/s3/chunked.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62d1c447..c2dd409f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,8 @@ All notable changes to virtkit will be documented in this file.
   Basic user and its password. Objects can be written, read with conditional headers and
   checksums, given metadata and deleted, and listed page by page, and are the same files WebDAV
   and `vk registry get` see; a key limited to a directory of a bucket can list that directory.
-  Multipart and chunked uploads, ranges and copies are not served yet. Set `s3 = false` in the
+  The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
+  checked; multipart uploads, ranges and copies are not served yet. Set `s3 = false` in the
   server config to turn it off.
 
 ## [0.106.0] - 2026-11-05
diff --git a/README.md b/README.md
index ebdcc130..2abecba3 100644
--- a/README.md
+++ b/README.md
@@ -867,8 +867,8 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 ```
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
-bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart and chunked uploads,
-ranges and copies are not served yet. Set `s3 = false` to disable it.
+bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads, ranges and
+copies are not served yet. Set `s3 = false` to disable it.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 7e47db5a..25cc91b0 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -643,7 +643,7 @@ reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD` or the body's SHA-256, else 400 `XAmzContentSHA256Mismatch` and nothing is tagged. `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. `Range` is ignored and no `Accept-Ranges` is sent: a whole 200 is a legal answer. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
@@ -652,7 +652,34 @@ reads; a replaced object keeps only what its own write sent.
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| anything else | 501 `NotImplemented`: creating and deleting buckets, copies, batch deletes, multipart uploads, `aws-chunked` bodies (`STREAMING-*` payloads, `Content-Encoding: aws-chunked`), tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+| anything else | 501 `NotImplemented`: creating and deleting buckets, copies, batch deletes, multipart uploads, tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+
+**`aws-chunked` bodies**, which AWS's SDKs and CLI send by default, are decoded as they
+stream, in one pass: a run of `<hex size>[;chunk-signature=<sig>]\r\n<data>\r\n` chunks ended
+by an empty one, then, in the `-TRAILER` modes, the checksum `x-amz-trailer` announced and,
+when signed, `x-amz-trailer-signature`. `x-amz-content-sha256` names the mode:
+`STREAMING-AWS4-HMAC-SHA256-PAYLOAD` signs every chunk, its `-TRAILER` form the trailer too,
+`STREAMING-UNSIGNED-PAYLOAD-TRAILER` signs nothing and carries the checksum, and
+`Content-Encoding: aws-chunked` beside `UNSIGNED-PAYLOAD` or a SHA-256 is framing alone (the
+SHA-256 then being the decoded bytes'). Chunk signatures chain from the request's own as AWS
+defines them, the trailer's signing its `name:value\n` lines after the last chunk's; they are
+checked with the signing key the request's signature was, which is kept while the body
+streams and wiped after. **A request authenticated by a bearer, Basic or session credential
+rather than SigV4** — the way a proxy that authenticates a guest's requests itself forwards
+them — and any request to a server with no credential has no secret to check them with: its
+framing is decoded and its signatures are read, not checked. `x-amz-decoded-content-length`
+is required (400 `InvalidRequest`), past 4 GiB is 413 before the body is read, and the chunks
+must hold exactly that many bytes. The trailer's `x-amz-checksum-{crc32,sha1,sha256}` is
+checked against the decoded bytes and echoed, as a header's is; `crc32c` and `crc64nvme` are
+taken unchecked; a checksum sent both as a header and in the trailer is 400. Reading is
+bounded as it goes: a chunk header of at most 256 bytes, a chunk no longer than what is left
+of the declared length, a trailer of at most 8 KiB, nothing after its end, and memory of one
+frame and a line. A body that breaks any of this is refused where it goes wrong — 400
+`InvalidChunkSizeError`, `IncompleteBody` or `MalformedTrailerError`, 403
+`SignatureDoesNotMatch` — and its staging file is dropped, so nothing it held is tagged. No
+other content encoding is decoded: one named beside `aws-chunked` is 501 `NotImplemented`, as
+is another streaming mode (`STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD`); another encoding
+alone is stored as sent, its name not kept.
 
 **A listing's cost** is bounded by its page. The walk runs on the blocking pool, starts at the
 directory the prefix's whole components name, lists each directory it enters once (its
diff --git a/vk-registry/src/s3/chunked.rs b/vk-registry/src/s3/chunked.rs
new file mode 100644
index 00000000..e33f7f33
--- /dev/null
+++ b/vk-registry/src/s3/chunked.rs
@@ -0,0 +1,1058 @@
+//! `aws-chunked` bodies: the framing AWS SDKs and the CLI wrap a PutObject's bytes in, decoded
+//! in one streaming pass by [`Decoder`], a [`Body`] over the request's own. The body is a run
+//! of chunks, `<hex size>[;chunk-signature=<64 hex>]\r\n<data>\r\n`, ended by a chunk of size
+//! zero; in the `-TRAILER` modes, `name:value\r\n` lines follow it (the checksum
+//! `x-amz-trailer` announced, then `x-amz-trailer-signature` when signed), and a last `\r\n`.
+//!
+//! A signed body's signatures chain: each chunk's covers its data and the signature before
+//! it, the first one's the request's own, and the trailer's the last chunk's. They are
+//! checked when the request was signed with a secret this registry knows ([`Seed`]); a body
+//! sent under a bearer, Basic or session credential, or to an open server, has its framing
+//! decoded and its signatures read but not checked, as no seed is known.
+//!
+//! What is read is bounded as it is read: a chunk header of at most [`MAX_HEADER`] bytes, a
+//! chunk no longer than what is left of `x-amz-decoded-content-length`, a trailer section of
+//! at most [`MAX_TRAILER`], and nothing after its end. Memory is one frame of the inner body
+//! and a line. Anything else stops the body with a [`Refusal`]; the data already passed on
+//! is then in a staging file its caller drops, so nothing it decoded is ever tagged.
+
+use std::error::Error as StdError;
+use std::fmt;
+use std::pin::Pin;
+use std::task::{Context, Poll, ready};
+
+use bytes::{Buf as _, Bytes};
+use hyper::StatusCode;
+use hyper::body::{Body, Frame};
+use sha2::{Digest as _, Sha256};
+
+use super::sigv4::{self, SigningKey};
+
+/// The longest chunk header taken, its CRLF included: a size and a signature need 91.
+pub(crate) const MAX_HEADER: usize = 256;
+
+/// The longest trailer section taken, every line's CRLF included.
+pub(crate) const MAX_TRAILER: usize = 8 * 1024;
+
+/// The trailer line carrying the trailer's signature.
+const TRAILER_SIGNATURE: &str = "x-amz-trailer-signature";
+
+/// The SHA-256 of nothing, which a chunk's string to sign carries where a header hash would be.
+const EMPTY_SHA256: &str = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+
+/// The checksums a trailer may carry, as `x-amz-trailer` names them.
+pub(crate) const CHECKSUMS: [&str; 5] = [
+    "x-amz-checksum-crc32",
+    "x-amz-checksum-crc32c",
+    "x-amz-checksum-sha1",
+    "x-amz-checksum-sha256",
+    "x-amz-checksum-crc64nvme",
+];
+
+/// How a chunked body is framed and signed, from its `x-amz-content-sha256`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Mode {
+    /// `STREAMING-AWS4-HMAC-SHA256-PAYLOAD`: every chunk signed, no trailer
+    Signed,
+    /// `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER`: every chunk and the trailer signed
+    SignedTrailer,
+    /// `STREAMING-UNSIGNED-PAYLOAD-TRAILER`: no signature, a trailer
+    UnsignedTrailer,
+    /// `Content-Encoding: aws-chunked` with any other payload hash: no signature, no trailer
+    Unsigned,
+}
+
+impl Mode {
+    /// The mode an `x-amz-content-sha256` names, if it names one of the streaming modes.
+    pub(crate) fn of(content_sha256: &str) -> Option<Mode> {
+        match content_sha256 {
+            "STREAMING-AWS4-HMAC-SHA256-PAYLOAD" => Some(Mode::Signed),
+            "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER" => Some(Mode::SignedTrailer),
+            "STREAMING-UNSIGNED-PAYLOAD-TRAILER" => Some(Mode::UnsignedTrailer),
+            _ => None,
+        }
+    }
+
+    /// Whether chunks and trailer carry signatures.
+    pub(crate) fn signed(self) -> bool {
+        matches!(self, Mode::Signed | Mode::SignedTrailer)
+    }
+
+    /// Whether trailer lines follow the last chunk.
+    pub(crate) fn trailer(self) -> bool {
+        matches!(self, Mode::SignedTrailer | Mode::UnsignedTrailer)
+    }
+}
+
+/// What a request's headers say of its chunked body.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Framing {
+    pub(crate) mode: Mode,
+    /// `x-amz-decoded-content-length`: exactly how many bytes the chunks hold
+    pub(crate) declared: u64,
+    /// the checksum `x-amz-trailer` announced, one of [`CHECKSUMS`]
+    pub(crate) trailer: Option<&'static str>,
+}
+
+/// What a signed body's signatures are checked against: the request's signing key, time,
+/// scope and signature, which seeds the chain. Its key is wiped when it is dropped.
+pub(crate) struct Seed {
+    key: SigningKey,
+    stamp: String,
+    scope: String,
+    signature: String,
+}
+
+impl Seed {
+    /// The seed of a request signed by `credential` with `secret` at `stamp`, its signature
+    /// already checked. `None` only if no key could be derived.
+    pub(crate) fn of(
+        secret: &str,
+        credential: &sigv4::Credential<'_>,
+        stamp: &str,
+    ) -> Option<Self> {
+        let key = SigningKey::derive(
+            secret,
+            credential.date,
+            credential.region,
+            credential.service,
+        )?;
+        Some(Seed {
+            key,
+            stamp: stamp.to_string(),
+            scope: credential.scope(),
+            signature: credential.signature.to_string(),
+        })
+    }
+
+    /// Whether `presented` is this key's signature of `string_to_sign`, in constant time.
+    fn signs(&self, string_to_sign: &str, presented: &str) -> bool {
+        self.key
+            .sign(string_to_sign)
+            .is_some_and(|ours| crate::auth::constant_eq(ours.as_bytes(), presented.as_bytes()))
+    }
+}
+
+/// The string a chunk's signature signs: the chain's previous signature and the chunk's data.
+fn chunk_string_to_sign(stamp: &str, scope: &str, previous: &str, data_sha256: &str) -> String {
+    format!(
+        "{}-PAYLOAD\n{stamp}\n{scope}\n{previous}\n{EMPTY_SHA256}\n{data_sha256}",
+        sigv4::ALGORITHM
+    )
+}
+
+/// The string the trailer's signature signs: the last chunk's signature and the trailer's
+/// lines, hashed as `name:value\n` each.
+fn trailer_string_to_sign(stamp: &str, scope: &str, previous: &str, lines_sha256: &str) -> String {
+    format!(
+        "{}-TRAILER\n{stamp}\n{scope}\n{previous}\n{lines_sha256}",
+        sigv4::ALGORITHM
+    )
+}
+
+/// Why a chunked body was refused: the S3 answer to it.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Refusal {
+    pub(crate) status: StatusCode,
+    pub(crate) code: &'static str,
+    pub(crate) message: &'static str,
+}
+
+impl Refusal {
+    /// A chunk header that is malformed, too long, or sizes a chunk past the declared length.
+    fn size(message: &'static str) -> Self {
+        Refusal {
+            status: StatusCode::BAD_REQUEST,
+            code: "InvalidChunkSizeError",
+            message,
+        }
+    }
+
+    /// A body that ends early, or holds other than the declared length.
+    fn incomplete(message: &'static str) -> Self {
+        Refusal {
+            status: StatusCode::BAD_REQUEST,
+            code: "IncompleteBody",
+            message,
+        }
+    }
+
+    /// A trailer section that is malformed, too long, or followed by anything.
+    fn trailer(message: &'static str) -> Self {
+        Refusal {
+            status: StatusCode::BAD_REQUEST,
+            code: "MalformedTrailerError",
+            message,
+        }
+    }
+
+    /// A chunk or trailer signature that is not the seed's key's.
+    fn signature(message: &'static str) -> Self {
+        Refusal {
+            status: StatusCode::FORBIDDEN,
+            code: "SignatureDoesNotMatch",
+            message,
+        }
+    }
+}
+
+/// Why a [`Decoder`] stopped: its framing was refused, or the body under it failed.
+#[derive(Debug)]
+pub(crate) enum Error {
+    Refused(Refusal),
+    Body(Box<dyn StdError + Send + Sync>),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Refused(r) => write!(f, "an aws-chunked body was refused: {}", r.message),
+            Error::Body(e) => write!(f, "reading an aws-chunked body: {e}"),
+        }
+    }
+}
+
+impl StdError for Error {
+    fn source(&self) -> Option<&(dyn StdError + 'static)> {
+        match self {
+            Error::Refused(_) => None,
+            Error::Body(e) => Some(&**e),
+        }
+    }
+}
+
+/// Where the decoder is in the body.
+#[derive(Clone, Copy, Debug)]
+enum State {
+    /// reading a chunk header line
+    Header,
+    /// passing on this many more bytes of a chunk's data
+    Data(u64),
+    /// reading the CRLF after a chunk's data, this many of its bytes seen
+    DataEnd(u8),
+    /// reading trailer lines, after the last chunk's header
+    Trailer,
+    /// past the trailer's end: only the inner body's end may follow
+    Done,
+    /// refused or failed: nothing more is read
+    Failed,
+}
+
+/// The trailer as read so far.
+#[derive(Default)]
+struct Trailer {
+    /// bytes read, CRLFs included
+    read: usize,
+    /// the announced checksum's value
+    value: Option<String>,
+    /// the hash of the checksum lines as the trailer signature signs them
+    lines: Sha256,
+    signature: Option<String>,
+}
+
+/// What one step of decoding produced.
+enum Step {
+    Data(Bytes),
+    More,
+    End,
+}
+
+/// An `aws-chunked` body decoded: a [`Body`] of the chunks' data, over the body as sent. It
+/// ends once the inner body has, after a well-formed end; [`Decoder::trailer`] then holds the
+/// trailer's checksum.
+pub(crate) struct Decoder<B> {
+    inner: B,
+    inner_done: bool,
+    framing: Framing,
+    /// set when signatures are checked: a signed mode, and a request signed with a known secret
+    seed: Option<Seed>,
+    /// the chain's previous signature: the request's, then each chunk's
+    previous: String,
+    state: State,
+    /// what is left of the inner body's current frame
+    pending: Bytes,
+    /// the line being read, its CRLF not yet seen
+    line: Vec<u8>,
+    decoded: u64,
+    /// the signature of the chunk being read and the hash of its data, when checked
+    chunk: Option<(String, Sha256)>,
+    trailer: Trailer,
+}
+
+impl<B> Decoder<B> {
+    /// A decoder of `inner` framed as `framing`, checking its signatures against `seed` if
+    /// there is one and the mode is signed.
+    pub(crate) fn new(inner: B, framing: Framing, seed: Option<Seed>) -> Self {
+        let seed = seed.filter(|_| framing.mode.signed());
+        Decoder {
+            inner,
+            inner_done: false,
+            framing,
+            previous: seed
+                .as_ref()
+                .map(|s| s.signature.clone())
+                .unwrap_or_default(),
+            seed,
+            state: State::Header,
+            pending: Bytes::new(),
+            line: Vec::new(),
+            decoded: 0,
+            chunk: None,
+            trailer: Trailer::default(),
+        }
+    }
+
+    /// The announced checksum and the value the trailer gave it, once the body has ended.
+    pub(crate) fn trailer(&self) -> Option<(&'static str, &str)> {
+        Some((self.framing.trailer?, self.trailer.value.as_deref()?))
+    }
+
+    /// Move the inner body's bytes into `line` up to a LF: `true` once a whole line is there,
+    /// its CRLF dropped. A line of `max` bytes or more, CRLF included, is `too_long`.
+    fn read_line(&mut self, max: usize, too_long: Refusal) -> Result<bool, Refusal> {
+        let Some(end) = self.pending.iter().position(|&b| b == b'\n') else {
+            if self.line.len().saturating_add(self.pending.len()) >= max {
+                return Err(too_long);
+            }
+            self.line.extend_from_slice(&self.pending);
+            self.pending.clear();
+            return Ok(false);
+        };
+        if self.line.len().saturating_add(end) >= max {
+            return Err(too_long);
+        }
+        self.line
+            .extend_from_slice(self.pending.get(..end).unwrap_or_default());
+        self.pending.advance(end.saturating_add(1));
+        if self.line.pop() != Some(b'\r') {
+            return Err(Refusal::size("a line of the body does not end in CRLF"));
+        }
+        Ok(true)
+    }
+
+    /// The chunk header in `line`: the next chunk's size, and its signature.
+    fn header(&mut self) -> Result<(), Refusal> {
+        let line = std::mem::take(&mut self.line);
+        let text =
+            std::str::from_utf8(&line).map_err(|_| Refusal::size("a chunk header is not text"))?;
+        let (size, extension) = match text.split_once(';') {
+            Some((size, extension)) => (size, Some(extension)),
+            None => (text, None),
+        };
+        if size.is_empty() || size.len() > 16 || !size.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return Err(Refusal::size("a chunk size is not a hex number"));
+        }
+        let size = u64::from_str_radix(size, 16)
+            .map_err(|_| Refusal::size("a chunk size is not a hex number"))?;
+        let signature = match (self.framing.mode.signed(), extension) {
+            (true, Some(extension)) => Some(
+                extension
+                    .strip_prefix("chunk-signature=")
+                    .filter(|s| is_signature(s))
+                    .ok_or(Refusal::size(
+                        "a signed chunk's header is its size and chunk-signature=<64 hex>",
+                    ))?,
+            ),
+            (false, None) => None,
+            (true, None) => {
+                return Err(Refusal::size(
+                    "a signed chunk's header has no chunk-signature",
+                ));
+            }
+            (false, Some(_)) => {
+                return Err(Refusal::size(
+                    "an unsigned chunk's header is its size alone",
+                ));
+            }
+        };
+        let left = self.framing.declared.saturating_sub(self.decoded);
+        if size > left {
+            return Err(Refusal::size(
+                "a chunk runs past x-amz-decoded-content-length",
+            ));
+        }
+        self.chunk = signature
+            .filter(|_| self.seed.is_some())
+            .map(|s| (s.to_string(), Sha256::new()));
+        if size == 0 {
+            if left != 0 {
+                return Err(Refusal::incomplete(
+                    "the chunks hold fewer bytes than x-amz-decoded-content-length",
+                ));
+            }
+            self.chunk_done()?;
+            self.state = State::Trailer;
+        } else {
+            self.state = State::Data(size);
+        }
+        Ok(())
+    }
+
+    /// Check the chunk just read against the chain, which then moves on to its signature.
+    fn chunk_done(&mut self) -> Result<(), Refusal> {
+        let (Some((presented, data)), Some(seed)) = (self.chunk.take(), &self.seed) else {
+            return Ok(());
+        };
+        let sts = chunk_string_to_sign(
+            &seed.stamp,
+            &seed.scope,
+            &self.previous,
+            &crate::hex_of(&data.finalize()),
+        );
+        if !seed.signs(&sts, &presented) {
+            return Err(Refusal::signature(
+                "a chunk signature does not match the one computed with the key's secret",
+            ));
+        }
+        self.previous = presented;
+        Ok(())
+    }
+
+    /// One trailer line, from `line`: the announced checksum, once, or the trailer's
+    /// signature, last.
+    fn trailer_line(&mut self) -> Result<(), Refusal> {
+        let line = std::mem::take(&mut self.line);
+        if !self.framing.mode.trailer() {
+            return Err(Refusal::trailer("bytes follow the last chunk of the body"));
+        }
+        if self.trailer.signature.is_some() {
+            return Err(Refusal::trailer(
+                "x-amz-trailer-signature is the trailer's last line",
+            ));
+        }
+        let (name, value) = std::str::from_utf8(&line)
+            .ok()
+            .and_then(|l| l.split_once(':'))
+            .ok_or(Refusal::trailer("a trailer line is name:value"))?;
+        if name.eq_ignore_ascii_case(TRAILER_SIGNATURE) {
+            let value = value.trim();
+            if !self.framing.mode.signed() || !is_signature(value) {
+                return Err(Refusal::trailer(
+                    "x-amz-trailer-signature is 64 hex digits, in a signed trailer only",
+                ));
+            }
+            self.trailer.signature = Some(value.to_string());
+            return Ok(());
+        }
+        if self.trailer.value.is_some()
+            || !self
+                .framing
+                .trailer
+                .is_some_and(|t| t.eq_ignore_ascii_case(name))
+        {
+            return Err(Refusal::trailer(
+                "the trailer holds the checksum x-amz-trailer announced, once",
+            ));
+        }
+        self.trailer.lines.update(&line);
+        self.trailer.lines.update(b"\n");
+        self.trailer.value = Some(value.trim().to_string());
+        Ok(())
+    }
+
+    /// The trailer's end: the announced checksum sent, and the signature checked.
+    fn trailer_done(&mut self) -> Result<(), Refusal> {
+        if !self.framing.mode.trailer() {
+            return Ok(());
+        }
+        if self.framing.trailer.is_some() && self.trailer.value.is_none() {
+            return Err(Refusal::trailer(
+                "the trailer does not hold the checksum x-amz-trailer announced",
+            ));
+        }
+        if !self.framing.mode.signed() {
+            return Ok(());
+        }
+        let Some(presented) = self.trailer.signature.take() else {
+            return Err(Refusal::trailer(
+                "a signed upload's trailer ends with x-amz-trailer-signature",
+            ));
+        };
+        let Some(seed) = &self.seed else {
+            return Ok(());
+        };
+        let lines = crate::hex_of(&std::mem::take(&mut self.trailer.lines).finalize());
+        let sts = trailer_string_to_sign(&seed.stamp, &seed.scope, &self.previous, &lines);
+        if !seed.signs(&sts, &presented) {
+            return Err(Refusal::signature(
+                "the trailer signature does not match the one computed with the key's secret",
+            ));
+        }
+        Ok(())
+    }
+
+    /// Decode what `pending` holds, which is empty only at the inner body's end.
+    fn step(&mut self) -> Result<Step, Refusal> {
+        let end = self.pending.is_empty();
+        let truncated = Refusal::incomplete("the body ends before its last chunk and trailer");
+        match self.state {
+            State::Failed => Ok(Step::End),
+            State::Done if end => Ok(Step::End),
+            State::Done => Err(Refusal::trailer("bytes follow the end of the body")),
+            _ if end && !matches!(self.state, State::Trailer) => Err(truncated),
+            State::Header => {
+                let too_long = Refusal::size("a chunk header is longer than 256 bytes");
+                if self.read_line(MAX_HEADER, too_long)? {
+                    self.header()?;
+                }
+                Ok(Step::More)
+            }
+            State::Data(left) => {
+                let n =
+                    usize::try_from(left).map_or(self.pending.len(), |l| l.min(self.pending.len()));
+                let data = self.pending.split_to(n);
+                if let Some((_, hash)) = &mut self.chunk {
+                    hash.update(&data);
+                }
+                let n = data.len() as u64;
+                self.decoded = self.decoded.saturating_add(n);
+                self.state = match left.saturating_sub(n) {
+                    0 => State::DataEnd(0),
+                    left => State::Data(left),
+                };
+                Ok(Step::Data(data))
+            }
+            State::DataEnd(seen) => {
+                let want = if seen == 0 { b'\r' } else { b'\n' };
+                if self.pending.first() != Some(&want) {
+                    return Err(Refusal::incomplete(
+                        "a chunk's data is not followed by CRLF",
+                    ));
+                }
+                self.pending.advance(1);
+                if seen == 0 {
+                    self.state = State::DataEnd(1);
+                } else {
+                    self.chunk_done()?;
+                    self.state = State::Header;
+                }
+                Ok(Step::More)
+            }
+            // The body may end without the last CRLF, though not inside a line.
+            State::Trailer if end => {
+                if !self.line.is_empty() {
+                    return Err(truncated);
+                }
+                self.trailer_done()?;
+                self.state = State::Done;
+                Ok(Step::End)
+            }
+            State::Trailer => {
+                let budget = MAX_TRAILER.saturating_sub(self.trailer.read);
+                let too_long = Refusal::trailer("the trailer is longer than 8 KiB");
+                if !self.read_line(budget, too_long)? {
+                    return Ok(Step::More);
+                }
+                self.trailer.read = self
+                    .trailer
+                    .read
+                    .saturating_add(self.line.len())
+                    .saturating_add(2);
+                if self.line.is_empty() {
+                    self.trailer_done()?;
+                    self.state = State::Done;
+                } else {
+                    self.trailer_line()?;
+                }
+                Ok(Step::More)
+            }
+        }
+    }
+}
+
+/// Whether `s` is a signature as SigV4 writes one: 64 lowercase hex digits.
+fn is_signature(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
+impl<B> Body for Decoder<B>
+where
+    B: Body<Data = Bytes> + Unpin,
+    B::Error: Into<Box<dyn StdError + Send + Sync>>,
+{
+    type Data = Bytes;
+    type Error = Error;
+
+    fn poll_frame(
+        self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+    ) -> Poll<Option<Result<Frame<Bytes>, Error>>> {
+        let this = self.get_mut();
+        loop {
+            if matches!(this.state, State::Failed) {
+                return Poll::Ready(None);
+            }
+            if this.pending.is_empty() && !this.inner_done {
+                match ready!(Pin::new(&mut this.inner).poll_frame(cx)) {
+                    None => this.inner_done = true,
+                    Some(Err(e)) => {
+                        this.state = State::Failed;
+                        return Poll::Ready(Some(Err(Error::Body(e.into()))));
+                    }
+                    // HTTP trailers of the transfer itself carry no content.
+                    Some(Ok(frame)) => {
+                        if let Ok(data) = frame.into_data() {
+                            this.pending = data;
+                        }
+                    }
+                }
+                continue;
+            }
+            match this.step() {
+                Ok(Step::Data(data)) => return Poll::Ready(Some(Ok(Frame::data(data)))),
+                Ok(Step::More) => {}
+                Ok(Step::End) => return Poll::Ready(None),
+                Err(refusal) => {
+                    this.state = State::Failed;
+                    return Poll::Ready(Some(Err(Error::Refused(refusal))));
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::VecDeque;
+    use std::convert::Infallible;
+    use std::task::Waker;
+
+    const SECRET: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+    const STAMP: &str = "20130524T000000Z";
+    const SCOPE: &str = "20130524/us-east-1/s3/aws4_request";
+
+    /// A body handed over in frames of `size` bytes.
+    struct Frames(VecDeque<Bytes>);
+
+    impl Frames {
+        fn of(body: &[u8], size: usize) -> Self {
+            Frames(
+                body.chunks(size.max(1))
+                    .map(Bytes::copy_from_slice)
+                    .collect(),
+            )
+        }
+    }
+
+    impl Body for Frames {
+        type Data = Bytes;
+        type Error = Infallible;
+
+        fn poll_frame(
+            self: Pin<&mut Self>,
+            _: &mut Context<'_>,
+        ) -> Poll<Option<Result<Frame<Bytes>, Infallible>>> {
+            Poll::Ready(self.get_mut().0.pop_front().map(|b| Ok(Frame::data(b))))
+        }
+    }
+
+    fn seed(signature: &str) -> Seed {
+        Seed {
+            key: SigningKey::derive(SECRET, "20130524", "us-east-1", "s3").unwrap(),
+            stamp: STAMP.to_string(),
+            scope: SCOPE.to_string(),
+            signature: signature.to_string(),
+        }
+    }
+
+    /// What the decoder passes on and the trailer it read, or its refusal: never a panic.
+    fn decode(
+        body: &[u8],
+        frame: usize,
+        framing: Framing,
+        seed: Option<Seed>,
+    ) -> Result<(Vec<u8>, Option<String>), Refusal> {
+        let mut dec = Decoder::new(Frames::of(body, frame), framing, seed);
+        let mut cx = Context::from_waker(Waker::noop());
+        let mut out = Vec::new();
+        loop {
+            match Pin::new(&mut dec).poll_frame(&mut cx) {
+                Poll::Ready(None) => break,
+                Poll::Ready(Some(Ok(f))) => out.extend_from_slice(&f.into_data().unwrap()),
+                Poll::Ready(Some(Err(Error::Refused(r)))) => return Err(r),
+                other => panic!("{other:?}"),
+            }
+        }
+        let trailer = dec.trailer().map(|(_, v)| v.to_string());
+        Ok((out, trailer))
+    }
+
+    const SEED: &str = "4f232c4386841ef735655705268965c44a0e4690baa4adea153f7db9fa80a0a9";
+    const CHUNK1: &str = "ad80c730a21e5b8d04586a2213dd63b9a0e99e0e2307b0ade35a65485a288648";
+    const CHUNK2: &str = "0055627c9e194cb4542bae2aa5492e3c1575bbb81b612b7d234b86a503ef5497";
+    const FINAL: &str = "b6c6ea8a5354eaf15b3cb7646744f4275b71ea724fed81ceb9323e279d449df9";
+
+    /// AWS's chunked PutObject example: 66 560 bytes of `a`, in chunks of 64 KiB, 1 KiB and 0.
+    fn example() -> Vec<u8> {
+        let mut body = format!("10000;chunk-signature={CHUNK1}\r\n").into_bytes();
+        body.extend_from_slice(&[b'a'; 65536]);
+        body.extend_from_slice(format!("\r\n400;chunk-signature={CHUNK2}\r\n").as_bytes());
+        body.extend_from_slice(&[b'a'; 1024]);
+        body.extend_from_slice(format!("\r\n0;chunk-signature={FINAL}\r\n\r\n").as_bytes());
+        body
+    }
+
+    fn signed(declared: u64) -> Framing {
+        Framing {
+            mode: Mode::Signed,
+            declared,
+            trailer: None,
+        }
+    }
+
+    #[test]
+    fn the_aws_chunked_example_decodes_and_verifies() {
+        let body = example();
+        assert_eq!(body.len(), 66_824, "the example's Content-Length");
+        for frame in [1, 7, 91, 4096, 65_536, body.len()] {
+            let (out, trailer) = decode(&body, frame, signed(66_560), Some(seed(SEED))).unwrap();
+            assert_eq!(out, [b'a'; 66_560], "{frame}");
+            assert_eq!(trailer, None);
+        }
+        // The last CRLF may be left out.
+        let short = &body[..body.len() - 2];
+        assert!(decode(short, 4096, signed(66_560), Some(seed(SEED))).is_ok());
+        // Unchecked without a seed, and decoded the same.
+        let (out, _) = decode(&body, 4096, signed(66_560), None).unwrap();
+        assert_eq!(out.len(), 66_560);
+    }
+
+    /// The trailer example's three chunk signatures and its trailer's, from the hashes it
+    /// documents: its second chunk's data is not given (its hash is not that of 1 KiB of `a`,
+    /// nor is its checksum that of the first example's bytes), so the chain is checked from
+    /// the hashes, and the decoder from the last chunk on.
+    #[test]
+    fn the_aws_trailer_example_verifies() {
+        let key = seed("").key;
+        let sign = |sts: &str| key.sign(sts).unwrap();
+        let mut previous =
+            "106e2a8a18243abcf37539882f36619c00e2dfc72633413f02d3b74544bfeb8e".to_string();
+        for (hash, expect) in [
+            (
+                "bf718b6f653bebc184e1479f1935b8da974d701b893afcf49e701f3e2f9f9c5a",
+                "b474d8862b1487a5145d686f57f013e54db672cee1c953b3010fb58501ef5aa2",
+            ),
+            (
+                "41edece42d63e8d9bf515a9ba6932e1c20cbc9f5a5d134645adb5db1b9737ea3",
+                "041169d545f3f4a02fe2e3d066bfb1798dd5f3417ae8cecd0e43690aafbe79d1",
+            ),
+            (
+                EMPTY_SHA256,
+                "e05ab64fe1dfdbf0b5870abbaabdb063c371d4e96f2767e6934d90529c5ae850",
+            ),
+        ] {
+            previous = sign(&chunk_string_to_sign(STAMP, SCOPE, &previous, hash));
+            assert_eq!(previous, expect);
+        }
+        let lines = crate::hex_of(&Sha256::digest(b"x-amz-checksum-crc32c:wdBDMA==\n"));
+        assert_eq!(
+            lines,
+            "2e4ab969aa65b1ad6def2db10e4d3a8260683d194dbaf757f90e8a37960a4b3c"
+        );
+        assert_eq!(
+            sign(&trailer_string_to_sign(STAMP, SCOPE, &previous, &lines)),
+            "41e14ac611e27a8bb3d66c3bad6856f209297767d5dd4fc87d8fa9e422e03faf"
+        );
+
+        // The body from its last chunk on, seeded with the chunk before it.
+        let tail = "0;chunk-signature=e05ab64fe1dfdbf0b5870abbaabdb063c371d4e96f2767e6934d90529c5ae850\r\n\
+                    x-amz-checksum-crc32c:wdBDMA==\r\n\
+                    x-amz-trailer-signature:41e14ac611e27a8bb3d66c3bad6856f209297767d5dd4fc87d8fa9e422e03faf\r\n\r\n";
+        let framing = Framing {
+            mode: Mode::SignedTrailer,
+            declared: 0,
+            trailer: Some("x-amz-checksum-crc32c"),
+        };
+        let chunk2 = "041169d545f3f4a02fe2e3d066bfb1798dd5f3417ae8cecd0e43690aafbe79d1";
+        for frame in [1, 5, tail.len()] {
+            let (out, trailer) =
+                decode(tail.as_bytes(), frame, framing, Some(seed(chunk2))).unwrap();
+            assert!(out.is_empty());
+            assert_eq!(trailer.as_deref(), Some("wdBDMA=="));
+        }
+        // Another trailer value, or another chain, does not verify.
+        let other = tail.replace("wdBDMA==", "wdBDMQ==");
+        assert_eq!(
+            decode(other.as_bytes(), 64, framing, Some(seed(chunk2)))
+                .unwrap_err()
+                .code,
+            "SignatureDoesNotMatch"
+        );
+        assert_eq!(
+            decode(tail.as_bytes(), 64, framing, Some(seed(SEED)))
+                .unwrap_err()
+                .code,
+            "SignatureDoesNotMatch"
+        );
+        // Without a seed the trailer is read, its signature not checked.
+        let (_, trailer) = decode(other.as_bytes(), 64, framing, None).unwrap();
+        assert_eq!(trailer.as_deref(), Some("wdBDMQ=="));
+    }
+
+    fn unsigned_trailer(declared: u64) -> Framing {
+        Framing {
+            mode: Mode::UnsignedTrailer,
+            declared,
+            trailer: Some("x-amz-checksum-crc32"),
+        }
+    }
+
+    #[test]
+    fn an_unsigned_trailer_carries_its_checksum() {
+        let crc = vk_hub_proto::to_base64(&crc32fast::hash(b"hello world").to_be_bytes());
+        let body = format!("5\r\nhello\r\n6\r\n world\r\n0\r\nx-amz-checksum-crc32:{crc}\r\n\r\n");
+        for frame in [1, 3, body.len()] {
+            // A seed changes nothing for a body that is not signed.
+            let (out, trailer) = decode(
+                body.as_bytes(),
+                frame,
+                unsigned_trailer(11),
+                Some(seed(SEED)),
+            )
+            .unwrap();
+            assert_eq!(out, b"hello world");
+            assert_eq!(trailer.as_deref(), Some(crc.as_str()));
+        }
+        let code =
+            |body: &str, framing| decode(body.as_bytes(), 4, framing, None).unwrap_err().code;
+        // Not announced, missing, twice, or signed where nothing is.
+        let t = unsigned_trailer(1);
+        assert_eq!(
+            code("1\r\na\r\n0\r\nx-amz-checksum-sha1:x\r\n\r\n", t),
+            "MalformedTrailerError"
+        );
+        assert_eq!(code("1\r\na\r\n0\r\n\r\n", t), "MalformedTrailerError");
+        assert_eq!(
+            code(
+                "1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\nx-amz-checksum-crc32:a\r\n\r\n",
+                t
+            ),
+            "MalformedTrailerError"
+        );
+        let sig = format!("x-amz-trailer-signature:{FINAL}");
+        assert_eq!(
+            code(
+                &format!("1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\n{sig}\r\n\r\n"),
+                t
+            ),
+            "MalformedTrailerError"
+        );
+        assert_eq!(
+            code(&format!("1;chunk-signature={FINAL}\r\na\r\n0\r\n\r\n"), t),
+            "InvalidChunkSizeError"
+        );
+        // A plain aws-chunked body has no trailer.
+        let plain = Framing {
+            mode: Mode::Unsigned,
+            declared: 1,
+            trailer: None,
+        };
+        assert_eq!(
+            decode(b"1\r\na\r\n0\r\n\r\n", 2, plain, None).unwrap().0,
+            b"a"
+        );
+        assert_eq!(
+            code("1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\n\r\n", plain),
+            "MalformedTrailerError"
+        );
+    }
+
+    #[test]
+    fn a_signed_trailer_needs_its_signature_last() {
+        let framing = Framing {
+            mode: Mode::SignedTrailer,
+            declared: 0,
+            trailer: None,
+        };
+        let code = |body: String| decode(body.as_bytes(), 8, framing, None).unwrap_err().code;
+        let zero = format!("0;chunk-signature={FINAL}\r\n");
+        assert_eq!(code(format!("{zero}\r\n")), "MalformedTrailerError");
+        let sig = format!("x-amz-trailer-signature:{FINAL}\r\n");
+        assert!(decode(format!("{zero}{sig}\r\n").as_bytes(), 8, framing, None).is_ok());
+        assert_eq!(
+            code(format!("{zero}{sig}{sig}\r\n")),
+            "MalformedTrailerError"
+        );
+        assert_eq!(
+            code(format!(
+                "{zero}x-amz-trailer-signature:{}\r\n\r\n",
+                FINAL.to_uppercase()
+            )),
+            "MalformedTrailerError"
+        );
+    }
+
+    #[test]
+    fn a_wrong_chunk_signature_is_refused() {
+        let body = String::from_utf8(example()).unwrap();
+        for wrong in [CHUNK1, CHUNK2, FINAL] {
+            let mut flipped = wrong.to_string();
+            flipped.replace_range(..1, if wrong.starts_with('0') { "1" } else { "0" });
+            let mutated = body.replace(wrong, &flipped);
+            let r = decode(mutated.as_bytes(), 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
+            assert_eq!(r.code, "SignatureDoesNotMatch", "{wrong}");
+            assert_eq!(r.status, StatusCode::FORBIDDEN);
+        }
+        // Another seed: another chain.
+        let r = decode(body.as_bytes(), 4096, signed(66_560), Some(seed(CHUNK1))).unwrap_err();
+        assert_eq!(r.code, "SignatureDoesNotMatch");
+    }
+
+    #[test]
+    fn framing_is_bounded_and_complete() {
+        let code = |body: &[u8], declared| {
+            let framing = Framing {
+                mode: Mode::Unsigned,
+                declared,
+                trailer: None,
+            };
+            decode(body, 3, framing, None).unwrap_err().code
+        };
+        // Past the declared length, short of it, or not the length a size says.
+        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 4), "InvalidChunkSizeError");
+        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 6), "IncompleteBody");
+        assert_eq!(code(b"4\r\nhello\r\n0\r\n\r\n", 5), "IncompleteBody");
+        assert_eq!(
+            code(b"ffffffffffffffff\r\nhello\r\n0\r\n\r\n", 5),
+            "InvalidChunkSizeError"
+        );
+        assert_eq!(code(b"10000000000000000\r\n", 5), "InvalidChunkSizeError");
+        // Sizes in hex only.
+        for bad in [
+            &b"x\r\n"[..],
+            b"\r\n",
+            b"-1\r\n",
+            b" 5\r\nhello\r\n",
+            b"+5\r\nhello\r\n",
+        ] {
+            assert_eq!(code(bad, 5), "InvalidChunkSizeError", "{bad:?}");
+        }
+        let plain = Framing {
+            mode: Mode::Unsigned,
+            declared: 10,
+            trailer: None,
+        };
+        let (out, _) = decode(b"A\r\n0123456789\r\n0\r\n", 3, plain, None).unwrap();
+        assert_eq!(out, b"0123456789");
+        // A header line is at most 256 bytes, CRLF included: one of 256 is read (and its size
+        // refused), one of 257 is refused for its length.
+        let pad = |n: usize| {
+            let mut h = vec![b'0'; n - 3];
+            h.extend_from_slice(b"1\r\n");
+            h.extend_from_slice(b"a\r\n0\r\n");
+            h
+        };
+        let message = |body: &[u8]| decode(body, 3, signed(1), None).unwrap_err().message;
+        assert!(
+            !message(&pad(256)).contains("256"),
+            "{}",
+            message(&pad(256))
+        );
+        assert!(message(&pad(257)).contains("256"));
+        assert_eq!(code(&pad(300), 1), "InvalidChunkSizeError");
+        // A header whose LF never comes is refused at the bound, not read further.
+        let mut endless = vec![b'0'; 10_000];
+        endless.insert(0, b'1');
+        assert_eq!(code(&endless, 1), "InvalidChunkSizeError");
+        // LF without CR, or data not followed by CRLF.
+        assert_eq!(code(b"5\nhello\r\n0\r\n\r\n", 5), "InvalidChunkSizeError");
+        assert_eq!(code(b"5\r\nhello\n0\r\n\r\n", 5), "IncompleteBody");
+        assert_eq!(code(b"5\r\nhelloXY0\r\n\r\n", 5), "IncompleteBody");
+        // Anything after the end.
+        assert_eq!(
+            code(b"5\r\nhello\r\n0\r\n\r\n\r\n", 5),
+            "MalformedTrailerError"
+        );
+        assert_eq!(
+            code(b"5\r\nhello\r\n0\r\n\r\nx", 5),
+            "MalformedTrailerError"
+        );
+        let mut garbage = example();
+        garbage.push(b'x');
+        let r = decode(&garbage, 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
+        assert_eq!(r.code, "MalformedTrailerError");
+    }
+
+    #[test]
+    fn a_truncated_body_is_refused() {
+        let body = example();
+        let mut cuts: Vec<usize> = (0..120).collect();
+        cuts.extend([
+            65_620, 65_625, 65_626, 65_700, 66_700, 66_737, 66_738, 66_800, 66_821, 66_823,
+        ]);
+        for cut in cuts {
+            let r = decode(&body[..cut], 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
+            assert_eq!(r.code, "IncompleteBody", "{cut}");
+        }
+    }
+
+    #[test]
+    fn a_trailer_is_at_most_8_kib() {
+        let line = |len: usize| format!("x-amz-checksum-crc32:{}\r\n", "A".repeat(len - 23));
+        let body = |len| format!("1\r\na\r\n0\r\n{}\r\n", line(len));
+        // A line that fills the budget with the trailer's last CRLF is taken, one past is not.
+        let ok = decode(
+            body(MAX_TRAILER - 2).as_bytes(),
+            512,
+            unsigned_trailer(1),
+            None,
+        )
+        .unwrap();
+        assert_eq!(ok.1.map(|v| v.len()), Some(MAX_TRAILER - 2 - 23));
+        for len in [MAX_TRAILER - 1, MAX_TRAILER, 100_000] {
+            let r = decode(body(len).as_bytes(), 512, unsigned_trailer(1), None).unwrap_err();
+            assert_eq!(r.code, "MalformedTrailerError", "{len}");
+        }
+    }
+
+    /// Every single-byte change of the example's framing, and of a sample of its data, is
+    /// refused: no change gives a body that decodes.
+    #[test]
+    fn any_one_byte_change_is_refused() {
+        let body = example();
+        let framing: Vec<usize> = (0..88)
+            .chain(65_624..65_712)
+            .chain(66_736..66_824)
+            .collect();
+        // A fixed LCG picks the data positions and the changes.
+        let mut x: u32 = 0x2545_f491;
+        let mut next = || {
+            x = x.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            x >> 8
+        };
+        let mut positions = framing;
+        for _ in 0..64 {
+            positions.push(88 + (next() as usize) % 65_536);
+            positions.push(65_712 + (next() as usize) % 1024);
+        }
+        for pos in positions {
+            let mut mutated = body.clone();
+            let change = 1 + (next() % 255) as u8;
+            mutated[pos] ^= change;
+            let r = decode(&mutated, 8192, signed(66_560), Some(seed(SEED)));
+            assert!(r.is_err(), "byte {pos} ^ {change:#x} was taken");
+        }
+    }
+
+    #[test]
+    fn modes_are_named_by_the_payload_hash() {
+        assert_eq!(
+            Mode::of("STREAMING-AWS4-HMAC-SHA256-PAYLOAD"),
+            Some(Mode::Signed)
+        );
+        assert_eq!(
+            Mode::of("STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER"),
+            Some(Mode::SignedTrailer)
+        );
+        assert_eq!(
+            Mode::of("STREAMING-UNSIGNED-PAYLOAD-TRAILER"),
+            Some(Mode::UnsignedTrailer)
+        );
+        assert_eq!(Mode::of("STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"), None);
+        assert_eq!(Mode::of("UNSIGNED-PAYLOAD"), None);
+        // A seed is kept for signed modes only.
+        let dec = Decoder::new(Frames::of(b"", 1), unsigned_trailer(0), Some(seed(SEED)));
+        assert!(dec.seed.is_none());
+    }
+}
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 6bbfc478..6d8b6d5d 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -9,9 +9,11 @@
 //! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
 //! one, served over the object layer the WebDAV view shares ([`crate::files`]): [`bucket`]
 //! answers the service and its buckets, [`list`] a bucket's listings, [`object`] the
-//! objects. Operations not served yet answer `NotImplemented`.
+//! objects, with [`chunked`] decoding the `aws-chunked` bodies SDKs upload them in.
+//! Operations not served yet answer `NotImplemented`.
 
 mod bucket;
+mod chunked;
 mod conditional;
 mod list;
 mod meta;
@@ -163,9 +165,9 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
     let who = if signed {
         signed_by(state, &req, ctx)
     } else {
-        presented(state, &req, ctx)
+        presented(state, &req, ctx).map(|who| (who, None))
     };
-    let who = match who {
+    let (who, seed) = match who {
         Ok(who) => who,
         Err(resp) => return before_auth(req, *resp).await,
     };
@@ -181,7 +183,7 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
             .insert(RETRY_AFTER, HeaderValue::from_static("60"));
         return refuse(req, resp, ctx).await;
     }
-    operate(state, &who.authz(), req, ctx).await
+    operate(state, &who.authz(), seed, req, ctx).await
 }
 
 /// The query parameter an AWS SDK adds to name the operation it calls, which says nothing
@@ -205,9 +207,11 @@ fn subresource(query: &str) -> Option<&str> {
 
 /// An authenticated request, to the operation its method, path and query name. What is not
 /// served answers `NotImplemented` once the body is read, as every refusal past the gate does.
+/// `seed` is what a signed `aws-chunked` body's signatures are checked against.
 async fn operate(
     state: &ServerState,
     authz: &Authz<'_>,
+    seed: Option<chunked::Seed>,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -239,7 +243,7 @@ async fn operate(
             object::attributes(state, authz, segs, req, ctx).await
         }
         (path::Target::Object { segs, .. }, &Method::PUT, None) => {
-            object::put(state, authz, segs, req, ctx).await
+            object::put(state, authz, segs, seed, req, ctx).await
         }
         (path::Target::Object { segs, .. }, &Method::DELETE, None) => {
             object::delete(state, authz, segs, req, ctx).await
@@ -358,12 +362,14 @@ fn resolve_failed(e: anyhow::Error, ctx: &Ctx) -> Box<Response<Body>> {
 /// the access key id is authenticated exactly as a bearer would be, by the resolvers the
 /// other routes use; only then is the secret it maps to used as a key, to check the
 /// signature. On a server with no credential configured, an id that is not a hub token is
-/// taken with its signature unchecked, as nothing else is checked there.
+/// taken with its signature unchecked, as nothing else is checked there. A request whose
+/// body is a signed `aws-chunked` stream also gets the seed its chunks' signatures chain
+/// from, which holds the signing key until the body has been read.
 fn signed_by(
     state: &ServerState,
     req: &Request<Incoming>,
     ctx: &Ctx,
-) -> std::result::Result<Who, Box<Response<Body>>> {
+) -> std::result::Result<(Who, Option<chunked::Seed>), Box<Response<Body>>> {
     let headers = req.headers();
     let malformed = |why: &str| {
         Box::new(ctx.error(StatusCode::BAD_REQUEST, "AuthorizationHeaderMalformed", why))
@@ -442,7 +448,7 @@ fn signed_by(
         },
     };
     let Some(secret) = secret else {
-        return Ok(who);
+        return Ok((who, None));
     };
 
     let payload_hash = headers
@@ -477,7 +483,14 @@ fn signed_by(
             &ctx.id,
         )));
     }
-    Ok(who)
+    if !chunked::Mode::of(payload_hash).is_some_and(chunked::Mode::signed) {
+        return Ok((who, None));
+    }
+    // Never a signed body whose signatures go unchecked for want of a key.
+    match chunked::Seed::of(secret, &credential, stamp) {
+        Some(seed) => Ok((who, Some(seed))),
+        None => Err(Box::new(internal_error(ctx))),
+    }
 }
 
 /// `Authorization: Bearer <id>`, alone; `None` when `id` cannot be a header value.
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 42d2337a..1eeeb657 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -21,7 +21,7 @@ use hyper::{Request, Response, StatusCode};
 use sha1::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
-use super::{Ctx, drain, meta, refuse, xml};
+use super::{Ctx, chunked, drain, meta, refuse, xml};
 use crate::dav::http_date;
 use crate::files::{
     self, Commit, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, object_of,
@@ -236,14 +236,19 @@ pub(super) async fn attributes(
     .await
 }
 
-/// How a PutObject's body is bound to its signature, by `x-amz-content-sha256`.
-enum Payload {
-    /// `UNSIGNED-PAYLOAD`, or no header (an unsigned request)
-    Unsigned,
-    /// the body's SHA-256, lowercase hex
-    Sha256(String),
+/// How a PutObject's body is bound to its signature, by `x-amz-content-sha256`, and how it is
+/// framed.
+struct Payload {
+    /// the (decoded) body's SHA-256, lowercase hex, when the header names one rather than
+    /// `UNSIGNED-PAYLOAD` or a streaming mode
+    sha256: Option<String>,
+    /// how the body is framed when it is `aws-chunked`
+    framing: Option<chunked::Framing>,
 }
 
+/// The header naming how long an `aws-chunked` body is once decoded.
+const DECODED_LENGTH: &str = "x-amz-decoded-content-length";
+
 /// The digests a PutObject asks to be checked against what arrives, each as bytes.
 #[derive(Default)]
 struct Expected {
@@ -259,39 +264,110 @@ struct Expected {
 /// and a message.
 type Refused = (StatusCode, &'static str, &'static str);
 
+/// What `x-amz-content-sha256`, `Content-Encoding`, `x-amz-decoded-content-length` and
+/// `x-amz-trailer` say of a PutObject's body. A streaming mode, or `aws-chunked` named among
+/// the encodings, makes it an `aws-chunked` body; no other encoding is decoded, so none is
+/// taken beside it.
 fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
-    let chunked = headers.get_all(CONTENT_ENCODING).iter().any(|v| {
-        v.to_str().is_ok_and(|v| {
-            v.split(',')
-                .any(|e| e.trim().eq_ignore_ascii_case("aws-chunked"))
-        })
-    });
-    let streaming = (
-        StatusCode::NOT_IMPLEMENTED,
-        "NotImplemented",
-        "aws-chunked uploads are not served yet: send UNSIGNED-PAYLOAD or the body's SHA-256",
-    );
-    if chunked {
-        return Err(streaming);
-    }
-    let Some(value) = headers.get("x-amz-content-sha256") else {
-        return Ok(Payload::Unsigned);
+    let invalid = |message| (StatusCode::BAD_REQUEST, "InvalidRequest", message);
+    let mut sent = headers.get_all("x-amz-content-sha256").iter();
+    let value = sent.next().map(|v| v.to_str().unwrap_or_default());
+    if sent.next().is_some() {
+        return Err(invalid("x-amz-content-sha256 is sent once"));
+    }
+    let (sha256, streaming) = match value {
+        None | Some("UNSIGNED-PAYLOAD") => (None, None),
+        Some(v) if v.starts_with("STREAMING-") => match chunked::Mode::of(v) {
+            Some(mode) => (None, Some(mode)),
+            None => {
+                return Err((
+                    StatusCode::NOT_IMPLEMENTED,
+                    "NotImplemented",
+                    "the streaming payloads taken are STREAMING-AWS4-HMAC-SHA256-PAYLOAD, its \
+                     -TRAILER form and STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+                ));
+            }
+        },
+        Some(v) if v.len() == 64 && v.bytes().all(|b| b.is_ascii_hexdigit()) => {
+            (Some(v.to_ascii_lowercase()), None)
+        }
+        Some(_) => {
+            return Err((
+                StatusCode::BAD_REQUEST,
+                "InvalidArgument",
+                "x-amz-content-sha256 is UNSIGNED-PAYLOAD, the body's SHA-256 in hex, or a \
+                 streaming mode",
+            ));
+        }
     };
-    let value = value.to_str().unwrap_or_default();
-    if value == "UNSIGNED-PAYLOAD" {
-        return Ok(Payload::Unsigned);
+    let (mut chunked, mut other) = (false, false);
+    for encoding in headers
+        .get_all(CONTENT_ENCODING)
+        .iter()
+        .flat_map(|v| v.to_str().unwrap_or("?").split(','))
+        .map(str::trim)
+        .filter(|e| !e.is_empty())
+    {
+        if encoding.eq_ignore_ascii_case("aws-chunked") {
+            chunked = true;
+        } else if !encoding.eq_ignore_ascii_case("identity") {
+            other = true;
+        }
     }
-    if value.starts_with("STREAMING-") {
-        return Err(streaming);
+    let Some(mode) = streaming.or(chunked.then_some(chunked::Mode::Unsigned)) else {
+        if headers.contains_key("x-amz-trailer") {
+            return Err(invalid("x-amz-trailer is for a -TRAILER streaming payload"));
+        }
+        return Ok(Payload {
+            sha256,
+            framing: None,
+        });
+    };
+    if other {
+        return Err((
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "an aws-chunked body is decoded, and no other content encoding with it",
+        ));
     }
-    if value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit()) {
-        return Ok(Payload::Sha256(value.to_ascii_lowercase()));
+    let declared = headers
+        .get(DECODED_LENGTH)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.parse::<u64>().ok())
+        .ok_or(invalid(
+            "an aws-chunked body needs x-amz-decoded-content-length, its decoded length",
+        ))?;
+    let trailer = match headers.get("x-amz-trailer") {
+        None => None,
+        Some(_) if !mode.trailer() => {
+            return Err(invalid("x-amz-trailer is for a -TRAILER streaming payload"));
+        }
+        Some(v) => {
+            let name = v.to_str().unwrap_or_default().trim();
+            let known = chunked::CHECKSUMS
+                .into_iter()
+                .find(|c| c.eq_ignore_ascii_case(name));
+            Some(known.ok_or(invalid("x-amz-trailer names one x-amz-checksum header"))?)
+        }
+    };
+    Ok(Payload {
+        sha256,
+        framing: Some(chunked::Framing {
+            mode,
+            declared,
+            trailer,
+        }),
+    })
+}
+
+/// How many bytes the checksum a header or trailer `name`s is.
+fn checksum_len(name: &str) -> usize {
+    match name {
+        "x-amz-checksum-sha256" => 32,
+        "x-amz-checksum-sha1" => 20,
+        "x-amz-checksum-crc64nvme" => 8,
+        _ => 4,
     }
-    Err((
-        StatusCode::BAD_REQUEST,
-        "InvalidArgument",
-        "x-amz-content-sha256 is UNSIGNED-PAYLOAD or the body's SHA-256 in hex",
-    ))
 }
 
 fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
@@ -330,17 +406,40 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
             )
         })?;
         if let Some((text, value)) = value {
-            out.echo.push((name, text));
-            match name {
-                "x-amz-checksum-sha256" => out.sha256 = Some(value),
-                "x-amz-checksum-sha1" => out.sha1 = Some(value),
-                _ => out.crc32 = Some(value),
-            }
+            out.expect(name, text, value);
         }
     }
     Ok(out)
 }
 
+impl Expected {
+    /// Check the body against `value`, the checksum `name`s, and echo its `text` once it
+    /// held: for the checksums this registry computes; any other is taken unchecked.
+    fn expect(&mut self, name: &'static str, text: String, value: Vec<u8>) {
+        let slot = match name {
+            "x-amz-checksum-sha256" => &mut self.sha256,
+            "x-amz-checksum-sha1" => &mut self.sha1,
+            "x-amz-checksum-crc32" => &mut self.crc32,
+            _ => return,
+        };
+        *slot = Some(value);
+        self.echo.push((name, text));
+    }
+
+    /// The trailer's checksum `name`d, as sent: base64 of the checksum's length.
+    fn trailer(&mut self, name: &'static str, text: &str) -> std::result::Result<(), Refused> {
+        let value = crate::auth::base64_decode(text)
+            .filter(|b| b.len() == checksum_len(name))
+            .ok_or((
+                StatusCode::BAD_REQUEST,
+                "InvalidRequest",
+                "the trailer's x-amz-checksum is the checksum of the body in base64",
+            ))?;
+        self.expect(name, text.to_string(), value);
+        Ok(())
+    }
+}
+
 /// The digests computed while a body streams: MD5 always (the ETag), SHA-1 and CRC32 only
 /// when the request asks to be checked against them.
 struct Digests {
@@ -350,11 +449,14 @@ struct Digests {
 }
 
 impl Digests {
-    fn for_(expected: &Expected) -> Self {
+    /// The digests `expected` asks for, and the one a trailer announced as `trailer`.
+    fn for_(expected: &Expected, trailer: Option<&str>) -> Self {
+        let wanted = |set: bool, name| set || trailer == Some(name);
         Digests {
             md5: md5::Context::new(),
-            sha1: expected.sha1.is_some().then(sha1::Sha1::new),
-            crc32: expected.crc32.is_some().then(crc32fast::Hasher::new),
+            sha1: wanted(expected.sha1.is_some(), "x-amz-checksum-sha1").then(sha1::Sha1::new),
+            crc32: wanted(expected.crc32.is_some(), "x-amz-checksum-crc32")
+                .then(crc32fast::Hasher::new),
         }
     }
 
@@ -383,11 +485,14 @@ fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
 /// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
 /// what the request said of it, then tag it under the namespace lock, with its MD5 and user
 /// metadata on the manifest and the request's `If-None-Match: *`/`If-Match` checked there.
-/// Its `Content-Type` is not kept: every object is served as bytes.
+/// Its `Content-Type` is not kept: every object is served as bytes. An `aws-chunked` body is
+/// decoded on the way, its chunk signatures checked against `seed` when there is one, and
+/// its trailer's checksum checked as a header's would be.
 pub(super) async fn put(
     state: &ServerState,
     authz: &Authz<'_>,
     segs: Vec<String>,
+    seed: Option<chunked::Seed>,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -397,19 +502,31 @@ pub(super) async fn put(
     }
     let headers = req.headers();
     // A declared length over the cap is refused unread; the connection then closes.
-    if headers
-        .get(CONTENT_LENGTH)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|v| v.parse::<u64>().ok())
-        .is_some_and(|n| n > MAX_OBJECT)
-    {
+    let over = |name| {
+        headers
+            .get(name)
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.parse::<u64>().ok())
+            .is_some_and(|n| n > MAX_OBJECT)
+    };
+    if over(CONTENT_LENGTH.as_str()) || over(DECODED_LENGTH) {
         return Ok(ctx.too_large());
     }
     if headers.contains_key("x-amz-copy-source") {
         return refuse(req, ctx.not_implemented(), ctx).await;
     }
-    let checked = payload(headers).and_then(|p| Ok((p, expected(headers)?)));
-    let (payload, expected) = match checked {
+    let checked = payload(headers).and_then(|p| {
+        let trailer = p.framing.and_then(|f| f.trailer);
+        if trailer.is_some_and(|name| headers.contains_key(name)) {
+            return Err((
+                StatusCode::BAD_REQUEST,
+                "InvalidRequest",
+                "a checksum is sent as a header or in the trailer, not both",
+            ));
+        }
+        Ok((p, expected(headers)?))
+    });
+    let (payload, mut expected) = match checked {
         Ok(checked) => checked,
         Err((status, code, message)) => {
             return refuse(req, ctx.error(status, code, message), ctx).await;
@@ -442,15 +559,41 @@ pub(super) async fn put(
         return refuse(req, unwritable(why, ctx), ctx).await;
     }
 
-    let mut digests = Digests::for_(&expected);
-    let staged = match files::stage(&state.store, req.into_body(), &mut |d| digests.update(d)).await
-    {
+    let mut digests = Digests::for_(&expected, payload.framing.and_then(|f| f.trailer));
+    let mut tap = |d: &[u8]| digests.update(d);
+    let (staged, trailer) = match payload.framing {
+        None => (
+            files::stage(&state.store, req.into_body(), &mut tap).await,
+            None,
+        ),
+        Some(framing) => {
+            let mut body = chunked::Decoder::new(req.into_body(), framing, seed);
+            let staged = files::stage(&state.store, &mut body, &mut tap).await;
+            let trailer = body
+                .trailer()
+                .map(|(name, value)| (name, value.to_string()));
+            (staged, trailer)
+        }
+    };
+    let staged = match staged {
         Ok(staged) => staged,
         Err(PutError::TooLarge) => return Ok(ctx.too_large()),
-        Err(PutError::Failed(e)) => return Err(e),
+        // A body whose framing was refused is answered, unread past where it went wrong; the
+        // answer closes the connection.
+        Err(PutError::Failed(e)) => match e.downcast_ref::<chunked::Error>() {
+            Some(chunked::Error::Refused(why)) => {
+                return Ok(ctx.error(why.status, why.code, why.message));
+            }
+            _ => return Err(e),
+        },
     };
     // A refusal from here on drops `staged`, which unlinks it: nothing is tagged.
-    if let Payload::Sha256(signed) = &payload
+    if let Some((name, value)) = trailer
+        && let Err((status, code, message)) = expected.trailer(name, &value)
+    {
+        return Ok(ctx.error(status, code, message));
+    }
+    if let Some(signed) = &payload.sha256
         && *signed != staged.hex
     {
         return Ok(ctx.error(
@@ -582,35 +725,125 @@ mod tests {
     }
 
     #[test]
-    fn a_payload_is_unsigned_or_its_sha256_and_streaming_waits() {
+    fn a_payload_is_unsigned_its_sha256_or_chunked() {
         let code = |pairs: &[(&str, &str)]| payload(&headers(pairs)).err().map(|e| e.1);
-        assert!(matches!(payload(&headers(&[])), Ok(Payload::Unsigned)));
-        assert!(matches!(
-            payload(&headers(&[("x-amz-content-sha256", "UNSIGNED-PAYLOAD")])),
-            Ok(Payload::Unsigned)
-        ));
+        let plain = |pairs: &[(&str, &str)]| {
+            let p = payload(&headers(pairs)).ok().unwrap();
+            assert!(p.framing.is_none());
+            p.sha256
+        };
+        assert_eq!(plain(&[]), None);
+        assert_eq!(plain(&[("x-amz-content-sha256", "UNSIGNED-PAYLOAD")]), None);
         let hex = "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855";
-        assert!(matches!(
-            payload(&headers(&[("x-amz-content-sha256", hex)])),
-            Ok(Payload::Sha256(h)) if h == hex.to_ascii_lowercase()
-        ));
-        for streaming in [
-            "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
-            "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+        let lower = Some(hex.to_ascii_lowercase());
+        assert_eq!(plain(&[("x-amz-content-sha256", hex)]), lower);
+        // Another encoding alone is not ours to decode, and is kept as it was sent.
+        assert_eq!(plain(&[("content-encoding", "gzip")]), None);
+        assert_eq!(
+            code(&[("x-amz-content-sha256", "abc")]),
+            Some("InvalidArgument")
+        );
+        assert_eq!(
+            code(&[
+                ("x-amz-content-sha256", "UNSIGNED-PAYLOAD"),
+                ("x-amz-content-sha256", hex)
+            ]),
+            Some("InvalidRequest")
+        );
+
+        let length = ("x-amz-decoded-content-length", "13");
+        let framing = |pairs: &[(&str, &str)]| {
+            let p = payload(&headers(pairs)).ok().unwrap();
+            (p.sha256, p.framing.unwrap())
+        };
+        for (value, mode) in [
+            ("STREAMING-AWS4-HMAC-SHA256-PAYLOAD", chunked::Mode::Signed),
+            (
+                "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER",
+                chunked::Mode::SignedTrailer,
+            ),
+            (
+                "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+                chunked::Mode::UnsignedTrailer,
+            ),
         ] {
+            let (sha256, f) = framing(&[("x-amz-content-sha256", value), length]);
+            assert_eq!(
+                (sha256, f.mode, f.declared, f.trailer),
+                (None, mode, 13, None)
+            );
             assert_eq!(
-                code(&[("x-amz-content-sha256", streaming)]),
-                Some("NotImplemented")
+                code(&[("x-amz-content-sha256", value)]),
+                Some("InvalidRequest"),
+                "{value} without its decoded length"
             );
         }
+        // aws-chunked named among the encodings, with any other payload hash.
+        let (sha256, f) = framing(&[
+            ("content-encoding", "aws-chunked"),
+            ("x-amz-content-sha256", hex),
+            length,
+        ]);
+        assert_eq!((sha256, f.mode), (lower, chunked::Mode::Unsigned));
+        let (_, f) = framing(&[("content-encoding", "identity, AWS-Chunked"), length]);
+        assert_eq!(f.mode, chunked::Mode::Unsigned);
         assert_eq!(
-            code(&[("content-encoding", "gzip, aws-chunked")]),
+            code(&[("content-encoding", "aws-chunked,gzip"), length]),
             Some("NotImplemented")
         );
         assert_eq!(
-            code(&[("x-amz-content-sha256", "abc")]),
-            Some("InvalidArgument")
+            code(&[
+                ("content-encoding", "aws-chunked"),
+                ("x-amz-decoded-content-length", "-1")
+            ]),
+            Some("InvalidRequest")
         );
+        assert_eq!(
+            code(&[(
+                "x-amz-content-sha256",
+                "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD"
+            )]),
+            Some("NotImplemented")
+        );
+
+        // The trailer's checksum, in the trailer modes only.
+        let trailer = ("x-amz-content-sha256", "STREAMING-UNSIGNED-PAYLOAD-TRAILER");
+        let (_, f) = framing(&[trailer, length, ("x-amz-trailer", "X-Amz-Checksum-CRC32")]);
+        assert_eq!(f.trailer, Some("x-amz-checksum-crc32"));
+        for bad in [
+            "x-amz-checksum-md5",
+            "x-amz-checksum-crc32,x-amz-checksum-sha1",
+            "",
+        ] {
+            assert_eq!(
+                code(&[trailer, length, ("x-amz-trailer", bad)]),
+                Some("InvalidRequest"),
+                "{bad}"
+            );
+        }
+        let signed = ("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD");
+        let crc = ("x-amz-trailer", "x-amz-checksum-crc32");
+        assert_eq!(code(&[signed, length, crc]), Some("InvalidRequest"));
+        assert_eq!(code(&[crc]), Some("InvalidRequest"));
+    }
+
+    #[test]
+    fn a_trailer_checksum_is_checked_as_a_header_is() {
+        let mut e = Expected::default();
+        let crc = vk_hub_proto::to_base64(&[1, 2, 3, 4]);
+        e.trailer("x-amz-checksum-crc32", &crc).ok().unwrap();
+        assert_eq!(e.crc32, Some(vec![1, 2, 3, 4]));
+        assert_eq!(e.echo, [("x-amz-checksum-crc32", crc.clone())]);
+        // Taken unchecked, and not echoed.
+        e.trailer(
+            "x-amz-checksum-crc64nvme",
+            &vk_hub_proto::to_base64(&[0; 8]),
+        )
+        .ok()
+        .unwrap();
+        assert_eq!(e.echo.len(), 1);
+        assert!(e.trailer("x-amz-checksum-sha256", &crc).is_err());
+        assert!(e.trailer("x-amz-checksum-crc32c", "!!").is_err());
     }
 
     #[test]
diff --git a/vk-registry/src/s3/sigv4.rs b/vk-registry/src/s3/sigv4.rs
index 80b6cb8b..3a72ebb6 100644
--- a/vk-registry/src/s3/sigv4.rs
+++ b/vk-registry/src/s3/sigv4.rs
@@ -362,6 +362,29 @@ fn hmac(key: &[u8], data: &[u8]) -> Option<Zeroizing<[u8; 32]>> {
     Some(out)
 }
 
+/// The key a scope's signatures are made with, derived from a secret and wiped when dropped.
+/// A request's own signature needs it only for the call that checks it ([`signature`]); the
+/// chunk signatures of an `aws-chunked` body need it for as long as the body streams.
+pub(crate) struct SigningKey(Zeroizing<[u8; 32]>);
+
+impl SigningKey {
+    /// The key `secret` gives the scope `date/region/service/aws4_request`; the keys derived
+    /// on the way are wiped as they are dropped.
+    pub(crate) fn derive(secret: &str, date: &str, region: &str, service: &str) -> Option<Self> {
+        let seed = Zeroizing::new(format!("AWS4{secret}").into_bytes());
+        let k_date = hmac(&seed, date.as_bytes())?;
+        let k_region = hmac(&*k_date, region.as_bytes())?;
+        let k_service = hmac(&*k_region, service.as_bytes())?;
+        Some(SigningKey(hmac(&*k_service, TERMINATOR.as_bytes())?))
+    }
+
+    /// The hex signature of `string_to_sign` under this key.
+    pub(crate) fn sign(&self, string_to_sign: &str) -> Option<String> {
+        let signed = hmac(&*self.0, string_to_sign.as_bytes())?;
+        Some(crate::hex_of(&*signed))
+    }
+}
+
 /// The hex signature of `string_to_sign` under the key derived from `secret` for the scope
 /// `date/region/service/aws4_request`. The derived keys live in this call only, each wiped
 /// when dropped; nothing but the signature leaves it.
@@ -372,13 +395,7 @@ pub(crate) fn signature(
     service: &str,
     string_to_sign: &str,
 ) -> Option<String> {
-    let seed = Zeroizing::new(format!("AWS4{secret}").into_bytes());
-    let k_date = hmac(&seed, date.as_bytes())?;
-    let k_region = hmac(&*k_date, region.as_bytes())?;
-    let k_service = hmac(&*k_region, service.as_bytes())?;
-    let k_signing = hmac(&*k_service, TERMINATOR.as_bytes())?;
-    let signed = hmac(&*k_signing, string_to_sign.as_bytes())?;
-    Some(crate::hex_of(&*signed))
+    SigningKey::derive(secret, date, region, service)?.sign(string_to_sign)
 }
 
 /// Whether `credential`'s signature is the one `secret` gives `canonical_request` made at
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 15d247a9..4b14da1c 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -171,17 +171,110 @@ fn authorization(
         "AWS4-HMAC-SHA256\n{at}\n{scope}\n{}",
         hex(&sha2::Sha256::digest(canonical.as_bytes()))
     );
-    let mut key = hmac(format!("AWS4{secret}").as_bytes(), date);
-    for part in ["us-east-1", "s3", "aws4_request"] {
-        key = hmac(&key, part);
-    }
     format!(
         "AWS4-HMAC-SHA256 Credential={id}/{scope}, SignedHeaders={}, Signature={}",
         names.join(";"),
-        hex(&hmac(&key, &sts))
+        hex(&hmac(&signing_key(secret, date), &sts))
     )
 }
 
+/// The key `secret` signs with on `date`, in the tests' region.
+fn signing_key(secret: &str, date: &str) -> Vec<u8> {
+    let mut key = hmac(format!("AWS4{secret}").as_bytes(), date);
+    for part in ["us-east-1", "s3", "aws4_request"] {
+        key = hmac(&key, part);
+    }
+    key
+}
+
+/// How a test's `aws-chunked` body is signed and ended.
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Chunked {
+    Signed,
+    SignedTrailer,
+    UnsignedTrailer,
+}
+
+impl Chunked {
+    fn content_sha256(self) -> &'static str {
+        match self {
+            Chunked::Signed => "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
+            Chunked::SignedTrailer => "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER",
+            Chunked::UnsignedTrailer => "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+        }
+    }
+}
+
+/// `data` framed as `aws-chunked` in chunks of `chunk` bytes, as AWS's SDKs frame it: each
+/// chunk signed from `seed` (the request's signature) with `key` at `at` in a signed mode,
+/// then the `trailer` line and, in the signed trailer mode, its signature.
+fn aws_chunked(
+    mode: Chunked,
+    data: &[u8],
+    chunk: usize,
+    (key, at, seed): (&[u8], &str, &str),
+    trailer: Option<(&str, &str)>,
+) -> Vec<u8> {
+    let scope = format!("{}/us-east-1/s3/aws4_request", &at[..8]);
+    let empty = sha256_hex(b"");
+    let mut previous = seed.to_string();
+    let mut out = Vec::new();
+    for piece in data.chunks(chunk).chain([&b""[..]]) {
+        out.extend_from_slice(format!("{:x}", piece.len()).as_bytes());
+        if mode != Chunked::UnsignedTrailer {
+            let sts = format!(
+                "AWS4-HMAC-SHA256-PAYLOAD\n{at}\n{scope}\n{previous}\n{empty}\n{}",
+                sha256_hex(piece)
+            );
+            previous = hex(&hmac(key, &sts));
+            out.extend_from_slice(format!(";chunk-signature={previous}").as_bytes());
+        }
+        out.extend_from_slice(b"\r\n");
+        out.extend_from_slice(piece);
+        if !piece.is_empty() {
+            out.extend_from_slice(b"\r\n");
+        }
+    }
+    if mode != Chunked::Signed {
+        let lines = trailer.map_or(String::new(), |(n, v)| format!("{n}:{v}\n"));
+        out.extend_from_slice(lines.replace('\n', "\r\n").as_bytes());
+        if mode == Chunked::SignedTrailer {
+            let sts = format!(
+                "AWS4-HMAC-SHA256-TRAILER\n{at}\n{scope}\n{previous}\n{}",
+                sha256_hex(lines.as_bytes())
+            );
+            let signature = hex(&hmac(key, &sts));
+            out.extend_from_slice(format!("x-amz-trailer-signature:{signature}\r\n").as_bytes());
+        }
+    }
+    out.extend_from_slice(b"\r\n");
+    out
+}
+
+/// The encoder frames AWS's chunked PutObject example as AWS does, signatures and all.
+#[test]
+fn the_test_encoder_reproduces_the_aws_chunked_example() {
+    let key = signing_key("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "20130524");
+    let seed = "4f232c4386841ef735655705268965c44a0e4690baa4adea153f7db9fa80a0a9";
+    let body = aws_chunked(
+        Chunked::Signed,
+        &[b'a'; 66_560],
+        65_536,
+        (&key, "20130524T000000Z", seed),
+        None,
+    );
+    assert_eq!(body.len(), 66_824);
+    let text = String::from_utf8(body).unwrap();
+    for signature in [
+        "ad80c730a21e5b8d04586a2213dd63b9a0e99e0e2307b0ade35a65485a288648",
+        "0055627c9e194cb4542bae2aa5492e3c1575bbb81b612b7d234b86a503ef5497",
+        "b6c6ea8a5354eaf15b3cb7646744f4275b71ea724fed81ceb9323e279d449df9",
+    ] {
+        assert!(text.contains(&format!(";chunk-signature={signature}\r\n")));
+    }
+    assert!(text.ends_with("\r\n\r\n"));
+}
+
 /// The signer reproduces AWS's GET Object example, signature and all.
 #[test]
 fn the_test_signer_reproduces_the_aws_get_object_example() {
@@ -276,6 +369,52 @@ impl Req {
             .header("Authorization", &auth)
     }
 
+    /// `data` sent as an `aws-chunked` body framed by `mode` in 64 KiB chunks, signed for
+    /// `host` by `key` now, with `trailer` as the trailer's checksum when given.
+    fn chunked(
+        self,
+        host: &str,
+        key: (&str, &str),
+        mode: Chunked,
+        data: &[u8],
+        trailer: Option<(&str, &str)>,
+    ) -> Self {
+        let at = stamp(vk_peer::now_secs());
+        let payload = mode.content_sha256();
+        let auth = authorization(
+            self.method,
+            &self.path,
+            &self.query,
+            &[
+                ("host", host),
+                ("x-amz-content-sha256", payload),
+                ("x-amz-date", &at),
+            ],
+            payload,
+            key,
+            &at,
+        );
+        let seed = auth.rsplit("Signature=").next().unwrap().to_string();
+        let signing = signing_key(key.1, &at[..8]);
+        let body = aws_chunked(mode, data, 64 * 1024, (&signing, &at, &seed), trailer);
+        let mut req = self
+            .header("x-amz-content-sha256", payload)
+            .header("x-amz-date", &at)
+            .header("Authorization", &auth)
+            .header("Content-Encoding", "aws-chunked")
+            .header("x-amz-decoded-content-length", &data.len().to_string());
+        if let Some((name, _)) = trailer {
+            req = req.header("x-amz-trailer", name);
+        }
+        req.body(body)
+    }
+
+    /// This request with `name` sent as `value` instead of as it was.
+    fn replace(mut self, name: &str, value: &str) -> Self {
+        self.headers.retain(|(n, _)| !n.eq_ignore_ascii_case(name));
+        self.header(name, value)
+    }
+
     fn head(&self, host: &str) -> String {
         let target = if self.query.is_empty() {
             self.path.clone()
@@ -962,10 +1101,10 @@ async fn the_sccache_sequence_round_trips_with_an_api_key() {
 }
 
 /// The payload modes: unsigned, or the body's SHA-256, which the body must then have. A
-/// streamed `aws-chunked` body is not decoded yet, so it is refused and its framing never
-/// becomes an object.
+/// streaming mode this registry does not decode is refused, so its framing never becomes an
+/// object.
 #[tokio::test]
-async fn a_put_body_is_unsigned_or_its_signed_sha256_and_streaming_waits() {
+async fn a_put_body_is_unsigned_or_its_signed_sha256() {
     let dir = tmp("payload");
     let (state, _) = shared(
         &dir,
@@ -1003,43 +1142,21 @@ async fn a_put_body_is_unsigned_or_its_signed_sha256_and_streaming_waits() {
     let req = put("/s3/b/garbage", HELLO).signed_payload(&host, key, 0, "not-a-digest");
     send(&host, req).await.is(400, "InvalidArgument");
 
-    // AWS's chunked framing, signed or announced: not stored as the object it would become.
-    let framed = b"d;chunk-signature=ad80c730a21e5b8d04586a2213dd63b9a0e99e0e2307b0ade35a65485a288648\r\n\
-Hello, World!\r\n0;chunk-signature=b6c6ea8a5354eaf15b3cb7646744f4275b71ea724fed81ceb9323e279d449df9\r\n\r\n";
-    for (path, req) in [
-        (
-            "/s3/b/streaming",
-            put("/s3/b/streaming", framed).signed_payload(
-                &host,
-                key,
-                0,
-                "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
-            ),
-        ),
-        (
-            "/s3/b/trailer",
-            put("/s3/b/trailer", framed).signed_payload(
-                &host,
-                key,
-                0,
-                "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
-            ),
-        ),
-        (
-            "/s3/b/chunked",
-            put("/s3/b/chunked", framed)
-                .header("Content-Encoding", "aws-chunked")
-                .header("x-amz-decoded-content-length", "13")
-                .signed(&host, key, 0),
-        ),
-    ] {
-        send(&host, req).await.is(501, "NotImplemented");
+    // A streaming mode not decoded here, or an encoding beside aws-chunked.
+    let framed = b"d\r\nHello, World!\r\n0\r\n\r\n";
+    let ecdsa = put("/s3/b/ecdsa", framed)
+        .header("Content-Encoding", "aws-chunked")
+        .header("x-amz-decoded-content-length", "13")
+        .signed_payload(&host, key, 0, "STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD");
+    send(&host, ecdsa).await.is(501, "NotImplemented");
+    let gzip = put("/s3/b/gzip", framed)
+        .header("Content-Encoding", "aws-chunked, gzip")
+        .header("x-amz-decoded-content-length", "13")
+        .signed(&host, key, 0);
+    send(&host, gzip).await.is(501, "NotImplemented");
+    for path in ["/s3/b/ecdsa", "/s3/b/gzip"] {
         send(&host, get(path)).await.is(404, "NoSuchKey");
     }
-    assert!(
-        !dir.join("store/repos/files/b/tags/streaming").exists()
-            && !dir.join("store/repos/files/b/tags/chunked").exists()
-    );
     assert_eq!(staging_left(&dir), 0);
 
     // A declared length past 4 GiB is refused before a byte is read.
@@ -1137,6 +1254,319 @@ async fn a_put_checks_the_digests_it_is_sent() {
     );
 }
 
+/// The shared bearer of [`bearer_server`], which is also its access key and secret.
+const BEARER: (&str, &str) = ("s3cret", "s3cret");
+
+/// A shared-bearer server: its directory and address.
+fn bearer_server(tag: &str) -> (std::path::PathBuf, String) {
+    let dir = tmp(tag);
+    let auth = Auth::Bearer {
+        token: BEARER.0.into(),
+    };
+    let (state, _) = shared(&dir, auth, true);
+    (dir, spawn(state))
+}
+
+fn bytes_of_len(n: usize) -> Vec<u8> {
+    (0..n).map(|i| (i * 7 % 251) as u8).collect()
+}
+
+fn sha1_b64(b: &[u8]) -> String {
+    use sha1::Digest as _;
+    b64(&sha1::Sha1::digest(b))
+}
+
+fn crc32_b64(b: &[u8]) -> String {
+    b64(&crc32fast::hash(b).to_be_bytes())
+}
+
+/// One request whose body the server may stop reading, refusing it: the body is written
+/// beside the wait for the answer, and a write failing once the server closes is expected.
+async fn send_refused(host: &str, req: Req) -> Resp {
+    let mut conn = Conn::open(host).await;
+    let mut write = conn.write.take().unwrap();
+    let head = req.head(host);
+    let writer = tokio::spawn(async move {
+        let _ = write.write_all(head.as_bytes()).await;
+        let _ = write.write_all(&req.body).await;
+        write
+    });
+    let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
+        .await
+        .expect("answered");
+    drop(writer.await.unwrap());
+    resp
+}
+
+/// Change the byte after the last `marker` in `body`, a hex digit, to another one.
+fn flip_after_last(body: &mut [u8], marker: &[u8]) {
+    let at = body
+        .windows(marker.len())
+        .rposition(|w| w == marker)
+        .unwrap()
+        + marker.len();
+    body[at] = if body[at] == b'0' { b'1' } else { b'0' };
+}
+
+/// `aws-chunked` bodies in the three streaming modes, from one byte to many chunks, decoded on
+/// the way in: read back, each is the bytes sent, its ETag their MD5, and the trailer's
+/// checksum is echoed as a header's would be.
+#[tokio::test]
+async fn aws_chunked_uploads_are_decoded_in_every_mode() {
+    let (dir, host) = bearer_server("chunked");
+    let get = |path: &str| Req::new("GET", path).signed(&host, BEARER, 0);
+    for size in [1, 1024, 64 * 1024 + 1, 1 << 20] {
+        let data = bytes_of_len(size);
+        let (crc, sha) = (crc32_b64(&data), b64(&sha2::Sha256::digest(&data)));
+        for (mode, trailer) in [
+            (Chunked::Signed, None),
+            (
+                Chunked::SignedTrailer,
+                Some(("x-amz-checksum-sha256", sha.as_str())),
+            ),
+            (
+                Chunked::UnsignedTrailer,
+                Some(("x-amz-checksum-crc32", crc.as_str())),
+            ),
+        ] {
+            let path = format!("/s3/b/{mode:?}-{size}");
+            let req = Req::new("PUT", &path).chunked(&host, BEARER, mode, &data, trailer);
+            let resp = send(&host, req).await;
+            resp.ok(200);
+            let etag = format!("\"{}\"", md5_hex(&data));
+            assert_eq!(resp.header("etag"), Some(&*etag), "{path}");
+            if let Some((name, value)) = trailer {
+                assert_eq!(resp.header(name), Some(value), "{path}");
+            }
+            is_object(&send(&host, get(&path)).await, &data);
+        }
+    }
+    // A checksum not computed here is taken unchecked, and not echoed.
+    let crc32c = Some(("x-amz-checksum-crc32c", "AAAAAA=="));
+    let req = Req::new("PUT", "/s3/b/crc32c").chunked(
+        &host,
+        BEARER,
+        Chunked::UnsignedTrailer,
+        HELLO,
+        crc32c,
+    );
+    let resp = send(&host, req).await;
+    resp.ok(200);
+    assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
+    is_object(&send(&host, get("/s3/b/crc32c")).await, HELLO);
+
+    // An aws-chunked body under its own SHA-256: the decoded bytes must have it.
+    let framed = b"d\r\nHello, World!\r\n0\r\n\r\n".to_vec();
+    let chunked = |path: &str, digest: &str| {
+        Req::new("PUT", path)
+            .header("Content-Encoding", "aws-chunked")
+            .header("x-amz-decoded-content-length", "13")
+            .body(framed.clone())
+            .signed_payload(&host, BEARER, 0, digest)
+    };
+    send(&host, chunked("/s3/b/hex", &sha256_hex(HELLO)))
+        .await
+        .ok(200);
+    is_object(&send(&host, get("/s3/b/hex")).await, HELLO);
+    let other = sha256_hex(b"Hello, World?");
+    send(&host, chunked("/s3/b/hex-other", &other))
+        .await
+        .is(400, "XAmzContentSHA256Mismatch");
+    send(&host, get("/s3/b/hex-other"))
+        .await
+        .is(404, "NoSuchKey");
+    assert_eq!(staging_left(&dir), 0);
+}
+
+/// A chunked body whose signatures or framing do not hold is refused, wherever in the body it
+/// goes wrong, and leaves neither an object nor a staging file behind.
+#[tokio::test]
+async fn a_chunked_body_that_does_not_hold_leaves_nothing() {
+    let (dir, host) = bearer_server("chunked-refused");
+    let data = bytes_of_len(200_000);
+    let crc = crc32_b64(&data);
+    let put = |path: &str, mode| {
+        let trailer = (mode != Chunked::Signed).then_some(("x-amz-checksum-crc32", crc.as_str()));
+        Req::new("PUT", path).chunked(&host, BEARER, mode, &data, trailer)
+    };
+    let mut cases = Vec::new();
+    // The last chunk's signature, read once every byte of data has been staged.
+    let mut req = put("/s3/b/last-chunk", Chunked::Signed);
+    flip_after_last(&mut req.body, b";chunk-signature=");
+    cases.push(("/s3/b/last-chunk", req, 403, "SignatureDoesNotMatch"));
+    // The first chunk's data.
+    let mut req = put("/s3/b/data", Chunked::Signed);
+    req.body[1000] ^= 1;
+    cases.push(("/s3/b/data", req, 403, "SignatureDoesNotMatch"));
+    let mut req = put("/s3/b/trailer-sig", Chunked::SignedTrailer);
+    flip_after_last(&mut req.body, b"x-amz-trailer-signature:");
+    cases.push(("/s3/b/trailer-sig", req, 403, "SignatureDoesNotMatch"));
+    // The length the chunks hold, and what follows their end.
+    let short = (data.len() - 1).to_string();
+    let req = put("/s3/b/short", Chunked::Signed).replace("x-amz-decoded-content-length", &short);
+    cases.push(("/s3/b/short", req, 400, "InvalidChunkSizeError"));
+    let long = (data.len() + 1).to_string();
+    let req =
+        put("/s3/b/long", Chunked::UnsignedTrailer).replace("x-amz-decoded-content-length", &long);
+    cases.push(("/s3/b/long", req, 400, "IncompleteBody"));
+    let mut req = put("/s3/b/garbage", Chunked::Signed);
+    req.body.extend_from_slice(b"\r\n");
+    cases.push(("/s3/b/garbage", req, 400, "MalformedTrailerError"));
+    let mut req = put("/s3/b/header", Chunked::UnsignedTrailer);
+    req.body.splice(0..0, std::iter::repeat_n(b'0', 300));
+    cases.push(("/s3/b/header", req, 400, "InvalidChunkSizeError"));
+    let mut req = put("/s3/b/truncated", Chunked::Signed);
+    req.body.truncate(req.body.len() - 50);
+    cases.push(("/s3/b/truncated", req, 400, "IncompleteBody"));
+    // No decoded length at all.
+    let mut req = put("/s3/b/no-length", Chunked::Signed);
+    req.headers
+        .retain(|(n, _)| n != "x-amz-decoded-content-length");
+    cases.push(("/s3/b/no-length", req, 400, "InvalidRequest"));
+
+    for (path, req, status, code) in cases {
+        send_refused(&host, req).await.is(status, code);
+        let get = Req::new("GET", path).signed(&host, BEARER, 0);
+        send(&host, get).await.is(404, "NoSuchKey");
+    }
+    assert!(!dir.join("store/repos/files/b/tags").exists());
+    assert_eq!(staging_left(&dir), 0);
+}
+
+/// Under the bearer rather than SigV4, as the guest proxy will send it, a signed chunked body
+/// has no seed to check its signatures against: its framing is decoded, its signatures not
+/// checked.
+#[tokio::test]
+async fn a_bearer_chunked_put_is_decoded_with_its_signatures_unchecked() {
+    let (dir, host) = bearer_server("chunked-bearer");
+    let data = bytes_of_len(100_000);
+    let crc = crc32_b64(&data);
+    let bearer = format!("Bearer {}", BEARER.0);
+    let stranger = ("anyone", "not-this-registry's-secret");
+    for mode in [
+        Chunked::Signed,
+        Chunked::SignedTrailer,
+        Chunked::UnsignedTrailer,
+    ] {
+        let path = format!("/s3/b/{mode:?}");
+        let trailer = (mode != Chunked::Signed).then_some(("x-amz-checksum-crc32", crc.as_str()));
+        let req = Req::new("PUT", &path)
+            .chunked(&host, stranger, mode, &data, trailer)
+            .replace("Authorization", &bearer);
+        send(&host, req).await.ok(200);
+        let get = Req::new("GET", &path).header("Authorization", &bearer);
+        is_object(&send(&host, get).await, &data);
+    }
+    // Its framing and its trailer's checksum still are.
+    let mut req = Req::new("PUT", "/s3/b/garbage")
+        .chunked(&host, stranger, Chunked::Signed, &data, None)
+        .replace("Authorization", &bearer);
+    req.body.push(b'x');
+    send(&host, req).await.is(400, "MalformedTrailerError");
+    let wrong = crc32_b64(b"other");
+    let req = Req::new("PUT", "/s3/b/crc")
+        .chunked(
+            &host,
+            stranger,
+            Chunked::SignedTrailer,
+            &data,
+            Some(("x-amz-checksum-crc32", wrong.as_str())),
+        )
+        .replace("Authorization", &bearer);
+    send(&host, req).await.is(400, "BadDigest");
+    assert_eq!(staging_left(&dir), 0);
+}
+
+/// A trailer's checksum is checked against the decoded bytes, as the header's would be.
+#[tokio::test]
+async fn a_trailer_checksum_must_be_the_body_s() {
+    let (dir, host) = bearer_server("chunked-trailer");
+    let data = bytes_of_len(70_000);
+    let other = b"other";
+    let get = |path: &str| Req::new("GET", path).signed(&host, BEARER, 0);
+    let mut n = 0;
+    for mode in [Chunked::SignedTrailer, Chunked::UnsignedTrailer] {
+        for (name, value) in [
+            ("x-amz-checksum-crc32", crc32_b64(other)),
+            ("x-amz-checksum-sha1", sha1_b64(other)),
+            ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(other))),
+        ] {
+            n += 1;
+            let path = format!("/s3/b/bad{n}");
+            let req = Req::new("PUT", &path).chunked(
+                &host,
+                BEARER,
+                mode,
+                &data,
+                Some((name, value.as_str())),
+            );
+            send(&host, req).await.is(400, "BadDigest");
+            send(&host, get(&path)).await.is(404, "NoSuchKey");
+        }
+        let sha1 = sha1_b64(&data);
+        let req = Req::new("PUT", "/s3/b/sha1").chunked(
+            &host,
+            BEARER,
+            mode,
+            &data,
+            Some(("x-amz-checksum-sha1", sha1.as_str())),
+        );
+        let resp = send(&host, req).await;
+        resp.ok(200);
+        assert_eq!(resp.header("x-amz-checksum-sha1"), Some(sha1.as_str()));
+
+        // Not base64 of its length; announced and not sent; sent as a header too.
+        let crc = ("x-amz-checksum-crc32", "!!");
+        let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(crc));
+        send(&host, req).await.is(400, "InvalidRequest");
+        let req = Req::new("PUT", "/s3/b/x")
+            .chunked(&host, BEARER, mode, &data, None)
+            .header("x-amz-trailer", "x-amz-checksum-crc32");
+        send(&host, req).await.is(400, "MalformedTrailerError");
+        let crc = crc32_b64(&data);
+        let req = Req::new("PUT", "/s3/b/x")
+            .chunked(
+                &host,
+                BEARER,
+                mode,
+                &data,
+                Some(("x-amz-checksum-crc32", crc.as_str())),
+            )
+            .header("x-amz-checksum-crc32", &crc);
+        send(&host, req).await.is(400, "InvalidRequest");
+        send(&host, get("/s3/b/x")).await.is(404, "NoSuchKey");
+    }
+    assert_eq!(staging_left(&dir), 0);
+}
+
+/// A decoded length past 4 GiB is refused before a byte of the body is read.
+#[tokio::test]
+async fn a_decoded_length_past_the_cap_is_refused_unread() {
+    let (dir, host) = bearer_server("chunked-big");
+    let req = Req::new("PUT", "/s3/b/big")
+        .header("Content-Encoding", "aws-chunked")
+        .header(
+            "x-amz-decoded-content-length",
+            &((4u64 << 30) + 1).to_string(),
+        )
+        .signed_payload(&host, BEARER, 0, "STREAMING-AWS4-HMAC-SHA256-PAYLOAD");
+    let head = req
+        .head(&host)
+        .replace("Content-Length: 0", "Content-Length: 1000000");
+    let mut conn = Conn::open(&host).await;
+    conn.write
+        .as_mut()
+        .unwrap()
+        .write_all(head.as_bytes())
+        .await
+        .unwrap();
+    let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
+        .await
+        .expect("answered unread");
+    resp.is(413, "EntityTooLarge");
+    assert_eq!(staging_left(&dir), 0);
+}
+
 #[tokio::test]
 async fn user_metadata_round_trips_and_no_content_type_is_kept() {
     let dir = tmp("meta");

From df077b4a12437807b547fcf0b712d0cfedb88aaa Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 12:07:38 +0100
Subject: [PATCH 08/54] vk-registry/s3: serve byte ranges

Serve one byte range of an object on GetObject and HeadObject: 206 with
Content-Range, 416 InvalidRange for no byte of it, If-Range honoured, and
several ranges or an unparsable Range answered whole. As S3 takes them,
a range with whitespace in it or whose last byte comes before its first
does not parse, and a suffix of an empty object is all of it. Accept-Ranges
is now sent on every object answer.

A plain blob is read after a seek, a zstd-stored one decoded and skipped
up to the range. A PutObject of 8 MiB or more is stored uncompressed, so
the AWS CLI's parallel 8 MiB ranged downloads stay linear.
---
 CHANGELOG.md                      |   5 +-
 README.md                         |   2 +-
 vk-registry/DESIGN.md             |  14 +-
 vk-registry/src/files.rs          |  46 ++++-
 vk-registry/src/lib.rs            | 165 +++++++++++++++++
 vk-registry/src/s3/conditional.rs |   2 +-
 vk-registry/src/s3/mod.rs         |   1 +
 vk-registry/src/s3/object.rs      |  80 +++++++--
 vk-registry/src/s3/range.rs       | 286 ++++++++++++++++++++++++++++++
 vk-registry/tests/s3_e2e.rs       | 206 ++++++++++++++++++++-
 10 files changed, 788 insertions(+), 19 deletions(-)
 create mode 100644 vk-registry/src/s3/range.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2dd409f..2849827a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,8 +15,9 @@ All notable changes to virtkit will be documented in this file.
   checksums, given metadata and deleted, and listed page by page, and are the same files WebDAV
   and `vk registry get` see; a key limited to a directory of a bucket can list that directory.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
-  checked; multipart uploads, ranges and copies are not served yet. Set `s3 = false` in the
-  server config to turn it off.
+  checked, and objects can be read in byte ranges, as the AWS CLI downloads large files;
+  multipart uploads and copies are not served yet. Set `s3 = false` in the server config to
+  turn it off.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/README.md b/README.md
index 2abecba3..42e2bc16 100644
--- a/README.md
+++ b/README.md
@@ -867,7 +867,7 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 ```
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
-bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads, ranges and
+bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads and
 copies are not served yet. Set `s3 = false` to disable it.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 25cc91b0..c3f084ff 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -644,7 +644,7 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. `Range` is ignored and no `Accept-Ranges` is sent: a whole 200 is a legal answer. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does; a `HEAD` touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers, the checksum being the whole object's; a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
 | `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
@@ -681,6 +681,18 @@ other content encoding is decoded: one named beside `aws-chunked` is 501 `NotImp
 is another streaming mode (`STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD`); another encoding
 alone is stored as sent, its name not kept.
 
+**Ranges** are read from the stored blob without buffering the part. A blob stored plain is
+read after a seek. One stored as a zstd frame is decoded from its start and what precedes the
+range discarded, so a range costs a decode of everything before it: nothing to notice on a
+small object, but a client reading a large one in consecutive ranges would decode about
+N²/(2·range) bytes in all. The AWS CLI and the SDKs' transfer managers download an object past
+8 MiB as parallel 8 MiB ranges, so a `PutObject` of 8 MiB or more is stored plain, with no
+compression pass, and each of its ranges is a seek; smaller ones are compressed when that
+pays, and their ranges cost at most an 8 MiB decode. An object written otherwise (WebDAV,
+`vk registry put`, `/upload`) is stored as those writes store it, compressed when that pays
+whatever its size, and content already held keeps the form it was stored in first, so a large
+object of either kind can still be a zstd frame and pay that cost.
+
 **A listing's cost** is bounded by its page. The walk runs on the blocking pool, starts at the
 directory the prefix's whole components name, lists each directory it enters once (its
 subdirectories and tags), and stops one entry past `max-keys`, to know whether the page is
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index c1da7212..b80266c5 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -280,6 +280,10 @@ pub(crate) struct Commit {
     /// checked under the locks the tag is written under, so no other write of this server
     /// comes between the check and the write
     pub(crate) precondition: Option<Precondition>,
+    /// promoted as the bytes came, with no compression pass, so that ranges of it are read
+    /// by seeking (see [`crate::StagedBlob::uncompressed`]); otherwise compressed when that
+    /// pays
+    pub(crate) uncompressed: bool,
 }
 
 /// Promote a [`stage`]d body into the pool and tag it at `segs` as a raw file, re-checking
@@ -299,7 +303,11 @@ pub(crate) async fn commit(
             hex,
             mut staging,
         } = staged;
-        let promotion = store.stage_promotion(&hex, &staging.path)?;
+        let promotion = if how.uncompressed {
+            crate::StagedBlob::uncompressed(&staging.path)
+        } else {
+            store.stage_promotion(&hex, &staging.path)?
+        };
         let _namespace = namespace(&store)?;
         // shared store lock (vs. an exclusive gc) across the promote and the manifest that
         // references it; see Store::lock_shared. Another write may have changed the path
@@ -502,6 +510,7 @@ mod tests {
         let how = Commit {
             annotations: annotations.clone(),
             precondition: absent(),
+            ..Commit::default()
         };
         assert!(matches!(write(b"one", how).await, Written::Created));
         let (hex, _) = store.tag_target("files/b", "k").unwrap();
@@ -536,6 +545,41 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// A commit asked to keep its bytes uncompressed promotes them plain, however well they
+    /// would compress; otherwise compressible bytes are stored as a zstd frame.
+    #[tokio::test]
+    async fn an_uncompressed_commit_is_promoted_plain() {
+        let dir = std::env::temp_dir().join(format!("vk-reg-files-plain-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Arc::new(Store::new(dir.clone()).unwrap());
+        let write = async |name: &str, data: Vec<u8>, uncompressed: bool| {
+            let frame: std::result::Result<_, std::io::Error> =
+                Ok(hyper::body::Frame::data(Bytes::from(data)));
+            let body = http_body_util::StreamBody::new(futures::stream::iter([frame]));
+            let staged = stage(&store, body, &mut |_| {}).await.ok().unwrap();
+            let hex = staged.hex.clone();
+            let segs = vec!["b".to_string(), name.to_string()];
+            let how = Commit {
+                uncompressed,
+                ..Commit::default()
+            };
+            let written = commit(Arc::clone(&store), segs, staged, how).await;
+            assert!(matches!(written.unwrap(), Written::Created));
+            hex
+        };
+        let data = b"compressible ".repeat(4096);
+        let plain = write("plain", data.clone(), true).await;
+        assert!(store.blob_path(&plain).is_file());
+        assert!(!store.zstd_blob_path(&plain).is_file());
+        let mut other = data.clone();
+        other.push(b'!');
+        let packed = write("packed", other, false).await;
+        assert!(store.zstd_blob_path(&packed).is_file());
+        assert!(!store.blob_path(&packed).is_file());
+        assert_eq!(store.get_blob(&plain).unwrap().unwrap(), data);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn paths_map_onto_repositories_and_tags() {
         let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index e66dcc10..779f949f 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -268,6 +268,42 @@ fn stream_body(reader: impl std::io::Read + Send + Sync + 'static, what: &str) -
     StreamBody::new(stream).boxed()
 }
 
+/// What [`Store::serve_blob_range`] serves: the blob's canonical length, and the part.
+pub(crate) struct BlobPart {
+    pub(crate) total: u64,
+    pub(crate) body: Body,
+}
+
+/// A reader that discards the first `skip` bytes of `inner` on its first read, through the
+/// caller's buffer: a ranged read of a zstd-stored blob decodes what precedes the range on
+/// the blocking pool the stream reads on, not before the answer's headers are sent.
+struct Skip<R> {
+    inner: R,
+    skip: u64,
+}
+
+impl<R: std::io::Read> std::io::Read for Skip<R> {
+    fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+        if buf.is_empty() {
+            return Ok(0);
+        }
+        // Counted down as it goes, so a read retried after `Interrupted` resumes where the
+        // one before stopped.
+        while self.skip > 0 {
+            let want = usize::try_from(self.skip).map_or(buf.len(), |s| s.min(buf.len()));
+            let n = self.inner.read(&mut buf[..want])?;
+            if n == 0 {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::UnexpectedEof,
+                    "the blob ends before the range starts",
+                ));
+            }
+            self.skip = self.skip.saturating_sub(n as u64);
+        }
+        self.inner.read(buf)
+    }
+}
+
 /// Capability header a cooperating server sets on its `GET /v2/` response, so an
 /// auto-mode client knows it may push transparent-zstd (uncompressed-digest) chunks.
 /// Absent on any dumb OCI registry.
@@ -448,6 +484,17 @@ pub(crate) struct StagedBlob {
 }
 
 impl StagedBlob {
+    /// `tmp` installed as it is, the canonical bytes, with no compression pass: for a writer
+    /// whose objects will be read back in ranges, which a plain blob serves by seeking (see
+    /// [`Store::serve_blob_range`]). A blob already held keeps the form it has.
+    pub(crate) fn uncompressed(tmp: &Path) -> Self {
+        StagedBlob {
+            install: tmp.to_path_buf(),
+            discard: None,
+            zstd: false,
+        }
+    }
+
     /// Drop the staged files without installing anything — for a caller that gives up
     /// between staging and promoting. `gc` would sweep `uploads/` eventually anyway, so an
     /// unlink that fails is not worth reporting over whatever made the caller give up.
@@ -1117,6 +1164,64 @@ impl Store {
         Ok(())
     }
 
+    /// `len` of blob `hex`'s canonical bytes from `start`, streamed through the body a whole
+    /// blob is, with the blob's canonical length; `None` when the blob is absent, and an error
+    /// when the part does not lie within it. Opened once and served from that descriptor, as
+    /// [`serve_blob`] is, and measured without reading it. Nothing is read for `head`.
+    ///
+    /// A plain blob is read from `start` after a seek. A zstd-stored one is decoded from the
+    /// frame's start and its first `start` bytes discarded, on the blocking pool as the
+    /// stream's first read: O(`start`) of decoding, with the decoder's window as memory, before
+    /// the part's first byte goes out. A client reading a large zstd blob in consecutive
+    /// ranges so pays quadratically, which is why the S3 view stores its large writes plain
+    /// ([`StagedBlob::uncompressed`]).
+    pub(crate) fn serve_blob_range(
+        &self,
+        hex: &str,
+        start: u64,
+        len: u64,
+        head: bool,
+    ) -> Result<Option<BlobPart>> {
+        use std::io::{Read, Seek, SeekFrom};
+        let Some((path, is_zstd)) = self.find_blob(hex) else {
+            return Ok(None);
+        };
+        let mut file =
+            std::fs::File::open(&path).with_context(|| format!("opening {}", path.display()))?;
+        let total = if is_zstd {
+            zstd_canonical_len(&mut file)
+                .with_context(|| format!("measuring the stored blob {hex}"))?
+        } else {
+            file.metadata()
+                .with_context(|| format!("stat {}", path.display()))?
+                .len()
+        };
+        if start.checked_add(len).is_none_or(|end| end > total) {
+            bail!("bytes {start}+{len} of the blob {hex}, which holds {total}");
+        }
+        if head || len == 0 {
+            return Ok(Some(BlobPart {
+                total,
+                body: body_of(Bytes::new()),
+            }));
+        }
+        let what = format!("sha256:{hex}");
+        let body = if is_zstd {
+            let decoder =
+                zstd::stream::read::Decoder::new(file).context("opening a stored blob")?;
+            let skipped = Skip {
+                inner: decoder,
+                skip: start,
+            };
+            stream_body(skipped.take(len), &what)
+        } else {
+            file.seek(SeekFrom::Start(start))
+                .with_context(|| format!("seeking in {}", path.display()))?;
+            stream_body(file.take(len), &what)
+        };
+        Ok(Some(BlobPart { total, body }))
+    }
+
     /// Return a blob's decompressed bytes, or `None` if absent or larger than `cap`.
     /// Bounds gc reads of index children, whose blobs the pusher chooses.
     fn read_blob_capped(&self, hex: &str, cap: usize) -> Result<Option<Vec<u8>>> {
@@ -10305,6 +10410,66 @@ mod tests {
         );
     }
 
+    /// A range of a blob is the same bytes stored plain (a seek) or as a zstd frame (decoded
+    /// and skipped), across chunk boundaries, at either end and whole; a HEAD reads nothing,
+    /// and a part not within the blob is an error, not a short body.
+    #[tokio::test]
+    async fn a_blob_range_is_the_same_bytes_plain_or_zstd() {
+        let dir = std::env::temp_dir().join(format!("vk-regserve-range-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Store::new(dir.clone()).unwrap();
+        // Compressible, so `put_blob` keeps a frame; long enough for several chunks.
+        let raw: Vec<u8> = (0..3 * STREAM_CHUNK + 17)
+            .map(|i| (i / 1000 % 251) as u8)
+            .collect();
+        let zstd = store.put_blob(&raw).unwrap();
+        let zstd = zstd.trim_start_matches("sha256:");
+        assert!(store.zstd_blob_path(zstd).is_file());
+        let mut other = raw.clone();
+        other[0] ^= 1;
+        let plain = sha256_hex_raw(&other);
+        atomic_write(&store.blob_path(&plain), &other).unwrap();
+        let total = raw.len() as u64;
+
+        for (hex, raw) in [(zstd, &raw), (plain.as_str(), &other)] {
+            let read = async |start: u64, len: u64| {
+                let part = store
+                    .serve_blob_range(hex, start, len, false)
+                    .unwrap()
+                    .unwrap();
+                assert_eq!(part.total, total);
+                part.body.collect().await.unwrap().to_bytes().to_vec()
+            };
+            let at = |start: usize, len: usize| raw[start..start + len].to_vec();
+            assert_eq!(read(0, 1).await, at(0, 1));
+            assert_eq!(read(0, 100).await, at(0, 100));
+            let middle = STREAM_CHUNK as u64 - 5;
+            assert_eq!(
+                read(middle, STREAM_CHUNK as u64 + 10).await,
+                at(middle as usize, STREAM_CHUNK + 10),
+                "across a chunk"
+            );
+            assert_eq!(read(total - 1, 1).await, at(raw.len() - 1, 1));
+            assert_eq!(read(0, total).await, *raw);
+            assert!(read(total, 0).await.is_empty(), "a zero-length tail");
+
+            let head = store.serve_blob_range(hex, 5, 10, true).unwrap().unwrap();
+            assert_eq!(head.total, total);
+            assert!(head.body.collect().await.unwrap().to_bytes().is_empty());
+            assert!(store.serve_blob_range(hex, total, 1, false).is_err());
+            assert!(store.serve_blob_range(hex, 1, total, false).is_err());
+            assert!(store.serve_blob_range(hex, u64::MAX, 2, false).is_err());
+        }
+        let absent = sha256_hex_raw(b"absent");
+        assert!(
+            store
+                .serve_blob_range(&absent, 0, 1, false)
+                .unwrap()
+                .is_none()
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// A reader whose length is an exact multiple of the chunk ends on the empty read,
     /// neither one chunk short nor with a trailing empty frame.
     #[tokio::test]
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index 1887178e..fa35c5f2 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -109,7 +109,7 @@ impl Conditions {
     }
 }
 
-fn whole_seconds(t: SystemTime) -> u64 {
+pub(crate) fn whole_seconds(t: SystemTime) -> u64 {
     t.duration_since(SystemTime::UNIX_EPOCH)
         .unwrap_or(Duration::ZERO)
         .as_secs()
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 6d8b6d5d..915deb08 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -19,6 +19,7 @@ mod list;
 mod meta;
 mod object;
 mod path;
+mod range;
 mod sigv4;
 mod xml;
 
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 1eeeb657..1b2871ae 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -14,13 +14,14 @@ use std::sync::Arc;
 use anyhow::{Context, Result};
 use hyper::body::Incoming;
 use hyper::header::{
-    CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LENGTH, ETAG, HeaderMap, HeaderValue,
-    LAST_MODIFIED,
+    ACCEPT_RANGES, CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LENGTH, CONTENT_RANGE,
+    CONTENT_TYPE, ETAG, HeaderMap, HeaderValue, LAST_MODIFIED,
 };
 use hyper::{Request, Response, StatusCode};
 use sha1::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::range::{self, Range};
 use super::{Ctx, chunked, drain, meta, refuse, xml};
 use crate::dav::http_date;
 use crate::files::{
@@ -90,9 +91,16 @@ fn insert(headers: &mut HeaderMap, name: hyper::header::HeaderName, value: &str)
     }
 }
 
-/// `GET`/`HEAD /s3/<bucket>/<key>`: the object's bytes, after its conditional headers. A GET
-/// served refreshes an idle object's tag, as a WebDAV GET does; a HEAD touches nothing.
-/// `Range` is ignored: a whole 200 is a legal answer to it.
+/// The `Content-Range` of `len` bytes from `start` of an object `total` bytes long.
+fn content_range(start: u64, len: u64, total: u64) -> String {
+    let last = start.saturating_add(len).saturating_sub(1);
+    format!("bytes {start}-{last}/{total}")
+}
+
+/// `GET`/`HEAD /s3/<bucket>/<key>`: the object's bytes, after its conditional headers, or
+/// the one byte range `Range` asks for (206) when `If-Range`, if sent, still holds; a HEAD
+/// answers what the GET would. A GET served, whole or in part, refreshes an idle object's tag
+/// as a WebDAV GET does; a HEAD touches nothing.
 pub(super) async fn get(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -105,6 +113,7 @@ pub(super) async fn get(
         return refuse(req, ctx.access_denied(), ctx).await;
     }
     let conditions = Conditions::of(req.headers());
+    let asked = range::Asked::of(req.headers());
     let checksum = req
         .headers()
         .get(CHECKSUM_MODE)
@@ -137,17 +146,56 @@ pub(super) async fn get(
                 ));
             }
         }
-        let mut resp =
-            crate::serve_blob(store, &format!("sha256:{}", obj.layer), head, false, false)?;
-        // The layer gone under the tag (a gc between the two reads) is no object either.
-        if resp.status() != StatusCode::OK {
-            return Ok(no_such_key(&ctx));
-        }
+        let mut resp = match asked.resolve(&etag, obj.modified, obj.size) {
+            Range::Whole => {
+                let digest = format!("sha256:{}", obj.layer);
+                let mut resp = crate::serve_blob(store, &digest, head, false, false)?;
+                // The layer gone under the tag (a gc between the two reads) is no object
+                // either.
+                if resp.status() != StatusCode::OK {
+                    return Ok(no_such_key(&ctx));
+                }
+                resp.headers_mut().remove("docker-content-digest");
+                resp
+            }
+            Range::Part { start, len } => {
+                let Some(part) = store.serve_blob_range(&obj.layer, start, len, head)? else {
+                    return Ok(no_such_key(&ctx));
+                };
+                Response::builder()
+                    .status(StatusCode::PARTIAL_CONTENT)
+                    .header(CONTENT_TYPE, "application/octet-stream")
+                    .header(CONTENT_LENGTH, len.to_string())
+                    .header(CONTENT_RANGE, content_range(start, len, part.total))
+                    .body(part.body)?
+            }
+            Range::Unsatisfiable => {
+                let total = obj.size.to_string();
+                let mut resp = xml::error(
+                    StatusCode::RANGE_NOT_SATISFIABLE,
+                    "InvalidRange",
+                    "the requested range is not satisfiable",
+                    &[
+                        ("RangeRequested", asked.range()),
+                        ("ActualObjectSize", &total),
+                    ],
+                    &ctx.path,
+                    &ctx.id,
+                );
+                insert(
+                    resp.headers_mut(),
+                    CONTENT_RANGE,
+                    &format!("bytes */{total}"),
+                );
+                insert(resp.headers_mut(), ACCEPT_RANGES, "bytes");
+                return Ok(resp);
+            }
+        };
         if !head {
             files::touch_if_idle(store, &obj);
         }
         let headers = resp.headers_mut();
-        headers.remove("docker-content-digest");
+        headers.insert(ACCEPT_RANGES, HeaderValue::from_static("bytes"));
         headers.insert(CONTENT_DISPOSITION, HeaderValue::from_static("attachment"));
         insert(headers, ETAG, &etag);
         insert(headers, LAST_MODIFIED, &modified);
@@ -246,6 +294,13 @@ struct Payload {
     framing: Option<chunked::Framing>,
 }
 
+/// The size from which a written object is stored uncompressed. The AWS CLI and SDK transfer
+/// managers download an object past 8 MiB as parallel 8 MiB ranges, and a range of a
+/// zstd-stored blob is decoded from the blob's start ([`Store::serve_blob_range`]): stored
+/// compressed, an object of N bytes would cost about N²/16 MiB of decoding to download, where
+/// stored plain each range is a seek. Below it, a range costs at most this much decoding.
+const UNCOMPRESSED_FROM: u64 = 8 << 20;
+
 /// The header naming how long an `aws-chunked` body is once decoded.
 const DECODED_LENGTH: &str = "x-amz-decoded-content-length";
 
@@ -631,6 +686,7 @@ pub(super) async fn put(
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
+        uncompressed: staged.size >= UNCOMPRESSED_FROM,
     };
     let written = files::commit(Arc::clone(&state.store), segs, staged, how).await?;
     match written {
diff --git a/vk-registry/src/s3/range.rs b/vk-registry/src/s3/range.rs
new file mode 100644
index 00000000..96f7b2a9
--- /dev/null
+++ b/vk-registry/src/s3/range.rs
@@ -0,0 +1,286 @@
+//! `Range` on a GetObject or HeadObject, and the `If-Range` that makes it conditional. One
+//! byte range is served, in any of RFC 9110's three forms (`bytes=a-b`, `bytes=a-`,
+//! `bytes=-n`), as S3 serves it. Anything else is ignored and the whole object served, which
+//! RFC 9110 allows: several ranges, another unit, a header that does not parse (whitespace
+//! in the range or a last byte before the first included, as S3 takes them), or an
+//! `If-Range` the object no longer matches.
+
+use std::time::SystemTime;
+
+use hyper::header::{HeaderMap, IF_RANGE, RANGE};
+
+use super::conditional;
+
+/// What a read's `Range` asks of an object.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) enum Range {
+    /// the whole object, 200
+    Whole,
+    /// `len` bytes from `start`, 206; `len` is at least one
+    Part { start: u64, len: u64 },
+    /// no byte of the object, 416
+    Unsatisfiable,
+}
+
+/// A read's `Range` and `If-Range`, as sent.
+#[derive(Debug)]
+pub(super) struct Asked {
+    range: Option<String>,
+    if_range: Option<String>,
+}
+
+impl Asked {
+    /// The headers, if each is sent once and is text; a `Range` sent twice is no single
+    /// range, and an `If-Range` sent twice no single validator.
+    pub(super) fn of(headers: &HeaderMap) -> Self {
+        let once = |name| {
+            let mut values = headers.get_all(name).iter();
+            match (values.next(), values.next()) {
+                (Some(v), None) => Some(v.to_str().map_or_else(|_| "?".into(), str::to_string)),
+                (None, _) => None,
+                (Some(_), Some(_)) => Some("?".into()),
+            }
+        };
+        Asked {
+            range: once(RANGE),
+            if_range: once(IF_RANGE),
+        }
+    }
+
+    /// The `Range` header as sent, for the error that refuses it.
+    pub(super) fn range(&self) -> &str {
+        self.range.as_deref().unwrap_or_default()
+    }
+
+    /// What is served of an object `total` bytes long, whose ETag is `etag` (quoted) and
+    /// which was last modified at `modified`. `If-Range` counts only beside a `Range`.
+    pub(super) fn resolve(&self, etag: &str, modified: SystemTime, total: u64) -> Range {
+        let Some(range) = &self.range else {
+            return Range::Whole;
+        };
+        if let Some(validator) = &self.if_range
+            && !holds(validator, etag, modified)
+        {
+            return Range::Whole;
+        }
+        parse(range, total)
+    }
+}
+
+/// Whether `If-Range`'s `validator` still names the object: its ETag compared strongly (a
+/// weak tag never matches), or a date its `Last-Modified` equals to the second. Anything
+/// else does not.
+fn holds(validator: &str, etag: &str, modified: SystemTime) -> bool {
+    let validator = validator.trim();
+    if validator.starts_with('"') {
+        return validator == etag;
+    }
+    if validator.starts_with("W/") {
+        return false;
+    }
+    httpdate::parse_http_date(validator)
+        .is_ok_and(|t| conditional::whole_seconds(t) == conditional::whole_seconds(modified))
+}
+
+/// `value` as a byte range of an object `total` bytes long. A range whose first byte is past
+/// the end, or a suffix of none, is unsatisfiable; a last byte past the end, or a suffix
+/// longer than the object, is cut to it, and a suffix of an empty object is all of it, as S3
+/// serves them. A last byte before the first does not parse.
+fn parse(value: &str, total: u64) -> Range {
+    let Some((unit, set)) = value.split_once('=') else {
+        return Range::Whole;
+    };
+    if !unit.trim().eq_ignore_ascii_case("bytes") {
+        return Range::Whole;
+    }
+    // A list, so empty elements are passed over (RFC 9110 5.6.1); S3 takes none padded.
+    let mut specs = set.split(',').filter(|s| !s.is_empty());
+    let (Some(spec), None) = (specs.next(), specs.next()) else {
+        return Range::Whole;
+    };
+    let Some((first, last)) = spec.split_once('-') else {
+        return Range::Whole;
+    };
+    match (number(first), number(last)) {
+        (Some(first), Some(last)) if first > last => Range::Whole,
+        (Some(first), Some(_)) if first >= total => Range::Unsatisfiable,
+        (Some(first), Some(last)) => Range::Part {
+            start: first,
+            len: last.min(total.saturating_sub(1)).saturating_sub(first) + 1,
+        },
+        (Some(first), None) if last.is_empty() => match total.checked_sub(first) {
+            Some(len) if len > 0 => Range::Part { start: first, len },
+            _ => Range::Unsatisfiable,
+        },
+        (None, Some(suffix)) if first.is_empty() => match (suffix, suffix.min(total)) {
+            (0, _) => Range::Unsatisfiable,
+            (_, 0) => Range::Whole,
+            (_, len) => Range::Part {
+                start: total - len,
+                len,
+            },
+        },
+        _ => Range::Whole,
+    }
+}
+
+/// A run of decimal digits, a number too large for a `u64` being the largest one (still past
+/// any object's end).
+fn number(s: &str) -> Option<u64> {
+    if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    Some(s.parse().unwrap_or(u64::MAX))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::Duration;
+
+    fn part(start: u64, len: u64) -> Range {
+        Range::Part { start, len }
+    }
+
+    #[test]
+    fn every_form_of_one_byte_range() {
+        assert_eq!(parse("bytes=0-0", 10), part(0, 1));
+        assert_eq!(parse("bytes=2-5", 10), part(2, 4));
+        assert_eq!(parse("bytes=0-9", 10), part(0, 10));
+        assert_eq!(parse("bytes=9-9", 10), part(9, 1));
+        assert_eq!(parse("bytes=3-", 10), part(3, 7));
+        assert_eq!(parse("bytes=9-", 10), part(9, 1));
+        assert_eq!(parse("bytes=-3", 10), part(7, 3));
+        assert_eq!(parse("bytes=-10", 10), part(0, 10));
+        // The unit is case-insensitive.
+        assert_eq!(parse("Bytes=1-1", 10), part(1, 1));
+    }
+
+    #[test]
+    fn a_range_past_the_end_is_cut_to_it() {
+        assert_eq!(parse("bytes=5-100", 10), part(5, 5));
+        assert_eq!(parse("bytes=0-18446744073709551615", 10), part(0, 10));
+        assert_eq!(parse("bytes=0-99999999999999999999999", 10), part(0, 10));
+        // A suffix longer than the object is all of it.
+        assert_eq!(parse("bytes=-11", 10), part(0, 10));
+        assert_eq!(parse("bytes=-99999999999999999999999", 10), part(0, 10));
+    }
+
+    #[test]
+    fn no_byte_of_the_object_is_unsatisfiable() {
+        for value in [
+            "bytes=10-",
+            "bytes=10-20",
+            "bytes=11-",
+            "bytes=99999999999999999999999-",
+            "bytes=-0",
+        ] {
+            assert_eq!(parse(value, 10), Range::Unsatisfiable, "{value}");
+        }
+        // An empty object has no first byte to serve, but a suffix of it is all of it.
+        for value in ["bytes=0-0", "bytes=0-", "bytes=-0"] {
+            assert_eq!(parse(value, 0), Range::Unsatisfiable, "{value}");
+        }
+        assert_eq!(parse("bytes=-1", 0), Range::Whole);
+    }
+
+    #[test]
+    fn several_ranges_or_none_are_ignored() {
+        for value in [
+            "bytes=0-1,3-4",
+            "bytes=0-1, -2",
+            "bytes=",
+            "bytes=,",
+            "bytes",
+            "items=0-1",
+            "bytes=a-b",
+            "bytes=-",
+            "bytes=1",
+            "bytes=+1-2",
+            "bytes=1-+2",
+            "bytes=-+2",
+            "bytes=1 - 2",
+            "bytes=0x1-2",
+            "bytes=5-2",
+            "bytes=102-0",
+            "bytes= -1",
+            "bytes=0 -1",
+            "bytes= 1-2 ",
+            "bytes=\t-3",
+            "",
+        ] {
+            assert_eq!(parse(value, 10), Range::Whole, "{value:?}");
+        }
+    }
+
+    #[test]
+    fn empty_list_elements_are_passed_over() {
+        assert_eq!(parse("bytes=,4-,", 10), part(4, 6));
+        assert_eq!(parse("bytes =1-2", 10), part(1, 2));
+    }
+
+    fn at(secs: u64) -> SystemTime {
+        SystemTime::UNIX_EPOCH + Duration::from_secs(secs)
+    }
+
+    #[test]
+    fn if_range_holds_on_the_etag_or_the_date() {
+        let etag = "\"65a8e27d8879283831b664bd8b7f0ad4\"";
+        // 1994-11-06T08:49:37Z
+        let modified = at(784_111_777);
+        let date = "Sun, 06 Nov 1994 08:49:37 GMT";
+        assert!(holds(etag, etag, modified));
+        assert!(holds(&format!(" {etag} "), etag, modified));
+        assert!(!holds("\"other\"", etag, modified));
+        assert!(!holds(&format!("W/{etag}"), etag, modified));
+        assert!(!holds("65a8e27d8879283831b664bd8b7f0ad4", etag, modified));
+        assert!(holds(date, etag, modified));
+        // To the second, as an HTTP date has it.
+        assert!(holds(date, etag, modified + Duration::from_millis(500)));
+        assert!(!holds(date, etag, at(784_111_778)));
+        assert!(!holds("Sun, 06 Nov 1994 08:49:36 GMT", etag, modified));
+        assert!(!holds("yesterday", etag, modified));
+    }
+
+    fn asked(pairs: &[(hyper::header::HeaderName, &str)]) -> Asked {
+        let mut h = HeaderMap::new();
+        for (n, v) in pairs {
+            h.append(n.clone(), hyper::header::HeaderValue::from_str(v).unwrap());
+        }
+        Asked::of(&h)
+    }
+
+    #[test]
+    fn if_range_decides_between_the_part_and_the_whole() {
+        let etag = "\"abc\"";
+        let modified = at(1_000_000);
+        let resolve = |a: Asked| a.resolve(etag, modified, 10);
+        assert_eq!(resolve(asked(&[])), Range::Whole);
+        assert_eq!(resolve(asked(&[(RANGE, "bytes=1-2")])), part(1, 2));
+        assert_eq!(
+            resolve(asked(&[(RANGE, "bytes=1-2"), (IF_RANGE, etag)])),
+            part(1, 2)
+        );
+        assert_eq!(
+            resolve(asked(&[(RANGE, "bytes=1-2"), (IF_RANGE, "\"old\"")])),
+            Range::Whole
+        );
+        // A mismatch serves the whole object rather than refusing the range.
+        assert_eq!(
+            resolve(asked(&[(RANGE, "bytes=20-"), (IF_RANGE, "\"old\"")])),
+            Range::Whole
+        );
+        assert_eq!(
+            resolve(asked(&[(RANGE, "bytes=20-"), (IF_RANGE, etag)])),
+            Range::Unsatisfiable
+        );
+        // Without a Range, If-Range asks nothing.
+        assert_eq!(resolve(asked(&[(IF_RANGE, "\"old\"")])), Range::Whole);
+        // Two Range headers are no single range.
+        assert_eq!(
+            resolve(asked(&[(RANGE, "bytes=1-2"), (RANGE, "bytes=3-4")])),
+            Range::Whole
+        );
+        assert_eq!(asked(&[(RANGE, "bytes=1-2")]).range(), "bytes=1-2");
+    }
+}
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 4b14da1c..155e8081 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1023,7 +1023,7 @@ fn is_object(resp: &Resp, body: &[u8]) {
     );
     assert_eq!(resp.header("content-disposition"), Some("attachment"));
     assert!(resp.header("last-modified").is_some(), "{resp:?}");
-    assert_eq!(resp.header("accept-ranges"), None);
+    assert_eq!(resp.header("accept-ranges"), Some("bytes"));
     assert_eq!(resp.header("docker-content-digest"), None);
 }
 
@@ -2329,3 +2329,207 @@ async fn s3_dav_and_v2_see_the_same_objects() {
         .await
         .is(404, "NoSuchKey");
 }
+
+/// What a ranged answer carries: 206, `Content-Range` and the part's length, and the whole
+/// object's headers.
+#[track_caller]
+fn is_part(resp: &Resp, data: &[u8], start: usize, len: usize, etag: &str) {
+    resp.ok(206);
+    let last = start + len - 1;
+    assert_eq!(
+        resp.header("content-range"),
+        Some(&*format!("bytes {start}-{last}/{}", data.len()))
+    );
+    assert_eq!(resp.header("content-length"), Some(&*len.to_string()));
+    assert_eq!(resp.header("etag"), Some(etag));
+    assert_eq!(resp.header("accept-ranges"), Some("bytes"));
+    assert_eq!(resp.header("content-disposition"), Some("attachment"));
+    assert_eq!(
+        resp.header("content-type"),
+        Some("application/octet-stream")
+    );
+    assert!(resp.header("last-modified").is_some(), "{resp:?}");
+    assert_eq!(resp.header("docker-content-digest"), None);
+}
+
+/// Bytes zstd shrinks well, varying enough that a misplaced range shows.
+fn compressible(n: usize) -> Vec<u8> {
+    (0..n).map(|i| (i / 300 % 251) as u8).collect()
+}
+
+/// Ranges of an object stored compressed (a small S3 write) and of one stored plain (an S3
+/// write of 8 MiB or more, so the AWS CLI's parallel 8 MiB ranges each cost a seek): every
+/// form, cut to the end, a HEAD, 416, and what is ignored.
+#[tokio::test]
+async fn ranges_of_plain_and_zstd_stored_objects() {
+    let dir = tmp("ranges");
+    let host = spawn(open_state(&dir, true));
+    let blobs = dir.join("store/blobs");
+    let small = compressible(300_000);
+    let big = compressible(8 << 20);
+    for (key, data) in [("small", &small), ("big", &big)] {
+        let path = format!("/s3/b/{key}");
+        send(&host, Req::new("PUT", &path).body(data.clone()))
+            .await
+            .ok(200);
+        let hex = sha256_hex(data);
+        let zstd = blobs.join("zstd").join(&hex).is_file();
+        let plain = blobs.join("sha256").join(&hex).is_file();
+        assert_eq!((zstd, plain), (key == "small", key == "big"), "{key}");
+
+        let whole = send(&host, Req::new("GET", &path)).await;
+        is_object(&whole, data);
+        let etag = whole.header("etag").unwrap().to_string();
+        let n = data.len();
+        let ranged = |value: &str| Req::new("GET", &path).header("Range", value);
+        for (value, start, len) in [
+            ("bytes=0-0".to_string(), 0, 1),
+            ("bytes=0-99".to_string(), 0, 100),
+            (format!("bytes={}-{}", n / 2, n / 2 + 70_000), n / 2, 70_001),
+            ("bytes=1000-".to_string(), 1000, n - 1000),
+            ("bytes=-500".to_string(), n - 500, 500),
+            (format!("bytes={}-", n - 1), n - 1, 1),
+            (format!("bytes=-{}", n + 10), 0, n),
+            (format!("bytes=10-{}", n * 2), 10, n - 10),
+            ("bytes=7-9,".to_string(), 7, 3),
+        ] {
+            let resp = send(&host, ranged(&value)).await;
+            is_part(&resp, data, start, len, &etag);
+            assert!(resp.bytes == data[start..start + len], "{key} {value}");
+        }
+        // The whole object again, from consecutive ranges as a transfer manager reads it.
+        let step = 3 << 20;
+        let mut joined = Vec::new();
+        for start in (0..n).step_by(step) {
+            let value = format!("bytes={start}-{}", start + step - 1);
+            joined.extend(send(&host, ranged(&value)).await.bytes);
+        }
+        assert!(joined == *data, "{key}: the parts are the whole");
+
+        // The checksum is the whole object's, and only when asked.
+        let resp = send(&host, ranged("bytes=0-9")).await;
+        assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+        let resp = send(
+            &host,
+            ranged("bytes=0-9").header("x-amz-checksum-mode", "ENABLED"),
+        )
+        .await;
+        is_part(&resp, data, 0, 10, &etag);
+        let sha = b64(&sha2::Sha256::digest(data));
+        assert_eq!(resp.header("x-amz-checksum-sha256"), Some(&*sha));
+
+        // A HEAD answers what the GET would.
+        let resp = send(
+            &host,
+            Req::new("HEAD", &path).header("Range", "bytes=100-199"),
+        )
+        .await;
+        is_part(&resp, data, 100, 100, &etag);
+        assert!(resp.bytes.is_empty());
+        let resp = send(&host, Req::new("HEAD", &path)).await;
+        resp.ok(200);
+        assert_eq!(resp.header("accept-ranges"), Some("bytes"));
+        assert_eq!(resp.header("content-length"), Some(&*n.to_string()));
+
+        // No byte of the object.
+        for value in [format!("bytes={n}-"), "bytes=-0".into()] {
+            let resp = send(&host, ranged(&value)).await;
+            resp.is(416, "InvalidRange");
+            assert_eq!(resp.header("content-range"), Some(&*format!("bytes */{n}")));
+            assert!(
+                resp.body
+                    .contains(&format!("<ActualObjectSize>{n}</ActualObjectSize>")),
+                "{}",
+                resp.body
+            );
+        }
+        let head = Req::new("HEAD", &path).header("Range", &format!("bytes={n}-"));
+        assert_eq!(send(&host, head).await.status, 416);
+        // Several ranges, or one that does not parse: the whole object.
+        for value in [
+            "bytes=0-1,5-6",
+            "bytes=x-y",
+            "lines=0-1",
+            "bytes=5-2",
+            "bytes= -1",
+        ] {
+            is_object(&send(&host, ranged(value)).await, data);
+        }
+
+        // If-Range: the part while the object is the one it names, else the whole.
+        let modified = whole.header("last-modified").unwrap().to_string();
+        let resp = send(&host, ranged("bytes=0-9").header("If-Range", &etag)).await;
+        is_part(&resp, data, 0, 10, &etag);
+        let resp = send(&host, ranged("bytes=0-9").header("If-Range", &modified)).await;
+        is_part(&resp, data, 0, 10, &etag);
+        for stale in ["\"0000\"", "Mon, 01 Jan 2001 00:00:00 GMT"] {
+            let resp = send(&host, ranged("bytes=0-9").header("If-Range", stale)).await;
+            is_object(&resp, data);
+        }
+        // The preconditions come first.
+        let resp = send(&host, ranged("bytes=0-9").header("If-None-Match", &etag)).await;
+        resp.ok(304);
+    }
+
+    // An empty object has no first byte, but a suffix of it is the whole of it.
+    send(&host, Req::new("PUT", "/s3/b/empty")).await.ok(200);
+    for method in ["GET", "HEAD"] {
+        let ranged = |value: &str| Req::new(method, "/s3/b/empty").header("Range", value);
+        let resp = send(&host, ranged("bytes=-1")).await;
+        resp.ok(200);
+        assert_eq!(resp.header("content-length"), Some("0"));
+        assert_eq!(resp.header("content-range"), None);
+        for value in ["bytes=0-", "bytes=0-0", "bytes=-0"] {
+            assert_eq!(
+                send(&host, ranged(value)).await.status,
+                416,
+                "{method} {value}"
+            );
+        }
+    }
+}
+
+/// An object written over WebDAV is stored compressed when that pays, whatever its size, and
+/// is served in ranges all the same. A ranged GET is a read, so it refreshes an idle tag as a
+/// whole one does; a ranged HEAD does not.
+#[tokio::test]
+async fn a_dav_written_object_is_served_in_ranges_and_a_ranged_get_refreshes_it() {
+    let dir = tmp("dav-ranges");
+    let host = spawn(open_state(&dir, true));
+    let data = compressible(100_000);
+    for name in ["got", "headed"] {
+        let path = format!("/dav/files/b/{name}");
+        let resp = send(&host, Req::new("PUT", &path).body(data.clone())).await;
+        assert_eq!(resp.status, 201);
+    }
+    let hex = sha256_hex(&data);
+    assert!(dir.join("store/blobs/zstd").join(&hex).is_file());
+    let etag = format!("\"{hex}\"");
+
+    let tag = |name: &str| dir.join(format!("store/repos/files/b/tags/{name}"));
+    let long_ago = SystemTime::UNIX_EPOCH + Duration::from_secs(784_887_151);
+    for name in ["got", "headed"] {
+        std::fs::File::open(tag(name))
+            .unwrap()
+            .set_modified(long_ago)
+            .unwrap();
+    }
+    let mtime = |name: &str| std::fs::metadata(tag(name)).unwrap().modified().unwrap();
+
+    let ranged = |method, name: &str| {
+        Req::new(method, &format!("/s3/b/{name}")).header("Range", "bytes=-1000")
+    };
+    let resp = send(&host, ranged("GET", "got")).await;
+    is_part(&resp, &data, data.len() - 1000, 1000, &etag);
+    assert!(resp.bytes == data[data.len() - 1000..]);
+    // The header is the pre-touch time.
+    assert_eq!(
+        resp.header("last-modified"),
+        Some("Tue, 15 Nov 1994 08:12:31 GMT")
+    );
+    assert!(mtime("got") > SystemTime::now() - Duration::from_secs(60));
+
+    let resp = send(&host, ranged("HEAD", "headed")).await;
+    is_part(&resp, &data, data.len() - 1000, 1000, &etag);
+    assert_eq!(mtime("headed"), long_ago);
+}

From 078525fd40afc22cad908ab2bb371543433130be Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 14:08:26 +0100
Subject: [PATCH 09/54] vk-registry/s3: create and delete buckets, copy and
 batch-delete objects

Serve CreateBucket and DeleteBucket over files/ directories, CopyObject
and DeleteObjects, and answer the configuration probes tools send before
using a bucket (versioning, tagging, ACLs, lifecycle and the rest) as S3
answers for a bucket with none set; writes of them stay NotImplemented.

A copy tags the source's layer again under the namespace and shared
store lock, so no byte moves and the destination records the layer as a
member; the source's copy-source conditions and the destination's write
conditions are checked there, and its MD5 and metadata carried or
replaced. A bucket whose keys are all deleted is empty, so DeleteBucket
removes the directories they leave. Delete documents are read by a
bounded, dependency-free element scanner that expands no entity.
---
 CHANGELOG.md                      |   8 +-
 README.md                         |   4 +-
 vk-registry/DESIGN.md             |  17 +-
 vk-registry/src/dav/files.rs      |   7 +-
 vk-registry/src/files.rs          | 144 +++++-
 vk-registry/src/lib.rs            |   6 +
 vk-registry/src/s3/batch.rs       | 229 +++++++++
 vk-registry/src/s3/bucket.rs      | 177 ++++++-
 vk-registry/src/s3/canned.rs      | 147 ++++++
 vk-registry/src/s3/conditional.rs |  84 +++-
 vk-registry/src/s3/copy.rs        | 290 +++++++++++
 vk-registry/src/s3/list.rs        |   2 +-
 vk-registry/src/s3/meta.rs        |  12 +
 vk-registry/src/s3/mod.rs         |  60 ++-
 vk-registry/src/s3/object.rs      | 208 ++++++--
 vk-registry/src/s3/xml.rs         |   4 +-
 vk-registry/src/s3/xml/scan.rs    | 406 ++++++++++++++++
 vk-registry/tests/s3_e2e.rs       | 766 +++++++++++++++++++++++++++++-
 18 files changed, 2470 insertions(+), 101 deletions(-)
 create mode 100644 vk-registry/src/s3/batch.rs
 create mode 100644 vk-registry/src/s3/canned.rs
 create mode 100644 vk-registry/src/s3/copy.rs
 create mode 100644 vk-registry/src/s3/xml/scan.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2849827a..1d9a19f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,9 +15,11 @@ All notable changes to virtkit will be documented in this file.
   checksums, given metadata and deleted, and listed page by page, and are the same files WebDAV
   and `vk registry get` see; a key limited to a directory of a bucket can list that directory.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
-  checked, and objects can be read in byte ranges, as the AWS CLI downloads large files;
-  multipart uploads and copies are not served yet. Set `s3 = false` in the server config to
-  turn it off.
+  checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
+  Buckets can be created and removed, objects copied without their bytes being stored twice
+  and deleted in batches, and the configuration probes tools send before using a bucket
+  (versioning, ACLs, tagging and the like) are answered as for a bucket with none set;
+  multipart uploads are not served yet. Set `s3 = false` in the server config to turn it off.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/README.md b/README.md
index 42e2bc16..f6ecf50e 100644
--- a/README.md
+++ b/README.md
@@ -867,8 +867,8 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 ```
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
-bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads and
-copies are not served yet. Set `s3 = false` to disable it.
+bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads are not
+served yet. Set `s3 = false` to disable it.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index c3f084ff..2f990c1f 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -647,12 +647,27 @@ reads; a replaced object keeps only what its own write sent.
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers, the checksum being the whole object's; a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
+| `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
+| `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through |
 | `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
 | `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| anything else | 501 `NotImplemented`: creating and deleting buckets, copies, batch deletes, multipart uploads, tagging, ACLs, versioning and every other subresource; an SDK's `x-id` operation hint is ignored |
+| anything else | 501 `NotImplemented`: multipart uploads and part copies, writes of tagging, ACLs, versioning and the other configurations, and every other subresource; an SDK's `x-id` operation hint is ignored |
+
+**XML in** (`Delete`, `CreateBucketConfiguration`) is read by an element scanner of this
+registry's own, not a parser: UTF-8 only; the XML declaration, processing instructions and
+comments are passed over and CDATA is text; `&lt; &gt; &amp; &quot; &apos;` and character
+references are decoded, and any other entity, or a document type declaration (which could
+define one), is 400 `MalformedXML`, so nothing is fetched or expanded. Elements are known by
+their local name, so namespaces and attributes say nothing, and an element a request does not
+define is passed over. Nesting is at most 16 deep and a document holds a bounded number of
+elements (6 per key and a few more for a `Delete`), so it costs at most its length in memory;
+a field given twice, a missing `Key` or anything that is not well formed is `MalformedXML`.
 
 **`aws-chunked` bodies**, which AWS's SDKs and CLI send by default, are decoded as they
 stream, in one pass: a run of `<hex size>[;chunk-signature=<sig>]\r\n<data>\r\n` chunks ended
diff --git a/vk-registry/src/dav/files.rs b/vk-registry/src/dav/files.rs
index 5c370003..a84d032f 100644
--- a/vk-registry/src/dav/files.rs
+++ b/vk-registry/src/dav/files.rs
@@ -17,8 +17,8 @@ use super::{
     method_not_allowed, multistatus, no_content, not_found, options, propfind_depth, refuse,
 };
 use crate::files::{
-    FILES_REPO, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, drain_into,
-    namespace, object_of, repo_name, resolve, under_object,
+    DELETE_LOCK_WAIT, FILES_REPO, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed,
+    drain_into, namespace, object_of, repo_name, resolve, under_object,
 };
 use crate::{Authz, Body, RepoRemoval, ServerState, Store, accounts, error_response};
 
@@ -407,9 +407,6 @@ fn mkcol(store: &Store, segs: &[String], href: &str) -> Result<Response<Body>> {
     }
 }
 
-/// Longest a directory `DELETE` waits for the exclusive store lock before answering 503.
-const DELETE_LOCK_WAIT: Duration = Duration::from_secs(30);
-
 /// Delete an object, or a directory with nothing in it (204); 403 for a directory with
 /// members or for a caller that may read the resource but not write it, 409 for a directory
 /// still holding fresh records a deleted object does not account for (see
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index b80266c5..780148b0 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -30,6 +30,10 @@ pub(crate) const MAX_OBJECT: u64 = 4 << 30;
 /// gc's retention keys on — so a cache read is a metadata write at most once an hour.
 const TOUCH_AFTER: Duration = Duration::from_secs(3600);
 
+/// Longest a directory's removal waits for the exclusive store lock, released between
+/// attempts, before answering 503.
+pub(crate) const DELETE_LOCK_WAIT: Duration = Duration::from_secs(30);
+
 /// Serialize `files/` checks and namespace changes (object tags, new directories, deletions)
 /// in this server so a write of an object and of a directory at the same path cannot both
 /// succeed. Acquire before the store lock, never while holding it. `/v2/` writes into
@@ -312,31 +316,20 @@ pub(crate) async fn commit(
         // shared store lock (vs. an exclusive gc) across the promote and the manifest that
         // references it; see Store::lock_shared. Another write may have changed the path
         // while the body streamed, so it is checked again.
-        let checked = store.lock_shared().and_then(|lock| {
-            let existing = match resolve(&store, &segs)? {
-                Some(Node::Object(obj)) => Some(obj),
-                _ => None,
-            };
-            Ok((lock, unwritable(&store, &segs)?, existing))
-        });
-        let (_lock, existing) = match checked {
-            Ok((lock, None, existing)) => (lock, existing),
-            Ok((_, Some(why), _)) => {
+        let checked = store
+            .lock_shared()
+            .and_then(|lock| Ok((lock, admit(&store, &segs, how.precondition)?)));
+        let (_lock, existed) = match checked {
+            Ok((lock, Ok(existed))) => (lock, existed),
+            Ok((_, Err(refused))) => {
                 promotion.discard();
-                return Ok(Written::Refused(why));
+                return Ok(refused);
             }
             Err(e) => {
                 promotion.discard();
                 return Err(e);
             }
         };
-        if let Some(precondition) = how.precondition
-            && !precondition(existing.as_ref())
-        {
-            promotion.discard();
-            return Ok(Written::PreconditionFailed);
-        }
-        let existed = existing.is_some();
         store.promote_staged(&hex, promotion)?;
         staging.armed = false;
         let (repo, tag) = object_of(&segs).context("a write past its checks names an object")?;
@@ -351,6 +344,73 @@ pub(crate) async fn commit(
     .context("the object's promotion panicked")?
 }
 
+/// Whether a write at `segs` goes ahead, checked under the locks it is written under:
+/// `Ok(existed)`, or the [`Written`] refusal — [`unwritable`] first, then `precondition` on
+/// the object found there.
+fn admit(
+    store: &Store,
+    segs: &[String],
+    precondition: Option<Precondition>,
+) -> Result<std::result::Result<bool, Written>> {
+    let existing = match resolve(store, segs)? {
+        Some(Node::Object(obj)) => Some(obj),
+        _ => None,
+    };
+    if let Some(why) = unwritable(store, segs)? {
+        return Ok(Err(Written::Refused(why)));
+    }
+    if let Some(precondition) = precondition
+        && !precondition(existing.as_ref())
+    {
+        return Ok(Err(Written::PreconditionFailed));
+    }
+    Ok(Ok(existing.is_some()))
+}
+
+/// The [`namespace`] and the shared store lock, held together in that order as a write of
+/// `files/` holds them: what [`link`] is called under, across whatever its caller read the
+/// layer it tags from.
+pub(crate) struct Held {
+    _namespace: Namespace,
+    _store: crate::LockGuard,
+}
+
+/// Take [`Held`]'s locks.
+pub(crate) fn hold(store: &Store) -> Result<Held> {
+    let namespace = namespace(store)?;
+    Ok(Held {
+        _namespace: namespace,
+        _store: store.lock_shared()?,
+    })
+}
+
+/// Tag `layer`, a blob of `size` bytes already in the pool, at `segs` as a raw file: what
+/// [`commit`] does for bytes that need no staging, such as a copy of another object. The
+/// caller holds the locks (`_held`) and has checked that the blob is there; [`unwritable`]
+/// and `how`'s precondition are checked here, and the layer's membership in the destination
+/// repository is recorded with the tag, as a commit records it. `how.uncompressed` says
+/// nothing here: the blob keeps the form it is stored in.
+pub(crate) fn link(
+    store: &Store,
+    _held: &Held,
+    segs: &[String],
+    layer: &str,
+    size: u64,
+    how: Commit,
+) -> Result<Written> {
+    let existed = match admit(store, segs, how.precondition)? {
+        Ok(existed) => existed,
+        Err(refused) => return Ok(refused),
+    };
+    let (repo, tag) = object_of(segs).context("a write past its checks names an object")?;
+    store.put_raw_file_annotated(&repo, tag, layer, size, None, &how.annotations)?;
+    Ok(if existed {
+        Written::Replaced
+    } else {
+        Written::Created
+    })
+}
+
 /// Stream `body` to `out`, coalescing small frames and enforcing `cap`, including for chunked
 /// bodies; `(bytes written, sha256 hex)` on success. `tap` sees each frame's bytes as they are
 /// hashed, before they are written. `out` may be a sink when draining a refused request. The
@@ -545,6 +605,54 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// A link tags a layer already in the pool elsewhere, recording it a member of the
+    /// destination so it is readable there, and is refused as a commit is.
+    #[tokio::test]
+    async fn a_link_tags_a_layer_already_held_as_a_commit_would() {
+        let dir = std::env::temp_dir().join(format!("vk-reg-files-link-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Arc::new(Store::new(dir.clone()).unwrap());
+        let frame: std::result::Result<_, std::io::Error> =
+            Ok(hyper::body::Frame::data(Bytes::from_static(b"one")));
+        let body = http_body_util::StreamBody::new(futures::stream::iter([frame]));
+        let staged = stage(&store, body, &mut |_| {}).await.ok().unwrap();
+        let layer = staged.hex.clone();
+        let src = vec!["b".to_string(), "k".to_string()];
+        let written = commit(Arc::clone(&store), src, staged, Commit::default()).await;
+        assert!(matches!(written.unwrap(), Written::Created));
+        let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+
+        let held = hold(&store).unwrap();
+        let annotations = BTreeMap::from([("org.example.k".to_string(), "v".to_string())]);
+        let how = Commit {
+            annotations,
+            ..Commit::default()
+        };
+        let dst = segs(&["c", "d", "copy"]);
+        let written = link(&store, &held, &dst, &layer, 3, how).unwrap();
+        assert!(matches!(written, Written::Created));
+        assert!(store.repo_has_blob("files/c/d", &layer));
+        let Some(Node::Object(obj)) = resolve(&store, &dst).unwrap() else {
+            panic!("an object at the link");
+        };
+        assert_eq!((obj.layer.as_str(), obj.size), (layer.as_str(), 3));
+        assert_eq!(obj.annotations["org.example.k"], "v");
+
+        let absent = Commit {
+            precondition: Some(Box::new(|o: Option<&Object>| o.is_none())),
+            ..Commit::default()
+        };
+        let written = link(&store, &held, &dst, &layer, 3, absent).unwrap();
+        assert!(matches!(written, Written::PreconditionFailed));
+        let below = segs(&["b", "k", "x"]);
+        let written = link(&store, &held, &below, &layer, 3, Commit::default()).unwrap();
+        assert!(matches!(written, Written::Refused(Unwritable::UnderObject)));
+        let written = link(&store, &held, &dst, &layer, 3, Commit::default()).unwrap();
+        assert!(matches!(written, Written::Replaced));
+        drop(held);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// A commit asked to keep its bytes uncompressed promotes them plain, however well they
     /// would compress; otherwise compressible bytes are stored as a zstd frame.
     #[tokio::test]
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 779f949f..cf7f4d6f 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -667,6 +667,12 @@ impl Store {
                 .is_ok_and(|m| m.is_dir())
     }
 
+    /// Whether anything is at `repos/<name>`, a directory or not: what keeps a name from
+    /// becoming a repository.
+    pub(crate) fn repo_path_taken(&self, name: &str) -> bool {
+        valid_name(name) && std::fs::symlink_metadata(self.root.join("repos").join(name)).is_ok()
+    }
+
     /// Create an empty `tags/` directory and any missing ancestors for WebDAV `MKCOL`.
     /// [`Store::has_repo`] then recognizes the repository before it holds any content.
     /// Hold the shared lock so [`Store::remove_empty_repo`] cannot remove an ancestor
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
new file mode 100644
index 00000000..811d2ba2
--- /dev/null
+++ b/vk-registry/src/s3/batch.rs
@@ -0,0 +1,229 @@
+//! DeleteObjects: `POST /s3/<bucket>?delete`, up to a thousand keys in one `Delete` document,
+//! each deleted as DeleteObject deletes it and answered on its own in the `DeleteResult`. The
+//! namespace lock is taken once for the whole batch. The document is bounded (1 MiB, 1000
+//! keys) and checked against the digests its request names before a key is touched.
+
+use anyhow::Result;
+use hyper::body::Incoming;
+use hyper::{Request, Response, StatusCode};
+
+use super::object::{Deleted, admitted, check_body, delete_one, unwritable_message};
+use super::xml::scan::{self, Malformed};
+use super::{Ctx, path, read_small, xml};
+use crate::files::{self, Unwritable};
+use crate::{Authz, Body, ServerState, Store, accounts};
+
+/// Longest `Delete` document taken.
+const MAX_DOCUMENT: usize = 1 << 20;
+
+/// Most keys one request deletes: S3's own bound.
+const MAX_KEYS: usize = 1000;
+
+/// Most elements a `Delete` document may hold: an `Object` and the five fields S3 defines in
+/// it, for each key, and a few more around them.
+const MAX_ELEMENTS: usize = 6 * MAX_KEYS + 16;
+
+/// One key a `Delete` document names.
+#[derive(Debug, PartialEq, Eq)]
+struct Entry {
+    key: String,
+    /// whether it names a version, which this registry does not keep
+    versioned: bool,
+}
+
+/// What a `Delete` document asks.
+#[derive(Debug, PartialEq, Eq)]
+struct Asked {
+    quiet: bool,
+    entries: Vec<Entry>,
+}
+
+/// The `Delete` document `body` holds.
+fn document(body: &[u8]) -> Result<Asked, Malformed> {
+    let root = scan::parse(body, MAX_ELEMENTS)?;
+    if root.name != "Delete" {
+        return Err(Malformed("the document is not a Delete"));
+    }
+    let quiet = match root.one("Quiet")?.map(|q| q.text.trim()) {
+        None => false,
+        Some(q) if q.eq_ignore_ascii_case("true") => true,
+        Some(q) if q.eq_ignore_ascii_case("false") => false,
+        Some(_) => return Err(Malformed("Quiet is true or false")),
+    };
+    let mut entries = Vec::new();
+    for o in root.all("Object") {
+        let key = o
+            .one("Key")?
+            .ok_or(Malformed("each Object names its Key"))?;
+        entries.push(Entry {
+            key: key.text.clone(),
+            versioned: o.one("VersionId")?.is_some(),
+        });
+    }
+    if entries.is_empty() {
+        return Err(Malformed("a Delete names at least one Object"));
+    }
+    if entries.len() > MAX_KEYS {
+        return Err(Malformed("a Delete names at most 1000 objects"));
+    }
+    Ok(Asked { quiet, entries })
+}
+
+/// Why one key was not deleted: an S3 error code and a message.
+type KeyError = (&'static str, &'static str);
+
+/// Delete `key` of `bucket` for this caller, the namespace held: as DeleteObject would, a
+/// key with no object counting as deleted.
+fn delete_key(
+    store: &Store,
+    namespace: &files::Namespace,
+    authz: &Authz<'_>,
+    bucket: &str,
+    key: &str,
+) -> Result<std::result::Result<(), KeyError>> {
+    // A key here is text, not a URL: no escape is decoded, and no key holds a `%`.
+    if key.contains('%') {
+        return Ok(Err((
+            "InvalidArgument",
+            "a key's components are runs of A-Z a-z 0-9 . _ - only",
+        )));
+    }
+    let segs = match path::parse(&format!("/s3/{bucket}/{key}")) {
+        Ok(path::Target::Object { segs, .. }) => segs,
+        Ok(_) => return Ok(Err(("InvalidArgument", "the key is empty"))),
+        Err(why) => return Ok(Err((why.code, why.message))),
+    };
+    let denied = ("AccessDenied", "the credential may not delete this key");
+    if !admitted(authz, accounts::Action::Write, &segs) {
+        return Ok(Err(denied));
+    }
+    Ok(match delete_one(store, namespace, authz, &segs)? {
+        Deleted::Gone => Ok(()),
+        Deleted::Denied => Err(denied),
+        Deleted::Foreign => Err(("OperationAborted", unwritable_message(Unwritable::Foreign))),
+    })
+}
+
+/// `POST /s3/<bucket>?delete`: each key of the document deleted, or the reason it was not,
+/// in the order asked. A bucket that does not exist holds none of the keys, which all count
+/// as deleted, as DeleteObject answers for each.
+pub(super) async fn delete(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let (parts, body) = req.into_parts();
+    let too_long = ctx.error(
+        StatusCode::BAD_REQUEST,
+        "MalformedXML",
+        "a Delete document is at most 1 MiB",
+    );
+    let body = match read_small(body, MAX_DOCUMENT, too_long, ctx).await? {
+        Ok(body) => body,
+        Err(resp) => return Ok(resp),
+    };
+    if let Err((status, code, message)) = check_body(&parts.headers, &body) {
+        return Ok(ctx.error(status, code, message));
+    }
+    let asked = match document(&body) {
+        Ok(asked) => asked,
+        Err(Malformed(why)) => return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why)),
+    };
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let namespace = files::namespace(store)?;
+        let mut out = String::new();
+        for entry in &asked.entries {
+            let outcome = if entry.versioned {
+                Err((
+                    "NotImplemented",
+                    "this registry keeps no versions: a key is deleted without a VersionId",
+                ))
+            } else {
+                delete_key(store, &namespace, authz, &bucket, &entry.key)?
+            };
+            match outcome {
+                Ok(()) if asked.quiet => {}
+                Ok(()) => out.push_str(&format!(
+                    "<Deleted>{}</Deleted>",
+                    xml::element("Key", &entry.key)
+                )),
+                Err((code, message)) => out.push_str(&format!(
+                    "<Error>{}{}{}</Error>",
+                    xml::element("Key", &entry.key),
+                    xml::element("Code", code),
+                    xml::element("Message", message)
+                )),
+            }
+        }
+        Ok(xml::document("DeleteResult", &out))
+    })
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn body(objects: &str) -> Vec<u8> {
+        format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+             <Delete xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">{objects}</Delete>"
+        )
+        .into_bytes()
+    }
+
+    fn entry(key: &str, versioned: bool) -> Entry {
+        Entry {
+            key: key.into(),
+            versioned,
+        }
+    }
+
+    #[test]
+    fn a_delete_names_its_keys_versions_and_quietness() {
+        let asked = document(&body(
+            "<Quiet>true</Quiet><Object><Key>a/b</Key></Object>\
+             <Object><VersionId>v</VersionId><Key>c</Key><ETag>\"x\"</ETag></Object>",
+        ))
+        .unwrap();
+        assert_eq!(
+            asked,
+            Asked {
+                quiet: true,
+                entries: vec![entry("a/b", false), entry("c", true)],
+            }
+        );
+        let asked = document(&body("<Object><Key>k</Key></Object><Quiet>False</Quiet>")).unwrap();
+        assert!(!asked.quiet);
+        // Text is taken as it is, to be judged as a key.
+        let asked = document(&body("<Object><Key> a&amp;b </Key></Object>")).unwrap();
+        assert_eq!(asked.entries, [entry(" a&b ", false)]);
+    }
+
+    #[test]
+    fn a_delete_that_is_not_one_is_malformed() {
+        let max = (0..MAX_KEYS)
+            .map(|i| format!("<Object><Key>k{i}</Key></Object>"))
+            .collect::<String>();
+        assert_eq!(document(&body(&max)).unwrap().entries.len(), MAX_KEYS);
+        let over = format!("{max}<Object><Key>one-more</Key></Object>");
+        assert!(document(&body(&over)).is_err());
+        for bad in [
+            body(""),
+            body("<Quiet>true</Quiet>"),
+            body("<Object></Object>"),
+            body("<Object><Key>a</Key><Key>b</Key></Object>"),
+            body("<Object><Key>a</Key></Object><Quiet>yes</Quiet>"),
+            body("<Object><Key>a</Key></Object><Quiet>true</Quiet><Quiet>true</Quiet>"),
+            body("<Object><Key>&ent;</Key></Object>"),
+            b"<Other><Object><Key>a</Key></Object></Other>".to_vec(),
+            b"".to_vec(),
+        ] {
+            assert!(document(&bad).is_err(), "{}", String::from_utf8_lossy(&bad));
+        }
+        let elements = (0..MAX_ELEMENTS).map(|_| "<x/>").collect::<String>();
+        assert!(document(&body(&elements)).is_err());
+    }
+}
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index b9a172a0..52f47e6b 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -1,14 +1,19 @@
-//! The service and its buckets: ListBuckets, HeadBucket and GetBucketLocation. A bucket is a
+//! The service and its buckets: ListBuckets, HeadBucket, GetBucketLocation, CreateBucket,
+//! DeleteBucket and the configuration reads [`super::canned`] answers. A bucket is a
 //! top-level directory of `files/`, authorized as the repository `files/<bucket>`; one the
 //! caller may read nothing in is absent to it, as in the WebDAV view.
 
+use std::time::{Duration, Instant};
+
 use hyper::body::Incoming;
-use hyper::header::{AUTHORIZATION, CONTENT_LENGTH};
+use hyper::header::{AUTHORIZATION, CONTENT_LENGTH, HeaderValue, LOCATION, RETRY_AFTER};
 use hyper::{Request, Response, StatusCode};
 
-use super::{Ctx, refuse, sigv4, xml};
-use crate::files::FILES_REPO;
-use crate::{Authz, Body, ServerState, body_of};
+use super::canned::Canned;
+use super::xml::scan;
+use super::{Ctx, drain, read_small, refuse, sigv4, xml};
+use crate::files::{self, DELETE_LOCK_WAIT, FILES_REPO, allowed};
+use crate::{Authz, Body, RepoRemoval, ServerState, Store, accounts, body_of};
 
 /// The owner every listing names: the registry, whoever wrote what it holds.
 pub(super) const OWNER: &str = "vk-registry";
@@ -127,3 +132,165 @@ pub(super) async fn location(
         .map_or(String::new(), |c| xml::escape(c.region));
     Ok(xml::document("LocationConstraint", &region))
 }
+
+/// `GET /s3/<bucket>?<configuration>`: what `canned` says a bucket has, after HeadBucket's
+/// checks.
+pub(super) async fn configuration(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    canned: Canned,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    if let Some(resp) = check(state, authz, &bucket, ctx).await? {
+        return refuse(req, resp, ctx).await;
+    }
+    refuse(req, canned.answer(ctx), ctx).await
+}
+
+/// Longest `CreateBucketConfiguration` body taken: it names a region, which is ignored.
+const MAX_CONFIGURATION: usize = 1024;
+
+/// `PUT /s3/<bucket>`: the directory `files/<bucket>`, made as WebDAV's `MKCOL` makes it,
+/// under the namespace lock. 200 with its `Location`; 409 `BucketAlreadyOwnedByYou` when it
+/// is a directory already, which every bucket's owner is. A `CreateBucketConfiguration` body
+/// and `x-amz-acl` are taken and ignored; asking for object lock is `NotImplemented`.
+pub(super) async fn create(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    let repo = format!("{FILES_REPO}/{bucket}");
+    if !allowed(authz, accounts::Action::Write, &repo) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    if req
+        .headers()
+        .get("x-amz-bucket-object-lock-enabled")
+        .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"true"))
+    {
+        let resp = ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "this registry keeps no object lock",
+        );
+        return refuse(req, resp, ctx).await;
+    }
+    let malformed = |message| ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", message);
+    let too_long = malformed("a CreateBucketConfiguration is at most 1 KiB");
+    let body = match read_small(req.into_body(), MAX_CONFIGURATION, too_long, ctx).await? {
+        Ok(body) => body,
+        Err(resp) => return Ok(resp),
+    };
+    if !body.iter().all(u8::is_ascii_whitespace)
+        && !scan::parse(&body, 16).is_ok_and(|el| el.name == "CreateBucketConfiguration")
+    {
+        return Ok(malformed("the body is not a CreateBucketConfiguration"));
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, _| {
+        let _namespace = files::namespace(store)?;
+        if store.repo_dir_exists(&repo) {
+            return Ok(ctx.error(
+                StatusCode::CONFLICT,
+                "BucketAlreadyOwnedByYou",
+                "the bucket you tried to create exists, and is yours",
+            ));
+        }
+        if store.repo_path_taken(&repo) {
+            return Ok(ctx.error(
+                StatusCode::CONFLICT,
+                "OperationAborted",
+                "something that is not a directory has the bucket's name in the store",
+            ));
+        }
+        store.create_repo(&repo)?;
+        Ok(Response::builder()
+            .status(StatusCode::OK)
+            .header(LOCATION, format!("/s3/{bucket}"))
+            .header(CONTENT_LENGTH, "0")
+            .body(body_of(bytes::Bytes::new()))?)
+    })
+    .await
+}
+
+/// Remove `repo` and the directories below it, deepest first, each as WebDAV's `DELETE`
+/// removes an empty one: a bucket whose keys are all deleted is empty to S3, though the
+/// directories they were in are left. Stops at the first one that is not removed, whose
+/// answer it is; those removed before it held nothing.
+fn remove_tree(store: &Store, repo: &str) -> anyhow::Result<RepoRemoval> {
+    for child in store.repo_children(repo)? {
+        let removal = remove_tree(store, &format!("{repo}/{child}"))?;
+        if removal != RepoRemoval::Removed {
+            return Ok(removal);
+        }
+    }
+    store.remove_empty_repo(repo, crate::DEFAULT_GC_GRACE)
+}
+
+/// `DELETE /s3/<bucket>`: the bucket's directory tree removed when it holds no key: 204; 409
+/// `BucketNotEmpty` when it holds keys, or records too fresh to be a deleted object's
+/// leftovers; 404 `NoSuchBucket`. The removal needs the store lock
+/// exclusive, tried under the namespace lock and retried, the namespace released between
+/// attempts, for up to [`DELETE_LOCK_WAIT`]; then 503 `ServiceUnavailable`.
+pub(super) async fn delete(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> anyhow::Result<Response<Body>> {
+    let repo = format!("{FILES_REPO}/{bucket}");
+    if !allowed(authz, accounts::Action::Write, &repo) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, _| {
+        let deadline = Instant::now() + DELETE_LOCK_WAIT;
+        let mut backoff = Duration::from_millis(10);
+        loop {
+            let namespace = files::namespace(store)?;
+            if !store.repo_dir_exists(&repo) {
+                return Ok(ctx.error(
+                    StatusCode::NOT_FOUND,
+                    "NoSuchBucket",
+                    "the specified bucket does not exist",
+                ));
+            }
+            let not_empty = |message| ctx.error(StatusCode::CONFLICT, "BucketNotEmpty", message);
+            return Ok(match remove_tree(store, &repo)? {
+                RepoRemoval::Removed => Response::builder()
+                    .status(StatusCode::NO_CONTENT)
+                    .body(body_of(bytes::Bytes::new()))?,
+                RepoRemoval::HasMembers => not_empty("the bucket you tried to delete is not empty"),
+                RepoRemoval::HasRecords => not_empty(
+                    "the bucket holds content written lately that is not a deleted object's, \
+                     such as an image pushed over /v2/; it can go once the gc's grace has passed",
+                ),
+                RepoRemoval::Busy if Instant::now() >= deadline => {
+                    let mut resp = ctx.error(
+                        StatusCode::SERVICE_UNAVAILABLE,
+                        "ServiceUnavailable",
+                        "the store stayed locked; retry the DeleteBucket",
+                    );
+                    resp.headers_mut()
+                        .insert(RETRY_AFTER, HeaderValue::from_static("5"));
+                    resp
+                }
+                RepoRemoval::Busy => {
+                    drop(namespace);
+                    std::thread::sleep(backoff);
+                    backoff = (backoff * 2).min(Duration::from_millis(500));
+                    continue;
+                }
+            });
+        }
+    })
+    .await
+}
diff --git a/vk-registry/src/s3/canned.rs b/vk-registry/src/s3/canned.rs
new file mode 100644
index 00000000..ed4a686a
--- /dev/null
+++ b/vk-registry/src/s3/canned.rs
@@ -0,0 +1,147 @@
+//! The configuration a bucket or an object is asked for, answered as S3 answers for one
+//! with nothing configured: tools probe versioning, tagging, ACLs, lifecycle and the rest
+//! before they use a bucket, and go on when they hear there is none. Nothing of it can be
+//! set here; a `PUT` or `DELETE` of any of them is `NotImplemented`.
+
+use hyper::{Response, StatusCode};
+
+use super::bucket::{OWNER, owner};
+use super::xml;
+
+/// What a configuration read answers.
+pub(super) enum Canned {
+    /// a 200 document: its root element and what it holds
+    Document(&'static str, String),
+    /// a 404: S3's code for "none configured"
+    Missing(&'static str),
+}
+
+impl Canned {
+    /// The answer, at `ctx`'s path.
+    pub(super) fn answer(self, ctx: &super::Ctx) -> Response<crate::Body> {
+        match self {
+            Canned::Document(root, inner) => xml::document(root, &inner),
+            Canned::Missing(code) => ctx.error(
+                StatusCode::NOT_FOUND,
+                code,
+                "this registry keeps no such configuration",
+            ),
+        }
+    }
+}
+
+/// The ACL every bucket and object has: the owner [`OWNER`], who may do anything.
+fn acl() -> Canned {
+    let grantee = format!(
+        "<Grantee xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \
+         xsi:type=\"CanonicalUser\">{}{}</Grantee>",
+        xml::element("ID", OWNER),
+        xml::element("DisplayName", OWNER)
+    );
+    Canned::Document(
+        "AccessControlPolicy",
+        format!(
+            "{}<AccessControlList><Grant>{grantee}{}</Grant></AccessControlList>",
+            owner(),
+            xml::element("Permission", "FULL_CONTROL")
+        ),
+    )
+}
+
+fn empty(root: &'static str) -> Canned {
+    Canned::Document(root, String::new())
+}
+
+/// What a `GET /s3/<bucket>?<sub>` answers, when `sub` is a configuration S3 has.
+pub(super) fn bucket(sub: &str) -> Option<Canned> {
+    Some(match sub {
+        "versioning" => empty("VersioningConfiguration"),
+        "tagging" => Canned::Document("Tagging", "<TagSet/>".to_string()),
+        "acl" => acl(),
+        "logging" => empty("BucketLoggingStatus"),
+        "notification" => empty("NotificationConfiguration"),
+        "requestPayment" => Canned::Document(
+            "RequestPaymentConfiguration",
+            xml::element("Payer", "BucketOwner"),
+        ),
+        "accelerate" => empty("AccelerateConfiguration"),
+        "lifecycle" => Canned::Missing("NoSuchLifecycleConfiguration"),
+        "policy" | "policyStatus" => Canned::Missing("NoSuchBucketPolicy"),
+        "cors" => Canned::Missing("NoSuchCORSConfiguration"),
+        "encryption" => Canned::Missing("ServerSideEncryptionConfigurationNotFoundError"),
+        "object-lock" => Canned::Missing("ObjectLockConfigurationNotFoundError"),
+        "replication" => Canned::Missing("ReplicationConfigurationNotFoundError"),
+        "website" => Canned::Missing("NoSuchWebsiteConfiguration"),
+        "publicAccessBlock" => Canned::Missing("NoSuchPublicAccessBlockConfiguration"),
+        "ownershipControls" => Canned::Missing("OwnershipControlsNotFoundError"),
+        _ => return None,
+    })
+}
+
+/// What a `GET /s3/<bucket>/<key>?<sub>` answers, when `sub` is a configuration S3 has.
+pub(super) fn object(sub: &str) -> Option<Canned> {
+    Some(match sub {
+        "tagging" => Canned::Document("Tagging", "<TagSet/>".to_string()),
+        "acl" => acl(),
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_bucket_configuration_has_an_answer_and_nothing_else_does() {
+        for sub in [
+            "versioning",
+            "tagging",
+            "acl",
+            "logging",
+            "notification",
+            "requestPayment",
+            "accelerate",
+            "lifecycle",
+            "policy",
+            "policyStatus",
+            "cors",
+            "encryption",
+            "object-lock",
+            "replication",
+            "website",
+            "publicAccessBlock",
+            "ownershipControls",
+        ] {
+            assert!(bucket(sub).is_some(), "{sub}");
+        }
+        for sub in [
+            "",
+            "uploads",
+            "delete",
+            "location",
+            "Versioning",
+            "intelligent-tiering",
+        ] {
+            assert!(bucket(sub).is_none(), "{sub}");
+        }
+        assert!(object("tagging").is_some() && object("acl").is_some());
+        assert!(object("versioning").is_none() && object("retention").is_none());
+    }
+
+    #[test]
+    fn the_acl_grants_the_owner_everything() {
+        let Some(Canned::Document(root, inner)) = bucket("acl") else {
+            panic!("a document");
+        };
+        assert_eq!(root, "AccessControlPolicy");
+        assert_eq!(
+            inner,
+            "<Owner><ID>vk-registry</ID><DisplayName>vk-registry</DisplayName></Owner>\
+             <AccessControlList><Grant><Grantee \
+             xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \
+             xsi:type=\"CanonicalUser\"><ID>vk-registry</ID>\
+             <DisplayName>vk-registry</DisplayName></Grantee>\
+             <Permission>FULL_CONTROL</Permission></Grant></AccessControlList>"
+        );
+    }
+}
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index fa35c5f2..f66d2442 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -67,7 +67,41 @@ pub(crate) enum Outcome {
 
 impl Conditions {
     pub(crate) fn of(headers: &HeaderMap) -> Self {
-        let text = |name| {
+        Self::named(
+            headers,
+            [
+                IF_MATCH.as_str(),
+                IF_NONE_MATCH.as_str(),
+                IF_MODIFIED_SINCE.as_str(),
+                IF_UNMODIFIED_SINCE.as_str(),
+            ],
+        )
+    }
+
+    /// A CopyObject's conditions on its source: the same four, each `x-amz-copy-source-`
+    /// prefixed, weighed in the same order. What a read would answer 304 fails the copy.
+    pub(crate) fn of_copy_source(headers: &HeaderMap) -> Self {
+        Self::named(
+            headers,
+            [
+                "x-amz-copy-source-if-match",
+                "x-amz-copy-source-if-none-match",
+                "x-amz-copy-source-if-modified-since",
+                "x-amz-copy-source-if-unmodified-since",
+            ],
+        )
+    }
+
+    /// The conditions the headers `names` (`If-Match`, `If-None-Match`, `If-Modified-Since`
+    /// and `If-Unmodified-Since`, or what stands for them) carry.
+    fn named(headers: &HeaderMap, names: [&str; 4]) -> Self {
+        let [
+            if_match,
+            if_none_match,
+            if_modified_since,
+            if_unmodified_since,
+        ] = names;
+        let text = |name: &str| {
             let values: Vec<&str> = headers
                 .get_all(name)
                 .iter()
@@ -75,17 +109,17 @@ impl Conditions {
                 .collect();
             (!values.is_empty()).then(|| values.join(","))
         };
-        let date = |name| {
+        let date = |name: &str| {
             headers
                 .get(name)
                 .and_then(|v| v.to_str().ok())
                 .and_then(|v| httpdate::parse_http_date(v.trim()).ok())
         };
         Conditions {
-            if_match: text(IF_MATCH),
-            if_none_match: text(IF_NONE_MATCH),
-            if_modified_since: date(IF_MODIFIED_SINCE),
-            if_unmodified_since: date(IF_UNMODIFIED_SINCE),
+            if_match: text(if_match),
+            if_none_match: text(if_none_match),
+            if_modified_since: date(if_modified_since),
+            if_unmodified_since: date(if_unmodified_since),
         }
     }
 
@@ -288,6 +322,44 @@ mod tests {
         );
     }
 
+    /// A copy's conditions on its source are the same four under their own names, and the
+    /// read's own headers say nothing to them.
+    #[test]
+    fn a_copy_source_s_conditions_are_its_own_headers() {
+        let e = format!("\"{MD5}\"");
+        let modified = at(1_000_000);
+        let before = httpdate::fmt_http_date(at(999_999));
+        let named = |n: &'static str| hyper::header::HeaderName::from_static(n);
+        let decide = |pairs: &[(hyper::header::HeaderName, &str)]| {
+            Conditions::of_copy_source(&headers(pairs)).evaluate(&e, modified)
+        };
+        assert_eq!(decide(&[(IF_MATCH, "\"x\"")]), Outcome::Serve);
+        let if_match = named("x-amz-copy-source-if-match");
+        let unmodified = named("x-amz-copy-source-if-unmodified-since");
+        assert_eq!(
+            decide(&[(if_match.clone(), "\"x\"")]),
+            Outcome::Failed("If-Match")
+        );
+        // S3's rule for the copy: a matching If-Match carries a failing If-Unmodified-Since.
+        assert_eq!(
+            decide(&[(if_match, &e), (unmodified.clone(), &before)]),
+            Outcome::Serve
+        );
+        assert_eq!(
+            decide(&[(unmodified, &before)]),
+            Outcome::Failed("If-Unmodified-Since")
+        );
+        assert_eq!(
+            decide(&[(named("x-amz-copy-source-if-none-match"), &e)]),
+            Outcome::NotModified
+        );
+        let since = httpdate::fmt_http_date(at(1_000_000));
+        assert_eq!(
+            decide(&[(named("x-amz-copy-source-if-modified-since"), &since)]),
+            Outcome::NotModified
+        );
+    }
+
     #[test]
     fn writes_create_only_or_replace_only_what_they_name() {
         let md5 = object(&[(MD5_ANNOTATION, MD5)]);
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
new file mode 100644
index 00000000..3a978c07
--- /dev/null
+++ b/vk-registry/src/s3/copy.rs
@@ -0,0 +1,290 @@
+//! CopyObject: `PUT /s3/<bucket>/<key>` with `x-amz-copy-source`. A copy is a new tag on the
+//! source's layer, written as a PutObject's tag is but with no byte moved, so it costs a
+//! manifest whatever the size and the pool still holds the bytes once. The source is read
+//! as GetObject reads it and its conditions are its `x-amz-copy-source-if-*` headers; the
+//! destination is written as PutObject writes, its `If-None-Match: *`/`If-Match` checked
+//! where the tag is written. The source's MD5, and so its ETag, comes along; its user
+//! metadata too, unless `x-amz-metadata-directive: REPLACE` gives the request's instead.
+
+use anyhow::Result;
+use hyper::body::Incoming;
+use hyper::{Request, Response, StatusCode};
+
+use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::object::{admitted, no_such_key, readable, unwritable};
+use super::{Ctx, drain, list, meta, path, refuse, xml};
+use crate::files::{self, Commit, FILES_REPO, Written, allowed, object_of};
+use crate::{Authz, Body, ServerState, Store, accounts};
+
+/// The header naming a copy's source.
+pub(super) const COPY_SOURCE: &str = "x-amz-copy-source";
+
+/// What `x-amz-copy-source` names.
+#[derive(Debug, PartialEq, Eq)]
+enum Source {
+    /// an object: the bucket then the key's components, as [`path::Target::Object`]'s
+    Object(Vec<String>),
+    /// one version of an object, which this registry does not keep
+    Versioned,
+    /// nothing this view serves: an S3 error code and the rule
+    Invalid(&'static str, &'static str),
+}
+
+/// What a copy source `value` names: `<bucket>/<key>`, with or without a leading slash, its
+/// escapes decoded as a whole — a key's characters need none, so a client that escapes the
+/// `/` between components names the same object as one that does not. What is decoded is
+/// then held to the key rules a request path is, and an escape that decodes to a `%`, which
+/// no key holds, is refused rather than decoded twice.
+fn source(value: &str) -> Source {
+    let (raw, query) = match value.split_once('?') {
+        Some((raw, query)) => (raw, Some(query)),
+        None => (value, None),
+    };
+    if let Some(query) = query {
+        let versioned = query
+            .split('&')
+            .any(|p| p.split_once('=').map_or(p, |(n, _)| n) == "versionId");
+        return if versioned {
+            Source::Versioned
+        } else {
+            Source::Invalid(
+                "InvalidArgument",
+                "x-amz-copy-source is <bucket>/<key>, with no query but a versionId",
+            )
+        };
+    }
+    let Some(decoded) = crate::dav::decode_segment(raw) else {
+        return Source::Invalid(
+            "InvalidArgument",
+            "x-amz-copy-source has a malformed percent escape or is not UTF-8",
+        );
+    };
+    if decoded.contains('%') {
+        return Source::Invalid(
+            "InvalidArgument",
+            "a key's components are runs of A-Z a-z 0-9 . _ - only",
+        );
+    }
+    let decoded = decoded.strip_prefix('/').unwrap_or(&decoded);
+    match path::parse(&format!("/s3/{decoded}")) {
+        Ok(path::Target::Object { segs, .. }) => Source::Object(segs),
+        Ok(_) => Source::Invalid(
+            "InvalidArgument",
+            "x-amz-copy-source names a bucket and a key",
+        ),
+        Err(why) => Source::Invalid(why.code, why.message),
+    }
+}
+
+fn failed(ctx: &Ctx) -> Response<Body> {
+    ctx.error(
+        StatusCode::PRECONDITION_FAILED,
+        "PreconditionFailed",
+        "at least one of the preconditions you specified did not hold",
+    )
+}
+
+/// The answer for a source the caller cannot read: `NoSuchBucket` when its bucket is no
+/// directory and the caller may read in it, otherwise `NoSuchKey`, as a read of it answers.
+fn absent(store: &Store, authz: &Authz<'_>, src: &[String], ctx: &Ctx) -> Response<Body> {
+    let bucket = format!("{FILES_REPO}/{}", src.first().map_or("", String::as_str));
+    if authz.may_read_below(&bucket) && !store.repo_dir_exists(&bucket) {
+        return ctx.error(
+            StatusCode::NOT_FOUND,
+            "NoSuchBucket",
+            "the specified bucket does not exist",
+        );
+    }
+    no_such_key(ctx)
+}
+
+/// `PUT /s3/<bucket>/<key>` with `x-amz-copy-source`: the source object tagged again at the
+/// key, under the namespace and shared store lock across the read of the source and the
+/// write, so neither changes between the two. 200 with `CopyObjectResult`.
+pub(super) async fn copy(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let parent = object_of(&segs).map(|(parent, _)| parent);
+    if !parent.is_some_and(|p| allowed(authz, accounts::Action::Write, &p)) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let headers = req.headers();
+    let value = headers
+        .get(COPY_SOURCE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or_default();
+    let src = match source(value) {
+        Source::Object(src) => src,
+        Source::Versioned => {
+            let resp = ctx.error(
+                StatusCode::NOT_IMPLEMENTED,
+                "NotImplemented",
+                "this registry keeps no versions to copy from",
+            );
+            return refuse(req, resp, ctx).await;
+        }
+        Source::Invalid(code, message) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, code, message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if !admitted(authz, accounts::Action::Read, &src) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let replace = match headers
+        .get("x-amz-metadata-directive")
+        .map(|v| v.as_bytes())
+    {
+        None | Some(b"COPY") => false,
+        Some(b"REPLACE") => true,
+        Some(_) => {
+            let resp = ctx.error(
+                StatusCode::BAD_REQUEST,
+                "InvalidArgument",
+                "x-amz-metadata-directive is COPY or REPLACE",
+            );
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if src == segs && !replace {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidRequest",
+            "this copy request is illegal because it is trying to copy an object to itself \
+             without changing the object's metadata",
+        );
+        return refuse(req, resp, ctx).await;
+    }
+    let replaced = if replace {
+        match meta::annotations(headers) {
+            Ok(a) => Some(a),
+            Err(why) => {
+                let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
+                return refuse(req, resp, ctx).await;
+            }
+        }
+    } else {
+        None
+    };
+    let conditions = Conditions::of_copy_source(headers);
+    let Ok(written) = WriteConditions::of(headers) else {
+        let resp = ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "a write's If-None-Match is * or nothing",
+        );
+        return refuse(req, resp, ctx).await;
+    };
+    let precondition = written.precondition();
+    // A copy has no body of its own; whatever came is read through first.
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let held = files::hold(store)?;
+        let Some(obj) = readable(store, authz, &src)? else {
+            return Ok(absent(store, authz, &src, &ctx));
+        };
+        if conditions.evaluate(&conditional::etag_of(&obj), obj.modified) != Outcome::Serve {
+            return Ok(failed(&ctx));
+        }
+        // The layer gone under the tag (pruned by hand) is no object either; present, it is
+        // now referenced again, which keeps it from the gc's grace window.
+        if !store.has_blob(&obj.layer) {
+            return Ok(no_such_key(&ctx));
+        }
+        let mut annotations = replaced.unwrap_or_else(|| meta::carried(&obj.annotations));
+        if let Some(md5) = obj.annotations.get(MD5_ANNOTATION) {
+            annotations.insert(MD5_ANNOTATION.to_string(), md5.clone());
+        }
+        let etag = conditional::etag(&obj.layer, &annotations);
+        let how = Commit {
+            annotations,
+            precondition,
+            uncompressed: false,
+        };
+        match files::link(store, &held, &segs, &obj.layer, obj.size, how)? {
+            Written::Created | Written::Replaced => {}
+            Written::Refused(why) => return Ok(unwritable(why, &ctx)),
+            Written::PreconditionFailed => return Ok(failed(&ctx)),
+        }
+        let modified = object_of(&segs)
+            .and_then(|(repo, tag)| store.tag_target(&repo, tag))
+            .map_or_else(std::time::SystemTime::now, |(_, t)| t);
+        Ok(xml::document(
+            "CopyObjectResult",
+            &format!(
+                "{}{}",
+                xml::element("LastModified", &list::iso8601(modified)),
+                xml::element("ETag", &etag)
+            ),
+        ))
+    })
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn object(parts: &[&str]) -> Source {
+        Source::Object(parts.iter().map(|s| s.to_string()).collect())
+    }
+
+    #[test]
+    fn a_copy_source_is_a_bucket_and_a_key_in_any_spelling() {
+        for spelling in [
+            "/b/a/k",
+            "b/a/k",
+            "/b%2Fa%2Fk",
+            "b%2Fa/k",
+            "%2Fb/a/k",
+            "/b/a/%6B",
+        ] {
+            assert_eq!(source(spelling), object(&["b", "a", "k"]), "{spelling}");
+        }
+        assert_eq!(
+            source("/b/.sccache_check"),
+            object(&["b", ".sccache_check"])
+        );
+        for versioned in ["/b/k?versionId=null", "b/k?versionId=3&x=1"] {
+            assert_eq!(source(versioned), Source::Versioned, "{versioned}");
+        }
+    }
+
+    #[test]
+    fn a_copy_source_that_names_no_object_is_refused_with_the_rule() {
+        let code = |value: &str| match source(value) {
+            Source::Invalid(code, _) => code,
+            other => panic!("{value}: {other:?}"),
+        };
+        for bad in [
+            "",
+            "/",
+            "/b",
+            "b/",
+            "/b/",
+            "/b/k?acl",
+            "/b/a%2",
+            "/b/%FF",
+            "/b/a%2541",
+            "/b/a//k",
+            "/b/a b",
+            "/b/../k",
+            "/b/tags/k",
+            "//b/k",
+        ] {
+            assert!(
+                ["InvalidArgument", "InvalidBucketName"].contains(&code(bad)),
+                "{bad}: {}",
+                code(bad)
+            );
+        }
+        assert_eq!(code(&format!("/b/{}", "x".repeat(256))), "KeyTooLongError");
+    }
+}
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 712237da..cc096c47 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -344,7 +344,7 @@ fn url_encode(key: &str) -> String {
 }
 
 /// An object's `LastModified` as S3's listings write it.
-fn iso8601(t: std::time::SystemTime) -> String {
+pub(super) fn iso8601(t: std::time::SystemTime) -> String {
     let secs = t
         .duration_since(std::time::UNIX_EPOCH)
         .map_or(0, |d| d.as_secs());
diff --git a/vk-registry/src/s3/meta.rs b/vk-registry/src/s3/meta.rs
index b4fe2c5c..8c3b668f 100644
--- a/vk-registry/src/s3/meta.rs
+++ b/vk-registry/src/s3/meta.rs
@@ -67,6 +67,16 @@ pub(crate) fn annotations(headers: &HeaderMap) -> Result<BTreeMap<String, String
     Ok(out)
 }
 
+/// The user metadata among an object's annotations, as [`annotations`] made them: what a
+/// copy carries over.
+pub(crate) fn carried(annotations: &BTreeMap<String, String>) -> BTreeMap<String, String> {
+    annotations
+        .iter()
+        .filter(|(k, _)| k.starts_with(ANNOTATION_PREFIX))
+        .map(|(k, v)| (k.clone(), v.clone()))
+        .collect()
+}
+
 /// The `x-amz-meta-*` headers an object's annotations hold; one that cannot be a header any
 /// more is left out.
 pub(crate) fn headers(
@@ -116,6 +126,8 @@ mod tests {
         );
         let mut all = a.clone();
         all.insert("org.virtkit.md5".into(), "00".into());
+        all.insert("org.virtkit.retention".into(), "keep".into());
+        assert_eq!(carried(&all), a);
         let back: Vec<(String, String)> = headers(&all)
             .map(|(n, v)| (n.to_string(), v.to_str().unwrap().to_string()))
             .collect();
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 915deb08..72685ca6 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -9,12 +9,17 @@
 //! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
 //! one, served over the object layer the WebDAV view shares ([`crate::files`]): [`bucket`]
 //! answers the service and its buckets, [`list`] a bucket's listings, [`object`] the
-//! objects, with [`chunked`] decoding the `aws-chunked` bodies SDKs upload them in.
-//! Operations not served yet answer `NotImplemented`.
+//! objects, with [`chunked`] decoding the `aws-chunked` bodies SDKs upload them in, [`copy`]
+//! their copies and [`batch`] their deletion in batches; [`canned`] answers the
+//! configurations a bucket or an object has none of. Operations not served yet answer
+//! `NotImplemented`.
 
+mod batch;
 mod bucket;
+mod canned;
 mod chunked;
 mod conditional;
+mod copy;
 mod list;
 mod meta;
 mod object;
@@ -237,12 +242,35 @@ async fn operate(
         (path::Target::Bucket(b), &Method::GET, _) if list::is_listing(&query) => {
             list::list(state, authz, b, &query, req, ctx).await
         }
+        (path::Target::Bucket(b), &Method::GET, Some(sub)) => match canned::bucket(sub) {
+            Some(canned) => bucket::configuration(state, authz, b, canned, req, ctx).await,
+            None => refuse(req, ctx.not_implemented(), ctx).await,
+        },
+        (path::Target::Bucket(b), &Method::PUT, None) => {
+            bucket::create(state, authz, b, req, ctx).await
+        }
+        (path::Target::Bucket(b), &Method::DELETE, None) => {
+            bucket::delete(state, authz, b, req, ctx).await
+        }
+        (path::Target::Bucket(b), &Method::POST, Some("delete")) => {
+            batch::delete(state, authz, b, req, ctx).await
+        }
         (path::Target::Object { segs, .. }, &Method::GET | &Method::HEAD, None) => {
             object::get(state, authz, segs, method == Method::HEAD, req, ctx).await
         }
         (path::Target::Object { segs, .. }, &Method::GET, Some("attributes")) => {
             object::attributes(state, authz, segs, req, ctx).await
         }
+        (path::Target::Object { segs, .. }, &Method::GET, Some(sub)) => match canned::object(sub) {
+            Some(canned) => object::configuration(state, authz, segs, canned, req, ctx).await,
+            None => refuse(req, ctx.not_implemented(), ctx).await,
+        },
+        // A copy names its source in a header, and its body is not the object.
+        (path::Target::Object { segs, .. }, &Method::PUT, None)
+            if req.headers().contains_key(copy::COPY_SOURCE) =>
+        {
+            copy::copy(state, authz, segs, req, ctx).await
+        }
         (path::Target::Object { segs, .. }, &Method::PUT, None) => {
             object::put(state, authz, segs, seed, req, ctx).await
         }
@@ -271,6 +299,34 @@ async fn drain(req: Request<Incoming>, ctx: &Ctx) -> Result<Option<Response<Body
     }
 }
 
+/// A request document read whole, up to `cap` bytes: `Err(too_long)` when it is longer,
+/// once the rest has been read through as a refusal's is (or 413 past the object cap).
+async fn read_small(
+    mut body: Incoming,
+    cap: usize,
+    too_long: Response<Body>,
+    ctx: &Ctx,
+) -> Result<std::result::Result<Vec<u8>, Response<Body>>> {
+    use http_body_util::BodyExt as _;
+    let mut out = Vec::new();
+    while let Some(frame) = body.frame().await {
+        let frame = anyhow::Context::context(frame, "reading a request document")?;
+        let Ok(data) = frame.into_data() else {
+            continue;
+        };
+        if out.len().saturating_add(data.len()) > cap {
+            let sink = &mut tokio::io::sink();
+            return match crate::files::drain_into(sink, &mut body, MAX_OBJECT, &mut |_| {}).await {
+                Ok(_) => Ok(Err(too_long)),
+                Err(PutError::TooLarge) => Ok(Err(ctx.too_large())),
+                Err(PutError::Failed(e)) => Err(e),
+            };
+        }
+        out.extend_from_slice(&data);
+    }
+    Ok(Ok(out))
+}
+
 /// Answer `resp` to a request refused before it was authenticated, having read at most
 /// [`PRE_AUTH_DRAIN`] of its body (and the frame that crossed it).
 async fn before_auth(req: Request<Incoming>, resp: Response<Body>) -> Result<Response<Body>> {
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 1b2871ae..0f7bebe5 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -1,5 +1,5 @@
-//! Objects: PutObject, GetObject and HeadObject, GetObjectAttributes and DeleteObject, over
-//! the object layer the WebDAV view shares. Authorized as that view authorizes: a write needs
+//! Objects: PutObject, GetObject and HeadObject, GetObjectAttributes, an object's canned
+//! configurations and DeleteObject, over the object layer the WebDAV view shares. Authorized as that view authorizes: a write needs
 //! `Write` on the key's parent repository, a read `Read` on the repository the key resolves
 //! to; a caller holding the action on neither the key's path nor its parent is refused before
 //! any lookup, and what it may not read is absent (`NoSuchKey`).
@@ -38,12 +38,12 @@ const CHECKSUM_SHA256: &str = "x-amz-checksum-sha256";
 
 /// Whether this caller may `action` on the key at `segs` or on its parent: what admits a
 /// request to the lookup that then decides on the repository the key resolves to.
-fn admitted(authz: &Authz<'_>, action: accounts::Action, segs: &[String]) -> bool {
+pub(super) fn admitted(authz: &Authz<'_>, action: accounts::Action, segs: &[String]) -> bool {
     allowed(authz, action, &repo_name(segs))
         || object_of(segs).is_some_and(|(parent, _)| allowed(authz, action, &parent))
 }
 
-fn no_such_key(ctx: &Ctx) -> Response<Body> {
+pub(super) fn no_such_key(ctx: &Ctx) -> Response<Body> {
     ctx.error(
         StatusCode::NOT_FOUND,
         "NoSuchKey",
@@ -54,7 +54,11 @@ fn no_such_key(ctx: &Ctx) -> Response<Body> {
 /// The object at `segs` as this caller may read it: `None` when nothing is there, when a
 /// directory or a foreign tag is, or when the caller may not read the repository it is in or
 /// its bytes through it.
-fn readable(store: &Store, authz: &Authz<'_>, segs: &[String]) -> Result<Option<Object>> {
+pub(super) fn readable(
+    store: &Store,
+    authz: &Authz<'_>,
+    segs: &[String],
+) -> Result<Option<Object>> {
     Ok(match files::resolve(store, segs)? {
         Some(Node::Object(obj))
             if allowed(authz, accounts::Action::Read, &obj.repo)
@@ -284,6 +288,29 @@ pub(super) async fn attributes(
     .await
 }
 
+/// `GET /s3/<bucket>/<key>?tagging|acl`: the configuration `canned` says an object has, once
+/// the object is one the caller may read.
+pub(super) async fn configuration(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    canned: super::canned::Canned,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !admitted(authz, accounts::Action::Read, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        Ok(match readable(store, authz, &segs)? {
+            Some(_) => canned.answer(&ctx),
+            None => no_such_key(&ctx),
+        })
+    })
+    .await
+}
+
 /// How a PutObject's body is bound to its signature, by `x-amz-content-sha256`, and how it is
 /// framed.
 struct Payload {
@@ -317,7 +344,7 @@ struct Expected {
 
 /// What a PutObject's headers ask that cannot be served, or are malformed: a status, a code
 /// and a message.
-type Refused = (StatusCode, &'static str, &'static str);
+pub(super) type Refused = (StatusCode, &'static str, &'static str);
 
 /// What `x-amz-content-sha256`, `Content-Encoding`, `x-amz-decoded-content-length` and
 /// `x-amz-trailer` say of a PutObject's body. A streaming mode, or `aws-chunked` named among
@@ -526,15 +553,90 @@ impl Digests {
     }
 }
 
-/// The answer to a write at a path that takes no object, with what is in the way.
-fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
-    let message = match why {
+/// Check what arrived against what the request said of it: its `md5`, and its `sha256`,
+/// `sha1` and `crc32` where they were computed.
+fn verify(
+    expected: &Expected,
+    md5: &[u8],
+    sha256: &Option<Vec<u8>>,
+    sha1: &Option<Vec<u8>>,
+    crc32: &Option<Vec<u8>>,
+) -> std::result::Result<(), Refused> {
+    if expected.md5.as_deref().is_some_and(|m| m != md5) {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "BadDigest",
+            "the Content-MD5 you specified did not match what was received",
+        ));
+    }
+    let mismatch = |expected: &Option<Vec<u8>>, got: &Option<Vec<u8>>| {
+        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
+    };
+    if mismatch(&expected.sha256, sha256)
+        || mismatch(&expected.sha1, sha1)
+        || mismatch(&expected.crc32, crc32)
+    {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "BadDigest",
+            "the x-amz-checksum you specified did not match the checksum of what was received",
+        ));
+    }
+    Ok(())
+}
+
+/// Check a request document read whole (a `Delete`) against what its headers say of it, as a
+/// PutObject's body is checked: the signed `x-amz-content-sha256`, `Content-MD5` and the
+/// `x-amz-checksum-*` headers. A document is sent whole, not `aws-chunked`.
+pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
+    let payload = payload(headers)?;
+    if payload.framing.is_some() {
+        return Err((
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "a request document is sent whole, not aws-chunked",
+        ));
+    }
+    let expected = expected(headers)?;
+    let sha256 = sha2::Sha256::digest(body).to_vec();
+    if payload
+        .sha256
+        .is_some_and(|signed| signed != crate::hex_of(&sha256))
+    {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "XAmzContentSHA256Mismatch",
+            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
+        ));
+    }
+    let sha1 = sha1::Sha1::digest(body).to_vec();
+    let crc32 = crc32fast::hash(body).to_be_bytes().to_vec();
+    verify(
+        &expected,
+        &md5::compute(body).0,
+        &Some(sha256),
+        &Some(sha1),
+        &Some(crc32),
+    )
+}
+
+/// Why a write at a path that takes no object is refused: what is in the way.
+pub(super) fn unwritable_message(why: Unwritable) -> &'static str {
+    match why {
         Unwritable::TopLevel => "a bucket takes no object of its own name",
         Unwritable::Directory => "this key is a prefix of other keys, and cannot be an object",
         Unwritable::Foreign => "this key holds content that is not a file, pushed over /v2/",
         Unwritable::UnderObject => "a prefix of this key is an object, which cannot hold keys",
-    };
-    ctx.error(StatusCode::CONFLICT, "OperationAborted", message)
+    }
+}
+
+/// The answer to a write at a path that takes no object, with what is in the way.
+pub(super) fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
+    ctx.error(
+        StatusCode::CONFLICT,
+        "OperationAborted",
+        unwritable_message(why),
+    )
 }
 
 /// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
@@ -567,9 +669,6 @@ pub(super) async fn put(
     if over(CONTENT_LENGTH.as_str()) || over(DECODED_LENGTH) {
         return Ok(ctx.too_large());
     }
-    if headers.contains_key("x-amz-copy-source") {
-        return refuse(req, ctx.not_implemented(), ctx).await;
-    }
     let checked = payload(headers).and_then(|p| {
         let trailer = p.framing.and_then(|f| f.trailer);
         if trailer.is_some_and(|name| headers.contains_key(name)) {
@@ -660,26 +759,9 @@ pub(super) async fn put(
     let md5 = digests.md5.finalize().0;
     let sha1 = digests.sha1.map(|h| h.finalize().to_vec());
     let crc32 = digests.crc32.map(|h| h.finalize().to_be_bytes().to_vec());
-    if expected.md5.as_deref().is_some_and(|m| m != md5) {
-        return Ok(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "BadDigest",
-            "the Content-MD5 you specified did not match what was received",
-        ));
-    }
     let sha256 = hex_bytes(&staged.hex);
-    let mismatch = |expected: &Option<Vec<u8>>, got: &Option<Vec<u8>>| {
-        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
-    };
-    if mismatch(&expected.sha256, &sha256)
-        || mismatch(&expected.sha1, &sha1)
-        || mismatch(&expected.crc32, &crc32)
-    {
-        return Ok(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "BadDigest",
-            "the x-amz-checksum you specified did not match the checksum of what was received",
-        ));
+    if let Err((status, code, message)) = verify(&expected, &md5, &sha256, &sha1, &crc32) {
+        return Ok(ctx.error(status, code, message));
     }
     let md5_hex = crate::hex_of(&md5);
     annotations.insert(MD5_ANNOTATION.to_string(), md5_hex.clone());
@@ -735,29 +817,51 @@ pub(super) async fn delete(
     }
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
-        let _namespace = files::namespace(store)?;
-        let node = match files::resolve(store, &segs)? {
-            Some(node) if allowed(authz, accounts::Action::Read, node.repo()) => node,
-            // Nothing there, as far as this caller can tell.
-            _ => return Ok(no_content()),
-        };
-        if !allowed(authz, accounts::Action::Write, node.repo()) {
-            return Ok(ctx.access_denied());
-        }
-        match node {
-            Node::Object(obj) => {
-                store.delete_tag(&obj.repo, &obj.tag)?;
-            }
-            Node::Foreign(_) => {
-                return Ok(unwritable(Unwritable::Foreign, &ctx));
-            }
-            Node::Dir(_) => {}
-        }
-        Ok(no_content())
+        let namespace = files::namespace(store)?;
+        Ok(match delete_one(store, &namespace, authz, &segs)? {
+            Deleted::Gone => no_content(),
+            Deleted::Denied => ctx.access_denied(),
+            Deleted::Foreign => unwritable(Unwritable::Foreign, &ctx),
+        })
     })
     .await
 }
 
+/// What [`delete_one`] did.
+pub(super) enum Deleted {
+    /// no object is at the key now, whether or not one was, as far as the caller can tell
+    Gone,
+    /// the caller may read the object but not write it
+    Denied,
+    /// a foreign tag is there, which is not this view's to delete
+    Foreign,
+}
+
+/// Delete the object at `segs` for this caller, the namespace held (`_namespace`): a key
+/// that is a directory holds no object to delete, and one the caller may not read is absent.
+pub(super) fn delete_one(
+    store: &Store,
+    _namespace: &files::Namespace,
+    authz: &Authz<'_>,
+    segs: &[String],
+) -> Result<Deleted> {
+    let node = match files::resolve(store, segs)? {
+        Some(node) if allowed(authz, accounts::Action::Read, node.repo()) => node,
+        _ => return Ok(Deleted::Gone),
+    };
+    if !allowed(authz, accounts::Action::Write, node.repo()) {
+        return Ok(Deleted::Denied);
+    }
+    match node {
+        Node::Object(obj) => {
+            store.delete_tag(&obj.repo, &obj.tag)?;
+        }
+        Node::Foreign(_) => return Ok(Deleted::Foreign),
+        Node::Dir(_) => {}
+    }
+    Ok(Deleted::Gone)
+}
+
 fn no_content() -> Response<Body> {
     Response::builder()
         .status(StatusCode::NO_CONTENT)
diff --git a/vk-registry/src/s3/xml.rs b/vk-registry/src/s3/xml.rs
index 721e126c..bb48ebd5 100644
--- a/vk-registry/src/s3/xml.rs
+++ b/vk-registry/src/s3/xml.rs
@@ -1,5 +1,7 @@
 //! The XML S3 answers in: the `Error` document every refusal carries, and the documents of
-//! the operations that answer with one.
+//! the operations that answer with one. The XML requests carry is read by [`scan`].
+
+pub(crate) mod scan;
 
 use bytes::Bytes;
 use hyper::header::{CONTENT_LENGTH, CONTENT_TYPE};
diff --git a/vk-registry/src/s3/xml/scan.rs b/vk-registry/src/s3/xml/scan.rs
new file mode 100644
index 00000000..4351f1ee
--- /dev/null
+++ b/vk-registry/src/s3/xml/scan.rs
@@ -0,0 +1,406 @@
+//! The XML S3 requests carry (`Delete`, `CreateBucketConfiguration`), read by an element
+//! scanner of its own rather than a parser: elements, their text and their children, and
+//! nothing XML can make a reader fetch or expand. The prolog, processing instructions and
+//! comments are passed over and CDATA is text; the five predefined entities and character
+//! references are decoded, and any other entity, or a document type declaration that could
+//! define one, makes the document malformed. Elements are known by their local name, so a
+//! namespace prefix and the `xmlns` attributes say nothing; attributes are checked for form
+//! and dropped. Depth and element count are bounded, so a document costs at most its length
+//! in memory, and no input makes it panic.
+
+/// One element: its local name, the text directly inside it, and its child elements.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub(crate) struct Element {
+    pub(crate) name: String,
+    pub(crate) text: String,
+    pub(crate) children: Vec<Element>,
+}
+
+impl Element {
+    /// The children named `name`, in order.
+    pub(crate) fn all<'a>(&'a self, name: &'a str) -> impl Iterator<Item = &'a Element> + 'a {
+        self.children.iter().filter(move |c| c.name == name)
+    }
+
+    /// The child named `name`: `Err` when there are several, which no field of a request
+    /// takes.
+    pub(crate) fn one(&self, name: &str) -> Result<Option<&Element>, Malformed> {
+        let mut all = self.children.iter().filter(|c| c.name == name);
+        let first = all.next();
+        match all.next() {
+            Some(_) => Err(Malformed("an element that is given once is given twice")),
+            None => Ok(first),
+        }
+    }
+}
+
+/// Why a document was refused: what S3 calls `MalformedXML`, with what was wrong.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct Malformed(pub(crate) &'static str);
+
+/// Deepest nesting taken, the document's element counting as one: S3's request documents
+/// are three deep.
+const MAX_DEPTH: usize = 16;
+
+/// Longest entity reference between `&` and `;`: `#x10FFFF`.
+const MAX_ENTITY: usize = 8;
+
+const TRUNCATED: Malformed = Malformed("the document ends inside an element");
+
+/// The document element of `input`, of at most `max_elements` elements in all.
+pub(crate) fn parse(input: &[u8], max_elements: usize) -> Result<Element, Malformed> {
+    let text = std::str::from_utf8(input).map_err(|_| Malformed("the document is not UTF-8"))?;
+    let rest = misc(text.strip_prefix('\u{feff}').unwrap_or(text))?;
+    if rest.is_empty() {
+        return Err(Malformed("the document has no element"));
+    }
+    let mut count = 0usize;
+    let (root, rest) = element(rest, 1, &mut count, max_elements)?;
+    if !misc(rest)?.is_empty() {
+        return Err(Malformed("the document goes on past its element"));
+    }
+    Ok(root)
+}
+
+fn is_space(c: char) -> bool {
+    matches!(c, ' ' | '\t' | '\r' | '\n')
+}
+
+/// `s` past what may come before and after the document element: white space, processing
+/// instructions (the XML declaration among them) and comments.
+fn misc(mut s: &str) -> Result<&str, Malformed> {
+    loop {
+        s = s.trim_start_matches(is_space);
+        if let Some(r) = s.strip_prefix("<?") {
+            s = past(r, "?>")?;
+        } else if let Some(r) = s.strip_prefix("<!--") {
+            s = past(r, "-->")?;
+        } else if s.starts_with("<!") {
+            return Err(Malformed("a document type declaration is not taken"));
+        } else {
+            return Ok(s);
+        }
+    }
+}
+
+/// `s` past the first `end`.
+fn past<'a>(s: &'a str, end: &str) -> Result<&'a str, Malformed> {
+    let at = s.find(end).ok_or(TRUNCATED)?;
+    s.get(at.saturating_add(end.len())..).ok_or(TRUNCATED)
+}
+
+/// Whether `name` can be an element or attribute name: not empty, and none of the
+/// characters that end or quote one. Looser than XML's production, which nothing here
+/// depends on.
+fn valid_name(name: &str) -> bool {
+    !name.is_empty()
+        && !name
+            .chars()
+            .any(|c| is_space(c) || matches!(c, '<' | '>' | '&' | '"' | '\'' | '=' | '/'))
+}
+
+/// A qualified name's local part.
+fn local(name: &str) -> &str {
+    name.rsplit(':').next().unwrap_or(name)
+}
+
+/// The element `s` starts with, at `depth`, and what follows it.
+fn element<'a>(
+    s: &'a str,
+    depth: usize,
+    count: &mut usize,
+    max: usize,
+) -> Result<(Element, &'a str), Malformed> {
+    if depth > MAX_DEPTH {
+        return Err(Malformed("the document nests too deep"));
+    }
+    *count = count.saturating_add(1);
+    if *count > max {
+        return Err(Malformed("the document has too many elements"));
+    }
+    let s = s
+        .strip_prefix('<')
+        .ok_or(Malformed("an element was expected"))?;
+    let end = s
+        .find(|c: char| is_space(c) || c == '/' || c == '>')
+        .ok_or(TRUNCATED)?;
+    let (qname, mut s) = s.split_at_checked(end).ok_or(TRUNCATED)?;
+    if !valid_name(qname) || local(qname).is_empty() {
+        return Err(Malformed("an element's name is malformed"));
+    }
+    let mut el = Element {
+        name: local(qname).to_string(),
+        ..Element::default()
+    };
+    // The attributes, checked and dropped.
+    loop {
+        let trimmed = s.trim_start_matches(is_space);
+        if let Some(r) = trimmed.strip_prefix("/>") {
+            return Ok((el, r));
+        }
+        if let Some(r) = trimmed.strip_prefix('>') {
+            s = r;
+            break;
+        }
+        if trimmed.len() == s.len() {
+            return Err(Malformed("attributes are separated by white space"));
+        }
+        let eq = trimmed.find('=').ok_or(TRUNCATED)?;
+        let (name, r) = trimmed.split_at_checked(eq).ok_or(TRUNCATED)?;
+        if !valid_name(name.trim_end_matches(is_space)) {
+            return Err(Malformed("an attribute's name is malformed"));
+        }
+        let r = r.get(1..).ok_or(TRUNCATED)?.trim_start_matches(is_space);
+        let quote = r.chars().next().ok_or(TRUNCATED)?;
+        if quote != '"' && quote != '\'' {
+            return Err(Malformed("an attribute's value is quoted"));
+        }
+        let r = r.get(1..).ok_or(TRUNCATED)?;
+        let close = r.find(quote).ok_or(TRUNCATED)?;
+        let (value, r) = r.split_at_checked(close).ok_or(TRUNCATED)?;
+        if value.contains('<') {
+            return Err(Malformed("an attribute's value holds a <"));
+        }
+        decode_into(value, &mut String::new())?;
+        s = r.get(1..).ok_or(TRUNCATED)?;
+    }
+    // The content, up to the matching end tag.
+    loop {
+        let lt = s.find('<').ok_or(TRUNCATED)?;
+        let (chars, r) = s.split_at_checked(lt).ok_or(TRUNCATED)?;
+        decode_into(chars, &mut el.text)?;
+        if let Some(r) = r.strip_prefix("</") {
+            let gt = r.find('>').ok_or(TRUNCATED)?;
+            let (name, r) = r.split_at_checked(gt).ok_or(TRUNCATED)?;
+            if name.trim_end_matches(is_space) != qname {
+                return Err(Malformed("an end tag does not match its element"));
+            }
+            return Ok((el, r.get(1..).ok_or(TRUNCATED)?));
+        } else if let Some(r) = r.strip_prefix("<!--") {
+            s = past(r, "-->")?;
+        } else if let Some(r) = r.strip_prefix("<![CDATA[") {
+            let end = r.find("]]>").ok_or(TRUNCATED)?;
+            let (data, r) = r.split_at_checked(end).ok_or(TRUNCATED)?;
+            el.text.push_str(data);
+            s = r.get(3..).ok_or(TRUNCATED)?;
+        } else if let Some(r) = r.strip_prefix("<?") {
+            s = past(r, "?>")?;
+        } else if r.starts_with("<!") {
+            return Err(Malformed("a declaration inside an element is not taken"));
+        } else {
+            let (child, r) = element(r, depth.saturating_add(1), count, max)?;
+            el.children.push(child);
+            s = r;
+        }
+    }
+}
+
+/// Append character data `s` to `out`, its references decoded: XML's five entities and
+/// character references, and nothing else.
+fn decode_into(s: &str, out: &mut String) -> Result<(), Malformed> {
+    let mut rest = s;
+    while let Some(amp) = rest.find('&') {
+        let (plain, r) = rest.split_at_checked(amp).ok_or(TRUNCATED)?;
+        out.push_str(plain);
+        let r = r.get(1..).ok_or(TRUNCATED)?;
+        let semi = r
+            .find(';')
+            .filter(|&i| i <= MAX_ENTITY)
+            .ok_or(Malformed("an & does not start a reference"))?;
+        let (name, r) = r.split_at_checked(semi).ok_or(TRUNCATED)?;
+        out.push(match name {
+            "lt" => '<',
+            "gt" => '>',
+            "amp" => '&',
+            "quot" => '"',
+            "apos" => '\'',
+            _ => character(name).ok_or(Malformed(
+                "an entity other than lt, gt, amp, quot, apos or a character reference",
+            ))?,
+        });
+        rest = r.get(1..).ok_or(TRUNCATED)?;
+    }
+    out.push_str(rest);
+    Ok(())
+}
+
+/// The character a reference `#<decimal>` or `#x<hex>` names, when XML allows it.
+fn character(name: &str) -> Option<char> {
+    let digits = name.strip_prefix('#')?;
+    let (digits, radix) = match digits.strip_prefix('x') {
+        Some(hex) => (hex, 16),
+        None => (digits, 10),
+    };
+    if digits.is_empty() || !digits.chars().all(|c| c.is_digit(radix)) {
+        return None;
+    }
+    let c = char::from_u32(u32::from_str_radix(digits, radix).ok()?)?;
+    (matches!(c, '\t' | '\n' | '\r') || c >= ' ').then_some(c)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn delete(objects: &str) -> String {
+        format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\
+             <Delete xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">{objects}</Delete>"
+        )
+    }
+
+    fn keys(el: &Element) -> Vec<String> {
+        el.all("Object")
+            .filter_map(|o| o.one("Key").ok().flatten())
+            .map(|k| k.text.clone())
+            .collect()
+    }
+
+    #[track_caller]
+    fn malformed(input: &str) -> &'static str {
+        match parse(input.as_bytes(), 100) {
+            Err(Malformed(why)) => why,
+            Ok(el) => panic!("took {input:?} as {el:?}"),
+        }
+    }
+
+    #[test]
+    fn a_delete_document_reads_as_sdks_write_it() {
+        let doc = delete(
+            "<Object><Key>a/b</Key></Object>\n  <Object><Key>c</Key>\
+             <VersionId>null</VersionId></Object><Quiet>true</Quiet>",
+        );
+        let el = parse(doc.as_bytes(), 100).unwrap();
+        assert_eq!(el.name, "Delete");
+        assert_eq!(keys(&el), ["a/b", "c"]);
+        assert_eq!(el.one("Quiet").unwrap().unwrap().text, "true");
+        let versioned: Vec<_> = el.all("Object").map(|o| o.one("VersionId")).collect();
+        assert_eq!(versioned[0], Ok(None));
+        assert_eq!(versioned[1].as_ref().unwrap().unwrap().text, "null");
+        // Reordered, prefixed, unknown elements and attributes among them.
+        let doc = "<s3:Delete xmlns:s3=\"urn:x\" a='1'><s3:Quiet>false</s3:Quiet>\
+                   <Unknown><Deeper x=\"&amp;\">t</Deeper></Unknown>\
+                   <s3:Object><Other/><s3:Key>k</s3:Key></s3:Object></s3:Delete>";
+        let el = parse(doc.as_bytes(), 100).unwrap();
+        assert_eq!((el.name.as_str(), keys(&el)), ("Delete", vec!["k".into()]));
+        assert_eq!(el.one("Quiet").unwrap().unwrap().text, "false");
+        // A missing field is the caller's to notice.
+        let el = parse(delete("<Object></Object>").as_bytes(), 100).unwrap();
+        assert_eq!(el.all("Object").count(), 1);
+        assert!(keys(&el).is_empty());
+        assert_eq!(
+            parse(b"<a><b/><b/></a>", 10).unwrap().one("b"),
+            Err(Malformed("an element that is given once is given twice"))
+        );
+    }
+
+    #[test]
+    fn text_is_decoded_from_entities_cdata_and_references_only() {
+        let el = parse(
+            "<K>&lt;a&gt; &amp; &quot;&apos; &#65;&#x42;<!-- no --><![CDATA[<&x;>]]>\u{e9}</K>"
+                .as_bytes(),
+            10,
+        )
+        .unwrap();
+        assert_eq!(el.text, "<a> & \"' AB<&x;>\u{e9}");
+        for bad in [
+            "<K>&nbsp;</K>",
+            "<K>&xxe;</K>",
+            "<K>&</K>",
+            "<K>& amp;</K>",
+            "<K>&#;</K>",
+            "<K>&#x;</K>",
+            "<K>&#0;</K>",
+            "<K>&#xD800;</K>",
+            "<K>&#x110000;</K>",
+            "<K>&#12a;</K>",
+            "<K>&averyverylongname;</K>",
+            "<K a=\"&nbsp;\"/>",
+        ] {
+            assert!(
+                malformed(bad).contains("&") || malformed(bad).contains("entity"),
+                "{bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn declarations_and_what_is_not_a_document_are_refused() {
+        let xxe = "<?xml version=\"1.0\"?><!DOCTYPE d [<!ENTITY x SYSTEM \"file:///etc/passwd\">\
+                   ]><Delete><Object><Key>&x;</Key></Object></Delete>";
+        assert!(malformed(xxe).contains("document type"));
+        assert!(malformed("<a><!DOCTYPE x></a>").contains("declaration"));
+        for (bad, why) in [
+            ("", "no element"),
+            ("  <!-- only -->  ", "no element"),
+            ("text", "element was expected"),
+            ("<a></b>", "end tag"),
+            ("<a><b></a></b>", "end tag"),
+            ("<a/><b/>", "past its element"),
+            ("<a/>text", "past its element"),
+            ("<a x></a>", "ends inside"),
+            ("<a x=1></a>", "quoted"),
+            ("<a x=\"<\"></a>", "holds a <"),
+            ("<a x=\"1\"y=\"2\"></a>", "white space"),
+            ("< a/>", "name"),
+            ("<:/>", "name"),
+            ("<a>\u{0}", "ends inside"),
+        ] {
+            assert!(malformed(bad).contains(why), "{bad}: {}", malformed(bad));
+        }
+        assert!(parse(&[0xff, b'<', b'a', b'/', b'>'], 1).is_err());
+        // A comment and processing instructions anywhere around and inside.
+        let el = parse(
+            b"\xef\xbb\xbf<?xml version='1.0'?><!-- c --><a><?pi x?>t<!-- c --></a><!-- c -->\n",
+            1,
+        )
+        .unwrap();
+        assert_eq!((el.name.as_str(), el.text.as_str()), ("a", "t"));
+    }
+
+    #[test]
+    fn depth_and_count_are_bounded() {
+        let nested = |n: usize| format!("{}{}", "<a>".repeat(n), "</a>".repeat(n));
+        assert!(parse(nested(MAX_DEPTH).as_bytes(), 100).is_ok());
+        assert!(malformed(&nested(MAX_DEPTH + 1)).contains("deep"));
+        let deep = nested(100_000);
+        assert!(parse(deep.as_bytes(), usize::MAX).is_err());
+        let wide = |n: usize| format!("<a>{}</a>", "<b/>".repeat(n));
+        assert!(parse(wide(99).as_bytes(), 100).is_ok());
+        assert!(malformed(&wide(100)).contains("too many"));
+        // Nested garbage.
+        assert!(parse(b"<a><b><c><<</c></b></a>", 100).is_err());
+        assert!(parse(b"<a><b>]]></b><![CDATA[</a>", 100).is_err());
+    }
+
+    #[test]
+    fn every_truncation_and_mutation_of_a_document_is_answered() {
+        let doc = delete(
+            "<Object><Key>a&amp;b</Key><VersionId>v</VersionId></Object><!-- x -->\
+             <Object><Key><![CDATA[c]]></Key></Object><Quiet>true</Quiet>",
+        );
+        let bytes = doc.as_bytes();
+        let whole = parse(bytes, 100).unwrap();
+        assert_eq!(keys(&whole), ["a&b", "c"]);
+        for n in 0..bytes.len() {
+            assert!(parse(&bytes[..n], 100).is_err(), "{n} bytes");
+        }
+        // A deterministic run of random single and double byte mutations.
+        let mut seed: u64 = 0x5eed_0f5c;
+        let mut next = || {
+            seed = seed
+                .wrapping_mul(6_364_136_223_846_793_005)
+                .wrapping_add(1_442_695_040_888_963_407);
+            (seed >> 33) as usize
+        };
+        let alphabet = b"<>/&;#x!-[]?=\"' aKZ\x00\xff\xc3";
+        for _ in 0..20_000 {
+            let mut m = bytes.to_vec();
+            for _ in 0..1 + next() % 2 {
+                let at = next() % m.len();
+                m[at] = alphabet[next() % alphabet.len()];
+            }
+            let _ = parse(&m, 100);
+        }
+    }
+}
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 155e8081..19801f1c 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1725,13 +1725,15 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         .await
         .is(404, "NoSuchKey");
 
-    // Not served yet: other subresources, other verbs, copies.
+    // Not served yet: other subresources, other verbs, part copies.
     for req in [
-        Req::new("GET", "/s3/b/k").query("tagging"),
         Req::new("GET", "/s3/b/k").query("partNumber=1"),
+        Req::new("GET", "/s3/b/k").query("retention"),
         Req::new("POST", "/s3/b/k").query("uploads"),
-        Req::new("GET", "/s3/b").query("versioning"),
-        put("/s3/b/copy").header("x-amz-copy-source", "/b/k"),
+        put("/s3/b/k").query("tagging"),
+        put("/s3/b/copy")
+            .query("partNumber=1&uploadId=0")
+            .header("x-amz-copy-source", "/b/k"),
     ] {
         send(&host, req).await.is(501, "NotImplemented");
     }
@@ -2197,7 +2199,13 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
         .await
         .is(404, "NoSuchBucket");
     // A query naming something else is not a listing.
-    send(host, list("acl=")).await.is(501, "NotImplemented");
+    let resp = send(host, list("acl=")).await;
+    resp.ok(200);
+    assert!(
+        resp.body.contains("<Permission>FULL_CONTROL</Permission>"),
+        "{}",
+        resp.body
+    );
     send(host, list("acl=&list-type=2"))
         .await
         .is(501, "NotImplemented");
@@ -2533,3 +2541,751 @@ async fn a_dav_written_object_is_served_in_ranges_and_a_ranged_get_refreshes_it(
     is_part(&resp, &data, data.len() - 1000, 1000, &etag);
     assert_eq!(mtime("headed"), long_ago);
 }
+
+// ---- buckets made and removed, copies, batch deletes, configurations ----
+
+/// A key of `db`'s user `ci` holding `scopes`, each an action on a pattern.
+fn api_key(db: &Db, name: &str, scopes: &[(Action, &str)]) -> String {
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let scopes: Vec<Scope> = scopes
+        .iter()
+        .map(|(action, pattern)| Scope {
+            action: *action,
+            repo_pattern: pattern.to_string(),
+        })
+        .collect();
+    db.create_api_key(Some(&user.id), name, &scopes, None)
+        .unwrap()
+        .1
+}
+
+/// A request signed by `key` as its access key and secret.
+fn as_key<'a>(host: &'a str, key: &'a str) -> impl Fn(Req) -> Req + 'a {
+    move |r: Req| r.signed(host, (key, key), 0)
+}
+
+/// CreateBucket and DeleteBucket, as `aws s3 mb` and `rb` send them: a bucket is made,
+/// refused twice, and removed once its keys are deleted, however deep they were.
+async fn buckets_are_made_and_removed(host: &str, sign: Sign<'_>) {
+    let req = |method, path: &str| sign(Req::new(method, path));
+    let resp = send(host, req("PUT", "/s3/made")).await;
+    resp.ok(200);
+    assert_eq!(resp.header("location"), Some("/s3/made"));
+    send(host, req("HEAD", "/s3/made")).await.ok(200);
+    send(host, req("PUT", "/s3/made"))
+        .await
+        .is(409, "BucketAlreadyOwnedByYou");
+
+    // A configuration and a canned ACL are taken and ignored; object lock is not served.
+    let config = "<CreateBucketConfiguration xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
+                  <LocationConstraint>eu-west-1</LocationConstraint></CreateBucketConfiguration>";
+    let configured = Req::new("PUT", "/s3/configured")
+        .header("x-amz-acl", "private")
+        .body(config.as_bytes().to_vec());
+    send(host, sign(configured)).await.ok(200);
+    for (path, body) in [
+        ("/s3/large", vec![b' '; 1025]),
+        ("/s3/garbled", b"<CreateBucketConfiguration>".to_vec()),
+        ("/s3/other", b"<Delete/>".to_vec()),
+    ] {
+        let resp = send(host, sign(Req::new("PUT", path).body(body))).await;
+        resp.is(400, "MalformedXML");
+    }
+    let locked = Req::new("PUT", "/s3/locked").header("x-amz-bucket-object-lock-enabled", "true");
+    send(host, sign(locked)).await.is(501, "NotImplemented");
+    for absent in ["/s3/large", "/s3/garbled", "/s3/other", "/s3/locked"] {
+        send(host, req("HEAD", absent)).await.ok(404);
+    }
+
+    // Not empty while it holds a key; empty once they are deleted, the directories they were
+    // in going with it.
+    for path in ["/s3/made/a/b/k", "/s3/made/top"] {
+        let put = Req::new("PUT", path).body(HELLO.to_vec());
+        send(host, sign(put)).await.ok(200);
+    }
+    send(host, req("DELETE", "/s3/made"))
+        .await
+        .is(409, "BucketNotEmpty");
+    send(host, req("DELETE", "/s3/made/top")).await.ok(204);
+    send(host, req("DELETE", "/s3/made"))
+        .await
+        .is(409, "BucketNotEmpty");
+    is_object(&send(host, req("GET", "/s3/made/a/b/k")).await, HELLO);
+    send(host, req("DELETE", "/s3/made/a/b/k")).await.ok(204);
+    send(host, req("DELETE", "/s3/made")).await.ok(204);
+    send(host, req("HEAD", "/s3/made")).await.ok(404);
+    send(host, req("DELETE", "/s3/made"))
+        .await
+        .is(404, "NoSuchBucket");
+    send(host, req("DELETE", "/s3/configured")).await.ok(204);
+    let resp = send(host, req("GET", "/s3/made/a/b/k")).await;
+    resp.is(404, "NoSuchKey");
+}
+
+#[tokio::test]
+async fn buckets_are_made_and_removed_on_an_open_server() {
+    let dir = tmp("mb-open");
+    let state = open_state(&dir, true);
+    let store = state.store.clone();
+    let host = spawn(state);
+    buckets_are_made_and_removed(&host, &|r| r).await;
+
+    // A bucket holding records a deleted object does not account for: an image's manifest
+    // pushed over /v2/, its tag since deleted.
+    store
+        .put_manifest("files/rec", "v1", MANIFEST_TYPE, br#"{"schemaVersion":2}"#)
+        .unwrap();
+    send(&host, Req::new("DELETE", "/s3/rec"))
+        .await
+        .is(409, "BucketNotEmpty");
+    store.delete_tag("files/rec", "v1").unwrap();
+    let resp = send(&host, Req::new("DELETE", "/s3/rec")).await;
+    resp.is(409, "BucketNotEmpty");
+    assert!(resp.body.contains("/v2/"), "{}", resp.body);
+    // The name taken in the store by something that is not a directory.
+    std::fs::write(dir.join("store/repos/files/plain"), b"").unwrap();
+    send(&host, Req::new("PUT", "/s3/plain"))
+        .await
+        .is(409, "OperationAborted");
+    assert_eq!(staging_left(&dir), 0);
+}
+
+#[tokio::test]
+async fn buckets_are_made_and_removed_with_an_api_key() {
+    let dir = tmp("mb-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let writer = api_key(db, "writer", &[(Action::Write, "files/*")]);
+    let reader = api_key(db, "reader", &[(Action::Read, "files/*")]);
+    let inside = api_key(db, "inside", &[(Action::Write, "files/made/sub/*")]);
+    let host = spawn(state.clone());
+    buckets_are_made_and_removed(&host, &as_key(&host, &writer)).await;
+
+    // A bucket is made and removed by a key that may write the bucket itself.
+    let (reader, inside) = (as_key(&host, &reader), as_key(&host, &inside));
+    let body = vec![b'x'; 1 << 20];
+    let resp = send(&host, reader(Req::new("PUT", "/s3/new").body(body))).await;
+    resp.is(403, "AccessDenied");
+    send(&host, inside(Req::new("PUT", "/s3/made")))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, as_key(&host, &writer)(Req::new("PUT", "/s3/made")))
+        .await
+        .ok(200);
+    send(&host, reader(Req::new("DELETE", "/s3/made")))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, inside(Req::new("DELETE", "/s3/made")))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, reader(Req::new("HEAD", "/s3/made")))
+        .await
+        .ok(200);
+}
+
+/// A copy's `CopyObjectResult`: its `ETag` element, unescaped.
+#[track_caller]
+fn copied(resp: &Resp) -> String {
+    resp.ok(200);
+    assert!(
+        resp.body.starts_with(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><CopyObjectResult \
+             xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"><LastModified>"
+        ),
+        "{}",
+        resp.body
+    );
+    assert!(element(&resp.body, "LastModified").ends_with(".000Z"));
+    element(&resp.body, "ETag").replace("&quot;", "\"")
+}
+
+/// CopyObject within and across buckets: the bytes, ETag and metadata carried or replaced,
+/// the source's four conditions and the destination's two, and what cannot be copied.
+async fn objects_are_copied(host: &str, sign: Sign<'_>) -> Vec<u8> {
+    let data = bytes_of_len(70_000);
+    let etag = format!("\"{}\"", md5_hex(&data));
+    let put = Req::new("PUT", "/s3/src/d/k")
+        .header("x-amz-meta-mtime", "1700000000")
+        .body(data.clone());
+    send(host, sign(put)).await.ok(200);
+    let copy = |to: &str, from: &str| Req::new("PUT", to).header("x-amz-copy-source", from);
+    let got = async |path: &str| {
+        let resp = send(host, sign(Req::new("GET", path))).await;
+        is_object(&resp, &data);
+        assert_eq!(resp.header("etag"), Some(&*etag));
+        resp
+    };
+
+    // Within the bucket, then across buckets in the spellings clients send.
+    let resp = send(host, sign(copy("/s3/src/e/copy", "/src/d/k"))).await;
+    assert_eq!(copied(&resp), etag);
+    let resp = got("/s3/src/e/copy").await;
+    assert_eq!(resp.header("x-amz-meta-mtime"), Some("1700000000"));
+    for (to, from) in [
+        ("/s3/dst/copy", "src/d/k"),
+        ("/s3/dst/escaped", "%2Fsrc%2Fd%2Fk"),
+    ] {
+        assert_eq!(copied(&send(host, sign(copy(to, from))).await), etag);
+        let resp = got(to).await;
+        assert_eq!(resp.header("x-amz-meta-mtime"), Some("1700000000"));
+    }
+
+    // REPLACE takes the request's metadata and keeps the bytes' MD5; onto itself, only so.
+    let replace = |to: &str| {
+        copy(to, "/src/d/k")
+            .header("x-amz-metadata-directive", "REPLACE")
+            .header("x-amz-meta-other", "x")
+    };
+    assert_eq!(
+        copied(&send(host, sign(replace("/s3/dst/replaced"))).await),
+        etag
+    );
+    let resp = got("/s3/dst/replaced").await;
+    assert_eq!(resp.header("x-amz-meta-other"), Some("x"));
+    assert_eq!(resp.header("x-amz-meta-mtime"), None);
+    send(host, sign(copy("/s3/src/d/k", "/src/d/k")))
+        .await
+        .is(400, "InvalidRequest");
+    let directive = copy("/s3/src/d/k", "/src/d/k").header("x-amz-metadata-directive", "COPY");
+    send(host, sign(directive)).await.is(400, "InvalidRequest");
+    assert_eq!(
+        copied(&send(host, sign(replace("/s3/src/d/k"))).await),
+        etag
+    );
+    let resp = got("/s3/src/d/k").await;
+    assert_eq!(resp.header("x-amz-meta-other"), Some("x"));
+    assert_eq!(resp.header("x-amz-meta-mtime"), None);
+    let bad = copy("/s3/dst/x", "/src/d/k").header("x-amz-metadata-directive", "MOVE");
+    send(host, sign(bad)).await.is(400, "InvalidArgument");
+
+    // The source's conditions, each met and failed.
+    let past = "Mon, 01 Jan 2001 00:00:00 GMT";
+    let future = "Fri, 01 Jan 2100 00:00:00 GMT";
+    for (name, met, failed) in [
+        ("x-amz-copy-source-if-match", etag.as_str(), "\"other\""),
+        (
+            "x-amz-copy-source-if-none-match",
+            "\"other\"",
+            etag.as_str(),
+        ),
+        ("x-amz-copy-source-if-modified-since", past, future),
+        ("x-amz-copy-source-if-unmodified-since", future, past),
+    ] {
+        let req = copy("/s3/dst/conditional", "/src/d/k").header(name, met);
+        assert_eq!(copied(&send(host, sign(req)).await), etag, "{name}");
+        let req = copy("/s3/dst/conditional", "/src/d/k").header(name, failed);
+        send(host, sign(req)).await.is(412, "PreconditionFailed");
+    }
+    // The destination's: create only, or replace only what it names.
+    let req = copy("/s3/dst/copy", "/src/d/k").header("If-None-Match", "*");
+    send(host, sign(req)).await.is(412, "PreconditionFailed");
+    let req = copy("/s3/dst/copy", "/src/d/k").header("If-Match", "\"other\"");
+    send(host, sign(req)).await.is(412, "PreconditionFailed");
+    let req = copy("/s3/dst/copy", "/src/d/k").header("If-Match", &etag);
+    assert_eq!(copied(&send(host, sign(req)).await), etag);
+    let req = copy("/s3/dst/fresh", "/src/d/k").header("If-None-Match", "*");
+    assert_eq!(copied(&send(host, sign(req)).await), etag);
+
+    // What names no object, or no place for one.
+    for (to, from, status, code) in [
+        ("/s3/dst/x", "/src/absent", 404, "NoSuchKey"),
+        ("/s3/dst/x", "/src/d", 404, "NoSuchKey"),
+        ("/s3/dst/x", "/nobucket/k", 404, "NoSuchBucket"),
+        (
+            "/s3/dst/x",
+            "/src/d/k?versionId=null",
+            501,
+            "NotImplemented",
+        ),
+        ("/s3/dst/x", "/src", 400, "InvalidArgument"),
+        ("/s3/dst/x", "/src/a%20b", 400, "InvalidArgument"),
+        ("/s3/src/d", "/src/d/k", 409, "OperationAborted"),
+        ("/s3/src/d/k/below", "/src/e/copy", 409, "OperationAborted"),
+    ] {
+        let resp = send(host, sign(copy(to, from))).await;
+        resp.is(status, code);
+    }
+    send(host, sign(Req::new("GET", "/s3/dst/x")))
+        .await
+        .is(404, "NoSuchKey");
+    data
+}
+
+/// A copy is a second tag on the same layer: `/v2/` names one digest for both.
+async fn one_layer_two_tags(host: &str, data: &[u8], bearer: Option<&str>) {
+    let layer = format!("sha256:{}", sha256_hex(data));
+    for path in [
+        "/v2/files/src/d/manifests/k",
+        "/v2/files/dst/manifests/copy",
+    ] {
+        let mut req = Req::new("GET", path).header("Accept", MANIFEST_TYPE);
+        if let Some(key) = bearer {
+            req = req.header("Authorization", &format!("Bearer {key}"));
+        }
+        let resp = send(host, req).await;
+        assert_eq!(resp.status, 200, "{path}: {}", resp.body);
+        let manifest: serde_json::Value = serde_json::from_slice(&resp.bytes).unwrap();
+        assert_eq!(manifest["layers"][0]["digest"], layer.as_str(), "{path}");
+        assert_eq!(
+            manifest["annotations"]["org.virtkit.md5"],
+            md5_hex(data).as_str()
+        );
+    }
+}
+
+#[tokio::test]
+async fn objects_are_copied_on_an_open_server() {
+    let dir = tmp("copy-open");
+    let host = spawn(open_state(&dir, true));
+    let data = objects_are_copied(&host, &|r| r).await;
+    one_layer_two_tags(&host, &data, None).await;
+    let blobs = std::fs::read_dir(dir.join("store/repos/files/dst/blobs"))
+        .unwrap()
+        .count();
+    assert_eq!(
+        blobs, 2,
+        "the destination holds the layer and the empty config"
+    );
+    assert_eq!(staging_left(&dir), 0);
+}
+
+#[tokio::test]
+async fn objects_are_copied_with_an_api_key() {
+    let dir = tmp("copy-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let writer = api_key(db, "writer", &[(Action::Write, "files/*")]);
+    let reader = api_key(db, "reader", &[(Action::Read, "files/*")]);
+    let dst_reader = api_key(db, "dst-reader", &[(Action::Read, "files/dst/*")]);
+    let blind = api_key(
+        db,
+        "blind",
+        &[
+            (Action::Write, "files/dst/*"),
+            (Action::Read, "files/src/d/k/*"),
+        ],
+    );
+    let host = spawn(state.clone());
+    let data = objects_are_copied(&host, &as_key(&host, &writer)).await;
+    one_layer_two_tags(&host, &data, Some(&writer)).await;
+
+    let copy = |to: &str, from: &str| Req::new("PUT", to).header("x-amz-copy-source", from);
+    // A key that may read the copy only, reads its bytes through the copy.
+    let resp = send(
+        &host,
+        as_key(&host, &dst_reader)(Req::new("GET", "/s3/dst/copy")),
+    )
+    .await;
+    is_object(&resp, &data);
+    send(
+        &host,
+        as_key(&host, &dst_reader)(Req::new("GET", "/s3/src/d/k")),
+    )
+    .await
+    .is(403, "AccessDenied");
+    // A read-only key may not write the destination; a source the key may not read is absent.
+    let resp = send(
+        &host,
+        as_key(&host, &reader)(copy("/s3/dst/new", "/src/d/k")),
+    )
+    .await;
+    resp.is(403, "AccessDenied");
+    let resp = send(
+        &host,
+        as_key(&host, &blind)(copy("/s3/dst/new", "/src/d/k")),
+    )
+    .await;
+    resp.is(404, "NoSuchKey");
+    let resp = send(
+        &host,
+        as_key(&host, &blind)(copy("/s3/dst/new", "/src/e/copy")),
+    )
+    .await;
+    resp.is(403, "AccessDenied");
+    send(
+        &host,
+        as_key(&host, &writer)(Req::new("GET", "/s3/dst/new")),
+    )
+    .await
+    .is(404, "NoSuchKey");
+}
+
+/// A `Delete` document of `objects` (each an `<Object>`'s content), quiet when asked.
+fn delete_doc(objects: &[&str], quiet: bool) -> Vec<u8> {
+    let mut doc = String::from(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+         <Delete xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">",
+    );
+    for o in objects {
+        doc.push_str(&format!("<Object>{o}</Object>"));
+    }
+    if quiet {
+        doc.push_str("<Quiet>true</Quiet>");
+    }
+    doc.push_str("</Delete>");
+    doc.into_bytes()
+}
+
+fn key_of(k: &str) -> String {
+    format!("<Key>{k}</Key>")
+}
+
+/// A `DeleteResult`: the keys deleted, and each error's key and code.
+#[track_caller]
+fn delete_result(resp: &Resp) -> (Vec<String>, Vec<(String, String)>) {
+    resp.ok(200);
+    assert!(
+        resp.body.starts_with(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><DeleteResult \
+             xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\""
+        ),
+        "{}",
+        resp.body
+    );
+    let deleted = elements(&resp.body, "Deleted")
+        .iter()
+        .map(|d| element(d, "Key"))
+        .collect();
+    let errors = elements(&resp.body, "Error")
+        .iter()
+        .map(|e| {
+            assert_eq!(elements(e, "Message").len(), 1, "{e}");
+            (element(e, "Key"), element(e, "Code"))
+        })
+        .collect();
+    (deleted, errors)
+}
+
+/// The request deleting `doc` from `bucket`, with its `Content-MD5`.
+fn delete_objects(bucket: &str, doc: Vec<u8>) -> Req {
+    Req::new("POST", &format!("/s3/{bucket}"))
+        .query("delete=")
+        .header("Content-MD5", &b64(&md5::compute(&doc).0))
+        .body(doc)
+}
+
+/// DeleteObjects with every outcome a key can have, verbose and quiet, and the documents and
+/// digests that are refused whole.
+async fn objects_are_deleted_in_batches(host: &str, sign: Sign<'_>, store: &Store) {
+    for path in [
+        "/s3/batch/a",
+        "/s3/batch/d/b",
+        "/s3/batch/c",
+        "/s3/batch/kept",
+    ] {
+        let put = Req::new("PUT", path).body(HELLO.to_vec());
+        send(host, sign(put)).await.ok(200);
+    }
+    store
+        .put_manifest(
+            "files/batch/img",
+            "v1",
+            MANIFEST_TYPE,
+            br#"{"schemaVersion":2}"#,
+        )
+        .unwrap();
+    let pair = |k: &str, code: &str| (k.to_string(), code.to_string());
+
+    // A digest that does not hold, or a document that is none, deletes nothing.
+    let doc = delete_doc(&[&key_of("kept")], false);
+    let wrong = delete_objects("batch", doc.clone()).replace("Content-MD5", &b64(&[0; 16]));
+    send(host, sign(wrong)).await.is(400, "BadDigest");
+    let crc = Req::new("POST", "/s3/batch")
+        .query("delete=")
+        .header("x-amz-checksum-crc32", &b64(&[0; 4]))
+        .body(doc.clone());
+    send(host, sign(crc)).await.is(400, "BadDigest");
+    let too_many: Vec<String> = (0..1001).map(|i| key_of(&format!("k{i}"))).collect();
+    let too_many: Vec<&str> = too_many.iter().map(String::as_str).collect();
+    let mut over = delete_doc(&[&key_of("kept")], false);
+    over.extend(std::iter::repeat_n(b' ', 1 << 20));
+    for bad in [
+        delete_doc(&too_many, false),
+        delete_doc(&["<Key>&ent;</Key>"], false),
+        delete_doc(&[], false),
+        b"<?xml version=\"1.0\"?><!DOCTYPE d><Delete/>".to_vec(),
+        over,
+    ] {
+        let resp = send_refused(host, sign(delete_objects("batch", bad))).await;
+        resp.is(400, "MalformedXML");
+    }
+    is_object(
+        &send(host, sign(Req::new("GET", "/s3/batch/kept"))).await,
+        HELLO,
+    );
+
+    // Every outcome, in the order asked.
+    let doc = delete_doc(
+        &[
+            &key_of("a"),
+            &key_of("absent"),
+            &key_of("a&amp;b"),
+            &key_of("d"),
+            &key_of("img/v1"),
+            "<Key>c</Key><VersionId>null</VersionId>",
+            &key_of("d/b"),
+            &key_of("x/../y"),
+        ],
+        false,
+    );
+    let (deleted, errors) = delete_result(&send(host, sign(delete_objects("batch", doc))).await);
+    assert_eq!(deleted, ["a", "absent", "d", "d/b"]);
+    assert_eq!(
+        errors,
+        [
+            pair("a&amp;b", "InvalidArgument"),
+            pair("img/v1", "OperationAborted"),
+            pair("c", "NotImplemented"),
+            pair("x/../y", "InvalidArgument"),
+        ]
+    );
+    for gone in ["/s3/batch/a", "/s3/batch/d/b"] {
+        send(host, sign(Req::new("GET", gone)))
+            .await
+            .is(404, "NoSuchKey");
+    }
+    is_object(
+        &send(host, sign(Req::new("GET", "/s3/batch/c"))).await,
+        HELLO,
+    );
+    assert_eq!(
+        store.has_manifests("files/batch/img", &["v1"]).unwrap(),
+        [true]
+    );
+
+    // Quiet: only the errors.
+    let doc = delete_doc(&[&key_of("c"), &key_of("img/v1")], true);
+    let resp = send(host, sign(delete_objects("batch", doc))).await;
+    let (deleted, errors) = delete_result(&resp);
+    assert!(deleted.is_empty(), "{}", resp.body);
+    assert_eq!(errors, [pair("img/v1", "OperationAborted")]);
+    let doc = delete_doc(&[&key_of("kept")], true);
+    let resp = send(host, sign(delete_objects("batch", doc))).await;
+    assert!(
+        resp.body.ends_with(
+            "<DeleteResult \
+         xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"/>"
+        ),
+        "{}",
+        resp.body
+    );
+    // A correct checksum header, and none at all.
+    send(
+        host,
+        sign(Req::new("PUT", "/s3/batch/c").body(HELLO.to_vec())),
+    )
+    .await
+    .ok(200);
+    let doc = delete_doc(&[&key_of("c")], false);
+    let crc = Req::new("POST", "/s3/batch")
+        .query("delete=")
+        .header("x-amz-checksum-crc32", &crc32_b64(&doc))
+        .body(doc.clone());
+    assert_eq!(delete_result(&send(host, sign(crc)).await).0, ["c"]);
+    let plain = Req::new("POST", "/s3/batch").query("delete=").body(doc);
+    assert_eq!(delete_result(&send(host, sign(plain)).await).0, ["c"]);
+    // A bucket that is not there holds none of the keys.
+    let doc = delete_doc(&[&key_of("k")], false);
+    let resp = send(host, sign(delete_objects("nobucket", doc))).await;
+    assert_eq!(delete_result(&resp).0, ["k"]);
+}
+
+#[tokio::test]
+async fn objects_are_deleted_in_batches_on_an_open_server() {
+    let dir = tmp("batch-open");
+    let state = open_state(&dir, true);
+    let store = state.store.clone();
+    let host = spawn(state);
+    objects_are_deleted_in_batches(&host, &|r| r, &store).await;
+    // The signed payload hash binds the document.
+    let doc = delete_doc(&[&key_of("k")], false);
+    let signed = |payload: &str| {
+        delete_objects("batch", doc.clone()).signed_payload(&host, ("any", "any"), 0, payload)
+    };
+    assert_eq!(
+        delete_result(&send(&host, signed(&sha256_hex(&doc))).await).0,
+        ["k"]
+    );
+    send(&host, signed(&sha256_hex(b"another")))
+        .await
+        .is(400, "XAmzContentSHA256Mismatch");
+    // The subresource as SDKs write it, with no `=`.
+    let bare = Req::new("POST", "/s3/batch").query("delete").body(doc);
+    assert_eq!(delete_result(&send(&host, bare).await).0, ["k"]);
+    let resp = send(&host, Req::new("GET", "/s3/batch").query("versioning")).await;
+    resp.ok(200);
+}
+
+#[tokio::test]
+async fn objects_are_deleted_in_batches_with_an_api_key() {
+    let dir = tmp("batch-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let writer = api_key(db, "writer", &[(Action::Write, "files/*")]);
+    let reader = api_key(db, "reader", &[(Action::Read, "files/*")]);
+    let inside = api_key(db, "inside", &[(Action::Write, "files/batch/w/*")]);
+    let host = spawn(state.clone());
+    objects_are_deleted_in_batches(&host, &as_key(&host, &writer), &state.store).await;
+
+    for path in ["/s3/batch/w/x", "/s3/batch/y"] {
+        let put = Req::new("PUT", path).body(HELLO.to_vec());
+        send(&host, as_key(&host, &writer)(put)).await.ok(200);
+    }
+    let doc = || delete_doc(&[&key_of("w/x"), &key_of("y")], false);
+    // The keys a credential may not delete are reported, the others deleted.
+    let resp = send(
+        &host,
+        as_key(&host, &reader)(delete_objects("batch", doc())),
+    )
+    .await;
+    let (deleted, errors) = delete_result(&resp);
+    assert!(deleted.is_empty());
+    let codes: Vec<&str> = errors.iter().map(|(_, c)| c.as_str()).collect();
+    assert_eq!(codes, ["AccessDenied", "AccessDenied"]);
+    let resp = send(
+        &host,
+        as_key(&host, &inside)(delete_objects("batch", doc())),
+    )
+    .await;
+    let (deleted, errors) = delete_result(&resp);
+    assert_eq!(deleted, ["w/x"]);
+    assert_eq!(errors, [("y".to_string(), "AccessDenied".to_string())]);
+    let get = |path: &str| as_key(&host, &writer)(Req::new("GET", path));
+    send(&host, get("/s3/batch/w/x")).await.is(404, "NoSuchKey");
+    is_object(&send(&host, get("/s3/batch/y")).await, HELLO);
+}
+
+/// The configurations tools probe, on a bucket and an object that exist and on ones that do
+/// not, and their writes refused.
+async fn configurations_are_canned(host: &str, sign: Sign<'_>) {
+    send(
+        host,
+        sign(Req::new("PUT", "/s3/conf/k").body(HELLO.to_vec())),
+    )
+    .await
+    .ok(200);
+    let get = |path: &str, q: &str| sign(Req::new("GET", path).query(&format!("{q}=")));
+    let doc = |root: &str, inner: &str| {
+        let open = format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><{root} \
+             xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\""
+        );
+        if inner.is_empty() {
+            format!("{open}/>")
+        } else {
+            format!("{open}>{inner}</{root}>")
+        }
+    };
+    for (q, root, inner) in [
+        ("versioning", "VersioningConfiguration", ""),
+        ("tagging", "Tagging", "<TagSet/>"),
+        ("logging", "BucketLoggingStatus", ""),
+        ("notification", "NotificationConfiguration", ""),
+        (
+            "requestPayment",
+            "RequestPaymentConfiguration",
+            "<Payer>BucketOwner</Payer>",
+        ),
+        ("accelerate", "AccelerateConfiguration", ""),
+    ] {
+        let resp = send(host, get("/s3/conf", q)).await;
+        resp.ok(200);
+        assert_eq!(resp.body, doc(root, inner), "{q}");
+        send(host, get("/s3/none", q)).await.is(404, "NoSuchBucket");
+    }
+    for path in ["/s3/conf", "/s3/conf/k"] {
+        let resp = send(host, get(path, "acl")).await;
+        resp.ok(200);
+        assert!(
+            resp.body.contains(
+                "<Grant><Grantee xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" \
+             xsi:type=\"CanonicalUser\"><ID>vk-registry</ID><DisplayName>vk-registry\
+             </DisplayName></Grantee><Permission>FULL_CONTROL</Permission></Grant>"
+            ),
+            "{}",
+            resp.body
+        );
+        assert!(
+            resp.body.contains(
+                "<Owner><ID>vk-registry</ID><DisplayName>vk-registry</DisplayName></Owner>"
+            )
+        );
+    }
+    let resp = send(host, get("/s3/conf/k", "tagging")).await;
+    resp.ok(200);
+    assert_eq!(resp.body, doc("Tagging", "<TagSet/>"));
+    for q in ["tagging", "acl"] {
+        send(host, get("/s3/conf/absent", q))
+            .await
+            .is(404, "NoSuchKey");
+    }
+    for (q, code) in [
+        ("lifecycle", "NoSuchLifecycleConfiguration"),
+        ("policy", "NoSuchBucketPolicy"),
+        ("policyStatus", "NoSuchBucketPolicy"),
+        ("cors", "NoSuchCORSConfiguration"),
+        (
+            "encryption",
+            "ServerSideEncryptionConfigurationNotFoundError",
+        ),
+        ("object-lock", "ObjectLockConfigurationNotFoundError"),
+        ("replication", "ReplicationConfigurationNotFoundError"),
+        ("website", "NoSuchWebsiteConfiguration"),
+        ("publicAccessBlock", "NoSuchPublicAccessBlockConfiguration"),
+        ("ownershipControls", "OwnershipControlsNotFoundError"),
+    ] {
+        send(host, get("/s3/conf", q)).await.is(404, code);
+        send(host, get("/s3/none", q)).await.is(404, "NoSuchBucket");
+    }
+    // Nothing of it is written.
+    for (method, path, q) in [
+        ("PUT", "/s3/conf", "versioning"),
+        ("PUT", "/s3/conf", "policy"),
+        ("PUT", "/s3/conf", "acl"),
+        ("DELETE", "/s3/conf", "tagging"),
+        ("DELETE", "/s3/conf", "lifecycle"),
+        ("PUT", "/s3/conf/k", "acl"),
+        ("PUT", "/s3/conf/k", "tagging"),
+        ("DELETE", "/s3/conf/k", "tagging"),
+    ] {
+        let req = Req::new(method, path)
+            .query(&format!("{q}="))
+            .body(b"<Tagging/>".to_vec());
+        send(host, sign(req)).await.is(501, "NotImplemented");
+    }
+    is_object(
+        &send(host, sign(Req::new("GET", "/s3/conf/k"))).await,
+        HELLO,
+    );
+}
+
+#[tokio::test]
+async fn configurations_are_canned_on_an_open_server() {
+    let dir = tmp("canned-open");
+    let host = spawn(open_state(&dir, true));
+    configurations_are_canned(&host, &|r| r).await;
+}
+
+#[tokio::test]
+async fn configurations_are_canned_with_an_api_key() {
+    let dir = tmp("canned-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let writer = api_key(db, "writer", &[(Action::Write, "files/*")]);
+    let other = api_key(db, "other", &[(Action::Read, "files/other/*")]);
+    let host = spawn(state.clone());
+    configurations_are_canned(&host, &as_key(&host, &writer)).await;
+    // Read on neither the bucket nor anything in it: refused, as HeadBucket is.
+    let other = as_key(&host, &other);
+    send(
+        &host,
+        other(Req::new("GET", "/s3/conf").query("versioning=")),
+    )
+    .await
+    .is(403, "AccessDenied");
+    send(&host, other(Req::new("GET", "/s3/conf/k").query("acl=")))
+        .await
+        .is(403, "AccessDenied");
+}

From 967918acf8a9fea767698e20b9dc36683a7509d0 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 14:33:37 +0100
Subject: [PATCH 10/54] vk-registry/s3: serve multipart uploads

Serve CreateMultipartUpload, UploadPart and UploadPartCopy,
CompleteMultipartUpload, AbortMultipartUpload, ListParts and
ListMultipartUploads. An upload is a private directory under
uploads/s3/ holding its record and its parts, each replaced whole; a
part is received and checked as a PutObject's body is, and a completion
concatenates the parts in one pass off the runtime, checking each part's
MD5 again, then tags the object as a PutObject is, under the multipart
ETag "<md5 of the parts' md5s>-<parts>". The completion's Location is
the object's absolute URL, as S3 gives it: the listener's scheme, the
Host the request was sent to and its path.

The gc sweeps an upload once nothing in it has been written for the
grace window, and status counts the uploads in progress.
---
 CHANGELOG.md                      |    6 +-
 README.md                         |    4 +-
 vk-registry/DESIGN.md             |   65 +-
 vk-registry/src/files.rs          |   36 +
 vk-registry/src/lib.rs            |  259 +++++-
 vk-registry/src/s3/conditional.rs |   53 +-
 vk-registry/src/s3/copy.rs        |   13 +-
 vk-registry/src/s3/list.rs        |    4 +-
 vk-registry/src/s3/mod.rs         |   39 +-
 vk-registry/src/s3/multipart.rs   | 1321 +++++++++++++++++++++++++++++
 vk-registry/src/s3/object.rs      |  324 ++++---
 vk-registry/tests/s3_e2e.rs       |  434 +++++++++-
 12 files changed, 2351 insertions(+), 207 deletions(-)
 create mode 100644 vk-registry/src/s3/multipart.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d9a19f9..d60e9bc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,8 +18,10 @@ All notable changes to virtkit will be documented in this file.
   checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
   Buckets can be created and removed, objects copied without their bytes being stored twice
   and deleted in batches, and the configuration probes tools send before using a bucket
-  (versioning, ACLs, tagging and the like) are answered as for a bucket with none set;
-  multipart uploads are not served yet. Set `s3 = false` in the server config to turn it off.
+  (versioning, ACLs, tagging and the like) are answered as for a bucket with none set. Large
+  files can be uploaded in parts, as the AWS CLI uploads them, parts copied from other objects,
+  and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
+  them. Set `s3 = false` in the server config to turn it off.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/README.md b/README.md
index f6ecf50e..77b19199 100644
--- a/README.md
+++ b/README.md
@@ -867,8 +867,8 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 ```
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
-bytes); objects are at most 4 GiB; presigned URLs are refused. Multipart uploads are not
-served yet. Set `s3 = false` to disable it.
+bytes); objects are at most 4 GiB; presigned URLs are refused. Set `s3 = false` to disable
+it.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 2f990c1f..5f6eda79 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -556,7 +556,11 @@ an object under a name a collection already holds. Idleness is the tag's mtime,
 `PUT` sets and a `GET` refreshes once it is an hour old, so a read-only pipeline's hits keep
 an entry alive as a writer's do. There is no per-directory policy and no size cap; a
 replaced or deleted object frees no disk until the next `gc`. A staging file a crashed `PUT`
-left in `uploads/` goes with the idle uploads.
+left in `uploads/` goes with the idle uploads, and so does an S3 multipart upload nothing has
+been written into for the grace window: its directory under `uploads/s3/` is idle by the
+newest mtime among its files (the directory's own does not move when a part is replaced),
+and goes whole, parts and all. Completing an upload marks it used, so the sweep does not
+take it while its parts are read.
 
 ## S3 view (`/s3/`)
 
@@ -637,7 +641,9 @@ is not stored, for the reason manifest media types are restricted (this origin a
 which a `PutObject` computes in the same pass as the SHA-256 and records on the manifest as
 `org.virtkit.md5`; an object written otherwise (WebDAV, `vk registry put`, `/upload`) has no
 MD5 and its ETag is its SHA-256, quoted — 64 hex digits, which a client checking an ETag as
-an MD5 sees is not one. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
+an MD5 sees is not one. An object a multipart upload made has S3's multipart ETag,
+`"<MD5 of its parts' MD5s>-<parts>"`, recorded in the same annotation, so GetObject, HeadObject,
+the listings and a copy's source all answer it. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
 of names and values) is kept on the manifest as `org.virtkit.s3-meta.<name>` and sent back on
 reads; a replaced object keeps only what its own write sent.
 
@@ -657,17 +663,25 @@ reads; a replaced object keeps only what its own write sent.
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| anything else | 501 `NotImplemented`: multipart uploads and part copies, writes of tagging, ACLs, versioning and the other configurations, and every other subresource; an SDK's `x-id` operation hint is ignored |
-
-**XML in** (`Delete`, `CreateBucketConfiguration`) is read by an element scanner of this
-registry's own, not a parser: UTF-8 only; the XML declaration, processing instructions and
-comments are passed over and CDATA is text; `&lt; &gt; &amp; &quot; &apos;` and character
-references are decoded, and any other entity, or a document type declaration (which could
-define one), is 400 `MalformedXML`, so nothing is fetched or expanded. Elements are known by
-their local name, so namespaces and attributes say nothing, and an element a request does not
-define is passed over. Nesting is at most 16 deep and a document holds a bounded number of
-elements (6 per key and a few more for a `Delete`), so it costs at most its length in memory;
-a field given twice, a missing `Key` or anything that is not well formed is `MalformedXML`.
+| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed; `x-amz-copy-source` is 400 `InvalidArgument` |
+| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
+| UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-{sha256,sha1,crc32}` is checked against the object (400 `BadDigest`); a composite one (`…-<parts>`) or another algorithm is taken unchecked. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
+| `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload` |
+| `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
+| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; 404 `NoSuchBucket` |
+| anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take; an SDK's `x-id` operation hint is ignored |
+
+**XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
+element scanner of this registry's own, not a parser: UTF-8 only; the XML declaration,
+processing instructions and comments are passed over and CDATA is text;
+`&lt; &gt; &amp; &quot; &apos;` and character references are decoded, and any other entity, or
+a document type declaration (which could define one), is 400 `MalformedXML`, so nothing is
+fetched or expanded. Elements are known by their local name, so namespaces and attributes say
+nothing, and an element a request does not define is passed over. Nesting is at most 16 deep and a document holds a bounded number of
+elements (6 per key or part and a few more for a `Delete` or a `CompleteMultipartUpload`, of
+at most 1 MiB), so it costs at most its length in memory; a field given twice, a missing `Key`,
+`PartNumber` or `ETag`, or anything that is not well formed is `MalformedXML`.
 
 **`aws-chunked` bodies**, which AWS's SDKs and CLI send by default, are decoded as they
 stream, in one pass: a run of `<hex size>[;chunk-signature=<sig>]\r\n<data>\r\n` chunks ended
@@ -719,6 +733,20 @@ small reads for a full page. A listing with `delimiter=/` never walks below the
 lists; one without a delimiter over a sharded `sccache` directory walks its thousands of
 repositories across its pages (see "Operational constraints and deferred work").
 
+**Multipart uploads** are staged in the store, each in a private directory
+`uploads/s3/<id>/` the gc sweeps once idle ("Lifecycle" above), not in the pool: `meta.json`
+(the bucket, the key, when it was created and the user metadata the object will carry), and
+for each part `part-<n>` (its bytes) and `part-<n>.json` (their size and MD5). Each file is
+written under a private temporary name and renamed over its own, so a part sent again replaces
+the earlier one whole; since a part's bytes and its record are two renames, completing an
+upload checks each part's MD5 again as it reads it. An upload id is minted as an OCI upload id
+is, `<pid>-<n>-<random hex>`, and held to hex digits and dashes, so it never names a path, and
+every call checks that the id's recorded bucket and key are the request's. A part's bytes
+stay out of the pool until the upload completes, so parts of the same content are stored once
+per upload until then; completing an upload costs a sequential read and write of the whole
+object, and listing uploads reads the record of every upload in progress in the store.
+`vk-registry status` counts the multipart uploads in progress beside the OCI ones.
+
 **`LastModified` moves on reads**, as `getlastmodified` does over WebDAV: a `GET` refreshes
 the tag's mtime once it is an hour old, which is what keeps a hot cache entry from the gc's
 retention. Sync tools that compare modification times (`aws s3 sync`, rclone `--update`) see
@@ -788,10 +816,10 @@ service; an operator can still stop the server and use direct database access.
 ## Garbage collection and reporting
 
 `status` reports stored blob bytes split by whether tags reference them, with in-progress
-uploads counted separately. A blob counts as referenced when the `gc` mark would reach it
-from a tag, image indexes included. The repository table lists tag counts. Bytes without
-tag references are not a prediction of what `gc` will reclaim: its retention and grace
-windows still apply.
+uploads, and the S3 multipart uploads in progress, counted separately. A blob counts as
+referenced when the `gc` mark would reach it from a tag, image indexes included. The
+repository table lists tag counts. Bytes without tag references are not a prediction of what
+`gc` will reclaim: its retention and grace windows still apply.
 
 `Stage data` is the uncompressed data in recorded completed build stages, including builder
 stages but excluding intermediate instruction checkpoints. It sums the chunk placement
@@ -825,7 +853,8 @@ and markers included, waits for the next complete pass.
 `gc` applies two windows:
 
 - retention controls when idle tags stop being roots; and
-- grace protects recent unreferenced blobs, digest-pinned manifests, and uploads.
+- grace protects recent unreferenced blobs, digest-pinned manifests, and uploads, S3
+  multipart uploads among them (idle by the newest file in the upload's directory).
 
 A manifest can set its own tags' retention through annotations, which the pusher chooses:
 `org.virtkit.retention=keep` keeps a tag however long it sits idle, and
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index 780148b0..ac596a4b 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -247,6 +247,21 @@ where
     B::Error: std::error::Error + Send + Sync + 'static,
 {
     let (path, file) = store.stage_file().map_err(PutError::Failed)?;
+    stage_into(path, file, body, tap).await
+}
+
+/// [`stage`] into `file`, a private file just created at `path`, which is then the
+/// [`Staged`]'s: unlinked if it is dropped.
+pub(crate) async fn stage_into<B>(
+    path: PathBuf,
+    file: std::fs::File,
+    body: B,
+    tap: &mut impl FnMut(&[u8]),
+) -> std::result::Result<Staged, PutError>
+where
+    B: hyper::body::Body<Data = Bytes> + Unpin,
+    B::Error: std::error::Error + Send + Sync + 'static,
+{
     let staging = Staging { path, armed: true };
     let mut file = tokio::fs::File::from_std(file);
     let written = drain_into(&mut file, body, MAX_OBJECT, tap).await;
@@ -259,6 +274,27 @@ where
     Ok(Staged { size, hex, staging })
 }
 
+impl Staged {
+    /// A staging file `path` its caller wrote whole, `size` bytes whose SHA-256 is `hex`:
+    /// unlinked if it is dropped, as one [`stage`] wrote.
+    pub(crate) fn written(path: PathBuf, size: u64, hex: String) -> Self {
+        Staged {
+            size,
+            hex,
+            staging: Staging { path, armed: true },
+        }
+    }
+
+    /// Rename the bytes to `dest`, replacing what is there, rather than promote them: for a
+    /// front that keeps them outside the pool for a while, such as an S3 part.
+    pub(crate) fn rename_to(mut self, dest: &std::path::Path) -> Result<()> {
+        std::fs::rename(&self.staging.path, dest)
+            .with_context(|| format!("renaming into {}", dest.display()))?;
+        self.staging.armed = false;
+        Ok(())
+    }
+}
+
 /// What [`commit`] did.
 pub(crate) enum Written {
     /// the object is new
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index cf7f4d6f..8c54d894 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -21,6 +21,7 @@
 //!                                 which is what makes a blob read repo-scoped
 //!   uploads/<id>                  in-progress blob uploads (this process only)
 //!   uploads/owners/<id>           the repository that upload session was opened for
+//!   uploads/s3/<id>/              an S3 multipart upload: its `meta.json` and parts
 
 use std::cell::Cell;
 use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
@@ -606,12 +607,7 @@ impl Store {
     pub(crate) fn stage_file(&self) -> Result<(PathBuf, std::fs::File)> {
         let dir = self.uploads_dir();
         std::fs::create_dir_all(&dir).with_context(|| format!("creating {}", dir.display()))?;
-        let path = self.upload_path(&format!(
-            "{}-{}-{}",
-            std::process::id(),
-            self.next_upload.fetch_add(1, Ordering::Relaxed),
-            accounts::random_token(16),
-        ));
+        let path = self.upload_path(&self.new_upload_id());
         let mut opts = std::fs::OpenOptions::new();
         opts.write(true).create_new(true);
         #[cfg(unix)]
@@ -625,6 +621,59 @@ impl Store {
         Ok((path, file))
     }
 
+    /// A fresh upload id, `<pid>-<n>-<random hex>`: the counter keeps ids unique within a
+    /// process, the pid across the servers sharing a store, and the random tail unguessable,
+    /// so one client cannot reach another's in-flight upload by enumerating ids. Always a
+    /// [`valid_upload_id`].
+    fn new_upload_id(&self) -> String {
+        format!(
+            "{}-{}-{}",
+            std::process::id(),
+            self.next_upload.fetch_add(1, Ordering::Relaxed),
+            accounts::random_token(16),
+        )
+    }
+
+    /// Where S3 multipart uploads are staged, a directory each. A subdirectory of `uploads/`
+    /// whose name no upload id can take, so the OCI sessions beside it never collide with it.
+    fn multipart_root(&self) -> PathBuf {
+        self.root.join("uploads").join(MULTIPART_DIR)
+    }
+
+    /// The directory of S3 multipart upload `id`, whether or not it exists; `None` for an id
+    /// this server cannot have minted, which so never names anything outside it.
+    pub(crate) fn multipart_dir(&self, id: &str) -> Option<PathBuf> {
+        valid_upload_id(id).then(|| self.multipart_root().join(id))
+    }
+
+    /// A new S3 multipart upload's directory, private to this user from its creation: its id
+    /// and path. [`Store::gc`] sweeps it once nothing in it has been written for the grace
+    /// window.
+    pub(crate) fn create_multipart(&self) -> Result<(String, PathBuf)> {
+        use std::os::unix::fs::DirBuilderExt;
+        let root = self.multipart_root();
+        std::fs::DirBuilder::new()
+            .recursive(true)
+            .mode(0o700)
+            .create(&root)
+            .with_context(|| format!("creating {}", root.display()))?;
+        let id = self.new_upload_id();
+        let dir = root.join(&id);
+        std::fs::DirBuilder::new()
+            .mode(0o700)
+            .create(&dir)
+            .with_context(|| format!("creating {}", dir.display()))?;
+        Ok((id, dir))
+    }
+
+    /// The S3 multipart uploads in progress, by id: their directories.
+    pub(crate) fn multipart_uploads(&self) -> Vec<(String, PathBuf)> {
+        multipart_dirs(&self.multipart_root())
+            .into_iter()
+            .filter_map(|dir| Some((dir.file_name()?.to_str()?.to_string(), dir)))
+            .collect()
+    }
+
     /// The repositories one level below `name` (`""` for the top level), sorted: the
     /// subdirectories of `repos/<name>` that are not its own layout directories. By
     /// `lstat`, so a symlink is neither followed nor shown; a name no repository could have
@@ -1172,15 +1221,8 @@ impl Store {
 
     /// `len` of blob `hex`'s canonical bytes from `start`, streamed through the body a whole
     /// blob is, with the blob's canonical length; `None` when the blob is absent, and an error
-    /// when the part does not lie within it. Opened once and served from that descriptor, as
-    /// [`serve_blob`] is, and measured without reading it. Nothing is read for `head`.
-    ///
-    /// A plain blob is read from `start` after a seek. A zstd-stored one is decoded from the
-    /// frame's start and its first `start` bytes discarded, on the blocking pool as the
-    /// stream's first read: O(`start`) of decoding, with the decoder's window as memory, before
-    /// the part's first byte goes out. A client reading a large zstd blob in consecutive
-    /// ranges so pays quadratically, which is why the S3 view stores its large writes plain
-    /// ([`StagedBlob::uncompressed`]).
+    /// when the part does not lie within it. Read as [`Store::read_blob_range`] reads it, and
+    /// served from that descriptor, as [`serve_blob`] is. Nothing is read for `head`.
     pub(crate) fn serve_blob_range(
         &self,
         hex: &str,
@@ -1188,6 +1230,33 @@ impl Store {
         len: u64,
         head: bool,
     ) -> Result<Option<BlobPart>> {
+        let Some((total, reader)) = self.read_blob_range(hex, start, len)? else {
+            return Ok(None);
+        };
+        let body = if head || len == 0 {
+            body_of(Bytes::new())
+        } else {
+            stream_body(reader, &format!("sha256:{hex}"))
+        };
+        Ok(Some(BlobPart { total, body }))
+    }
+
+    /// A blocking reader of `len` of blob `hex`'s canonical bytes from `start`, with the
+    /// blob's canonical length; `None` when the blob is absent, and an error when the part
+    /// does not lie within it. Opened once and read from that descriptor, and measured
+    /// without reading it.
+    ///
+    /// A plain blob is read from `start` after a seek. A zstd-stored one is decoded from the
+    /// frame's start and its first `start` bytes discarded by the reader's first read: O(`start`)
+    /// of decoding, with the decoder's window as memory, before the part's first byte. A
+    /// client reading a large zstd blob in consecutive ranges so pays quadratically, which is
+    /// why the S3 view stores its large writes plain ([`StagedBlob::uncompressed`]).
+    pub(crate) fn read_blob_range(
+        &self,
+        hex: &str,
+        start: u64,
+        len: u64,
+    ) -> Result<Option<(u64, Box<dyn std::io::Read + Send + Sync>)>> {
         use std::io::{Read, Seek, SeekFrom};
         let Some((path, is_zstd)) = self.find_blob(hex) else {
             return Ok(None);
@@ -1205,27 +1274,20 @@ impl Store {
         if start.checked_add(len).is_none_or(|end| end > total) {
             bail!("bytes {start}+{len} of the blob {hex}, which holds {total}");
         }
-        if head || len == 0 {
-            return Ok(Some(BlobPart {
-                total,
-                body: body_of(Bytes::new()),
-            }));
-        }
-        let what = format!("sha256:{hex}");
-        let body = if is_zstd {
+        let reader: Box<dyn Read + Send + Sync> = if is_zstd {
             let decoder =
                 zstd::stream::read::Decoder::new(file).context("opening a stored blob")?;
             let skipped = Skip {
                 inner: decoder,
                 skip: start,
             };
-            stream_body(skipped.take(len), &what)
+            Box::new(skipped.take(len))
         } else {
             file.seek(SeekFrom::Start(start))
                 .with_context(|| format!("seeking in {}", path.display()))?;
-            stream_body(file.take(len), &what)
+            Box::new(file.take(len))
         };
-        Ok(Some(BlobPart { total, body }))
+        Ok(Some((total, reader)))
     }
 
     /// Return a blob's decompressed bytes, or `None` if absent or larger than `cap`.
@@ -2118,6 +2180,11 @@ impl Store {
                 .into_iter()
                 .map(Last::Owner),
         );
+        last.extend(
+            multipart_dirs(&self.multipart_root())
+                .into_iter()
+                .map(Last::Multipart),
+        );
         let last_done = spells.run(Phase::Last, &mut plan, &idle, last, |plan, _, item| {
             match item {
                 Last::Sidecar(sidecar) => {
@@ -2153,6 +2220,30 @@ impl Store {
                     remove(&upload)?;
                     report.uploads_dropped += 1;
                 }
+                // An S3 multipart upload is idle when nothing in it has been written for the
+                // window: its directory's own mtime does not move when a part is rewritten in
+                // place, so the newest of its entries' says when it was last used. It goes
+                // whole, parts and all.
+                Last::Multipart(dir) => {
+                    let idle = newest_mtime(&dir)
+                        .and_then(|m| now.duration_since(m).ok())
+                        .is_some_and(|age| age > policy.grace);
+                    if !idle {
+                        return Ok(());
+                    }
+                    if !dry_run {
+                        match std::fs::remove_dir_all(&dir) {
+                            Ok(()) => {}
+                            // Gone since the listing: completed, aborted or swept meanwhile.
+                            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+                            Err(e) => {
+                                return Err(e)
+                                    .with_context(|| format!("removing {}", dir.display()));
+                            }
+                        }
+                    }
+                    report.uploads_dropped += 1;
+                }
                 // An owner record whose session is already gone (dropped by an earlier sweep,
                 // or by a finish that could not clean up) is not an upload and is not counted
                 // as one. Gated on `grace` like every other removal here: `start_upload` writes
@@ -2768,6 +2859,7 @@ impl Store {
             s.uploads += 1;
             s.upload_bytes += std::fs::metadata(&up).map(|m| m.len()).unwrap_or(0);
         }
+        (s.multipart_uploads, s.multipart_bytes) = multipart_usage(&self.multipart_root());
 
         // per-repo content: a repo is a dir under repos/ holding any of its own
         // subdirectories. `blobs/` counts — a pull-through cache serving tag pulls holds
@@ -3151,6 +3243,7 @@ pub struct GcReport {
     pub blobs_dropped: usize,
     /// the space the dropped blobs took on disk (allocated blocks)
     pub bytes_freed: u64,
+    /// idle upload sessions and staging files, and idle S3 multipart uploads
     pub uploads_dropped: usize,
     /// membership markers removed because the blob they named is gone
     pub blob_markers_dropped: usize,
@@ -3346,6 +3439,8 @@ enum Last {
     Marker(PathBuf, String),
     Upload(PathBuf),
     Owner(PathBuf),
+    /// an S3 multipart upload's directory under `uploads/s3/`
+    Multipart(PathBuf),
 }
 
 /// The exclusive spells of one [`Store::gc_with`] pass.
@@ -3518,6 +3613,9 @@ pub struct StoreStats {
     pub zstd_bytes: u64,
     pub uploads: usize,
     pub upload_bytes: u64,
+    /// S3 multipart uploads in progress, and the bytes of their parts so far
+    pub multipart_uploads: usize,
+    pub multipart_bytes: u64,
     pub total_tags: usize,
     pub total_manifests: usize,
     /// membership markers across every repo, summed — the inode cost of repo-scoping
@@ -3755,6 +3853,47 @@ fn dir_files(dir: &Path) -> Vec<PathBuf> {
         .collect()
 }
 
+/// The directory multipart uploads are staged in, under `uploads/` (see
+/// [`Store::create_multipart`]).
+const MULTIPART_DIR: &str = "s3";
+
+/// The S3 multipart upload directories directly inside `dir`, by `lstat`: real directories
+/// named like an upload id, so nothing else there is ever swept as one (a missing dir reads
+/// as empty).
+fn multipart_dirs(dir: &Path) -> Vec<PathBuf> {
+    std::fs::read_dir(dir)
+        .into_iter()
+        .flatten()
+        .flatten()
+        .filter(|e| e.file_type().is_ok_and(|t| t.is_dir()))
+        .filter(|e| e.file_name().to_str().is_some_and(valid_upload_id))
+        .map(|e| e.path())
+        .collect()
+}
+
+/// When anything in `dir` was last written: the newest mtime of the directory and of the
+/// entries directly in it, by `lstat`. `None` when the directory cannot be read, which a
+/// sweep takes as fresh: never delete on uncertain evidence.
+fn newest_mtime(dir: &Path) -> Option<SystemTime> {
+    let mut newest = std::fs::symlink_metadata(dir).ok()?.modified().ok()?;
+    for entry in std::fs::read_dir(dir).ok()? {
+        let modified = entry.ok()?.metadata().ok()?.modified().ok()?;
+        newest = newest.max(modified);
+    }
+    Some(newest)
+}
+
+/// What the S3 multipart uploads in `dir` hold: how many there are, and their files' bytes.
+fn multipart_usage(dir: &Path) -> (usize, u64) {
+    let uploads = multipart_dirs(dir);
+    let bytes = uploads
+        .iter()
+        .flat_map(|d| dir_files(d))
+        .map(|f| std::fs::metadata(f).map_or(0, |m| m.len()))
+        .sum();
+    (uploads.len(), bytes)
+}
+
 /// A held store lock (see [`Store::lock_shared`]); released when dropped (flock
 /// releases on the last close of the fd).
 pub struct LockGuard {
@@ -4999,15 +5138,9 @@ async fn route(req: Request<Incoming>, state: Arc<ServerState>) -> Result<Respon
 
 /// POST /v2/<name>/blobs/uploads/ — open an upload session (an empty temp file).
 fn start_upload(store: &Store, name: &str) -> Result<Response<Body>> {
-    // The counter keeps ids unique within a process; the random tail keeps them
-    // unguessable, so one client cannot append to another's in-flight upload by
+    // Unguessable, so one client cannot append to another's in-flight upload by
     // enumerating session ids.
-    let id = format!(
-        "{}-{}-{}",
-        std::process::id(),
-        store.next_upload.fetch_add(1, Ordering::Relaxed),
-        accounts::random_token(16),
-    );
+    let id = store.new_upload_id();
     // The binding first, the session second: `upload_is_for` fails closed, so a session
     // file that existed before its binding would be a session nothing could finish — and,
     // worse, the gc's orphaned-binding sweep keys on "a binding whose session is absent".
@@ -6240,6 +6373,14 @@ fn status_to(out: &mut impl std::io::Write, cmd: &str, root: PathBuf) -> Result<
             s.uploads,
         )?;
     }
+    if s.multipart_uploads > 0 {
+        writeln!(
+            out,
+            "  Multipart uploads in progress: {} ({} uploads, separate from stored blobs)",
+            human_bytes(s.multipart_bytes),
+            s.multipart_uploads,
+        )?;
+    }
     if !s.repos.is_empty() {
         writeln!(out)?;
         writeln!(out, "  {:<40} {:>5}", "REPOSITORY", "TAGS")?;
@@ -8133,6 +8274,56 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// An S3 multipart upload is idle when nothing in it was written for the grace window:
+    /// one whose part was rewritten lately stays, however old its directory, as does one
+    /// holding only a fresh record; an idle one goes whole. `status` counts the ones left.
+    #[test]
+    fn gc_sweeps_idle_multipart_uploads_by_their_newest_entry() {
+        let dir = std::env::temp_dir().join(format!("vk-regserve-gcmp-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Store::new(dir.clone()).unwrap();
+        let (_, idle) = store.create_multipart().unwrap();
+        let (_, busy) = store.create_multipart().unwrap();
+        let (_, fresh) = store.create_multipart().unwrap();
+        for up in [&idle, &busy] {
+            std::fs::write(up.join("meta.json"), b"{}").unwrap();
+            std::fs::write(up.join("part-1"), b"part").unwrap();
+            std::fs::write(up.join("part-1.json"), b"{}").unwrap();
+        }
+        std::fs::write(fresh.join("meta.json"), b"{}").unwrap();
+        // Not an upload's name: never taken for one.
+        std::fs::create_dir_all(dir.join("uploads/s3/not-an-upload")).unwrap();
+
+        let old = SystemTime::now() - DAY * 100;
+        backdate_all(&dir, old);
+        for up in [&idle, &busy, &fresh, &dir.join("uploads/s3/not-an-upload")] {
+            std::fs::File::open(up).unwrap().set_modified(old).unwrap();
+        }
+        touch(&busy.join("part-1"));
+        touch(&fresh.join("meta.json"));
+        let s = store.stats().unwrap();
+        assert_eq!((s.multipart_uploads, s.multipart_bytes), (3, 8 + 8 + 2));
+        let mut out = Vec::new();
+        status_to(&mut out, "vk-registry", dir.clone()).unwrap();
+        let out = String::from_utf8(out).unwrap();
+        assert!(
+            out.contains("Multipart uploads in progress: 18 B (3 uploads"),
+            "{out}"
+        );
+
+        let dry = store.gc(DAY * 30, DAY, true).unwrap();
+        assert_eq!(dry.uploads_dropped, 1);
+        assert!(idle.is_dir(), "a dry run removes nothing");
+        let report = store.gc(DAY * 30, DAY, false).unwrap();
+        assert_eq!(report.uploads_dropped, 1);
+        assert!(!idle.exists());
+        assert!(busy.join("part-1").is_file());
+        assert!(fresh.join("meta.json").is_file());
+        assert!(dir.join("uploads/s3/not-an-upload").is_dir());
+        assert_eq!(store.stats().unwrap().multipart_uploads, 2);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// Manifest annotations override the window: kept tags survive any idleness,
     /// expired tags are dropped regardless of use, and future expiries survive.
     #[test]
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index f66d2442..1fd4d057 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -10,26 +10,40 @@ use hyper::header::{HeaderMap, IF_MATCH, IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_UN
 
 use crate::files::{Object, Precondition};
 
-/// The manifest annotation holding an S3-written object's MD5, as lowercase hex.
+/// The manifest annotation holding an S3-written object's MD5, as lowercase hex; for an
+/// object a multipart upload made, its multipart ETag, `<md5>-<parts>`.
 pub(crate) const MD5_ANNOTATION: &str = "org.virtkit.md5";
 
-/// An object's ETag, quoted: the MD5 an S3 write recorded, or the SHA-256 of its bytes for
-/// one written otherwise (WebDAV, `vk registry put`). 64 hex digits, so a client that checks
-/// an ETag as an MD5 sees it is not one rather than a mismatch.
+/// An object's ETag, quoted: the MD5 an S3 write recorded (or the multipart ETag a completed
+/// upload did), or the SHA-256 of its bytes for one written otherwise (WebDAV, `vk registry
+/// put`). 64 hex digits, so a client that checks an ETag as an MD5 sees it is not one rather
+/// than a mismatch.
 pub(crate) fn etag(layer: &str, annotations: &BTreeMap<String, String>) -> String {
     match annotations.get(MD5_ANNOTATION) {
-        Some(md5)
-            if md5.len() == 32
-                && md5
-                    .bytes()
-                    .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)) =>
-        {
-            format!("\"{md5}\"")
-        }
+        Some(md5) if is_md5_etag(md5) => format!("\"{md5}\""),
         _ => format!("\"{layer}\""),
     }
 }
 
+/// Whether `s` is an ETag an S3 write records: 32 lowercase hex digits, then for a multipart
+/// upload's `-` and its count of parts, 1 to 10000.
+fn is_md5_etag(s: &str) -> bool {
+    let (md5, parts) = match s.split_once('-') {
+        Some((md5, parts)) => (md5, Some(parts)),
+        None => (s, None),
+    };
+    md5.len() == 32
+        && md5
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+        && parts.is_none_or(|p| {
+            !p.starts_with('0')
+                && p.len() <= 5
+                && p.bytes().all(|b| b.is_ascii_digit())
+                && p.parse::<u32>().is_ok_and(|n| (1..=10_000).contains(&n))
+        })
+}
+
 /// [`etag`] of an object.
 pub(crate) fn etag_of(obj: &Object) -> String {
     etag(&obj.layer, &obj.annotations)
@@ -251,6 +265,21 @@ mod tests {
             etag_of(&object(&[(MD5_ANNOTATION, &MD5[1..])])),
             format!("\"{SHA}\"")
         );
+        // A multipart upload's: the MD5 of its parts' MD5s and their count.
+        for parts in ["1", "3", "10000"] {
+            let multipart = format!("{MD5}-{parts}");
+            assert_eq!(
+                etag_of(&object(&[(MD5_ANNOTATION, &multipart)])),
+                format!("\"{multipart}\"")
+            );
+        }
+        for bad in ["-", "-0", "-01", "-10001", "-x", "-1-2", "- 1"] {
+            assert_eq!(
+                etag_of(&object(&[(MD5_ANNOTATION, &format!("{MD5}{bad}"))])),
+                format!("\"{SHA}\""),
+                "{bad}"
+            );
+        }
     }
 
     #[test]
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index 3a978c07..1a85f951 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -21,7 +21,7 @@ pub(super) const COPY_SOURCE: &str = "x-amz-copy-source";
 
 /// What `x-amz-copy-source` names.
 #[derive(Debug, PartialEq, Eq)]
-enum Source {
+pub(super) enum Source {
     /// an object: the bucket then the key's components, as [`path::Target::Object`]'s
     Object(Vec<String>),
     /// one version of an object, which this registry does not keep
@@ -35,7 +35,7 @@ enum Source {
 /// `/` between components names the same object as one that does not. What is decoded is
 /// then held to the key rules a request path is, and an escape that decodes to a `%`, which
 /// no key holds, is refused rather than decoded twice.
-fn source(value: &str) -> Source {
+pub(super) fn source(value: &str) -> Source {
     let (raw, query) = match value.split_once('?') {
         Some((raw, query)) => (raw, Some(query)),
         None => (value, None),
@@ -76,7 +76,7 @@ fn source(value: &str) -> Source {
     }
 }
 
-fn failed(ctx: &Ctx) -> Response<Body> {
+pub(super) fn failed(ctx: &Ctx) -> Response<Body> {
     ctx.error(
         StatusCode::PRECONDITION_FAILED,
         "PreconditionFailed",
@@ -86,7 +86,12 @@ fn failed(ctx: &Ctx) -> Response<Body> {
 
 /// The answer for a source the caller cannot read: `NoSuchBucket` when its bucket is no
 /// directory and the caller may read in it, otherwise `NoSuchKey`, as a read of it answers.
-fn absent(store: &Store, authz: &Authz<'_>, src: &[String], ctx: &Ctx) -> Response<Body> {
+pub(super) fn absent(
+    store: &Store,
+    authz: &Authz<'_>,
+    src: &[String],
+    ctx: &Ctx,
+) -> Response<Body> {
     let bucket = format!("{FILES_REPO}/{}", src.first().map_or("", String::as_str));
     if authz.may_read_below(&bucket) && !store.repo_dir_exists(&bucket) {
         return ctx.error(
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index cc096c47..651d45ec 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -336,7 +336,7 @@ impl Walker<'_, '_> {
 
 /// `key` for a document asking `encoding-type=url`: each component percent-encoded, the
 /// slashes kept.
-fn url_encode(key: &str) -> String {
+pub(super) fn url_encode(key: &str) -> String {
     key.split('/')
         .map(crate::percent_encode)
         .collect::<Vec<_>>()
@@ -409,7 +409,7 @@ fn page(store: &Store, authz: &Authz<'_>, bucket: &str, q: &Query) -> Result<(Ve
 
 /// Whether this caller may list `bucket` with `prefix`: it may read the bucket, or the
 /// directory the prefix's whole components name; the walk then shows what it may read.
-fn admitted(authz: &Authz<'_>, bucket: &str, prefix: &str) -> bool {
+pub(super) fn admitted(authz: &Authz<'_>, bucket: &str, prefix: &str) -> bool {
     let read = |repo: &str| allowed(authz, accounts::Action::Read, repo);
     let bucket = format!("{FILES_REPO}/{bucket}");
     read(&bucket)
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 72685ca6..d555329e 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -10,9 +10,9 @@
 //! one, served over the object layer the WebDAV view shares ([`crate::files`]): [`bucket`]
 //! answers the service and its buckets, [`list`] a bucket's listings, [`object`] the
 //! objects, with [`chunked`] decoding the `aws-chunked` bodies SDKs upload them in, [`copy`]
-//! their copies and [`batch`] their deletion in batches; [`canned`] answers the
-//! configurations a bucket or an object has none of. Operations not served yet answer
-//! `NotImplemented`.
+//! their copies, [`multipart`] their uploads in parts and [`batch`] their deletion in
+//! batches; [`canned`] answers the configurations a bucket or an object has none of.
+//! Operations not served answer `NotImplemented`.
 
 mod batch;
 mod bucket;
@@ -22,6 +22,7 @@ mod conditional;
 mod copy;
 mod list;
 mod meta;
+mod multipart;
 mod object;
 mod path;
 mod range;
@@ -52,12 +53,28 @@ const PRE_AUTH_DRAIN: u64 = 64 * 1024;
 /// The header naming each request, for a client's report to be matched to a server line.
 const REQUEST_ID: &str = "x-amz-request-id";
 
+/// The size from which a written object is stored uncompressed. The AWS CLI and SDK transfer
+/// managers download an object past 8 MiB as parallel 8 MiB ranges, and a range of a
+/// zstd-stored blob is decoded from the blob's start ([`crate::Store::serve_blob_range`]):
+/// stored compressed, an object of N bytes would cost about N²/16 MiB of decoding to download,
+/// where stored plain each range is a seek. Below it, a range costs at most this much decoding.
+pub(super) const UNCOMPRESSED_FROM: u64 = 8 << 20;
+
 /// Serve one `/s3/…` request, from its credentials on: [`crate::route`] hands every such
 /// request here before its own gate when S3 is on.
 pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result<Response<Body>> {
     let ctx = Ctx {
         id: accounts::random_token(8),
         path: req.uri().path().to_string(),
+        url: match req.headers().get(hyper::header::HOST) {
+            Some(host) => format!(
+                "{}://{}{}",
+                crate::scheme(state.tls.is_some()),
+                String::from_utf8_lossy(host.as_bytes()),
+                req.uri().path()
+            ),
+            None => req.uri().path().to_string(),
+        },
     };
     let id = &ctx.id;
     let mut resp = match serve(state, req, &ctx).await {
@@ -78,6 +95,9 @@ pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result
 struct Ctx {
     id: String,
     path: String,
+    /// the URL the request was sent to, as S3 names a resource it made: the scheme this
+    /// listener serves, the `Host` and the path, as sent
+    url: String,
 }
 
 impl Ctx {
@@ -232,6 +252,19 @@ async fn operate(
     let sub = subresource(&query);
     let method = req.method().clone();
     match (target, &method, sub) {
+        // Before the arms below: `?uploads` and `?uploadId` name no canned configuration, no
+        // listing, and a part's copy is no CopyObject.
+        (path::Target::Bucket(b), &Method::GET, _) if multipart::names(&query, "uploads") => {
+            multipart::list_uploads(state, authz, b, &query, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, &Method::POST, _)
+            if multipart::names(&query, "uploads") =>
+        {
+            multipart::create(state, authz, segs, &query, req, ctx).await
+        }
+        (path::Target::Object { segs, .. }, _, _) if multipart::names(&query, "uploadId") => {
+            multipart::upload(state, authz, segs, seed, &query, req, ctx).await
+        }
         (path::Target::Service, &Method::GET, None) => bucket::list(state, authz, req, ctx).await,
         (path::Target::Bucket(b), &Method::HEAD, None) => {
             bucket::head(state, authz, b, req, ctx).await
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
new file mode 100644
index 00000000..2535e953
--- /dev/null
+++ b/vk-registry/src/s3/multipart.rs
@@ -0,0 +1,1321 @@
+//! Multipart uploads: CreateMultipartUpload, UploadPart and UploadPartCopy,
+//! CompleteMultipartUpload, AbortMultipartUpload, ListParts and ListMultipartUploads.
+//!
+//! An upload is a private directory of the store, `uploads/s3/<id>/`, holding `meta.json`
+//! (the bucket, the key, when it was created and the user metadata the object will carry)
+//! and, for each part, `part-<n>` (its bytes) and `part-<n>.json` (their size and MD5). Each
+//! file is written under a private temporary name and renamed over its own, so a part sent
+//! again replaces the earlier one whole. Completing an upload concatenates the parts it names
+//! into one staging file in a single pass off the runtime, hashing on the way, then promotes
+//! and tags it as a PutObject's body is, its ETag `"<MD5 of the parts' MD5s>-<parts>"`; the
+//! directory then goes. The gc sweeps an upload nothing has been written into for its grace
+//! window, as it sweeps an idle OCI upload.
+//!
+//! Authorized as a PutObject is: `Write` on the key's parent repository, `Read` there for
+//! ListParts, and ListMultipartUploads as a listing of the bucket. The upload id must name an
+//! upload recorded for the request's own bucket and key, or it is `NoSuchUpload`; an id is
+//! held to what this server mints (hex digits and dashes), so it never names a path.
+
+use std::collections::BTreeMap;
+use std::io::{Read as _, Write as _};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use anyhow::{Context, Result};
+use hyper::body::Incoming;
+use hyper::header::HeaderMap;
+use hyper::{Method, Request, Response, StatusCode};
+use serde::{Deserialize, Serialize};
+use sha1::Digest as _;
+
+use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::copy::{self, COPY_SOURCE, Source};
+use super::object::{self, Refused, admitted, no_such_key, readable, unwritable};
+use super::xml::scan::{self, Malformed};
+use super::{
+    Ctx, OPERATION_HINT, UNCOMPRESSED_FROM, bucket, chunked, drain, list, meta, read_small, refuse,
+    xml,
+};
+use crate::files::{self, Commit, FILES_REPO, MAX_OBJECT, Staged, Written, allowed, object_of};
+use crate::{Authz, Body, STREAM_CHUNK, ServerState, Store, accounts, body_of};
+
+/// Most parts an upload has, and the highest part number: S3's bound.
+const MAX_PARTS: u32 = 10_000;
+
+/// Longest `CompleteMultipartUpload` document taken.
+const MAX_DOCUMENT: usize = 1 << 20;
+
+/// Most elements a `CompleteMultipartUpload` document may hold: a `Part` and the five fields
+/// S3 defines in it, for each part, and a few more around them.
+const MAX_ELEMENTS: usize = 6 * MAX_PARTS as usize + 16;
+
+/// Most entries a ListParts or ListMultipartUploads page holds: S3's bound.
+const MAX_LISTED: usize = 1000;
+
+/// What an upload records of itself, in its directory.
+const META: &str = "meta.json";
+
+/// Longest `meta.json` or part record read: far above what one can hold (a key, and at most
+/// 2 KiB of user metadata).
+const MAX_RECORD: u64 = 64 * 1024;
+
+/// What an upload records of itself at its creation.
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+struct Meta {
+    bucket: String,
+    /// the key's components joined by `/`
+    key: String,
+    /// seconds since the epoch
+    created: u64,
+    /// the user metadata the object will carry, as [`meta::annotations`] made it
+    annotations: BTreeMap<String, String>,
+}
+
+/// What a part's record says of it.
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+struct Part {
+    size: u64,
+    /// lowercase hex
+    md5: String,
+}
+
+/// An upload this request may act on: its directory and what it recorded.
+struct Upload {
+    id: String,
+    dir: PathBuf,
+    meta: Meta,
+}
+
+/// The key a run of object components names below its bucket.
+fn key_of(segs: &[String]) -> String {
+    segs.get(1..).unwrap_or_default().join("/")
+}
+
+/// The bucket a run of object components names.
+fn bucket_of(segs: &[String]) -> &str {
+    segs.first().map_or("", String::as_str)
+}
+
+/// `query`'s parameters with their values percent-decoded, in order, the SDK's operation
+/// hint left out.
+fn params(query: &str) -> Vec<(&str, String)> {
+    query
+        .split('&')
+        .filter(|p| !p.is_empty())
+        .map(|p| {
+            let (n, v) = p.split_once('=').unwrap_or((p, ""));
+            (n, crate::percent_decode(v))
+        })
+        .filter(|(n, _)| *n != OPERATION_HINT)
+        .collect()
+}
+
+/// The value of the first parameter named `name`.
+fn param<'a>(params: &'a [(&str, String)], name: &str) -> Option<&'a str> {
+    params
+        .iter()
+        .find(|(n, _)| *n == name)
+        .map(|(_, v)| v.as_str())
+}
+
+/// Whether `query` names a parameter `name`: what dispatches a request here.
+pub(super) fn names(query: &str, name: &str) -> bool {
+    params(query).iter().any(|(n, _)| *n == name)
+}
+
+/// Whether every parameter is one of `taken`.
+fn only(params: &[(&str, String)], taken: &[&str]) -> bool {
+    params.iter().all(|(n, _)| taken.contains(n))
+}
+
+/// A part number as a query or a document gives it: 1 to [`MAX_PARTS`], in decimal.
+fn part_number(s: &str) -> Option<u32> {
+    if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) || s.len() > 5 {
+        return None;
+    }
+    s.parse().ok().filter(|n| (1..=MAX_PARTS).contains(n))
+}
+
+/// The number of the part `name` records (`part-<n>.json`), with no leading zero.
+fn recorded_part(name: &str) -> Option<u32> {
+    let n = name.strip_prefix("part-")?.strip_suffix(".json")?;
+    (!n.starts_with('0')).then(|| part_number(n)).flatten()
+}
+
+fn part_path(dir: &Path, n: u32) -> PathBuf {
+    dir.join(format!("part-{n}"))
+}
+
+fn record_path(dir: &Path, n: u32) -> PathBuf {
+    dir.join(format!("part-{n}.json"))
+}
+
+/// A record of at most [`MAX_RECORD`] bytes at `path`: `None` when it is absent or cannot be
+/// read as one, which every caller takes as no upload or no part — failing closed, since
+/// what a record says decides what an upload is for.
+fn read_record<T: serde::de::DeserializeOwned>(path: &Path) -> Option<T> {
+    let mut bytes = Vec::new();
+    std::fs::File::open(path)
+        .ok()?
+        .take(MAX_RECORD)
+        .read_to_end(&mut bytes)
+        .ok()?;
+    serde_json::from_slice(&bytes).ok()
+}
+
+/// The upload `id` names, when it is one recorded for the object at `segs`.
+fn open(store: &Store, id: &str, segs: &[String]) -> Option<Upload> {
+    let dir = store.multipart_dir(id)?;
+    let meta: Meta = read_record(&dir.join(META))?;
+    (meta.bucket == bucket_of(segs) && meta.key == key_of(segs)).then(|| Upload {
+        id: id.to_string(),
+        dir,
+        meta,
+    })
+}
+
+fn no_such_upload(ctx: &Ctx) -> Response<Body> {
+    ctx.error(
+        StatusCode::NOT_FOUND,
+        "NoSuchUpload",
+        "the specified multipart upload does not exist: its id may be wrong, or it was \
+         completed or aborted",
+    )
+}
+
+fn invalid(ctx: &Ctx, message: &str) -> Response<Body> {
+    ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", message)
+}
+
+/// Whether this caller may `action` on the repository the object at `segs` would be in.
+fn on_parent(authz: &Authz<'_>, action: accounts::Action, segs: &[String]) -> bool {
+    object_of(segs).is_some_and(|(parent, _)| allowed(authz, action, &parent))
+}
+
+/// A private file to write into `dir` under a name of its own, `.<what>.<random>`, to be
+/// renamed over the name it stands for once whole.
+fn temp_in(dir: &Path, what: &str) -> Result<(PathBuf, std::fs::File)> {
+    use std::os::unix::fs::OpenOptionsExt;
+    let path = dir.join(format!(".{what}.{}", accounts::random_token(8)));
+    let file = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .open(&path)
+        .with_context(|| format!("creating {}", path.display()))?;
+    Ok((path, file))
+}
+
+/// Install part `n` of the upload in `dir`: its bytes, staged in `dir`, renamed over the
+/// part's, then its record. Each rename replaces its file whole, but the two are not one
+/// step: a reader between them sees new bytes beside the old record, which is why Complete
+/// checks every part's MD5 as it reads it.
+fn install_part(dir: &Path, n: u32, staged: Staged, md5: &str) -> Result<()> {
+    let size = staged.size;
+    staged.rename_to(&part_path(dir, n))?;
+    let record = serde_json::to_vec(&Part {
+        size,
+        md5: md5.to_string(),
+    })?;
+    vk_fs::write_atomic_unsynced(&record_path(dir, n), &record, 0o600)
+}
+
+/// `POST /s3/<bucket>/<key>?uploads`: a new upload of the key, its user metadata recorded for
+/// the object. The key is checked now as a PutObject's would be (409 `OperationAborted`), and
+/// again when the upload is completed.
+pub(super) async fn create(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    query: &str,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    if !only(&params(query), &["uploads"]) {
+        return refuse(req, ctx.not_implemented(), ctx).await;
+    }
+    let headers = req.headers();
+    if headers.contains_key(COPY_SOURCE) {
+        let resp = invalid(
+            ctx,
+            "a multipart upload's parts are copied by UploadPartCopy, not named at its creation",
+        );
+        return refuse(req, resp, ctx).await;
+    }
+    let annotations = match meta::annotations(headers) {
+        Ok(a) => a,
+        Err(why) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    let algorithm = match checksum_algorithm(headers) {
+        Ok(a) => a,
+        Err(message) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidRequest", message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, _| {
+        if let Some(why) = files::unwritable(store, &segs)? {
+            return Ok(unwritable(why, &ctx));
+        }
+        let meta = Meta {
+            bucket: bucket_of(&segs).to_string(),
+            key: key_of(&segs),
+            created: vk_peer::now_secs(),
+            annotations,
+        };
+        let (id, dir) = store.create_multipart()?;
+        let recorded = serde_json::to_vec(&meta)
+            .map_err(anyhow::Error::from)
+            .and_then(|json| vk_fs::write_atomic_unsynced(&dir.join(META), &json, 0o600));
+        if let Err(e) = recorded {
+            // An upload with no record is no upload; the gc would sweep it anyway.
+            let _ = std::fs::remove_dir_all(&dir);
+            return Err(e);
+        }
+        let mut resp = xml::document(
+            "InitiateMultipartUploadResult",
+            &format!(
+                "{}{}{}",
+                xml::element("Bucket", &meta.bucket),
+                xml::element("Key", &meta.key),
+                xml::element("UploadId", &id)
+            ),
+        );
+        if let Some(algorithm) = algorithm
+            && let Ok(v) = hyper::header::HeaderValue::from_str(algorithm)
+        {
+            resp.headers_mut().insert("x-amz-checksum-algorithm", v);
+        }
+        Ok(resp)
+    })
+    .await
+}
+
+/// The `x-amz-checksum-algorithm` a creation names, as S3 spells it: the algorithm the
+/// parts' checksums will be in, which each part's request then carries and is checked by.
+fn checksum_algorithm(
+    headers: &HeaderMap,
+) -> std::result::Result<Option<&'static str>, &'static str> {
+    let Some(v) = headers.get("x-amz-checksum-algorithm") else {
+        return Ok(None);
+    };
+    ["CRC32", "CRC32C", "CRC64NVME", "SHA1", "SHA256"]
+        .into_iter()
+        .find(|a| v.as_bytes().eq_ignore_ascii_case(a.as_bytes()))
+        .map(Some)
+        .ok_or("x-amz-checksum-algorithm is CRC32, CRC32C, CRC64NVME, SHA1 or SHA256")
+}
+
+/// A request naming `uploadId` on an object, to the operation its method names.
+pub(super) async fn upload(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    seed: Option<chunked::Seed>,
+    query: &str,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let params = params(query);
+    let id = param(&params, "uploadId").unwrap_or_default().to_string();
+    let method = req.method().clone();
+    let taken: &[&str] = match method {
+        Method::PUT => &["uploadId", "partNumber"],
+        Method::GET => &[
+            "uploadId",
+            "max-parts",
+            "part-number-marker",
+            "encoding-type",
+        ],
+        _ => &["uploadId"],
+    };
+    if !only(&params, taken) {
+        return refuse(req, ctx.not_implemented(), ctx).await;
+    }
+    match method {
+        Method::PUT => {
+            let Some(n) = param(&params, "partNumber").and_then(part_number) else {
+                let resp = invalid(ctx, "partNumber is a part's number, 1 to 10000");
+                return refuse(req, resp, ctx).await;
+            };
+            if req.headers().contains_key(COPY_SOURCE) {
+                copy_part(state, authz, segs, n, id, req, ctx).await
+            } else {
+                upload_part(state, authz, segs, n, id, seed, req, ctx).await
+            }
+        }
+        Method::POST => complete(state, authz, segs, id, req, ctx).await,
+        Method::DELETE => abort(state, authz, segs, id, req, ctx).await,
+        Method::GET => list_parts(state, authz, segs, id, &params, req, ctx).await,
+        _ => refuse(req, ctx.not_implemented(), ctx).await,
+    }
+}
+
+/// The upload `id` names for the object at `segs`, looked up off the runtime.
+async fn open_async(state: &ServerState, id: &str, segs: &[String]) -> Result<Option<Upload>> {
+    let (store, id, segs) = (Arc::clone(&state.store), id.to_string(), segs.to_vec());
+    tokio::task::spawn_blocking(move || open(&store, &id, &segs))
+        .await
+        .context("looking up an upload panicked")
+}
+
+/// `PUT /s3/<bucket>/<key>?partNumber=<n>&uploadId=<id>`: part `n`'s bytes, received as a
+/// PutObject's body is (its payload modes, digests and checksums, an `aws-chunked` body
+/// decoded) into the upload's directory, and installed over any earlier part `n`. 200 with
+/// the part's ETag, its MD5.
+#[allow(clippy::too_many_arguments)]
+async fn upload_part(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    n: u32,
+    id: String,
+    seed: Option<chunked::Seed>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let headers = req.headers();
+    if object::declared_too_large(headers) {
+        return Ok(ctx.too_large());
+    }
+    let plan = match object::plan(headers) {
+        Ok(plan) => plan,
+        Err((status, code, message)) => {
+            return refuse(req, ctx.error(status, code, message), ctx).await;
+        }
+    };
+    let Some(up) = open_async(state, &id, &segs).await? else {
+        return refuse(req, no_such_upload(ctx), ctx).await;
+    };
+    let staging = match temp_in(&up.dir, &format!("part-{n}")) {
+        Ok(staging) => staging,
+        // Completed or aborted since it was looked up.
+        Err(_) if !up.dir.is_dir() => return refuse(req, no_such_upload(ctx), ctx).await,
+        Err(e) => return Err(e),
+    };
+    let received = match object::receive(plan, req.into_body(), seed, staging, ctx).await? {
+        Ok(received) => received,
+        Err(resp) => return Ok(resp),
+    };
+    let md5 = crate::hex_of(&received.md5);
+    let installed = {
+        let (dir, md5) = (up.dir.clone(), md5.clone());
+        tokio::task::spawn_blocking(move || install_part(&dir, n, received.staged, &md5))
+            .await
+            .context("installing a part panicked")?
+    };
+    match installed {
+        Ok(()) => {}
+        Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(ctx)),
+        Err(e) => return Err(e),
+    }
+    object::written(&format!("\"{md5}\""), received.echo)
+}
+
+/// The header naming the bytes of a part's source to copy.
+const COPY_SOURCE_RANGE: &str = "x-amz-copy-source-range";
+
+/// What `x-amz-copy-source-range` names: `bytes=<first>-<last>`, both given, first ≤ last.
+fn copy_range(value: &str) -> Option<(u64, u64)> {
+    let (first, last) = value.trim().strip_prefix("bytes=")?.split_once('-')?;
+    let number = |s: &str| {
+        (!s.is_empty() && s.bytes().all(|b| b.is_ascii_digit()))
+            .then(|| s.parse::<u64>().ok())
+            .flatten()
+    };
+    let (first, last) = (number(first)?, number(last)?);
+    (first <= last).then_some((first, last))
+}
+
+/// `PUT …?partNumber=<n>&uploadId=<id>` with `x-amz-copy-source`: part `n` copied from an
+/// object, whole or the bytes `x-amz-copy-source-range` names, read as CopyObject reads its
+/// source and checked against the same `x-amz-copy-source-if-*` conditions. The bytes are
+/// copied into the upload (a part is the upload's own until it completes), off the runtime,
+/// hashed on the way. 200 with `CopyPartResult`.
+async fn copy_part(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    n: u32,
+    id: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let headers = req.headers();
+    let value = headers
+        .get(COPY_SOURCE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or_default();
+    let src = match copy::source(value) {
+        Source::Object(src) => src,
+        Source::Versioned => {
+            let resp = ctx.error(
+                StatusCode::NOT_IMPLEMENTED,
+                "NotImplemented",
+                "this registry keeps no versions to copy from",
+            );
+            return refuse(req, resp, ctx).await;
+        }
+        Source::Invalid(code, message) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, code, message);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if !admitted(authz, accounts::Action::Read, &src) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let range = match headers.get(COPY_SOURCE_RANGE) {
+        None => None,
+        Some(v) => match v.to_str().ok().and_then(copy_range) {
+            Some(range) => Some(range),
+            None => {
+                let resp = invalid(
+                    ctx,
+                    "x-amz-copy-source-range is bytes=<first>-<last>, the zero-based offsets \
+                     of the first and last bytes to copy",
+                );
+                return refuse(req, resp, ctx).await;
+            }
+        },
+    };
+    let conditions = Conditions::of_copy_source(headers);
+    // A part copy has no body of its own; whatever came is read through first.
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        let Some(up) = open(store, &id, &segs) else {
+            return Ok(no_such_upload(&ctx));
+        };
+        let Some(obj) = readable(store, authz, &src)? else {
+            return Ok(copy::absent(store, authz, &src, &ctx));
+        };
+        if conditions.evaluate(&conditional::etag_of(&obj), obj.modified) != Outcome::Serve {
+            return Ok(copy::failed(&ctx));
+        }
+        let (start, len) = match range {
+            None => (0, obj.size),
+            Some((first, last)) if last < obj.size => (first, last - first + 1),
+            Some(_) => {
+                let size = obj.size.to_string();
+                return Ok(xml::error(
+                    StatusCode::RANGE_NOT_SATISFIABLE,
+                    "InvalidRange",
+                    "x-amz-copy-source-range reaches past the source object's end",
+                    &[("ActualObjectSize", &size)],
+                    &ctx.path,
+                    &ctx.id,
+                ));
+            }
+        };
+        let Some((_, mut reader)) = store.read_blob_range(&obj.layer, start, len)? else {
+            return Ok(no_such_key(&ctx));
+        };
+        let (path, mut file) = match temp_in(&up.dir, &format!("part-{n}")) {
+            Ok(staging) => staging,
+            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx)),
+            Err(e) => return Err(e),
+        };
+        let mut staged = Staged::written(path, 0, String::new());
+        let mut md5 = md5::Context::new();
+        let mut buf = vec![0u8; STREAM_CHUNK];
+        loop {
+            let got = match reader.read(&mut buf) {
+                Ok(0) => break,
+                Ok(got) => got,
+                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+                Err(e) => return Err(anyhow::Error::from(e).context("reading a part's source")),
+            };
+            let data = buf.get(..got).unwrap_or_default();
+            md5.consume(data);
+            file.write_all(data).context("writing a copied part")?;
+            staged.size = staged.size.saturating_add(got as u64);
+        }
+        drop(file);
+        let md5 = crate::hex_of(&md5.finalize().0);
+        match install_part(&up.dir, n, staged, &md5) {
+            Ok(()) => {}
+            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx)),
+            Err(e) => return Err(e),
+        }
+        Ok(xml::document(
+            "CopyPartResult",
+            &format!(
+                "{}{}",
+                xml::element("LastModified", &list::iso8601(SystemTime::now())),
+                xml::element("ETag", &format!("\"{md5}\""))
+            ),
+        ))
+    })
+    .await
+}
+
+/// Why a `CompleteMultipartUpload` document is refused.
+#[derive(Debug, PartialEq, Eq)]
+enum Refusal {
+    /// 400 `MalformedXML`
+    Malformed(&'static str),
+    /// 400 `InvalidPartOrder`: the part numbers do not ascend
+    Order,
+}
+
+/// The parts a `CompleteMultipartUpload` document names, in order: each part's number and
+/// the ETag it is expected to have, unquoted and lowercase. Fields beside `PartNumber` and
+/// `ETag` (the parts' checksums) are passed over.
+fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Refusal> {
+    let root = scan::parse(body, MAX_ELEMENTS).map_err(|Malformed(why)| Refusal::Malformed(why))?;
+    if root.name != "CompleteMultipartUpload" {
+        return Err(Refusal::Malformed(
+            "the document is not a CompleteMultipartUpload",
+        ));
+    }
+    let mut parts: Vec<(u32, String)> = Vec::new();
+    for p in root.all("Part") {
+        let field = |name| {
+            p.one(name)
+                .map_err(|Malformed(why)| Refusal::Malformed(why))?
+                .map(|e| e.text.trim().to_string())
+                .ok_or(Refusal::Malformed(
+                    "each Part names its PartNumber and ETag",
+                ))
+        };
+        let n = part_number(&field("PartNumber")?)
+            .ok_or(Refusal::Malformed("a PartNumber is 1 to 10000"))?;
+        let etag = field("ETag")?;
+        let etag = etag
+            .strip_prefix('"')
+            .and_then(|e| e.strip_suffix('"'))
+            .unwrap_or(&etag)
+            .to_ascii_lowercase();
+        if parts.last().is_some_and(|(last, _)| *last >= n) {
+            return Err(Refusal::Order);
+        }
+        parts.push((n, etag));
+    }
+    if parts.is_empty() {
+        return Err(Refusal::Malformed(
+            "a CompleteMultipartUpload names at least one Part",
+        ));
+    }
+    Ok(parts)
+}
+
+/// The ETag of an object made of parts whose MD5s are `md5s`, unquoted: the MD5 of their
+/// concatenated MD5s, then `-` and how many there are, as S3 makes it.
+fn multipart_etag(md5s: &[[u8; 16]]) -> String {
+    let mut all = md5::Context::new();
+    for m in md5s {
+        all.consume(m);
+    }
+    format!("{}-{}", crate::hex_of(&all.finalize().0), md5s.len())
+}
+
+/// The whole-object checksums a completion's headers name, as bytes: those of the
+/// algorithms this registry computes, sent as a full object's. A composite checksum (a
+/// checksum of the parts' checksums, `<base64>-<parts>`) or one of another algorithm is
+/// passed over, since the parts were checked as they came.
+#[derive(Default)]
+struct WholeChecksums {
+    sha256: Option<Vec<u8>>,
+    sha1: Option<Vec<u8>>,
+    crc32: Option<Vec<u8>>,
+}
+
+impl WholeChecksums {
+    fn of(headers: &HeaderMap) -> Self {
+        let full = |name, len| {
+            object::base64_header(headers, name, len)
+                .ok()
+                .flatten()
+                .map(|(_, bytes)| bytes)
+        };
+        WholeChecksums {
+            sha256: full("x-amz-checksum-sha256", 32),
+            sha1: full("x-amz-checksum-sha1", 20),
+            crc32: full("x-amz-checksum-crc32", 4),
+        }
+    }
+}
+
+/// What [`assemble`] made: the object staged, and its ETag, unquoted.
+struct Assembled {
+    staged: Staged,
+    etag: String,
+}
+
+/// Concatenate the `parts` of `up`, in order, into a staging file, in one pass, hashing on
+/// the way: each part's MD5, checked against both the ETag asked and the part's record, so a
+/// part replaced while this reads it is noticed rather than built in; the whole object's
+/// SHA-256, and its SHA-1 and CRC32 when `whole` asks to be checked against them.
+fn assemble(
+    store: &Store,
+    up: &Upload,
+    parts: &[(u32, String)],
+    whole: &WholeChecksums,
+) -> Result<std::result::Result<Assembled, Refused>> {
+    let invalid_part: Refused = (
+        StatusCode::BAD_REQUEST,
+        "InvalidPart",
+        "one or more of the specified parts could not be found, or its ETag is not the one \
+         given",
+    );
+    // Written into, so the gc takes the upload as in use while it is read.
+    if let Ok(meta) = std::fs::File::open(up.dir.join(META)) {
+        // A failure only leaves the upload as fresh as its last write.
+        let _ = meta.set_modified(SystemTime::now());
+    }
+    let mut total: u64 = 0;
+    for (n, etag) in parts {
+        let Some(part) = read_record::<Part>(&record_path(&up.dir, *n)) else {
+            return Ok(Err(invalid_part));
+        };
+        if part.md5 != *etag {
+            return Ok(Err(invalid_part));
+        }
+        total = total.saturating_add(part.size);
+    }
+    let too_large: Refused = (
+        StatusCode::PAYLOAD_TOO_LARGE,
+        "EntityTooLarge",
+        "an object is at most 4 GiB, its parts together",
+    );
+    if total > MAX_OBJECT {
+        return Ok(Err(too_large));
+    }
+
+    let (path, mut out) = store.stage_file()?;
+    let mut staged = Staged::written(path, 0, String::new());
+    let mut sha256 = sha2::Sha256::new();
+    let mut sha1 = whole.sha1.as_ref().map(|_| sha1::Sha1::new());
+    let mut crc32 = whole.crc32.as_ref().map(|_| crc32fast::Hasher::new());
+    let mut md5s = Vec::with_capacity(parts.len());
+    let mut buf = vec![0u8; STREAM_CHUNK];
+    for (n, etag) in parts {
+        let mut file = match std::fs::File::open(part_path(&up.dir, *n)) {
+            Ok(file) => file,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Err(invalid_part)),
+            Err(e) => return Err(anyhow::Error::from(e).context("opening a part")),
+        };
+        let mut md5 = md5::Context::new();
+        loop {
+            let got = match file.read(&mut buf) {
+                Ok(0) => break,
+                Ok(got) => got,
+                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+                Err(e) => return Err(anyhow::Error::from(e).context("reading a part")),
+            };
+            staged.size = staged.size.saturating_add(got as u64);
+            if staged.size > MAX_OBJECT {
+                return Ok(Err(too_large));
+            }
+            let data = buf.get(..got).unwrap_or_default();
+            md5.consume(data);
+            sha256.update(data);
+            if let Some(h) = &mut sha1 {
+                h.update(data);
+            }
+            if let Some(h) = &mut crc32 {
+                h.update(data);
+            }
+            out.write_all(data).context("writing an object")?;
+        }
+        let md5 = md5.finalize().0;
+        if crate::hex_of(&md5) != *etag {
+            return Ok(Err(invalid_part));
+        }
+        md5s.push(md5);
+    }
+    drop(out);
+    let mismatch = |expected: &Option<Vec<u8>>, got: Option<Vec<u8>>| {
+        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
+    };
+    let sha256 = sha256.finalize().to_vec();
+    if mismatch(&whole.sha256, Some(sha256.clone()))
+        || mismatch(&whole.sha1, sha1.map(|h| h.finalize().to_vec()))
+        || mismatch(
+            &whole.crc32,
+            crc32.map(|h| h.finalize().to_be_bytes().to_vec()),
+        )
+    {
+        return Ok(Err((
+            StatusCode::BAD_REQUEST,
+            "BadDigest",
+            "the x-amz-checksum you specified did not match the checksum of the object the \
+             parts make",
+        )));
+    }
+    staged.hex = crate::hex_of(&sha256);
+    Ok(Ok(Assembled {
+        staged,
+        etag: multipart_etag(&md5s),
+    }))
+}
+
+/// `POST /s3/<bucket>/<key>?uploadId=<id>`: the object the `CompleteMultipartUpload`
+/// document's parts make, in the order given, tagged at the key as a PutObject's body is
+/// (the key checked again, `If-None-Match: *`/`If-Match` checked where the tag is written),
+/// with the user metadata recorded at the upload's creation and the multipart ETag; the
+/// upload then goes. A refusal leaves the upload as it was, to be completed again.
+async fn complete(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    id: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let Ok(conditions) = WriteConditions::of(req.headers()) else {
+        let resp = ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "a write's If-None-Match is * or nothing",
+        );
+        return refuse(req, resp, ctx).await;
+    };
+    let whole = WholeChecksums::of(req.headers());
+    let (head, body) = req.into_parts();
+    let too_long = ctx.error(
+        StatusCode::BAD_REQUEST,
+        "MalformedXML",
+        "a CompleteMultipartUpload document is at most 1 MiB",
+    );
+    let body = match read_small(body, MAX_DOCUMENT, too_long, ctx).await? {
+        Ok(body) => body,
+        Err(resp) => return Ok(resp),
+    };
+    if let Err((status, code, message)) = object::check_document(&head.headers, &body) {
+        return Ok(ctx.error(status, code, message));
+    }
+    let parts = match document(&body) {
+        Ok(parts) => parts,
+        Err(Refusal::Malformed(why)) => {
+            return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why));
+        }
+        Err(Refusal::Order) => {
+            return Ok(ctx.error(
+                StatusCode::BAD_REQUEST,
+                "InvalidPartOrder",
+                "the list of parts was not in ascending order of part number",
+            ));
+        }
+    };
+    let assembled = {
+        let (store, segs) = (Arc::clone(&state.store), segs.clone());
+        tokio::task::spawn_blocking(move || -> Result<_> {
+            let Some(up) = open(&store, &id, &segs) else {
+                return Ok(None);
+            };
+            let assembled = assemble(&store, &up, &parts, &whole)?;
+            Ok(Some((up, assembled)))
+        })
+        .await
+        .context("assembling an upload panicked")??
+    };
+    let (up, assembled) = match assembled {
+        None => return Ok(no_such_upload(ctx)),
+        Some((_, Err((status, code, message)))) => return Ok(ctx.error(status, code, message)),
+        Some((up, Ok(assembled))) => (up, assembled),
+    };
+    let Assembled { staged, etag } = assembled;
+    let mut annotations = up.meta.annotations;
+    annotations.insert(MD5_ANNOTATION.to_string(), etag.clone());
+    let how = Commit {
+        annotations,
+        precondition: conditions.precondition(),
+        uncompressed: staged.size >= UNCOMPRESSED_FROM,
+    };
+    match files::commit(Arc::clone(&state.store), segs, staged, how).await? {
+        Written::Created | Written::Replaced => {}
+        Written::Refused(why) => return Ok(unwritable(why, ctx)),
+        Written::PreconditionFailed => return Ok(copy::failed(ctx)),
+    }
+    remove(up.dir).await?;
+    Ok(xml::document(
+        "CompleteMultipartUploadResult",
+        &format!(
+            "{}{}{}{}",
+            xml::element("Location", &ctx.url),
+            xml::element("Bucket", &up.meta.bucket),
+            xml::element("Key", &up.meta.key),
+            xml::element("ETag", &format!("\"{etag}\""))
+        ),
+    ))
+}
+
+/// Remove an upload's directory, off the runtime; one already gone is gone.
+async fn remove(dir: PathBuf) -> Result<()> {
+    tokio::task::spawn_blocking(move || match std::fs::remove_dir_all(&dir) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(anyhow::Error::from(e).context(format!("removing {}", dir.display()))),
+    })
+    .await
+    .context("removing an upload panicked")?
+}
+
+/// `DELETE /s3/<bucket>/<key>?uploadId=<id>`: the upload and its parts removed; 204.
+async fn abort(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    id: String,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Write, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    if let Some(resp) = drain(req, ctx).await? {
+        return Ok(resp);
+    }
+    let Some(up) = open_async(state, &id, &segs).await? else {
+        return Ok(no_such_upload(ctx));
+    };
+    remove(up.dir).await?;
+    Ok(Response::builder()
+        .status(StatusCode::NO_CONTENT)
+        .body(body_of(bytes::Bytes::new()))?)
+}
+
+/// A page size as a query gives it: a count, clamped to [`MAX_LISTED`]; absent, the bound.
+fn page_size(value: Option<&str>) -> Option<usize> {
+    match value {
+        None => Some(MAX_LISTED),
+        Some(v) if !v.is_empty() && v.bytes().all(|b| b.is_ascii_digit()) => {
+            Some(v.parse::<usize>().map_or(MAX_LISTED, |n| n.min(MAX_LISTED)))
+        }
+        Some(_) => None,
+    }
+}
+
+/// `<Initiator>` and `<Owner>`, as S3's upload listings carry them.
+fn initiator_and_owner() -> String {
+    format!(
+        "<Initiator>{}{}</Initiator>{}",
+        xml::element("ID", bucket::OWNER),
+        xml::element("DisplayName", bucket::OWNER),
+        bucket::owner()
+    )
+}
+
+/// The parts recorded in `dir` after part `marker`, ascending: at most `limit` of them.
+fn parts_after(dir: &Path, marker: u32, limit: usize) -> Result<Vec<u32>> {
+    let mut numbers: Vec<u32> = std::fs::read_dir(dir)
+        .with_context(|| format!("listing {}", dir.display()))?
+        .filter_map(|e| recorded_part(e.ok()?.file_name().to_str()?))
+        .filter(|n| *n > marker)
+        .collect();
+    numbers.sort_unstable();
+    numbers.truncate(limit);
+    Ok(numbers)
+}
+
+/// `GET /s3/<bucket>/<key>?uploadId=<id>`: the upload's parts, ascending, from after
+/// `part-number-marker`, `max-parts` of them (at most and by default 1000), each with its
+/// number, ETag, size and when it was written.
+#[allow(clippy::too_many_arguments)]
+async fn list_parts(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    id: String,
+    params: &[(&str, String)],
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !on_parent(authz, accounts::Action::Read, &segs) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let Some(max) = page_size(param(params, "max-parts")) else {
+        return refuse(req, invalid(ctx, "max-parts is a count of parts"), ctx).await;
+    };
+    let marker = match param(params, "part-number-marker") {
+        None => 0,
+        Some(m) => match m.parse::<u32>() {
+            Ok(m) => m,
+            Err(_) => {
+                let resp = invalid(ctx, "part-number-marker is a part's number");
+                return refuse(req, resp, ctx).await;
+            }
+        },
+    };
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, _| {
+        let Some(up) = open(store, &id, &segs) else {
+            return Ok(no_such_upload(&ctx));
+        };
+        let mut numbers = if max == 0 {
+            Vec::new()
+        } else {
+            parts_after(&up.dir, marker, max.saturating_add(1))?
+        };
+        let truncated = numbers.len() > max;
+        numbers.truncate(max);
+        let mut out = format!(
+            "{}{}{}{}{}{}",
+            xml::element("Bucket", &up.meta.bucket),
+            xml::element("Key", &up.meta.key),
+            xml::element("UploadId", &up.id),
+            initiator_and_owner(),
+            xml::element("StorageClass", "STANDARD"),
+            xml::element("PartNumberMarker", &marker.to_string()),
+        );
+        if let Some(last) = numbers.last() {
+            out.push_str(&xml::element("NextPartNumberMarker", &last.to_string()));
+        }
+        out.push_str(&xml::element("MaxParts", &max.to_string()));
+        out.push_str(&xml::element(
+            "IsTruncated",
+            if truncated { "true" } else { "false" },
+        ));
+        for n in numbers {
+            let path = record_path(&up.dir, n);
+            // Gone since the listing: replaced this moment, or the upload completed.
+            let Some(part) = read_record::<Part>(&path) else {
+                continue;
+            };
+            let written = std::fs::metadata(&path)
+                .and_then(|m| m.modified())
+                .unwrap_or_else(|_| SystemTime::now());
+            out.push_str(&format!(
+                "<Part>{}{}{}{}</Part>",
+                xml::element("PartNumber", &n.to_string()),
+                xml::element("LastModified", &list::iso8601(written)),
+                xml::element("ETag", &format!("\"{}\"", part.md5)),
+                xml::element("Size", &part.size.to_string())
+            ));
+        }
+        Ok(xml::document("ListPartsResult", &out))
+    })
+    .await
+}
+
+/// One upload a ListMultipartUploads lists.
+struct Listed {
+    key: String,
+    id: String,
+    created: u64,
+}
+
+/// `GET /s3/<bucket>?uploads`: the uploads in progress into the bucket whose key starts with
+/// `prefix`, by key then id, after `key-marker` (and, for that key, `upload-id-marker`),
+/// `max-uploads` of them (at most and by default 1000). Admitted as a listing of the bucket
+/// with that prefix is, and shows only the uploads whose key the caller may read. Every
+/// upload's record is read: the cost is the store's uploads in progress, not the bucket's.
+pub(super) async fn list_uploads(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: String,
+    query: &str,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    let params = params(query);
+    let taken = [
+        "uploads",
+        "prefix",
+        "max-uploads",
+        "key-marker",
+        "upload-id-marker",
+        "encoding-type",
+    ];
+    if !only(&params, &taken) {
+        return refuse(req, ctx.not_implemented(), ctx).await;
+    }
+    let url = match param(&params, "encoding-type") {
+        None => false,
+        Some("url") => true,
+        Some(_) => return refuse(req, invalid(ctx, "encoding-type is url"), ctx).await,
+    };
+    let Some(max) = page_size(param(&params, "max-uploads")) else {
+        return refuse(req, invalid(ctx, "max-uploads is a count of uploads"), ctx).await;
+    };
+    let prefix = param(&params, "prefix").unwrap_or_default().to_string();
+    let key_marker = param(&params, "key-marker").unwrap_or_default().to_string();
+    let id_marker = param(&params, "upload-id-marker")
+        .unwrap_or_default()
+        .to_string();
+    if !list::admitted(authz, &bucket, &prefix) {
+        return refuse(req, ctx.access_denied(), ctx).await;
+    }
+    let ctx = ctx.clone();
+    crate::dav::blocking(state, authz, move |store, authz| {
+        if !store.repo_dir_exists(&format!("{FILES_REPO}/{bucket}")) {
+            return Ok(ctx.error(
+                StatusCode::NOT_FOUND,
+                "NoSuchBucket",
+                "the specified bucket does not exist",
+            ));
+        }
+        let mut uploads: Vec<Listed> = Vec::new();
+        for (id, dir) in store.multipart_uploads() {
+            let Some(meta) = read_record::<Meta>(&dir.join(META)) else {
+                continue;
+            };
+            let after = meta.key > key_marker
+                || (meta.key == key_marker && !id_marker.is_empty() && id > id_marker);
+            let segs: Vec<String> = std::iter::once(bucket.clone())
+                .chain(meta.key.split('/').map(str::to_string))
+                .collect();
+            if meta.bucket == bucket
+                && meta.key.starts_with(&prefix)
+                && (key_marker.is_empty() || after)
+                && on_parent(authz, accounts::Action::Read, &segs)
+            {
+                uploads.push(Listed {
+                    key: meta.key,
+                    id,
+                    created: meta.created,
+                });
+            }
+        }
+        uploads.sort_by(|a, b| (&a.key, &a.id).cmp(&(&b.key, &b.id)));
+        let truncated = uploads.len() > max;
+        uploads.truncate(max);
+        let enc = |s: &str| {
+            if url {
+                list::url_encode(s)
+            } else {
+                s.to_string()
+            }
+        };
+        let mut out = format!(
+            "{}{}{}",
+            xml::element("Bucket", &bucket),
+            xml::element("KeyMarker", &enc(&key_marker)),
+            xml::element("UploadIdMarker", &id_marker),
+        );
+        if let (true, Some(last)) = (truncated, uploads.last()) {
+            out.push_str(&xml::element("NextKeyMarker", &enc(&last.key)));
+            out.push_str(&xml::element("NextUploadIdMarker", &last.id));
+        }
+        out.push_str(&xml::element("Prefix", &enc(&prefix)));
+        if url {
+            out.push_str(&xml::element("EncodingType", "url"));
+        }
+        out.push_str(&xml::element("MaxUploads", &max.to_string()));
+        out.push_str(&xml::element(
+            "IsTruncated",
+            if truncated { "true" } else { "false" },
+        ));
+        for u in &uploads {
+            let created = SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(u.created);
+            out.push_str(&format!(
+                "<Upload>{}{}{}{}{}</Upload>",
+                xml::element("Key", &enc(&u.key)),
+                xml::element("UploadId", &u.id),
+                initiator_and_owner(),
+                xml::element("StorageClass", "STANDARD"),
+                xml::element("Initiated", &list::iso8601(created))
+            ));
+        }
+        Ok(xml::document("ListMultipartUploadsResult", &out))
+    })
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn body(parts: &str) -> Vec<u8> {
+        format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+             <CompleteMultipartUpload xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
+             {parts}</CompleteMultipartUpload>"
+        )
+        .into_bytes()
+    }
+
+    fn part(n: &str, etag: &str) -> String {
+        format!("<Part><PartNumber>{n}</PartNumber><ETag>{etag}</ETag></Part>")
+    }
+
+    const MD5: &str = "65a8e27d8879283831b664bd8b7f0ad4";
+
+    #[test]
+    fn a_completion_names_its_parts_in_ascending_order() {
+        let parts = document(&body(&format!(
+            "{}<Part><ChecksumCRC32>AAAAAA==</ChecksumCRC32><ETag>{MD5}</ETag>\
+             <PartNumber> 3 </PartNumber></Part>{}",
+            part("1", &format!("&quot;{}&quot;", MD5.to_ascii_uppercase())),
+            part("10000", &format!("\"{MD5}\"")),
+        )))
+        .unwrap();
+        assert_eq!(
+            parts,
+            [
+                (1, MD5.to_string()),
+                (3, MD5.to_string()),
+                (10_000, MD5.to_string())
+            ]
+        );
+        for unordered in [
+            format!("{}{}", part("2", MD5), part("1", MD5)),
+            format!("{}{}", part("2", MD5), part("2", MD5)),
+        ] {
+            assert_eq!(document(&body(&unordered)), Err(Refusal::Order));
+        }
+    }
+
+    #[test]
+    fn a_completion_that_is_not_one_is_malformed() {
+        for bad in [
+            body(""),
+            body("<Part><PartNumber>1</PartNumber></Part>"),
+            body("<Part><ETag>x</ETag></Part>"),
+            body(&part("0", MD5)),
+            body(&part("10001", MD5)),
+            body(&part("-1", MD5)),
+            body(&part("one", MD5)),
+            body(&part("", MD5)),
+            body("<Part><PartNumber>1</PartNumber><PartNumber>2</PartNumber><ETag>x</ETag></Part>"),
+            body(&part("1", "&ent;")),
+            b"<Other><Part><PartNumber>1</PartNumber><ETag>x</ETag></Part></Other>".to_vec(),
+            b"".to_vec(),
+        ] {
+            assert!(
+                matches!(document(&bad), Err(Refusal::Malformed(_))),
+                "{}",
+                String::from_utf8_lossy(&bad)
+            );
+        }
+        // The most parts there can be fit in the bound; past it, the scan stops.
+        let max = (1..=MAX_PARTS)
+            .map(|n| part(&n.to_string(), MD5))
+            .collect::<String>();
+        assert_eq!(document(&body(&max)).unwrap().len(), MAX_PARTS as usize);
+        let elements = (0..MAX_ELEMENTS).map(|_| "<x/>").collect::<String>();
+        assert!(matches!(
+            document(&body(&elements)),
+            Err(Refusal::Malformed(_))
+        ));
+        let big = vec![b' '; MAX_DOCUMENT + 1];
+        assert!(document(&big).is_err());
+    }
+
+    #[test]
+    fn a_multipart_etag_is_the_md5_of_the_parts_md5s_and_their_count() {
+        let a = md5::compute(b"a").0;
+        let b = md5::compute(b"b").0;
+        let mut both = a.to_vec();
+        both.extend_from_slice(&b);
+        assert_eq!(
+            multipart_etag(&[a, b]),
+            format!("{}-2", crate::hex_of(&md5::compute(&both).0))
+        );
+        assert_eq!(
+            multipart_etag(&[a]),
+            format!("{}-1", crate::hex_of(&md5::compute(a).0))
+        );
+    }
+
+    #[test]
+    fn part_numbers_and_records_are_strict() {
+        assert_eq!(part_number("1"), Some(1));
+        assert_eq!(part_number("10000"), Some(10_000));
+        for bad in ["0", "10001", "", "+1", "1 ", "99999999999", "1e3"] {
+            assert_eq!(part_number(bad), None, "{bad}");
+        }
+        assert_eq!(recorded_part("part-7.json"), Some(7));
+        for name in [
+            "part-07.json",
+            "part-7",
+            ".part-7.json",
+            "part-7.json.x",
+            "meta.json",
+        ] {
+            assert_eq!(recorded_part(name), None, "{name}");
+        }
+    }
+
+    #[test]
+    fn a_copy_range_names_both_ends_in_order() {
+        assert_eq!(copy_range("bytes=0-0"), Some((0, 0)));
+        assert_eq!(copy_range(" bytes=5-10 "), Some((5, 10)));
+        for bad in [
+            "bytes=5-",
+            "bytes=-5",
+            "bytes=10-5",
+            "items=0-1",
+            "bytes=a-b",
+            "0-1",
+        ] {
+            assert_eq!(copy_range(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn queries_name_their_parameters_decoded() {
+        let p = params("uploadId=1-2-ab&partNumber=3&x-id=UploadPart");
+        assert_eq!(param(&p, "uploadId"), Some("1-2-ab"));
+        assert_eq!(param(&p, "partNumber"), Some("3"));
+        assert!(only(&p, &["uploadId", "partNumber"]));
+        assert!(!only(&p, &["uploadId"]));
+        assert!(names("uploads", "uploads"));
+        assert!(names("uploads=&prefix=a%2Fb", "uploads"));
+        assert_eq!(param(&params("prefix=a%2Fb"), "prefix"), Some("a/b"));
+        assert!(!names("uploadIds=1", "uploadId"));
+        assert_eq!(page_size(None), Some(MAX_LISTED));
+        assert_eq!(page_size(Some("5")), Some(5));
+        assert_eq!(
+            page_size(Some("100000000000000000000000")),
+            Some(MAX_LISTED)
+        );
+        assert_eq!(page_size(Some("-1")), None);
+    }
+
+    /// An upload is found only for the bucket and key it was created for, and never through an
+    /// id that is not one this server mints.
+    #[test]
+    fn an_upload_answers_only_for_its_own_key() {
+        let dir = std::env::temp_dir().join(format!("vk-reg-s3-mp-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let store = Store::new(dir.clone()).unwrap();
+        let (id, up) = store.create_multipart().unwrap();
+        let meta = Meta {
+            bucket: "b".into(),
+            key: "a/k".into(),
+            created: 1,
+            annotations: BTreeMap::new(),
+        };
+        std::fs::write(up.join(META), serde_json::to_vec(&meta).unwrap()).unwrap();
+        let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
+        assert_eq!(
+            open(&store, &id, &segs(&["b", "a", "k"])).unwrap().meta,
+            meta
+        );
+        for other in [
+            segs(&["b", "a", "x"]),
+            segs(&["c", "a", "k"]),
+            segs(&["b", "a"]),
+        ] {
+            assert!(open(&store, &id, &other).is_none(), "{other:?}");
+        }
+        for id in ["../s3", "", "a/b", "owners"] {
+            assert!(open(&store, id, &segs(&["b", "a", "k"])).is_none(), "{id}");
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 0f7bebe5..81884a94 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -22,7 +22,7 @@ use sha1::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::range::{self, Range};
-use super::{Ctx, chunked, drain, meta, refuse, xml};
+use super::{Ctx, UNCOMPRESSED_FROM, chunked, drain, meta, refuse, xml};
 use crate::dav::http_date;
 use crate::files::{
     self, Commit, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, object_of,
@@ -321,13 +321,6 @@ struct Payload {
     framing: Option<chunked::Framing>,
 }
 
-/// The size from which a written object is stored uncompressed. The AWS CLI and SDK transfer
-/// managers download an object past 8 MiB as parallel 8 MiB ranges, and a range of a
-/// zstd-stored blob is decoded from the blob's start ([`Store::serve_blob_range`]): stored
-/// compressed, an object of N bytes would cost about N²/16 MiB of decoding to download, where
-/// stored plain each range is a seek. Below it, a range costs at most this much decoding.
-const UNCOMPRESSED_FROM: u64 = 8 << 20;
-
 /// The header naming how long an `aws-chunked` body is once decoded.
 const DECODED_LENGTH: &str = "x-amz-decoded-content-length";
 
@@ -452,27 +445,38 @@ fn checksum_len(name: &str) -> usize {
     }
 }
 
-fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
-    // The header's text and the bytes it decodes to, `len` of them.
-    let decoded = |name: &str, len: usize| -> std::result::Result<Option<(String, Vec<u8>)>, ()> {
-        let Some(v) = headers.get(name) else {
-            return Ok(None);
-        };
-        let text = v.to_str().map_err(|_| ())?.trim();
-        let bytes = crate::auth::base64_decode(text)
-            .filter(|b| b.len() == len)
-            .ok_or(())?;
-        Ok(Some((text.to_string(), bytes)))
+/// Header `name`'s text and the bytes it decodes to from base64, `len` of them: `Ok(None)`
+/// when it is not sent, `Err` when it is not that.
+pub(super) fn base64_header(
+    headers: &HeaderMap,
+    name: &str,
+    len: usize,
+) -> std::result::Result<Option<(String, Vec<u8>)>, ()> {
+    let Some(v) = headers.get(name) else {
+        return Ok(None);
     };
-    let md5 = decoded("content-md5", 16).map_err(|()| {
+    let text = v.to_str().map_err(|_| ())?.trim();
+    let bytes = crate::auth::base64_decode(text)
+        .filter(|b| b.len() == len)
+        .ok_or(())?;
+    Ok(Some((text.to_string(), bytes)))
+}
+
+/// The `Content-MD5` a request sends, as bytes.
+fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refused> {
+    let md5 = base64_header(headers, "content-md5", 16).map_err(|()| {
         (
             StatusCode::BAD_REQUEST,
             "InvalidDigest",
             "Content-MD5 is the body's MD5 in base64",
         )
     })?;
+    Ok(md5.map(|(_, b)| b))
+}
+
+fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
     let mut out = Expected {
-        md5: md5.map(|(_, b)| b),
+        md5: content_md5(headers)?,
         ..Expected::default()
     };
     for (name, len) in [
@@ -480,7 +484,7 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
         ("x-amz-checksum-sha1", 20),
         ("x-amz-checksum-crc32", 4),
     ] {
-        let value = decoded(name, len).map_err(|()| {
+        let value = base64_header(headers, name, len).map_err(|()| {
             (
                 StatusCode::BAD_REQUEST,
                 "InvalidRequest",
@@ -589,6 +593,24 @@ fn verify(
 /// PutObject's body is checked: the signed `x-amz-content-sha256`, `Content-MD5` and the
 /// `x-amz-checksum-*` headers. A document is sent whole, not `aws-chunked`.
 pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
+    check_document(headers, body)?;
+    let expected = expected(headers)?;
+    let sha256 = sha2::Sha256::digest(body).to_vec();
+    let sha1 = sha1::Sha1::digest(body).to_vec();
+    let crc32 = crc32fast::hash(body).to_be_bytes().to_vec();
+    verify(
+        &expected,
+        &md5::compute(body).0,
+        &Some(sha256),
+        &Some(sha1),
+        &Some(crc32),
+    )
+}
+
+/// [`check_body`] for a document whose `x-amz-checksum-*` headers are not its own (a
+/// `CompleteMultipartUpload`'s are the object's): the signed `x-amz-content-sha256` and
+/// `Content-MD5` only.
+pub(super) fn check_document(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
     let payload = payload(headers)?;
     if payload.framing.is_some() {
         return Err((
@@ -597,11 +619,9 @@ pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Resul
             "a request document is sent whole, not aws-chunked",
         ));
     }
-    let expected = expected(headers)?;
-    let sha256 = sha2::Sha256::digest(body).to_vec();
     if payload
         .sha256
-        .is_some_and(|signed| signed != crate::hex_of(&sha256))
+        .is_some_and(|signed| signed != crate::hex_of(&sha2::Sha256::digest(body)))
     {
         return Err((
             StatusCode::BAD_REQUEST,
@@ -609,15 +629,11 @@ pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Resul
             "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
         ));
     }
-    let sha1 = sha1::Sha1::digest(body).to_vec();
-    let crc32 = crc32fast::hash(body).to_be_bytes().to_vec();
-    verify(
-        &expected,
-        &md5::compute(body).0,
-        &Some(sha256),
-        &Some(sha1),
-        &Some(crc32),
-    )
+    let expected = Expected {
+        md5: content_md5(headers)?,
+        ..Expected::default()
+    };
+    verify(&expected, &md5::compute(body).0, &None, &None, &None)
 }
 
 /// Why a write at a path that takes no object is refused: what is in the way.
@@ -639,12 +655,143 @@ pub(super) fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
     )
 }
 
+/// Whether a write's declared length, `Content-Length` or `x-amz-decoded-content-length`, is
+/// past the object cap: refused unread, and the connection then closes.
+pub(super) fn declared_too_large(headers: &HeaderMap) -> bool {
+    let over = |name| {
+        headers
+            .get(name)
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.parse::<u64>().ok())
+            .is_some_and(|n| n > MAX_OBJECT)
+    };
+    over(CONTENT_LENGTH.as_str()) || over(DECODED_LENGTH)
+}
+
+/// What a write's headers say of its body, checked before it is read: how it is framed and
+/// bound to the signature, and the digests it is to be checked against.
+pub(super) struct Plan {
+    payload: Payload,
+    expected: Expected,
+}
+
+/// The [`Plan`] of a write's body, or why its headers are refused.
+pub(super) fn plan(headers: &HeaderMap) -> std::result::Result<Plan, Refused> {
+    let payload = payload(headers)?;
+    let trailer = payload.framing.and_then(|f| f.trailer);
+    if trailer.is_some_and(|name| headers.contains_key(name)) {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "InvalidRequest",
+            "a checksum is sent as a header or in the trailer, not both",
+        ));
+    }
+    Ok(Plan {
+        payload,
+        expected: expected(headers)?,
+    })
+}
+
+/// A write's body, received whole and checked against what its request said of it.
+pub(super) struct Received {
+    /// the bytes, staged
+    pub(super) staged: files::Staged,
+    pub(super) md5: [u8; 16],
+    /// the `x-amz-checksum-*` that held, to echo
+    pub(super) echo: Vec<(&'static str, String)>,
+}
+
+/// Stream `body` into `staging` (a private file just created, and its path) while hashing it,
+/// as `plan` says it is framed, then check it against what `plan` says of it. An
+/// `aws-chunked` body is decoded on the way, its chunk signatures checked against `seed` when
+/// there is one, and its trailer's checksum checked as a header's would be. `Ok(Err(answer))`
+/// for a body refused, whose staging file is then gone; a body refused part way is not read
+/// past where it went wrong, and the answer closes the connection.
+pub(super) async fn receive(
+    plan: Plan,
+    body: Incoming,
+    seed: Option<chunked::Seed>,
+    (path, file): (std::path::PathBuf, std::fs::File),
+    ctx: &Ctx,
+) -> Result<std::result::Result<Received, Response<Body>>> {
+    let Plan {
+        payload,
+        mut expected,
+    } = plan;
+    let mut digests = Digests::for_(&expected, payload.framing.and_then(|f| f.trailer));
+    let mut tap = |d: &[u8]| digests.update(d);
+    let (staged, trailer) = match payload.framing {
+        None => (files::stage_into(path, file, body, &mut tap).await, None),
+        Some(framing) => {
+            let mut body = chunked::Decoder::new(body, framing, seed);
+            let staged = files::stage_into(path, file, &mut body, &mut tap).await;
+            let trailer = body
+                .trailer()
+                .map(|(name, value)| (name, value.to_string()));
+            (staged, trailer)
+        }
+    };
+    let staged = match staged {
+        Ok(staged) => staged,
+        Err(PutError::TooLarge) => return Ok(Err(ctx.too_large())),
+        Err(PutError::Failed(e)) => match e.downcast_ref::<chunked::Error>() {
+            Some(chunked::Error::Refused(why)) => {
+                return Ok(Err(ctx.error(why.status, why.code, why.message)));
+            }
+            _ => return Err(e),
+        },
+    };
+    // A refusal from here on drops `staged`, which unlinks it.
+    if let Some((name, value)) = trailer
+        && let Err((status, code, message)) = expected.trailer(name, &value)
+    {
+        return Ok(Err(ctx.error(status, code, message)));
+    }
+    if let Some(signed) = &payload.sha256
+        && *signed != staged.hex
+    {
+        return Ok(Err(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "XAmzContentSHA256Mismatch",
+            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
+        )));
+    }
+    let md5 = digests.md5.finalize().0;
+    let sha1 = digests.sha1.map(|h| h.finalize().to_vec());
+    let crc32 = digests.crc32.map(|h| h.finalize().to_be_bytes().to_vec());
+    let sha256 = hex_bytes(&staged.hex);
+    if let Err((status, code, message)) = verify(&expected, &md5, &sha256, &sha1, &crc32) {
+        return Ok(Err(ctx.error(status, code, message)));
+    }
+    Ok(Ok(Received {
+        staged,
+        md5,
+        echo: expected.echo,
+    }))
+}
+
+/// The 200 a write answers: its `etag` (quoted) and the checksums that held.
+pub(super) fn written(etag: &str, echo: Vec<(&'static str, String)>) -> Result<Response<Body>> {
+    let mut resp = Response::builder()
+        .status(StatusCode::OK)
+        .header(CONTENT_LENGTH, "0")
+        .body(body_of(bytes::Bytes::new()))?;
+    let headers = resp.headers_mut();
+    insert(headers, ETAG, etag);
+    for (name, value) in echo {
+        insert(
+            headers,
+            hyper::header::HeaderName::from_static(name),
+            &value,
+        );
+    }
+    Ok(resp)
+}
+
 /// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
-/// what the request said of it, then tag it under the namespace lock, with its MD5 and user
-/// metadata on the manifest and the request's `If-None-Match: *`/`If-Match` checked there.
-/// Its `Content-Type` is not kept: every object is served as bytes. An `aws-chunked` body is
-/// decoded on the way, its chunk signatures checked against `seed` when there is one, and
-/// its trailer's checksum checked as a header's would be.
+/// what the request said of it ([`receive`]), then tag it under the namespace lock, with its
+/// MD5 and user metadata on the manifest and the request's `If-None-Match: *`/`If-Match`
+/// checked there. Its `Content-Type` is not kept: every object is served as bytes.
 pub(super) async fn put(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -658,30 +805,11 @@ pub(super) async fn put(
         return refuse(req, ctx.access_denied(), ctx).await;
     }
     let headers = req.headers();
-    // A declared length over the cap is refused unread; the connection then closes.
-    let over = |name| {
-        headers
-            .get(name)
-            .and_then(|v| v.to_str().ok())
-            .and_then(|v| v.parse::<u64>().ok())
-            .is_some_and(|n| n > MAX_OBJECT)
-    };
-    if over(CONTENT_LENGTH.as_str()) || over(DECODED_LENGTH) {
+    if declared_too_large(headers) {
         return Ok(ctx.too_large());
     }
-    let checked = payload(headers).and_then(|p| {
-        let trailer = p.framing.and_then(|f| f.trailer);
-        if trailer.is_some_and(|name| headers.contains_key(name)) {
-            return Err((
-                StatusCode::BAD_REQUEST,
-                "InvalidRequest",
-                "a checksum is sent as a header or in the trailer, not both",
-            ));
-        }
-        Ok((p, expected(headers)?))
-    });
-    let (payload, mut expected) = match checked {
-        Ok(checked) => checked,
+    let plan = match plan(headers) {
+        Ok(plan) => plan,
         Err((status, code, message)) => {
             return refuse(req, ctx.error(status, code, message), ctx).await;
         }
@@ -713,64 +841,19 @@ pub(super) async fn put(
         return refuse(req, unwritable(why, ctx), ctx).await;
     }
 
-    let mut digests = Digests::for_(&expected, payload.framing.and_then(|f| f.trailer));
-    let mut tap = |d: &[u8]| digests.update(d);
-    let (staged, trailer) = match payload.framing {
-        None => (
-            files::stage(&state.store, req.into_body(), &mut tap).await,
-            None,
-        ),
-        Some(framing) => {
-            let mut body = chunked::Decoder::new(req.into_body(), framing, seed);
-            let staged = files::stage(&state.store, &mut body, &mut tap).await;
-            let trailer = body
-                .trailer()
-                .map(|(name, value)| (name, value.to_string()));
-            (staged, trailer)
-        }
-    };
-    let staged = match staged {
-        Ok(staged) => staged,
-        Err(PutError::TooLarge) => return Ok(ctx.too_large()),
-        // A body whose framing was refused is answered, unread past where it went wrong; the
-        // answer closes the connection.
-        Err(PutError::Failed(e)) => match e.downcast_ref::<chunked::Error>() {
-            Some(chunked::Error::Refused(why)) => {
-                return Ok(ctx.error(why.status, why.code, why.message));
-            }
-            _ => return Err(e),
-        },
+    let staging = state.store.stage_file()?;
+    let received = match receive(plan, req.into_body(), seed, staging, ctx).await? {
+        Ok(received) => received,
+        Err(resp) => return Ok(resp),
     };
-    // A refusal from here on drops `staged`, which unlinks it: nothing is tagged.
-    if let Some((name, value)) = trailer
-        && let Err((status, code, message)) = expected.trailer(name, &value)
-    {
-        return Ok(ctx.error(status, code, message));
-    }
-    if let Some(signed) = &payload.sha256
-        && *signed != staged.hex
-    {
-        return Ok(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "XAmzContentSHA256Mismatch",
-            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
-        ));
-    }
-    let md5 = digests.md5.finalize().0;
-    let sha1 = digests.sha1.map(|h| h.finalize().to_vec());
-    let crc32 = digests.crc32.map(|h| h.finalize().to_be_bytes().to_vec());
-    let sha256 = hex_bytes(&staged.hex);
-    if let Err((status, code, message)) = verify(&expected, &md5, &sha256, &sha1, &crc32) {
-        return Ok(ctx.error(status, code, message));
-    }
-    let md5_hex = crate::hex_of(&md5);
+    let md5_hex = crate::hex_of(&received.md5);
     annotations.insert(MD5_ANNOTATION.to_string(), md5_hex.clone());
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
-        uncompressed: staged.size >= UNCOMPRESSED_FROM,
+        uncompressed: received.staged.size >= UNCOMPRESSED_FROM,
     };
-    let written = files::commit(Arc::clone(&state.store), segs, staged, how).await?;
+    let written = files::commit(Arc::clone(&state.store), segs, received.staged, how).await?;
     match written {
         Written::Created | Written::Replaced => {}
         Written::Refused(why) => return Ok(unwritable(why, ctx)),
@@ -782,20 +865,7 @@ pub(super) async fn put(
             ));
         }
     }
-    let mut resp = Response::builder()
-        .status(StatusCode::OK)
-        .header(CONTENT_LENGTH, "0")
-        .body(body_of(bytes::Bytes::new()))?;
-    let headers = resp.headers_mut();
-    insert(headers, ETAG, &format!("\"{md5_hex}\""));
-    for (name, value) in expected.echo {
-        insert(
-            headers,
-            hyper::header::HeaderName::from_static(name),
-            &value,
-        );
-    }
-    Ok(resp)
+    self::written(&format!("\"{md5_hex}\""), received.echo)
 }
 
 /// `DELETE /s3/<bucket>/<key>`: 204 whether or not the key held an object, as S3 answers;
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 19801f1c..def19075 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1725,14 +1725,14 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         .await
         .is(404, "NoSuchKey");
 
-    // Not served yet: other subresources, other verbs, part copies.
+    // Not served: other subresources and verbs, and parameters an operation does not take.
     for req in [
         Req::new("GET", "/s3/b/k").query("partNumber=1"),
         Req::new("GET", "/s3/b/k").query("retention"),
-        Req::new("POST", "/s3/b/k").query("uploads"),
+        Req::new("POST", "/s3/b/k").query("uploads&acl"),
         put("/s3/b/k").query("tagging"),
         put("/s3/b/copy")
-            .query("partNumber=1&uploadId=0")
+            .query("partNumber=1&uploadId=0&acl")
             .header("x-amz-copy-source", "/b/k"),
     ] {
         send(&host, req).await.is(501, "NotImplemented");
@@ -3289,3 +3289,431 @@ async fn configurations_are_canned_with_an_api_key() {
         .await
         .is(403, "AccessDenied");
 }
+
+// ---- multipart uploads ----
+
+/// `?uploadId=<id>` and, for a part, `partNumber=<n>` before it, as SigV4 sorts them.
+fn part_query(id: &str, n: u32) -> String {
+    format!("partNumber={n}&uploadId={id}")
+}
+
+/// A `CompleteMultipartUpload` document naming `parts` (number, ETag as sent).
+fn complete_doc(parts: &[(u32, &str)]) -> Vec<u8> {
+    let mut doc = String::from(
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+         <CompleteMultipartUpload xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">",
+    );
+    for (n, etag) in parts {
+        doc.push_str(&format!(
+            "<Part><ETag>{etag}</ETag><PartNumber>{n}</PartNumber></Part>"
+        ));
+    }
+    doc.push_str("</CompleteMultipartUpload>");
+    doc.into_bytes()
+}
+
+/// The ETag S3 gives an object made of `parts`: the MD5 of their MD5s, and their count.
+fn multipart_etag(parts: &[&[u8]]) -> String {
+    let md5s: Vec<u8> = parts.iter().flat_map(|p| md5::compute(p).0).collect();
+    format!("\"{}-{}\"", md5_hex(&md5s), parts.len())
+}
+
+/// Start an upload of the object at `path`: its id.
+async fn create_upload(host: &str, sign: Sign<'_>, path: &str) -> String {
+    let resp = send(host, sign(Req::new("POST", path).query("uploads="))).await;
+    resp.ok(200);
+    element(&resp.body, "UploadId")
+}
+
+/// Send part `n` of upload `id` of `path`: its ETag.
+async fn upload_part(
+    host: &str,
+    sign: Sign<'_>,
+    path: &str,
+    id: &str,
+    n: u32,
+    data: &[u8],
+) -> String {
+    let req = Req::new("PUT", path)
+        .query(&part_query(id, n))
+        .body(data.to_vec());
+    let resp = send(host, sign(req)).await;
+    resp.ok(200);
+    let etag = format!("\"{}\"", md5_hex(data));
+    assert_eq!(resp.header("etag"), Some(&*etag));
+    etag
+}
+
+/// Complete upload `id` of `path` with `parts`.
+fn complete(path: &str, id: &str, parts: &[(u32, &str)]) -> Req {
+    Req::new("POST", path)
+        .query(&format!("uploadId={id}"))
+        .body(complete_doc(parts))
+}
+
+/// The S3 multipart uploads left in the store, by id.
+fn multipart_left(dir: &std::path::Path) -> Vec<String> {
+    let mut ids: Vec<String> = std::fs::read_dir(dir.join("store/uploads/s3"))
+        .map(|d| {
+            d.filter_map(|e| e.ok())
+                .map(|e| e.file_name().to_string_lossy().into_owned())
+                .collect()
+        })
+        .unwrap_or_default();
+    ids.sort();
+    ids
+}
+
+/// An upload in three parts, as the AWS CLI sends a large file (the first part SigV4-signed
+/// `aws-chunked`, the second with its `Content-MD5`, the last with its SHA-256 signed and an
+/// `x-amz-checksum-sha256`), one part replaced, listed, refused when completed wrong, then
+/// completed and read back as the object the parts make, under the multipart ETag; and what
+/// becomes of the upload.
+#[tokio::test]
+async fn a_multipart_upload_is_assembled_from_its_parts() {
+    let (dir, host) = bearer_server("multipart");
+    let sign = |r: Req| r.signed(&host, BEARER, 0);
+    send(&host, sign(Req::new("PUT", "/s3/b"))).await.ok(200);
+    let path = "/s3/b/big/obj";
+    let create = Req::new("POST", path)
+        .query("uploads=")
+        .header("x-amz-meta-mtime", "1700000000")
+        .header("x-amz-checksum-algorithm", "sha256");
+    let resp = send(&host, sign(create)).await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "Bucket"), "b");
+    assert_eq!(element(&resp.body, "Key"), "big/obj");
+    assert_eq!(resp.header("x-amz-checksum-algorithm"), Some("SHA256"));
+    let id = element(&resp.body, "UploadId");
+    assert!(
+        id.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-'),
+        "{id}"
+    );
+    assert_eq!(multipart_left(&dir), std::slice::from_ref(&id));
+
+    let listed = send(&host, sign(Req::new("GET", "/s3/b").query("uploads="))).await;
+    listed.ok(200);
+    assert_eq!(
+        elements(&listed.body, "UploadId"),
+        std::slice::from_ref(&id)
+    );
+    assert_eq!(keys(&listed.body), ["big/obj"]);
+    assert!(element(&listed.body, "Initiated").ends_with(".000Z"));
+
+    let one = bytes_of_len(5 << 20);
+    let two: Vec<u8> = (0..5usize << 20).map(|i| (i * 13 % 241) as u8).collect();
+    let three = bytes_of_len(1024);
+    let query = part_query(&id, 1);
+    let req =
+        Req::new("PUT", path)
+            .query(&query)
+            .chunked(&host, BEARER, Chunked::Signed, &one, None);
+    let resp = send(&host, req).await;
+    resp.ok(200);
+    let etag1 = format!("\"{}\"", md5_hex(&one));
+    assert_eq!(resp.header("etag"), Some(&*etag1));
+    // Part 2 sent wrong first, then replaced.
+    let wrong = upload_part(&host, &sign, path, &id, 2, b"not this").await;
+    let req = Req::new("PUT", path)
+        .query(&part_query(&id, 2))
+        .header("content-md5", &b64(&md5::compute(&two).0))
+        .body(two.clone());
+    let resp = send(&host, sign(req)).await;
+    resp.ok(200);
+    let etag2 = format!("\"{}\"", md5_hex(&two));
+    assert_eq!(resp.header("etag"), Some(&*etag2));
+    let sha = b64(&sha2::Sha256::digest(&three));
+    let req = Req::new("PUT", path)
+        .query(&part_query(&id, 3))
+        .header("x-amz-checksum-sha256", &sha)
+        .body(three.clone())
+        .signed_payload(&host, BEARER, 0, &sha256_hex(&three));
+    let resp = send(&host, req).await;
+    resp.ok(200);
+    assert_eq!(resp.header("x-amz-checksum-sha256"), Some(&*sha));
+    let etag3 = format!("\"{}\"", md5_hex(&three));
+    // A part whose digest does not hold is refused, and the part it would replace kept.
+    let req = Req::new("PUT", path)
+        .query(&part_query(&id, 3))
+        .header("content-md5", &b64(&md5::compute(b"other").0))
+        .body(three.clone());
+    send(&host, sign(req)).await.is(400, "BadDigest");
+
+    // The parts, two to a page.
+    let page = |q: &str| sign(Req::new("GET", path).query(q));
+    let resp = send(&host, page(&format!("max-parts=2&uploadId={id}"))).await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "PartNumber"), ["1", "2"]);
+    assert_eq!(
+        elements(&resp.body, "ETag"),
+        [etag1.replace('"', "&quot;"), etag2.replace('"', "&quot;")]
+    );
+    assert_eq!(
+        elements(&resp.body, "Size"),
+        [(5 << 20).to_string(), (5 << 20).to_string()]
+    );
+    assert_eq!(element(&resp.body, "IsTruncated"), "true");
+    assert_eq!(element(&resp.body, "NextPartNumberMarker"), "2");
+    assert_eq!(element(&resp.body, "UploadId"), id);
+    let resp = send(&host, page(&format!("part-number-marker=2&uploadId={id}"))).await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "PartNumber"), ["3"]);
+    assert_eq!(element(&resp.body, "IsTruncated"), "false");
+
+    // Completions that name the parts wrong leave the upload as it was.
+    let (e1, e2, e3) = (etag1.as_str(), etag2.as_str(), etag3.as_str());
+    for (parts, status, code) in [
+        (vec![(2, e2), (1, e1), (3, e3)], 400, "InvalidPartOrder"),
+        (vec![(1, e1), (1, e1)], 400, "InvalidPartOrder"),
+        (
+            vec![(1, e1), (2, wrong.as_str()), (3, e3)],
+            400,
+            "InvalidPart",
+        ),
+        (vec![(1, e1), (2, e2), (4, e3)], 400, "InvalidPart"),
+        (vec![], 400, "MalformedXML"),
+    ] {
+        let resp = send(&host, sign(complete(path, &id, &parts))).await;
+        resp.is(status, code);
+    }
+    let resp = send(
+        &host,
+        sign(complete(path, &id, &[(1, e1), (2, e2), (3, e3)])),
+    )
+    .await;
+    resp.ok(200);
+    let etag = multipart_etag(&[&one, &two, &three]);
+    assert!(etag.ends_with("-3\""), "{etag}");
+    assert_eq!(element(&resp.body, "ETag"), etag.replace('"', "&quot;"));
+    assert_eq!(element(&resp.body, "Key"), "big/obj");
+    // An absolute URL, as S3 answers: the scheme and host the request was sent to.
+    assert_eq!(
+        element(&resp.body, "Location"),
+        format!("http://{host}{path}")
+    );
+
+    let whole = [one.as_slice(), &two, &three].concat();
+    let resp = send(&host, sign(Req::new("GET", path))).await;
+    is_object(&resp, &whole);
+    assert_eq!(resp.header("etag"), Some(&*etag));
+    assert_eq!(resp.header("x-amz-meta-mtime"), Some("1700000000"));
+    let resp = send(&host, sign(Req::new("HEAD", path))).await;
+    resp.ok(200);
+    assert_eq!(resp.header("etag"), Some(&*etag));
+    let resp = send(&host, sign(Req::new("GET", "/s3/b").query("list-type=2"))).await;
+    resp.ok(200);
+    assert_eq!(keys(&resp.body), ["big/obj"]);
+    assert_eq!(element(&resp.body, "ETag"), etag.replace('"', "&quot;"));
+    // Past 8 MiB, stored plain, as a PutObject of that size is.
+    assert!(
+        dir.join("store/blobs/sha256")
+            .join(sha256_hex(&whole))
+            .is_file()
+    );
+
+    // The upload is gone with its parts, and nothing is left staged.
+    assert!(multipart_left(&dir).is_empty());
+    assert_eq!(staging_left(&dir), 0);
+    let listed = send(&host, sign(Req::new("GET", "/s3/b").query("uploads="))).await;
+    listed.ok(200);
+    assert!(
+        elements(&listed.body, "Upload").is_empty(),
+        "{}",
+        listed.body
+    );
+    let req = Req::new("PUT", path)
+        .query(&part_query(&id, 1))
+        .body(b"late".to_vec());
+    send(&host, sign(req)).await.is(404, "NoSuchUpload");
+    send(&host, sign(complete(path, &id, &[(1, e1)])))
+        .await
+        .is(404, "NoSuchUpload");
+}
+
+/// A one-part upload, an aborted one, part copies, an upload's id used for another key, a
+/// total past the object cap, and the gc's sweep of the uploads left idle.
+#[tokio::test]
+async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
+    let (dir, host) = bearer_server("multipart-more");
+    let sign = |r: Req| r.signed(&host, BEARER, 0);
+    let path = "/s3/b/k";
+
+    // One part.
+    let id = create_upload(&host, &sign, path).await;
+    let data = bytes_of_len(1024);
+    let etag = upload_part(&host, &sign, path, &id, 1, &data).await;
+    let resp = send(&host, sign(complete(path, &id, &[(1, &etag)]))).await;
+    resp.ok(200);
+    let whole = multipart_etag(&[&data]);
+    assert!(whole.ends_with("-1\""), "{whole}");
+    assert_eq!(element(&resp.body, "ETag"), whole.replace('"', "&quot;"));
+    is_object(&send(&host, sign(Req::new("GET", path))).await, &data);
+
+    // Aborted: gone, and gone again.
+    let id = create_upload(&host, &sign, path).await;
+    upload_part(&host, &sign, path, &id, 1, &data).await;
+    let abort = || sign(Req::new("DELETE", path).query(&format!("uploadId={id}")));
+    send(&host, abort()).await.ok(204);
+    let list = Req::new("GET", path).query(&format!("uploadId={id}"));
+    send(&host, sign(list)).await.is(404, "NoSuchUpload");
+    send(&host, abort()).await.is(404, "NoSuchUpload");
+
+    // An id names its own key's upload only, and an id this server cannot mint nothing.
+    let id = create_upload(&host, &sign, path).await;
+    for other in ["/s3/b/other", "/s3/c/k"] {
+        let req = Req::new("PUT", other)
+            .query(&part_query(&id, 1))
+            .body(data.clone());
+        send(&host, sign(req)).await.is(404, "NoSuchUpload");
+    }
+    for bad in ["..", "0-0-zz", "s3"] {
+        let req = Req::new("PUT", path)
+            .query(&part_query(bad, 1))
+            .body(data.clone());
+        send(&host, sign(req)).await.is(404, "NoSuchUpload");
+    }
+    for n in ["0", "10001", "x"] {
+        let req = Req::new("PUT", path)
+            .query(&format!("partNumber={n}&uploadId={id}"))
+            .body(data.clone());
+        send(&host, sign(req)).await.is(400, "InvalidArgument");
+    }
+    // A copy source on a creation is no part copy.
+    let req = Req::new("POST", "/s3/b/x")
+        .query("uploads=")
+        .header("x-amz-copy-source", "/b/k");
+    send(&host, sign(req)).await.is(400, "InvalidArgument");
+    // Nor can an upload be made where no object can be.
+    let req = Req::new("POST", "/s3/b/k/below").query("uploads=");
+    send(&host, sign(req)).await.is(409, "OperationAborted");
+
+    // Parts copied from an object: whole, then a range of it.
+    let src = bytes_of_len(70_000);
+    send(&host, sign(Req::new("PUT", "/s3/b/src").body(src.clone())))
+        .await
+        .ok(200);
+    let copied = "/s3/b/copied";
+    let id = create_upload(&host, &sign, copied).await;
+    let copy = |n: u32| {
+        Req::new("PUT", copied)
+            .query(&part_query(&id, n))
+            .header("x-amz-copy-source", "/b/src")
+    };
+    let resp = send(&host, sign(copy(1))).await;
+    resp.ok(200);
+    assert!(resp.body.contains("<CopyPartResult"), "{}", resp.body);
+    let e1 = element(&resp.body, "ETag").replace("&quot;", "\"");
+    assert_eq!(e1, format!("\"{}\"", md5_hex(&src)));
+    let resp = send(
+        &host,
+        sign(copy(2).header("x-amz-copy-source-range", "bytes=100-1099")),
+    )
+    .await;
+    resp.ok(200);
+    let e2 = element(&resp.body, "ETag").replace("&quot;", "\"");
+    assert_eq!(e2, format!("\"{}\"", md5_hex(&src[100..1100])));
+    let past = copy(3).header("x-amz-copy-source-range", "bytes=69000-70000");
+    send(&host, sign(past)).await.is(416, "InvalidRange");
+    let backwards = copy(3).header("x-amz-copy-source-range", "bytes=5-2");
+    send(&host, sign(backwards))
+        .await
+        .is(400, "InvalidArgument");
+    let failed = copy(3).header("x-amz-copy-source-if-match", "\"other\"");
+    send(&host, sign(failed))
+        .await
+        .is(412, "PreconditionFailed");
+    let absent = Req::new("PUT", copied)
+        .query(&part_query(&id, 3))
+        .header("x-amz-copy-source", "/b/absent");
+    send(&host, sign(absent)).await.is(404, "NoSuchKey");
+    let resp = send(&host, sign(complete(copied, &id, &[(1, &e1), (2, &e2)]))).await;
+    resp.ok(200);
+    let both = [src.as_slice(), &src[100..1100]].concat();
+    is_object(&send(&host, sign(Req::new("GET", copied))).await, &both);
+
+    // A total past the object cap is refused, as the parts' records say before any is read.
+    let id = create_upload(&host, &sign, "/s3/b/huge").await;
+    let e1 = upload_part(&host, &sign, "/s3/b/huge", &id, 1, &data).await;
+    let e2 = upload_part(&host, &sign, "/s3/b/huge", &id, 2, &data).await;
+    let record = dir.join(format!("store/uploads/s3/{id}/part-1.json"));
+    let swollen = format!("{{\"size\":{},\"md5\":\"{}\"}}", 4u64 << 30, md5_hex(&data));
+    std::fs::write(&record, swollen).unwrap();
+    let resp = send(
+        &host,
+        sign(complete("/s3/b/huge", &id, &[(1, &e1), (2, &e2)])),
+    )
+    .await;
+    resp.is(413, "EntityTooLarge");
+    send(&host, sign(Req::new("GET", "/s3/b/huge")))
+        .await
+        .is(404, "NoSuchKey");
+
+    // The gc sweeps an upload nothing was written into for its grace window, and keeps one
+    // a part was written into lately.
+    let fresh = create_upload(&host, &sign, "/s3/b/fresh").await;
+    let old = SystemTime::now() - Duration::from_secs(3 * 86_400);
+    for id in multipart_left(&dir).iter().filter(|id| **id != fresh) {
+        let up = dir.join(format!("store/uploads/s3/{id}"));
+        for e in std::fs::read_dir(&up).unwrap() {
+            std::fs::File::open(e.unwrap().path())
+                .unwrap()
+                .set_modified(old)
+                .unwrap();
+        }
+        std::fs::File::open(&up).unwrap().set_modified(old).unwrap();
+    }
+    assert_eq!(multipart_left(&dir).len(), 3);
+    let store = Store::new(dir.join("store")).unwrap();
+    let day = Duration::from_secs(86_400);
+    let report = store.gc(day * 30, day, false).unwrap();
+    assert_eq!(report.uploads_dropped, 2);
+    assert_eq!(multipart_left(&dir), std::slice::from_ref(&fresh));
+    upload_part(&host, &sign, "/s3/b/fresh", &fresh, 1, &data).await;
+    assert_eq!(staging_left(&dir), 0);
+}
+
+/// A key that may only read a directory can list its uploads and parts, and can neither
+/// start an upload there nor send a part to one.
+#[tokio::test]
+async fn a_read_only_key_cannot_upload_parts() {
+    let dir = tmp("multipart-accounts");
+    let state = accounts_state(&dir);
+    let db = accounts_db(&state);
+    let writer = api_key(db, "writer", &[(Action::Write, "files/*")]);
+    let reader = api_key(db, "reader", &[(Action::Read, "files/*")]);
+    let host = spawn(state.clone());
+    let (writer, reader) = (as_key(&host, &writer), as_key(&host, &reader));
+    send(&host, writer(Req::new("PUT", "/s3/b"))).await.ok(200);
+    let path = "/s3/b/d/k";
+    let id = create_upload(&host, &writer, path).await;
+    let data = bytes_of_len(1024);
+    let etag = upload_part(&host, &writer, path, &id, 1, &data).await;
+
+    let body = vec![b'x'; 1 << 20];
+    let req = Req::new("PUT", path).query(&part_query(&id, 2)).body(body);
+    send(&host, reader(req)).await.is(403, "AccessDenied");
+    let req = Req::new("POST", "/s3/b/d/other").query("uploads=");
+    send(&host, reader(req)).await.is(403, "AccessDenied");
+    send(&host, reader(complete(path, &id, &[(1, &etag)])))
+        .await
+        .is(403, "AccessDenied");
+    let abort = Req::new("DELETE", path).query(&format!("uploadId={id}"));
+    send(&host, reader(abort)).await.is(403, "AccessDenied");
+    let resp = send(
+        &host,
+        reader(Req::new("GET", path).query(&format!("uploadId={id}"))),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "PartNumber"), ["1"]);
+    let resp = send(&host, reader(Req::new("GET", "/s3/b").query("uploads="))).await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "UploadId"), std::slice::from_ref(&id));
+
+    send(&host, writer(complete(path, &id, &[(1, &etag)])))
+        .await
+        .ok(200);
+    is_object(&send(&host, reader(Req::new("GET", path))).await, &data);
+    assert!(multipart_left(&dir).is_empty());
+    assert_eq!(staging_left(&dir), 0);
+}

From d7d7dd72fac3ea31a7e677aaf0fd0d5fb0c0a776 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 14:41:15 +0100
Subject: [PATCH 11/54] vk-registry: print a key's S3 pair

`accounts create-key` and the `/settings/keys` page now also show a
newly minted key as the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair S3
clients take. The CLI's stdout is unchanged (the token alone); the pair
goes to stderr, and spells the token out only when stdout is a terminal.
---
 CHANGELOG.md                      |  3 ++-
 vk-registry/DESIGN.md             |  7 ++++++
 vk-registry/src/accounts_cli.rs   | 32 ++++++++++++++++++++++++++
 vk-registry/src/keys.rs           | 38 +++++++++++++++++++++++++------
 vk-registry/tests/accounts_e2e.rs | 15 ++++++++++++
 5 files changed, 87 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d60e9bc3..f122c03e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,7 +21,8 @@ All notable changes to virtkit will be documented in this file.
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set. Large
   files can be uploaded in parts, as the AWS CLI uploads them, parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
-  them. Set `s3 = false` in the server config to turn it off.
+  them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
+  shown as the S3 key pair, ready to paste.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 5f6eda79..22489440 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -798,6 +798,13 @@ print the issuer and subject of the user they act on. If more than one issuer ha
 the same email, the command requires `--issuer`. API keys are selected by the full hash
 identifier printed by `list-keys`.
 
+`create-key` prints the new token alone on stdout, so a redirect captures it and nothing else;
+what to do with it goes to stderr, including the token as S3 clients take it
+(`AWS_ACCESS_KEY_ID=vkr_… AWS_SECRET_ACCESS_KEY=vkr_…`, the same value twice). That pair
+spells the token out only when stdout is a terminal, so a redirected run leaves it out of a
+log stderr may be going to. `/settings/keys` shows a key it mints both ways, on the one page
+that ever shows its token.
+
 The administration channel is not HTTP and is never part of the public route table. By
 default, the socket is `admin.sock` beside the accounts database. It is published with mode
 `0600` by binding it inside a private staging directory and atomically renaming it into
diff --git a/vk-registry/src/accounts_cli.rs b/vk-registry/src/accounts_cli.rs
index e4b0aee5..ebcddd70 100644
--- a/vk-registry/src/accounts_cli.rs
+++ b/vk-registry/src/accounts_cli.rs
@@ -20,6 +20,7 @@
 //! person already holds working until they expire — `revoke-sessions` is what ends those.
 
 use std::collections::HashMap;
+use std::io::IsTerminal;
 use std::time::SystemTime;
 
 use anyhow::{Context, Result, bail};
@@ -336,9 +337,23 @@ pub fn create_key(
     }
     eprintln!("Copy this token now — it is not stored and will not be shown again.");
     println!("{token}");
+    // Only where the token was just shown: a redirected stdout is the operator capturing
+    // it, and stderr may then be a log the token must not reach.
+    let shown = std::io::stdout().is_terminal().then_some(token.as_str());
+    eprint!("{}", s3_pair(shown));
     Ok(())
 }
 
+/// The key in the form S3 clients take it, for stderr after the token: the same string is
+/// both halves of the pair. `None` names the pair without the token in it.
+fn s3_pair(token: Option<&str>) -> String {
+    let token = token.unwrap_or("<token>");
+    format!(
+        "For S3 clients (endpoint https://<registry>/s3), the token is both the access key \
+         id and the secret:\nAWS_ACCESS_KEY_ID={token} AWS_SECRET_ACCESS_KEY={token}\n"
+    )
+}
+
 /// `ACTION:repo_pattern`, e.g. `write:team-a/*` or `read:*`.
 pub fn parse_scope(s: &str) -> Result<Scope> {
     let (action, pattern) = s
@@ -660,6 +675,23 @@ mod tests {
         Ok(())
     }
 
+    /// The S3 lines carry the token only when asked to, and as both halves of the pair.
+    #[test]
+    fn a_minted_key_is_also_shown_as_an_s3_pair() {
+        let shown = s3_pair(Some("vkr_abc"));
+        assert_eq!(
+            shown,
+            "For S3 clients (endpoint https://<registry>/s3), the token is both the access \
+             key id and the secret:\nAWS_ACCESS_KEY_ID=vkr_abc AWS_SECRET_ACCESS_KEY=vkr_abc\n"
+        );
+        let hidden = s3_pair(None);
+        assert!(!hidden.contains("vkr_"), "{hidden}");
+        assert!(
+            hidden.ends_with("AWS_ACCESS_KEY_ID=<token> AWS_SECRET_ACCESS_KEY=<token>\n"),
+            "{hidden}"
+        );
+    }
+
     /// Drives every `accounts_cli` function in sequence against a real `Db` — the
     /// same functions `main.rs`'s `run_accounts` calls, just without going through
     /// clap. Each one prints to stdout (part of the CLI's job) and returns `Ok`;
diff --git a/vk-registry/src/keys.rs b/vk-registry/src/keys.rs
index 7131badc..601fc935 100644
--- a/vk-registry/src/keys.rs
+++ b/vk-registry/src/keys.rs
@@ -179,17 +179,26 @@ async fn create(
             Some(Section::Keys),
             &Principal::Session(user.clone()),
             csrf_of(db, session_id.as_deref()).as_deref(),
-            &format!(
-                "<h1>New API key</h1>\n\
-                 <p>Copy this token now — it is not stored and will not be shown again:</p>\n\
-                 <pre>{}</pre>\n\
-                 <p><a href=\"/settings/keys\">&larr; back to keys</a></p>",
-                html_escape(&token)
-            ),
+            &minted(&token),
         ),
     ))
 }
 
+/// The one page a new key's token is ever shown on: as the bearer string, then as the pair
+/// S3 clients take, which is the same string twice.
+fn minted(token: &str) -> String {
+    let token = html_escape(token);
+    format!(
+        "<h1>New API key</h1>\n\
+         <p>Copy this token now — it is not stored and will not be shown again:</p>\n\
+         <pre>{token}</pre>\n\
+         <p>For S3 clients (endpoint <code>https://&lt;registry&gt;/s3</code>), the token is \
+         both the access key id and the secret:</p>\n\
+         <pre>AWS_ACCESS_KEY_ID={token} AWS_SECRET_ACCESS_KEY={token}</pre>\n\
+         <p><a href=\"/settings/keys\">&larr; back to keys</a></p>"
+    )
+}
+
 async fn revoke(
     db: &Db,
     user: &User,
@@ -431,6 +440,21 @@ mod tests {
         );
     }
 
+    /// The token is shown as the bearer and as both halves of the S3 pair, escaped each time.
+    #[test]
+    fn a_new_key_is_shown_as_a_bearer_and_as_an_s3_pair() {
+        let page = minted("vkr_<a&b>");
+        assert!(page.contains("<pre>vkr_&lt;a&amp;b&gt;</pre>"), "{page}");
+        assert!(
+            page.contains(
+                "<pre>AWS_ACCESS_KEY_ID=vkr_&lt;a&amp;b&gt; \
+                 AWS_SECRET_ACCESS_KEY=vkr_&lt;a&amp;b&gt;</pre>"
+            ),
+            "{page}"
+        );
+        assert!(!page.contains("<a&b>"), "{page}");
+    }
+
     #[test]
     fn a_day_stamp_is_rendered_without_a_date_library() {
         let at = |s: u64| ymd(Some(SystemTime::UNIX_EPOCH + Duration::from_secs(s)));
diff --git a/vk-registry/tests/accounts_e2e.rs b/vk-registry/tests/accounts_e2e.rs
index 48b8e6a4..492c73eb 100644
--- a/vk-registry/tests/accounts_e2e.rs
+++ b/vk-registry/tests/accounts_e2e.rs
@@ -665,9 +665,24 @@ async fn settings_keys_round_trips_create_and_revoke_with_csrf() {
         .await
         .unwrap();
     assert_eq!(resp.status(), 200);
+    let minted = resp.text().await.unwrap();
     let keys = db.list_api_keys(&user.id).unwrap();
     assert_eq!(keys.len(), 1);
     assert!(keys[0].revoked_at.is_none());
+    // shown once, as the bearer and as the S3 pair, the same token both times
+    let shown = minted
+        .split("<pre>")
+        .nth(1)
+        .and_then(|s| s.split("</pre>").next())
+        .unwrap();
+    let after_prefix = shown.strip_prefix("vkr_").unwrap_or_default();
+    assert!(after_prefix.starts_with(&keys[0].token_prefix), "{minted}");
+    assert!(
+        minted.contains(&format!(
+            "AWS_ACCESS_KEY_ID={shown} AWS_SECRET_ACCESS_KEY={shown}"
+        )),
+        "{minted}"
+    );
 
     // An API key cannot manage keys, even authenticated.
     let (_, token) = db

From 7770420cd2460622c1efe1cc88355a6e79dc94d5 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 14:56:01 +0100
Subject: [PATCH 12/54] vk-registry/s3: take the bucket from the host name with
 s3_host

A new optional `s3_host` setting serves `<bucket>.<s3_host>` as the
path-style `/s3/<bucket>/<path>`, for S3 clients that only speak
virtual-hosted style. The match comes before every other route, so the
whole path is the key; any other host, `s3_host` itself and a label
that cannot be a bucket are routed as before. Signatures are checked
over the request as sent, so nothing changes for credentials.
---
 CHANGELOG.md                      |   3 +-
 README.md                         |   3 +-
 vk-driver/src/registry.rs         |   8 +++
 vk-registry/DESIGN.md             |  15 ++++-
 vk-registry/src/config.rs         |  83 +++++++++++++++++++++++
 vk-registry/src/config/help.rs    |   7 ++
 vk-registry/src/hub/mod.rs        |   1 +
 vk-registry/src/lib.rs            |  17 ++++-
 vk-registry/src/s3/mod.rs         |  81 +++++++++++++++++++---
 vk-registry/src/s3/path.rs        |   7 +-
 vk-registry/tests/accounts_e2e.rs |   4 ++
 vk-registry/tests/exists_e2e.rs   |   1 +
 vk-registry/tests/hubtoken_e2e.rs |   1 +
 vk-registry/tests/relay_e2e.rs    |  16 +++++
 vk-registry/tests/s3_e2e.rs       | 108 +++++++++++++++++++++++++++++-
 15 files changed, 336 insertions(+), 19 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f122c03e..dd1d7383 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,7 +22,8 @@ All notable changes to virtkit will be documented in this file.
   files can be uploaded in parts, as the AWS CLI uploads them, parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
-  shown as the S3 key pair, ready to paste.
+  shown as the S3 key pair, ready to paste. With wildcard DNS, setting `s3_host` also serves
+  each bucket at its own host name, as clients using virtual-hosted style address it.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/README.md b/README.md
index 77b19199..d803d259 100644
--- a/README.md
+++ b/README.md
@@ -868,7 +868,8 @@ SCCACHE_S3_KEY_PREFIX=<dir> AWS_ACCESS_KEY_ID=$KEY AWS_SECRET_ACCESS_KEY=$KEY sc
 
 Object keys follow the store's names (`A-Z a-z 0-9 . _ -` between slashes, at most 1024
 bytes); objects are at most 4 GiB; presigned URLs are refused. Set `s3 = false` to disable
-it.
+it. With wildcard DNS, `s3_host = "s3.example.com"` also serves each bucket virtual-hosted
+style, as `https://<bucket>.s3.example.com/<key>`.
 
 `vk registry put [--dir <dir>] [--ttl 7d | --keep] <file>...` stores files there, each once by
 digest (`/dav/files/sha256/<hex>`) and, with `--dir`, by name (`/dav/files/<dir>/<name>`), and
diff --git a/vk-driver/src/registry.rs b/vk-driver/src/registry.rs
index 19a3fce2..bc22884b 100644
--- a/vk-driver/src/registry.rs
+++ b/vk-driver/src/registry.rs
@@ -5661,6 +5661,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }))
@@ -5709,6 +5710,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -5745,6 +5747,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -5859,6 +5862,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6109,6 +6113,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6168,6 +6173,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6210,6 +6216,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
@@ -6247,6 +6254,7 @@ pub(crate) mod tests {
             tls: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         }));
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 22489440..21dda34d 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -580,8 +580,19 @@ the server logs this setting at startup.
 
 Clients take `endpoint = https://<registry>/s3` and any region: `sccache` with
 `SCCACHE_BUCKET=<bucket> SCCACHE_ENDPOINT=https://<registry>/s3 SCCACHE_REGION=auto`
-(`SCCACHE_S3_KEY_PREFIX` names a directory inside the bucket). Virtual-hosted style, which
-needs wildcard DNS, is not served.
+(`SCCACHE_S3_KEY_PREFIX` names a directory inside the bucket).
+
+**Virtual-hosted style** is opt-in, for clients that cannot be made to use paths: with
+`s3_host = "s3.example.com"`, a request sent to `<bucket>.s3.example.com` names its bucket by
+its host and its key by its whole path, and is served as `/s3/<bucket>/<path>`, so `/` there
+is the bucket and `/a/b` its object `a/b`, even where the path is one another route would
+take. The `Host` port is ignored. The signature is checked over the request as sent, host and
+path included, so nothing about credentials changes. It needs a wildcard DNS record
+`*.s3.example.com` pointing at the registry and, with TLS, a certificate covering that
+wildcard (one label deep: a bucket name with a dot is not covered). A host whose label cannot
+be a bucket, `s3_host` itself, and every other host are served as before, and path-style
+`/s3/` keeps working on any of them. The setting is a lowercase host name with no port; the
+server refuses anything else at startup.
 
 **Credentials.** SigV4 needs the server to hold the signing secret, and this registry stores
 API keys only as hashes and never mints hub tokens, so no new secret is introduced: the
diff --git a/vk-registry/src/config.rs b/vk-registry/src/config.rs
index 461a241a..58b928ac 100644
--- a/vk-registry/src/config.rs
+++ b/vk-registry/src/config.rs
@@ -90,6 +90,9 @@ pub struct ServerConfig {
     /// Enable `/s3/` (default: true). When disabled, requests return 404 after auth; the
     /// objects already stored under `files/` stay reachable over `/dav/` and `/v2/`.
     pub s3: bool,
+    /// The domain whose subdomains name S3 buckets, virtual-hosted style: a request sent to
+    /// `<bucket>.<s3_host>` is served as `/s3/<bucket>/<path>`. Path-style keeps working.
+    pub s3_host: Option<String>,
     /// Connections served at once; past it, new ones wait in the listen backlog.
     pub max_connections: usize,
     /// Connections served at once from one client address (an IPv6 /64); past it, new ones
@@ -263,6 +266,8 @@ struct FileConfig {
     webdav: Option<bool>,
     /// Enable `/s3/`; defaults to true.
     s3: Option<bool>,
+    /// Serve `<bucket>.<s3_host>` as `/s3/<bucket>/`; unset by default.
+    s3_host: Option<String>,
     max_connections: Option<usize>,
     max_connections_per_client: Option<usize>,
     oidc: Option<FileOidc>,
@@ -384,6 +389,7 @@ impl ServerConfig {
             oidc: None,
             webdav: true,
             s3: true,
+            s3_host: None,
             max_connections: crate::DEFAULT_MAX_CONNECTIONS,
             max_connections_per_client: crate::DEFAULT_MAX_CONNECTIONS_PER_CLIENT,
             hub: HubSettings::default(),
@@ -462,6 +468,10 @@ impl ServerConfig {
         if !self.s3 {
             described.push_str(" s3=false");
         }
+        // Only when set, so a registry that leaves it unset keeps the hash it had.
+        if let Some(host) = &self.s3_host {
+            described.push_str(&format!(" s3_host={host}"));
+        }
         // Only when set, so a registry that leaves it keeps the hash it had.
         if *update_drain_minutes != DEFAULT_UPDATE_DRAIN_MINUTES {
             described.push_str(&format!(" update_drain_minutes={update_drain_minutes}"));
@@ -680,6 +690,7 @@ impl ServerConfig {
             }),
             webdav: f.webdav.unwrap_or(true),
             s3: f.s3.unwrap_or(true),
+            s3_host: f.s3_host,
             max_connections: f.max_connections.unwrap_or(crate::DEFAULT_MAX_CONNECTIONS),
             max_connections_per_client: f
                 .max_connections_per_client
@@ -699,6 +710,9 @@ impl ServerConfig {
             gc_prefixes: f.gc.map(|g| g.prefix).unwrap_or_default(),
         };
         cfg.check_connection_limits()?;
+        if let Some(host) = &cfg.s3_host {
+            check_s3_host(host)?;
+        }
         cfg.check_hub()?;
         check_gc_prefixes(&cfg.gc_prefixes)?;
         // Also here, not only in `build_auth`: `load` is where a file becomes a config, so
@@ -964,6 +978,7 @@ impl ServerConfig {
             tls: None,
             webdav: self.webdav,
             s3: self.s3,
+            s3_host: self.s3_host,
             tokens: Default::default(),
             handover: Default::default(),
         })
@@ -1018,6 +1033,26 @@ fn parse_addr(addr: Option<String>) -> Result<Option<SocketAddr>> {
 }
 
 /// Each `[[gc.prefix]]` names a repository prefix, once, with a window of a day or more.
+/// `s3_host` is a host name its buckets are subdomains of: lowercase DNS labels, as a
+/// wildcard certificate and record name them, and no port, which a request's own `Host`
+/// carries and the match ignores.
+fn check_s3_host(host: &str) -> Result<()> {
+    let label_ok = |l: &str| {
+        (1..=63).contains(&l.len())
+            && !l.starts_with('-')
+            && !l.ends_with('-')
+            && l.bytes()
+                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
+    };
+    if host.len() > 253 || !host.split('.').all(label_ok) {
+        bail!(
+            "s3_host {host:?} is not a host name: lowercase labels of a-z, 0-9 and -, joined \
+             by dots, with no port or trailing dot"
+        );
+    }
+    Ok(())
+}
+
 fn check_gc_prefixes(prefixes: &[GcPrefix]) -> Result<()> {
     let mut seen = std::collections::HashSet::new();
     for p in prefixes {
@@ -1924,6 +1959,54 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// `s3_host` is a lowercase host name or nothing, and changes the config hash only when
+    /// set.
+    #[test]
+    fn s3_host_is_a_host_name_and_changes_the_config_hash_only_when_set() {
+        let dir = std::env::temp_dir().join(format!("vk-regserve-s3h-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let load = |body: &str| {
+            let p = dir.join("c.toml");
+            std::fs::write(&p, body).unwrap();
+            ServerConfig::load(&p, None, None)
+        };
+        assert_eq!(load("").unwrap().s3_host, None);
+        for ok in ["s3.example.com", "localhost", "a-1.b2.example", "x"] {
+            let cfg = load(&format!("s3_host = {ok:?}\n")).unwrap();
+            assert_eq!(cfg.s3_host.as_deref(), Some(ok));
+        }
+        let long_label = "a".repeat(64);
+        let long_host = vec!["a".repeat(63); 4].join(".");
+        for bad in [
+            "",
+            "S3.example.com",
+            "s3.example.com:443",
+            "s3.example.com.",
+            ".s3.example.com",
+            "s3..example.com",
+            "-s3.example.com",
+            "s3-.example.com",
+            "s3_x.example.com",
+            "*.example.com",
+            "https://s3.example.com",
+            "[::1]",
+            "10.0.0.1:9000",
+            &long_label,
+            &long_host,
+        ] {
+            let Err(err) = load(&format!("s3_host = {bad:?}\n")) else {
+                panic!("{bad:?} was accepted");
+            };
+            assert!(format!("{err:#}").contains("s3_host"), "{bad:?}: {err:#}");
+        }
+        let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), "/s".into());
+        assert_eq!(cfg.hub_facts().config_hash, "e3609a2059e9c15e");
+        cfg.s3_host = Some("s3.example.com".into());
+        assert_ne!(cfg.hub_facts().config_hash, "e3609a2059e9c15e");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// With `[hub] tokens = true`, a shared secret that reads as a hub token is refused.
     #[test]
     fn a_shared_secret_that_reads_as_a_hub_token_is_refused_with_tokens_on() {
diff --git a/vk-registry/src/config/help.rs b/vk-registry/src/config/help.rs
index 2acb29da..f4f71d46 100644
--- a/vk-registry/src/config/help.rs
+++ b/vk-registry/src/config/help.rs
@@ -101,6 +101,13 @@ const KEYS: &[Key] = &[
         name: "s3",
         help: "enable /s3/; false returns 404 [default: true]",
     },
+    Key {
+        table: Table::Top,
+        name: "s3_host",
+        help: "host name whose subdomains are S3 buckets: <bucket>.<s3_host>\n\
+               is served as /s3/<bucket>/, for virtual-hosted clients;\n\
+               needs wildcard DNS and certificate [default: unset]",
+    },
     Key {
         table: Table::Top,
         name: "max_connections",
diff --git a/vk-registry/src/hub/mod.rs b/vk-registry/src/hub/mod.rs
index 8e114638..777ae24b 100644
--- a/vk-registry/src/hub/mod.rs
+++ b/vk-registry/src/hub/mod.rs
@@ -922,6 +922,7 @@ mod tests {
             tls: None,
             webdav: false,
             s3: false,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         })
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index 8c54d894..d4b135cc 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -111,6 +111,8 @@ pub struct ServerState {
     pub webdav: bool,
     /// Enable the S3 routes under `/s3/`.
     pub s3: bool,
+    /// The domain whose subdomains name S3 buckets, virtual-hosted style, when S3 is on.
+    pub s3_host: Option<String>,
     /// The hub tokens taken, once enrolled with `[hub] tokens = true`.
     pub tokens: hubtoken::TokenGate,
     /// The listeners served through, to hand to a release.
@@ -4318,6 +4320,8 @@ async fn serve_refusing(
     }
     if !state.s3 {
         eprintln!("vk-registry: S3 off (s3 = false): /s3/ answers 404");
+    } else if let Some(host) = &state.s3_host {
+        eprintln!("vk-registry: S3 buckets also served as <bucket>.{host}");
     }
     let slots = Arc::new(tokio::sync::Semaphore::new(limits.connections));
     let peers = PeerCounts::default();
@@ -4686,6 +4690,15 @@ fn token_challenge(auth: &Authenticator) -> Response<Body> {
 }
 
 async fn route(req: Request<Incoming>, state: Arc<ServerState>) -> Result<Response<Body>> {
+    // A host naming a bucket under `s3_host` makes the whole path an S3 key, so this comes
+    // before any route a path selects: an object may be called `login`.
+    if state.s3
+        && let Some(s3_host) = &state.s3_host
+        && let Some(bucket) = s3::host_of(&req).and_then(|h| s3::virtual_bucket(s3_host, h))
+    {
+        let bucket = bucket.to_string();
+        return s3::route(&state, Some(&bucket), req).await;
+    }
     let path = req.uri().path().to_string();
 
     // OIDC login/callback/logout must be reachable without a principal — gating the
@@ -4700,7 +4713,7 @@ async fn route(req: Request<Incoming>, state: Arc<ServerState>) -> Result<Respon
     // `/s3/` passes through a gate of its own, built on the same resolvers. Disabled, it is
     // the 404 below after this gate, as a disabled `/dav/` is.
     if state.s3 && s3::is_path(&path) {
-        return s3::route(&state, req).await;
+        return s3::route(&state, None, req).await;
     }
 
     // Client auth on every other path, including the `/v2/` version probe. Returning
@@ -6730,6 +6743,7 @@ mod tests {
             tls,
             webdav: false,
             s3: false,
+            s3_host: None,
             tokens: Default::default(),
             handover: Default::default(),
         });
@@ -7172,6 +7186,7 @@ mod tests {
                 tls: acceptor,
                 webdav: false,
                 s3: false,
+                s3_host: None,
                 tokens: Default::default(),
                 handover: Default::default(),
             });
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index d555329e..ad2f7388 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -13,6 +13,11 @@
 //! their copies, [`multipart`] their uploads in parts and [`batch`] their deletion in
 //! batches; [`canned`] answers the configurations a bucket or an object has none of.
 //! Operations not served answer `NotImplemented`.
+//!
+//! With `s3_host` set, a request sent to `<bucket>.<s3_host>` names its bucket by its host,
+//! virtual-hosted style, and its key by its whole path ([`virtual_bucket`]). It is served
+//! as the path-style request for the same bucket and key; its signature is checked against
+//! the request as sent, host and path included, as the client signed it.
 
 mod batch;
 mod bucket;
@@ -45,6 +50,28 @@ pub(crate) fn is_path(path: &str) -> bool {
     path == "/s3" || path.starts_with("/s3/")
 }
 
+/// The bucket a request sent to `host` names, virtual-hosted style: `<bucket>.<s3_host>`,
+/// with any `:port` ignored and the domain compared without regard to case. `None` for any
+/// other host, and for a label that cannot name a bucket, so the other routes answer it.
+pub(crate) fn virtual_bucket<'h>(s3_host: &str, host: &'h str) -> Option<&'h str> {
+    let name = match host.rsplit_once(':') {
+        Some((name, port)) if !port.is_empty() && port.bytes().all(|b| b.is_ascii_digit()) => name,
+        _ => host,
+    };
+    let at = name.len().checked_sub(s3_host.len())?;
+    let (label, domain) = (name.get(..at)?, name.get(at..)?);
+    let bucket = label.strip_suffix('.')?;
+    (domain.eq_ignore_ascii_case(s3_host) && path::is_bucket(bucket)).then_some(bucket)
+}
+
+/// The host a request was sent to: its `Host` header, or the authority of an HTTP/2 one.
+pub(crate) fn host_of(req: &Request<Incoming>) -> Option<&str> {
+    match req.headers().get(hyper::header::HOST) {
+        Some(host) => host.to_str().ok(),
+        None => req.uri().authority().map(|a| a.as_str()),
+    }
+}
+
 /// How much of a request body is read before answering a refusal decided before the caller
 /// is known: enough for a small write to see its answer rather than a reset, not so much
 /// that anyone who can reach the port can make the server read a large upload for nothing.
@@ -61,19 +88,24 @@ const REQUEST_ID: &str = "x-amz-request-id";
 pub(super) const UNCOMPRESSED_FROM: u64 = 8 << 20;
 
 /// Serve one `/s3/…` request, from its credentials on: [`crate::route`] hands every such
-/// request here before its own gate when S3 is on.
-pub(crate) async fn route(state: &ServerState, req: Request<Incoming>) -> Result<Response<Body>> {
+/// request here before its own gate when S3 is on, and every request whose host names a
+/// `bucket` ([`virtual_bucket`]), which is then served as the `/s3/<bucket>/…` path naming
+/// the same key.
+pub(crate) async fn route(
+    state: &ServerState,
+    bucket: Option<&str>,
+    req: Request<Incoming>,
+) -> Result<Response<Body>> {
+    let path = req.uri().path();
     let ctx = Ctx {
         id: accounts::random_token(8),
-        path: req.uri().path().to_string(),
-        url: match req.headers().get(hyper::header::HOST) {
-            Some(host) => format!(
-                "{}://{}{}",
-                crate::scheme(state.tls.is_some()),
-                String::from_utf8_lossy(host.as_bytes()),
-                req.uri().path()
-            ),
-            None => req.uri().path().to_string(),
+        path: match bucket {
+            Some(bucket) => format!("/s3/{bucket}{path}"),
+            None => path.to_string(),
+        },
+        url: match host_of(&req) {
+            Some(host) => format!("{}://{host}{path}", crate::scheme(state.tls.is_some())),
+            None => path.to_string(),
         },
     };
     let id = &ctx.id;
@@ -607,6 +639,33 @@ mod tests {
         }
     }
 
+    /// The bucket is the host's first labels before `s3_host`, whatever the port; any other
+    /// host, and a label that cannot be a bucket, names none.
+    #[test]
+    fn a_host_names_a_bucket_only_below_s3_host() {
+        let of = |host| virtual_bucket("s3.example.com", host);
+        assert_eq!(of("b.s3.example.com"), Some("b"));
+        assert_eq!(of("b.s3.example.com:8443"), Some("b"));
+        assert_eq!(of("b.S3.Example.COM"), Some("b"));
+        assert_eq!(of("my.cache.s3.example.com"), Some("my.cache"));
+        for host in [
+            "s3.example.com",
+            "s3.example.com:443",
+            ".s3.example.com",
+            "bs3.example.com",
+            "b.s3.example.org",
+            "b.s3.example.com.",
+            "b.s3.example.com:",
+            "b.s3.example.com:x",
+            "tags.s3.example.com",
+            "a%2fb.s3.example.com",
+            "example.com",
+            "",
+        ] {
+            assert_eq!(of(host), None, "{host:?}");
+        }
+    }
+
     #[test]
     fn a_presigned_query_is_recognised() {
         assert!(is_presigned(
diff --git a/vk-registry/src/s3/path.rs b/vk-registry/src/s3/path.rs
index c8a26690..fc5fe05c 100644
--- a/vk-registry/src/s3/path.rs
+++ b/vk-registry/src/s3/path.rs
@@ -77,7 +77,7 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
         None => (rest, None),
     };
     let bucket = decode_segment(raw_bucket)
-        .filter(|b| crate::valid_name(b) && !b.contains('/') && b.len() <= MAX_COMPONENT)
+        .filter(|b| is_bucket(b))
         .ok_or(BAD_BUCKET)?;
     let raw_key = match raw_key {
         None | Some("") => return Ok(Target::Bucket(bucket)),
@@ -97,6 +97,11 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
     Ok(Target::Object { key, segs })
 }
 
+/// Whether `name`, decoded, can name a bucket: one top-level component of `files/`.
+pub(crate) fn is_bucket(name: &str) -> bool {
+    crate::valid_name(name) && !name.contains('/') && name.len() <= MAX_COMPONENT
+}
+
 /// One key component, decoded and held to a repository name's component rule (which the
 /// leaf, as a tag, also passes).
 fn component(raw: &str) -> Result<String, Refusal> {
diff --git a/vk-registry/tests/accounts_e2e.rs b/vk-registry/tests/accounts_e2e.rs
index 492c73eb..37f1dc06 100644
--- a/vk-registry/tests/accounts_e2e.rs
+++ b/vk-registry/tests/accounts_e2e.rs
@@ -1382,6 +1382,7 @@ async fn a_relayed_blob_becomes_a_member_of_the_repo_it_was_fetched_for() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1488,6 +1489,7 @@ async fn shared_secret_mode_is_unchanged_by_repo_scoping() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1709,6 +1711,7 @@ async fn deleting_a_manifest_on_an_open_server() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -2204,6 +2207,7 @@ async fn a_cross_site_write_is_refused_on_an_open_server() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
diff --git a/vk-registry/tests/exists_e2e.rs b/vk-registry/tests/exists_e2e.rs
index 1a5f4fb8..f2ec4fba 100644
--- a/vk-registry/tests/exists_e2e.rs
+++ b/vk-registry/tests/exists_e2e.rs
@@ -62,6 +62,7 @@ async fn batch_probe_answers_every_tag_in_order() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
diff --git a/vk-registry/tests/hubtoken_e2e.rs b/vk-registry/tests/hubtoken_e2e.rs
index 3dc11cac..773942f9 100644
--- a/vk-registry/tests/hubtoken_e2e.rs
+++ b/vk-registry/tests/hubtoken_e2e.rs
@@ -91,6 +91,7 @@ fn shared_with(
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
diff --git a/vk-registry/tests/relay_e2e.rs b/vk-registry/tests/relay_e2e.rs
index 7090e158..27fe61fc 100644
--- a/vk-registry/tests/relay_e2e.rs
+++ b/vk-registry/tests/relay_e2e.rs
@@ -97,6 +97,7 @@ async fn relay_caches_digest_not_tag() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -119,6 +120,7 @@ async fn relay_caches_digest_not_tag() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -194,6 +196,7 @@ async fn multi_lock_is_atomic_all_or_nothing() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -271,6 +274,7 @@ async fn lock_client_authenticates_with_basic() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -316,6 +320,7 @@ async fn lock_client_authenticates_with_bearer() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -357,6 +362,7 @@ async fn lock_client_round_trips_against_the_server() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -427,6 +433,7 @@ async fn bearer_auth_gates_everything_including_the_probe() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -513,6 +520,7 @@ async fn basic_auth_gates_and_challenges() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -731,6 +739,7 @@ async fn relay_does_not_leak_upstream_credentials_to_the_client() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -776,6 +785,7 @@ async fn lock_api_build_once_over_http() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -1086,6 +1096,7 @@ async fn browse_belongs_to_accounts_mode_and_redirects_a_signed_out_browser() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -1279,6 +1290,7 @@ fn mirror_of(up_addr: std::net::SocketAddr, dir: &std::path::Path) -> Arc<Server
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     })
@@ -1557,6 +1569,7 @@ async fn a_blob_head_is_never_relayed() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1577,6 +1590,7 @@ async fn a_blob_head_is_never_relayed() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1645,6 +1659,7 @@ async fn a_blob_head_agrees_with_the_get_for_a_compressed_blob() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
@@ -1751,6 +1766,7 @@ async fn a_blob_larger_than_one_chunk_streams_back_intact() {
         tls: None,
         webdav: true,
         s3: true,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     }));
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index def19075..8d84a48c 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -73,6 +73,7 @@ fn shared(dir: &std::path::Path, auth: Auth, s3: bool) -> (Arc<ServerState>, Sig
         tls: None,
         webdav: true,
         s3,
+        s3_host: None,
         tokens: Default::default(),
         handover: Default::default(),
     });
@@ -82,6 +83,15 @@ fn shared(dir: &std::path::Path, auth: Auth, s3: bool) -> (Arc<ServerState>, Sig
 
 /// Accounts-mode state built the way `serve` builds it, as in `dav_e2e.rs`.
 fn accounts_state(dir: &std::path::Path) -> Arc<ServerState> {
+    Arc::new(
+        accounts_config(dir)
+            .into_state()
+            .expect("a valid accounts config starts"),
+    )
+}
+
+/// The accounts-mode config [`accounts_state`] starts.
+fn accounts_config(dir: &std::path::Path) -> ServerConfig {
     let secret = dir.join("oidc-secret");
     std::fs::write(&secret, "s3cr3t\n").unwrap();
     let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), dir.join("store"));
@@ -92,7 +102,7 @@ fn accounts_state(dir: &std::path::Path) -> Arc<ServerState> {
         client_secret_file: secret,
         public_url: "https://registry.internal".to_string(),
     });
-    Arc::new(cfg.into_state().expect("a valid accounts config starts"))
+    cfg
 }
 
 fn accounts_db(state: &ServerState) -> &Db {
@@ -496,7 +506,12 @@ struct Conn {
 
 impl Conn {
     async fn open(host: &str) -> Self {
-        let sock = tokio::net::TcpStream::connect(host).await.unwrap();
+        Conn::open_as(host, host).await
+    }
+
+    /// A connection to `addr` whose requests say they are for `host`.
+    async fn open_as(addr: &str, host: &str) -> Self {
+        let sock = tokio::net::TcpStream::connect(addr).await.unwrap();
         let (read, write) = sock.into_split();
         Conn {
             host: host.to_string(),
@@ -1100,6 +1115,95 @@ async fn the_sccache_sequence_round_trips_with_an_api_key() {
     sccache_sequence(&host, &bearer, "other/").await;
 }
 
+/// With `s3_host` set, a host `<bucket>.<s3_host>` names the bucket and the whole path the
+/// key, signed over the host and path as sent; path-style goes on working beside it, and a
+/// host that names no bucket is left to the other routes.
+#[tokio::test]
+async fn a_bucket_is_named_by_its_host_under_s3_host() {
+    let dir = tmp("virtual-host");
+    let mut cfg = accounts_config(&dir);
+    cfg.s3_host = Some("s3.example.com".to_string());
+    let state = Arc::new(cfg.into_state().unwrap());
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    let scopes = [Scope {
+        action: Action::Write,
+        repo_pattern: "files/*".to_string(),
+    }];
+    let (_, key) = db
+        .create_api_key(Some(&user.id), "s3", &scopes, None)
+        .unwrap();
+    let addr = spawn(state.clone());
+    let port = addr.rsplit(':').next().unwrap();
+    let send_to = |host: String, req: Req| {
+        let addr = addr.clone();
+        async move { Conn::open_as(&addr, &host).await.send(&req).await }
+    };
+    let signed = |host: &str, req: Req| req.signed(host, (&key, &key), 0);
+    // the port a client sends is ignored, and the signature covers the host with it
+    for vhost in [
+        "b.s3.example.com".to_string(),
+        format!("b.s3.example.com:{port}"),
+    ] {
+        let put = signed(&vhost, Req::new("PUT", "/dir/k").body(HELLO.to_vec()));
+        send_to(vhost.clone(), put).await.ok(200);
+        let get = signed(&vhost, Req::new("GET", "/dir/k"));
+        is_object(&send_to(vhost.clone(), get).await, HELLO);
+    }
+    // the same object, path-style, on the registry's own host
+    let get = signed(&addr, Req::new("GET", "/s3/b/dir/k"));
+    is_object(&send_to(addr.clone(), get).await, HELLO);
+    // and on `s3_host` itself, where only `/s3/` is S3
+    let get = signed("s3.example.com", Req::new("GET", "/s3/b/dir/k"));
+    is_object(&send_to("s3.example.com".into(), get).await, HELLO);
+
+    let vhost = "b.s3.example.com".to_string();
+    // `/` is the bucket: its listing
+    let list = signed(&vhost, Req::new("GET", "/").query("list-type=2"));
+    let resp = send_to(vhost.clone(), list).await;
+    resp.ok(200);
+    assert!(resp.body.contains("<Name>b</Name>"), "{}", resp.body);
+    assert!(resp.body.contains("<Key>dir/k</Key>"), "{}", resp.body);
+    // the whole path is the key, even one another route would take
+    for path in ["/login", "/s3/k", "/v2/k"] {
+        let put = signed(&vhost, Req::new("PUT", path).body(HELLO.to_vec()));
+        send_to(vhost.clone(), put).await.ok(200);
+    }
+    let get = signed(&addr, Req::new("GET", "/s3/b/s3/k"));
+    is_object(&send_to(addr.clone(), get).await, HELLO);
+    let del = signed(&vhost, Req::new("DELETE", "/dir/k"));
+    send_to(vhost.clone(), del).await.ok(204);
+    let get = signed(&vhost, Req::new("GET", "/dir/k"));
+    send_to(vhost.clone(), get).await.is(404, "NoSuchKey");
+
+    // A label that cannot be a bucket, `s3_host` itself and another domain are the
+    // registry's other routes, as for any host.
+    let bearer = format!("Bearer {key}");
+    let unknown = send_to(
+        addr.clone(),
+        Req::new("GET", "/nowhere").header("Authorization", &bearer),
+    )
+    .await;
+    assert_eq!(unknown.status, 404);
+    for host in [
+        "tags.s3.example.com",
+        "s3.example.com",
+        "b.s3.example.org",
+        "b.s4.example.com",
+    ] {
+        let resp = send_to(
+            host.to_string(),
+            Req::new("GET", "/nowhere").header("Authorization", &bearer),
+        )
+        .await;
+        assert_eq!(resp.status, 404, "{host}: {resp:?}");
+        assert_eq!(resp.header("x-amz-request-id"), None, "{host}");
+        assert_eq!(resp.body, unknown.body, "{host}");
+    }
+}
+
 /// The payload modes: unsigned, or the body's SHA-256, which the body must then have. A
 /// streaming mode this registry does not decode is refused, so its framing never becomes an
 /// object.

From 9dbfe343f121b1128ff2166e4cae9cf6eef2851e Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 22:32:06 +0100
Subject: [PATCH 13/54] vk-registry/s3-compat: add the external S3 conformance
 suites

A host-side harness that points suites written by others at the
registry's S3 view: ceph's s3-tests, MSST-S3, versitygw's integration
tests, MinIO warp, and an AWS CLI and rclone smoke run, each fetched at
a pinned commit or sha256 and run from a shell against a throwaway
`vk-registry serve`. A baseline of expected failures per suite, recorded
by `run.sh --accept`, makes a run fail only on a regression. Nothing
here is part of the build or of `cargo test`.
---
 vk-registry/s3-compat/.gitignore              |   8 +
 vk-registry/s3-compat/README.md               | 133 +++++++++++++++
 vk-registry/s3-compat/lib.sh                  |  98 +++++++++++
 .../s3-compat/msst-s3/expected-failures.txt   |   3 +
 vk-registry/s3-compat/msst-s3/run.sh          |  89 ++++++++++
 vk-registry/s3-compat/outcomes.py             | 117 ++++++++++++++
 vk-registry/s3-compat/proxy.py                | 152 ++++++++++++++++++
 .../s3-compat/s3-tests/expected-failures.txt  |   4 +
 vk-registry/s3-compat/s3-tests/markers.txt    |  40 +++++
 vk-registry/s3-compat/s3-tests/run.sh         |  55 +++++++
 .../s3-compat/s3-tests/s3tests.conf.in        |  58 +++++++
 vk-registry/s3-compat/serve.sh                | 125 ++++++++++++++
 vk-registry/s3-compat/smoke/run.sh            |  96 +++++++++++
 .../s3-compat/versitygw/expected-failures.txt |   3 +
 vk-registry/s3-compat/versitygw/run.sh        |  44 +++++
 vk-registry/s3-compat/warp/run.sh             |  56 +++++++
 16 files changed, 1081 insertions(+)
 create mode 100644 vk-registry/s3-compat/.gitignore
 create mode 100644 vk-registry/s3-compat/README.md
 create mode 100644 vk-registry/s3-compat/lib.sh
 create mode 100644 vk-registry/s3-compat/msst-s3/expected-failures.txt
 create mode 100755 vk-registry/s3-compat/msst-s3/run.sh
 create mode 100644 vk-registry/s3-compat/outcomes.py
 create mode 100644 vk-registry/s3-compat/proxy.py
 create mode 100644 vk-registry/s3-compat/s3-tests/expected-failures.txt
 create mode 100644 vk-registry/s3-compat/s3-tests/markers.txt
 create mode 100755 vk-registry/s3-compat/s3-tests/run.sh
 create mode 100644 vk-registry/s3-compat/s3-tests/s3tests.conf.in
 create mode 100755 vk-registry/s3-compat/serve.sh
 create mode 100755 vk-registry/s3-compat/smoke/run.sh
 create mode 100644 vk-registry/s3-compat/versitygw/expected-failures.txt
 create mode 100755 vk-registry/s3-compat/versitygw/run.sh
 create mode 100755 vk-registry/s3-compat/warp/run.sh

diff --git a/vk-registry/s3-compat/.gitignore b/vk-registry/s3-compat/.gitignore
new file mode 100644
index 00000000..f94deee5
--- /dev/null
+++ b/vk-registry/s3-compat/.gitignore
@@ -0,0 +1,8 @@
+# What the harness fetches and produces: the server's state, the pinned tools and suites,
+# their virtualenvs and every run's results. Only the scripts, templates and baselines are
+# versioned.
+/.state/
+/*/upstream/
+/*/.venv/
+/*/results/
+/__pycache__/
diff --git a/vk-registry/s3-compat/README.md b/vk-registry/s3-compat/README.md
new file mode 100644
index 00000000..405aa1d5
--- /dev/null
+++ b/vk-registry/s3-compat/README.md
@@ -0,0 +1,133 @@
+# S3 compatibility, correctness and performance suites
+
+External test suites pointed at this registry's S3 view (`/s3/`, see `DESIGN.md`'s "S3
+view"): the S3 equivalent of running Autobahn against a WebSocket server. Nothing here is
+part of the build or of `cargo test`; each suite is fetched at a pinned version on first
+use and run from a shell against a throwaway server.
+
+| directory | what | how it reaches the server |
+|---|---|---|
+| `s3-tests/` | [ceph's s3-tests](https://github.com/ceph/ceph/tree/main/src/test/rgw/s3-tests), the broadest S3 conformance suite (boto3, ~800 tests of buckets, objects, listing, multipart, copies, conditional requests, versioning, ACLs, policies...) | through the proxy (host and port only) |
+| `msst-s3/` | [MSST-S3](https://github.com/linux-kdevops/msst-s3) (boto3, ~600 tests mostly ported from versitygw's, in separable groups: basic, multipart, edge, batch...) | directly, SigV4 |
+| `versitygw/` | [versitygw's integration tests](https://github.com/versity/versitygw) (`versitygw test full-flow`, aws-sdk-go-v2: the strictest on headers, error codes and messages, checksums, conditional writes, streaming signatures) | directly, SigV4 |
+| `warp/` | [MinIO warp](https://github.com/minio/warp), the S3 benchmark (mixed, get, put, list, stat, delete, multipart) | through the proxy |
+| `smoke/` | the AWS CLI and rclone doing what their users do: make a bucket, upload small and large (multipart) objects, list, sync, download in ranges, compare, delete | directly, SigV4 |
+
+## Running
+
+Prerequisites: `git`, `curl`, `python3`, `tar`, `unzip`, [`uv`](https://docs.astral.sh/uv/)
+(the Python suites' environments and the AWS CLI come through it), and network access to
+github.com and pypi.org the first time. No Docker, no Go, no system Python packages: every
+download is pinned to a version and a sha256 (`lib.sh`'s `s3c_fetch`, `s3c_clone`).
+
+```sh
+cd vk-registry/s3-compat
+./serve.sh start            # a vk-registry on 127.0.0.1:5300 with S3 on, plus the proxy on :5301
+./smoke/run.sh              # the AWS CLI and rclone, a few seconds
+./s3-tests/run.sh           # ceph's suite: all of test_s3.py less markers.txt, minutes
+./msst-s3/run.sh            # MSST-S3's basic, multipart, edge and batch groups
+./versitygw/run.sh          # versitygw's full-flow
+./warp/run.sh mixed         # a minute of mixed GET/PUT/DELETE/LIST/STAT at 1 MiB objects
+./serve.sh stop
+```
+
+`serve.sh` takes the binary from `dist/vk-registry` (`./build.sh --fast --only=vk-registry`),
+else the debug build `cargo test` leaves in `target/`, else `VK_REGISTRY`. The server runs
+in shared-secret mode with one Basic user, `s3compat`, and a random password, so the SigV4
+access key id is `s3compat` and the secret is the password (`DESIGN.md`, "Credentials");
+its store, config, logs and pids are under `.state/` (`serve.sh start --fresh` wipes the
+store). `.state/env.sh` holds the endpoints and credentials every `run.sh` sources;
+`eval "$(./serve.sh env)"` loads them into a shell for the AWS CLI or rclone by hand.
+
+To run a suite against another server, say AWS or MinIO for a side-by-side reading of a
+failure, export `S3C_ENDPOINT` (the S3 API's URL), `S3C_ROOT_ENDPOINT` (the same API with
+no path, for s3-tests and warp), `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` before
+the `run.sh`; `.state/env.sh` is then not read.
+
+Each run writes `results/<time>/` in its suite's directory, with `results/latest` pointing
+at it: the suite's own output, its log, and `outcomes.txt` (one `PASS|FAIL|SKIP<tab>id`
+line per test). `results/`, `upstream/`, `.venv/` and `.state/` are ignored by git.
+
+## Holding a baseline
+
+A suite written for S3 as AWS serves it will fail here wherever this registry serves
+less (no versioning, ACLs, policies, lifecycle, tagging, object lock or encryption; keys
+restricted to `[A-Za-z0-9._-]` components) or answers differently on purpose (every object
+is `application/octet-stream`; presigned URLs refused). The point is not to reach zero
+failures but to know the set and watch it shrink. So each conformance suite keeps
+`expected-failures.txt`, and its `run.sh` ends by comparing the run with it
+(`outcomes.py compare`):
+
+- a failure the baseline does not expect is a regression, or work still to do: listed,
+  and the run exits 1;
+- an expected failure that now passes is progress: listed, with a hint to drop it from
+  the baseline;
+- `run.sh --accept` rewrites the baseline from the run's failures.
+
+The baselines start empty: once the server is where it should be, run each suite,
+read its failures, and `--accept` what is understood. From then on a run that exits 0 means
+"no worse than the baseline". `s3-tests/markers.txt` lists the pytest markers left out
+entirely, for the tests that are slow (lifecycle tests sleep for minutes) or need another
+service (IAM, STS, SNS, Keycloak); tests of unserved features that fail fast stay in, so
+the day a feature is served its tests start passing without a change here.
+
+## The proxy, and why
+
+Some clients take an endpoint URL and keep its path: boto3 and the AWS CLI, rclone and the
+Go SDK send `/s3/<bucket>/<key>` when told `http://host:5300/s3`. Ceph's s3-tests take a
+host and a port and warp takes `--host`, so they can only send `/<bucket>/<key>`.
+`proxy.py` (standard library, started by `serve.sh`) listens on the second port, prepends
+`/s3` and forwards to the registry. A SigV4 signature covers the path, so the client's
+cannot be kept; the registry takes its other credentials on `/s3/` too, so the proxy
+replaces the SigV4 header with the Basic user when the access key id is its name, and with
+a bearer holding the access key id otherwise (an API key or a hub token is both id and
+secret). `aws-chunked` bodies pass through: under such a credential the registry decodes
+them without checking chunk signatures.
+
+Consequences: through the proxy, signatures are not what is tested (the registry's own
+e2e tests cover SigV4 against AWS's published examples, and versitygw's authentication
+tests reach it directly); and the proxy opens one connection per request, which is part of
+what warp measures, so warp numbers compare one build with another rather than this
+registry with a server addressed at its root.
+
+## Pins
+
+| tool | version | from |
+|---|---|---|
+| ceph/ceph `src/test/rgw/s3-tests` | commit `1cfa9f84f53c4ffd25ff92fe5e0b56154eaf0bfb` (main, 2026-11-05) | sparse, blobless clone (6 MB) |
+| linux-kdevops/msst-s3 | commit `b84a323cca5ee862e87677043f672f156c46b448` (main, 2025-12-04) | clone |
+| versitygw | 1.10.0 (2026-10-22), `versitygw_v1.10.0_Linux_x86_64.tar.gz` | GitHub release, sha256 pinned |
+| warp | 1.8.2 (2026-09-24), `warp-rdma_linux_amd64.tar.gz` (the release's only Linux build; dynamically linked, its library beside it) | GitHub release, sha256 pinned |
+| rclone | 1.75.2 (2026-10-09), `rclone-v1.75.2-linux-amd64.zip` | GitHub release, sha256 pinned |
+| awscli | 1.46.2 (2026-10-21) | PyPI, through `uvx` |
+
+The old `ceph/s3-tests` repository was archived in October 2026 and its tests moved into
+`ceph/ceph`; MinIO's `mint` was archived in March 2026 and is not used here. To move a
+pin, change the version and sha256 (or commit) at the top of the suite's `run.sh`.
+
+## What the suites need from the server
+
+Found while bringing the harness up against a build in progress (November 2026):
+
+- **s3-tests cannot run at all without ListObjectVersions.** Its per-test setup and
+  teardown empty every test bucket with `list_object_versions`, so a 501 there makes every
+  test error before it starts. An unversioned bucket's answer (each key once, `VersionId`
+  `null`, `IsLatest` true, no delete markers) is what AWS gives for a bucket that was never
+  versioned.
+- **A ranged GET that carries the whole object's `x-amz-checksum-sha256` fails the AWS
+  CLI's downloads.** The CLI fetches anything past 8 MiB as parallel ranges, validates each
+  206 response's body against the checksum header it carries, and the whole object's does
+  not match a part. The smoke test's 20 MiB download and `s3 sync` down fail that way.
+- **versitygw's `full-flow` can crash mid-way** on an answer it did not expect (a Go
+  panic in the client), in which case `run.sh` reports what ran; the rest is reachable one
+  test at a time (`./versitygw/run.sh <TestName>`, names from `versitygw test --help`).
+
+## Layout
+
+```text
+serve.sh        the throwaway server and the proxy: start [--fresh] | stop | status | env
+lib.sh          shared by the run.sh scripts: env, pinned downloads and clones, venvs, results
+proxy.py        /<bucket>/<key> on one port -> /s3/<bucket>/<key> on the registry's
+outcomes.py     junit or versitygw output -> outcomes; outcomes vs expected-failures.txt
+<suite>/run.sh  fetch, configure, run, compare; see each one's header for its arguments
+```
diff --git a/vk-registry/s3-compat/lib.sh b/vk-registry/s3-compat/lib.sh
new file mode 100644
index 00000000..efa098ea
--- /dev/null
+++ b/vk-registry/s3-compat/lib.sh
@@ -0,0 +1,98 @@
+# Shared by every script here: where things are, the server a run targets, pinned
+# downloads and clones, Python environments, and the pass/fail baseline. Sourced, not run.
+#
+# A run targets the server `serve.sh start` wrote into `.state/env.sh`, unless the caller
+# exported S3C_ENDPOINT (and S3C_ROOT_ENDPOINT, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
+# to point it at another S3 server, say AWS or MinIO, for a side-by-side comparison.
+
+s3c_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+s3c_repo=$(cd "$s3c_dir/../.." && pwd)
+S3C_STATE=${S3C_STATE:-$s3c_dir/.state}
+s3c_tools=$S3C_STATE/tools
+s3c_downloads=$S3C_STATE/downloads
+
+die() { echo "$(basename "$0"): $*" >&2; exit 1; }
+need() { command -v "$1" >/dev/null 2>&1 || die "$1 is required: $2"; }
+log() { echo "== $*" >&2; }
+
+# The endpoint and credentials of the server under test, into the environment.
+s3c_env() {
+  if [ -z "${S3C_ENDPOINT:-}" ]; then
+    [ -f "$S3C_STATE/env.sh" ] || die "no server to test: run $s3c_dir/serve.sh start, or export \
+S3C_ENDPOINT, S3C_ROOT_ENDPOINT, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY"
+    # shellcheck disable=SC1091
+    . "$S3C_STATE/env.sh"
+  fi
+  : "${S3C_ENDPOINT:?}" "${AWS_ACCESS_KEY_ID:?}" "${AWS_SECRET_ACCESS_KEY:?}"
+  : "${S3C_ROOT_ENDPOINT:=$S3C_ENDPOINT}"
+  export S3C_ENDPOINT S3C_ROOT_ENDPOINT AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
+  export AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:-us-east-1}
+  export AWS_EC2_METADATA_DISABLED=true
+}
+
+# `host:port` of a URL, and whether it is https: what the tools taking no URL want.
+s3c_url_host() { printf '%s\n' "$1" | sed -E 's#^[a-z]+://##; s#/.*$##'; }
+s3c_url_https() { case $1 in https://*) return 0 ;; *) return 1 ;; esac; }
+
+# Download URL once into the downloads cache and hold it to SHA256; its path on stdout.
+s3c_fetch() {
+  local url=$1 sha=$2 out=$s3c_downloads/${3:-$(basename "$1")}
+  need curl "to download $url"
+  mkdir -p "$s3c_downloads"
+  if [ ! -f "$out" ]; then
+    log "downloading $url"
+    curl -fsSL --retry 3 -o "$out.part" "$url" && mv "$out.part" "$out"
+  fi
+  if ! printf '%s  %s\n' "$sha" "$out" | sha256sum -c --quiet - >/dev/null 2>&1; then
+    rm -f "$out"
+    die "$url does not match the pinned sha256 $sha (the download was discarded)"
+  fi
+  printf '%s\n' "$out"
+}
+
+# A repository at a pinned commit in DIR: a blobless clone, narrowed to SPARSE_PATH when
+# one is given, so a large repository costs only the part the suite is in. A second call
+# with the same commit is a no-op.
+s3c_clone() {
+  local url=$1 sha=$2 dir=$3 sparse=${4:-}
+  need git "to clone $url"
+  if [ -d "$dir/.git" ] && [ "$(git -C "$dir" rev-parse HEAD 2>/dev/null)" = "$sha" ]; then
+    return
+  fi
+  if [ ! -d "$dir/.git" ]; then
+    log "cloning $url at $sha"
+    git clone --quiet --filter=blob:none --no-checkout --depth 1 "$url" "$dir"
+  fi
+  git -C "$dir" fetch --quiet --depth 1 origin "$sha"
+  if [ -n "$sparse" ]; then
+    git -C "$dir" sparse-checkout set --cone "$sparse"
+  fi
+  git -C "$dir" checkout --quiet --detach "$sha"
+}
+
+# A virtualenv at DIR/.venv holding the given requirements; its python on stdout.
+s3c_venv() {
+  local dir=$1; shift
+  need uv "to make a Python environment (https://docs.astral.sh/uv/)"
+  if [ ! -x "$dir/.venv/bin/python" ]; then
+    log "creating $dir/.venv"
+    uv venv --quiet "$dir/.venv"
+  fi
+  uv pip install --quiet --python "$dir/.venv/bin/python" "$@"
+  printf '%s\n' "$dir/.venv/bin/python"
+}
+
+# A fresh results directory for this run, named by the time, and `latest` pointing at it.
+s3c_results() {
+  local base=$1/results dir
+  dir=$base/$(date -u +%Y%m%dT%H%M%SZ)
+  mkdir -p "$dir"
+  ln -sfn "$(basename "$dir")" "$base/latest"
+  printf '%s\n' "$dir"
+}
+
+# Compare a run's outcomes with the suite's baseline of expected failures; `--accept`
+# rewrites the baseline from this run. Exit status is the comparison's.
+s3c_compare() {
+  python3 -I "$s3c_dir/outcomes.py" compare "$@"
+}
diff --git a/vk-registry/s3-compat/msst-s3/expected-failures.txt b/vk-registry/s3-compat/msst-s3/expected-failures.txt
new file mode 100644
index 00000000..66ac1fac
--- /dev/null
+++ b/vk-registry/s3-compat/msst-s3/expected-failures.txt
@@ -0,0 +1,3 @@
+# Tests expected to fail, one id per line; rewritten by run.sh --accept.
+# Remove a line once the server passes its test.
+# Empty until the first run against the finished server.
diff --git a/vk-registry/s3-compat/msst-s3/run.sh b/vk-registry/s3-compat/msst-s3/run.sh
new file mode 100755
index 00000000..efad2a02
--- /dev/null
+++ b/vk-registry/s3-compat/msst-s3/run.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# MSST-S3 (linux-kdevops/msst-s3, boto3; most of its tests ported from versitygw's) against
+# the server under test, a test group at a time. Its runner takes an endpoint URL, so it
+# goes straight to the registry's /s3/ (S3C_ENDPOINT) with real SigV4 signatures.
+#
+# Usage: run.sh [--accept] [--list] [group...]
+#   no group     basic multipart edge batch (the groups covering what the registry serves)
+#   --list       print the suite's tests and groups, and stop
+#   --accept     rewrite expected-failures.txt from this run's failures
+#
+# Groups: basic multipart versioning acl encryption lifecycle performance stress edge
+# integration advanced_basic advanced_multipart replication notifications lambda analytics
+# batch tiering access_points object_lambda compliance ... (scripts/test-runner.py).
+#
+# Results: results/<time>/{<group>.xml,outcomes.txt,<group>.log}, results/latest.
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=../lib.sh
+. ../lib.sh
+
+MSST_URL=https://github.com/linux-kdevops/msst-s3.git
+MSST_SHA=b84a323cca5ee862e87677043f672f156c46b448   # main, 2025-12-04
+
+accept=()
+if [ "${1:-}" = --accept ]; then accept=(--accept); shift; fi
+
+s3c_env
+s3c_clone "$MSST_URL" "$MSST_SHA" upstream
+suite=$PWD/upstream
+python=$(s3c_venv "$PWD" -r "$suite/requirements.txt")
+
+results=$(s3c_results "$PWD")
+cfg=$results/s3_config.yaml
+use_ssl=false
+if s3c_url_https "$S3C_ENDPOINT"; then use_ssl=true; fi
+(umask 077; cat > "$cfg" <<YAML
+# written by run.sh for scripts/test-runner.py
+s3_endpoint_url: "$S3C_ENDPOINT"
+s3_access_key: "$AWS_ACCESS_KEY_ID"
+s3_secret_key: "$AWS_SECRET_ACCESS_KEY"
+s3_region: "$AWS_DEFAULT_REGION"
+s3_use_ssl: $use_ssl
+s3_verify_ssl: false
+s3_bucket_prefix: "s3compat-msst"
+test_basic: true
+test_multipart: true
+test_versioning: true
+test_acl: true
+test_encryption: true
+test_lifecycle: true
+test_performance: true
+test_stress: true
+test_compatibility: true
+test_run_mode: "sequential"
+test_timeout: 120
+test_retry_count: 0
+test_object_sizes: "1KB,1MB"
+test_bucket_count: 2
+test_object_count: 5
+output_format: "junit"
+output_verbose: 1
+output_dir: "$results"
+output_timestamp: false
+output_save_logs: true
+vendor_type: "generic"
+debug_enabled: false
+debug_keep_buckets: false
+YAML
+)
+
+runner() { (cd "$suite" && "$python" scripts/test-runner.py --config "$cfg" "$@"); }
+
+if [ "${1:-}" = --list ]; then runner --list-tests; exit; fi
+if [ $# -eq 0 ]; then set -- basic multipart edge batch; fi
+
+: > "$results/outcomes.txt"
+for group in "$@"; do
+  log "group $group -> $results"
+  before=$(ls "$results"/*.xml 2>/dev/null || true)
+  runner --group "$group" --output-dir "$results" --output-format junit 2>&1 \
+    | tee "$results/$group.log" || true
+  for xml in "$results"/*.xml; do
+    [ -f "$xml" ] || continue
+    case " $before " in *" $xml "*) continue ;; esac
+    python3 -I ../outcomes.py from-junit "$xml" >> "$results/outcomes.txt"
+  done
+done
+[ -s "$results/outcomes.txt" ] || die "the runner wrote no junit results: see $results/*.log"
+s3c_compare "$results/outcomes.txt" expected-failures.txt "${accept[@]}"
diff --git a/vk-registry/s3-compat/outcomes.py b/vk-registry/s3-compat/outcomes.py
new file mode 100644
index 00000000..294870bd
--- /dev/null
+++ b/vk-registry/s3-compat/outcomes.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+"""A suite's outcomes as one line per test, and their comparison with a baseline.
+
+    outcomes.py from-junit RESULTS.xml            > outcomes.txt
+    outcomes.py from-log   versitygw-output.log   > outcomes.txt
+    outcomes.py compare    outcomes.txt expected-failures.txt [--accept]
+
+An outcomes line is `PASS|FAIL|SKIP<tab>test id`. The baseline lists the ids expected to
+fail, one per line, `#` comments allowed. `compare` prints the counts, every failure the
+baseline does not expect (the regressions, or the work still to do) and every expected
+failure that passed (progress: remove it from the baseline, or `--accept` to rewrite the
+baseline from this run). It exits 1 when there is a new failure, so a CI step can gate on
+"no worse than the baseline" while the baseline shrinks.
+"""
+
+import re
+import sys
+import xml.etree.ElementTree as ET
+
+ANSI = re.compile(r"\x1b\[[0-9;]*m")
+
+
+def from_junit(path):
+    root = ET.parse(path).getroot()
+    for case in root.iter("testcase"):
+        name = case.get("name", "")
+        classname = case.get("classname", "")
+        test_id = f"{classname}::{name}" if classname else name
+        if case.find("failure") is not None or case.find("error") is not None:
+            status = "FAIL"
+        elif case.find("skipped") is not None:
+            status = "SKIP"
+        else:
+            status = "PASS"
+        print(f"{status}\t{test_id}")
+
+
+def from_log(path):
+    """versitygw's `PASS name` / `FAIL name` / `SKIP name` lines, colours stripped."""
+    with open(path, encoding="utf-8", errors="replace") as f:
+        for line in f:
+            line = ANSI.sub("", line).rstrip("\n")
+            m = re.match(r"(PASS|FAIL|SKIP)\s+([^:\s]+)", line)
+            if m:  # a FAIL line goes on with `: <why>`, which is not part of the id
+                print(f"{m.group(1)}\t{m.group(2)}")
+
+
+def read_outcomes(path):
+    outcomes = {}
+    with open(path) as f:
+        for line in f:
+            line = line.rstrip("\n")
+            if not line or line.startswith("#"):
+                continue
+            status, _, test_id = line.partition("\t")
+            outcomes[test_id] = status
+    return outcomes
+
+
+def read_baseline(path):
+    expected = set()
+    try:
+        with open(path) as f:
+            for line in f:
+                line = line.strip()
+                if line and not line.startswith("#"):
+                    expected.add(line)
+    except FileNotFoundError:
+        pass
+    return expected
+
+
+def compare(outcomes_path, baseline_path, accept):
+    outcomes = read_outcomes(outcomes_path)
+    expected = read_baseline(baseline_path)
+    failed = {t for t, s in outcomes.items() if s == "FAIL"}
+    passed = {t for t, s in outcomes.items() if s == "PASS"}
+    skipped = {t for t, s in outcomes.items() if s == "SKIP"}
+    new = sorted(failed - expected)
+    fixed = sorted(expected & passed)
+    print(f"ran {len(outcomes)}: {len(passed)} passed, {len(failed)} failed, "
+          f"{len(skipped)} skipped; baseline expects {len(expected)} failures")
+    if fixed:
+        print(f"\n{len(fixed)} expected failures now pass (remove them from the baseline, "
+              f"or --accept):")
+        for t in fixed:
+            print(f"  {t}")
+    if new:
+        print(f"\n{len(new)} failures the baseline does not expect:")
+        for t in new:
+            print(f"  {t}")
+    if accept:
+        with open(baseline_path, "w") as f:
+            f.write("# Tests expected to fail, one id per line; rewritten by run.sh --accept.\n")
+            f.write("# Remove a line once the server passes its test.\n")
+            for t in sorted(failed):
+                f.write(t + "\n")
+        print(f"\nbaseline rewritten: {baseline_path} ({len(failed)} failures)")
+        return 0
+    return 1 if new else 0
+
+
+def main(argv):
+    if len(argv) >= 3 and argv[1] == "from-junit":
+        from_junit(argv[2])
+    elif len(argv) >= 3 and argv[1] == "from-log":
+        from_log(argv[2])
+    elif len(argv) >= 4 and argv[1] == "compare":
+        return compare(argv[2], argv[3], "--accept" in argv[4:])
+    else:
+        print(__doc__, file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
diff --git a/vk-registry/s3-compat/proxy.py b/vk-registry/s3-compat/proxy.py
new file mode 100644
index 00000000..c9cf1181
--- /dev/null
+++ b/vk-registry/s3-compat/proxy.py
@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+"""Serve an S3 API that lives under a path prefix at the root of another port.
+
+vk-registry answers S3 under `/s3/`. boto3, the AWS CLI, rclone and the Go SDK take an
+endpoint with a path and send `/s3/<bucket>/<key>`; ceph's s3-tests (host and port only)
+and warp (`--host`) cannot. This proxy takes `/<bucket>/<key>` on its port and forwards
+`/s3/<bucket>/<key>` to the registry.
+
+A SigV4 signature covers the path, so a rewritten request cannot carry the client's
+signature. The registry also takes the credentials its other routes take on `/s3/`, so the
+proxy swaps the SigV4 `Authorization` for one of those: the Basic user when the access key
+id is its name, else a bearer holding the access key id (an API key or a hub token is both
+id and secret). The registry decodes `aws-chunked` bodies under such a credential without
+checking chunk signatures, so SDK uploads pass through unchanged.
+
+One request per connection: the proxy adds `Connection: close`, so the server closes after
+answering and the client opens a new connection for its next request. That keeps the proxy
+a byte pump, with no HTTP body parsing to get wrong, at the cost of a connection per
+request, which is a cost in a benchmark. Standard library only.
+"""
+
+import argparse
+import asyncio
+import base64
+import re
+import sys
+
+MAX_HEAD = 64 * 1024
+CREDENTIAL = re.compile(r"Credential=([^/,\s]+)/")
+
+
+class Settings:
+    def __init__(self, args):
+        self.upstream_host, port = args.upstream.rsplit(":", 1)
+        self.upstream_port = int(port)
+        self.prefix = args.prefix.rstrip("/").encode()
+        self.basic_user = args.basic_user
+        self.basic = None
+        if args.basic_user and args.password_file:
+            with open(args.password_file) as f:
+                password = f.read().strip()
+            self.basic = b"Basic " + base64.b64encode(
+                f"{args.basic_user}:{password}".encode()
+            )
+        self.verbose = args.verbose
+
+
+def rewrite_authorization(value: bytes, settings: Settings):
+    """The credential the registry takes in place of a SigV4 header; others pass."""
+    text = value.decode("latin-1")
+    if not text.startswith("AWS4-HMAC-SHA256"):
+        return value
+    m = CREDENTIAL.search(text)
+    if not m:
+        return value
+    key_id = m.group(1)
+    if settings.basic is not None and key_id == settings.basic_user:
+        return settings.basic
+    return b"Bearer " + key_id.encode("latin-1")
+
+
+def rewrite_head(head: bytes, settings: Settings) -> bytes:
+    lines = head.split(b"\r\n")
+    method, target, version = lines[0].split(b" ", 2)
+    if not target.startswith(b"/"):
+        raise ValueError("origin-form request target expected")
+    out = [b" ".join((method, settings.prefix + target, version))]
+    for line in lines[1:]:
+        name, _, value = line.partition(b":")
+        lname = name.strip().lower()
+        if lname in (b"connection", b"proxy-connection", b"keep-alive"):
+            continue
+        if lname == b"authorization":
+            out.append(b"Authorization: " + rewrite_authorization(value.strip(), settings))
+            continue
+        out.append(line)
+    out.append(b"Connection: close")
+    if settings.verbose:
+        print(f"{method.decode()} {target.decode()}", file=sys.stderr, flush=True)
+    return b"\r\n".join(out) + b"\r\n\r\n"
+
+
+async def pump(reader, writer, eof_only: bool):
+    """Copy until EOF; then half-close (a request's end) or close (a response's)."""
+    try:
+        while chunk := await reader.read(64 * 1024):
+            writer.write(chunk)
+            await writer.drain()
+        if eof_only and writer.can_write_eof():
+            writer.write_eof()
+        elif not eof_only:
+            writer.close()
+    except (ConnectionResetError, BrokenPipeError, asyncio.IncompleteReadError):
+        pass
+    except Exception as e:  # noqa: BLE001 - a pump's failure is a connection's, not the proxy's
+        print(f"proxy: {e}", file=sys.stderr, flush=True)
+        writer.close()
+
+
+async def handle(client_r, client_w, settings: Settings):
+    up_w = None
+    try:
+        try:
+            head = await client_r.readuntil(b"\r\n\r\n")
+        except asyncio.LimitOverrunError:
+            client_w.write(b"HTTP/1.1 431 Request Header Fields Too Large\r\n"
+                           b"Connection: close\r\nContent-Length: 0\r\n\r\n")
+            await client_w.drain()
+            return
+        except asyncio.IncompleteReadError:
+            return
+        new_head = rewrite_head(head[:-4], settings)
+        up_r, up_w = await asyncio.open_connection(settings.upstream_host, settings.upstream_port)
+        up_w.write(new_head)
+        await up_w.drain()
+        await asyncio.gather(pump(client_r, up_w, eof_only=True),
+                             pump(up_r, client_w, eof_only=False))
+    except (ConnectionResetError, BrokenPipeError, ValueError) as e:
+        print(f"proxy: {e}", file=sys.stderr, flush=True)
+    finally:
+        for w in (client_w, up_w):
+            if w is not None:
+                w.close()
+                try:
+                    await w.wait_closed()
+                except Exception:  # noqa: BLE001
+                    pass
+
+
+async def main():
+    p = argparse.ArgumentParser(description=__doc__.split("\n\n")[0])
+    p.add_argument("--listen", default="127.0.0.1:5301", help="host:port to serve")
+    p.add_argument("--upstream", default="127.0.0.1:5300", help="host:port of the registry")
+    p.add_argument("--prefix", default="/s3", help="the path the S3 API lives under")
+    p.add_argument("--basic-user", help="the registry's Basic user, for that access key id")
+    p.add_argument("--password-file", help="that user's password")
+    p.add_argument("--verbose", action="store_true", help="log every request")
+    args = p.parse_args()
+    settings = Settings(args)
+    host, port = args.listen.rsplit(":", 1)
+    server = await asyncio.start_server(
+        lambda r, w: handle(r, w, settings), host, int(port), limit=MAX_HEAD)
+    print(f"proxy: {args.listen} -> {args.upstream}{args.prefix}", file=sys.stderr, flush=True)
+    async with server:
+        await server.serve_forever()
+
+
+if __name__ == "__main__":
+    try:
+        asyncio.run(main())
+    except KeyboardInterrupt:
+        pass
diff --git a/vk-registry/s3-compat/s3-tests/expected-failures.txt b/vk-registry/s3-compat/s3-tests/expected-failures.txt
new file mode 100644
index 00000000..6df30271
--- /dev/null
+++ b/vk-registry/s3-compat/s3-tests/expected-failures.txt
@@ -0,0 +1,4 @@
+# Tests expected to fail, one id per line; rewritten by run.sh --accept.
+# Remove a line once the server passes its test.
+# Empty until the first run against the finished server: run.sh then lists every failure,
+# and run.sh --accept records them as the baseline to hold.
diff --git a/vk-registry/s3-compat/s3-tests/markers.txt b/vk-registry/s3-compat/s3-tests/markers.txt
new file mode 100644
index 00000000..5f0904ee
--- /dev/null
+++ b/vk-registry/s3-compat/s3-tests/markers.txt
@@ -0,0 +1,40 @@
+# pytest markers left out of a run (see pytest.ini in the suite for the full list): the
+# features this registry does not serve and whose tests are slow (lifecycle tests sleep
+# for minutes), need another service (IAM, STS, Keycloak, SNS), or are known not to hold
+# on AWS itself. Tests of unserved features that fail fast (versioning, tagging, policies,
+# encryption...) stay in and are tracked in expected-failures.txt, so the day one is
+# served its tests start passing without a change here.
+fails_on_aws
+lifecycle
+lifecycle_expiration
+lifecycle_transition
+cloud_transition
+cloud_restore
+bucket_logging
+bucket_logging_cleanup
+fails_without_logging_rollover
+s3select
+s3website
+s3website_routing_rules
+s3website_redirect_location
+s3control
+sns
+test_of_sts
+webidentity_test
+token_claims_trust_policy_test
+token_principal_tag_role_policy_test
+token_request_tag_trust_policy_test
+token_resource_tags_test
+token_role_tags_test
+token_tag_keys_test
+iam_account
+iam_cross_account
+iam_role
+iam_tenant
+iam_user
+group
+group_policy
+role_policy
+session_policy
+user_policy
+abac_test
diff --git a/vk-registry/s3-compat/s3-tests/run.sh b/vk-registry/s3-compat/s3-tests/run.sh
new file mode 100755
index 00000000..87b9675d
--- /dev/null
+++ b/vk-registry/s3-compat/s3-tests/run.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Ceph's s3-tests (the broadest S3 conformance suite, boto3) against the server under test.
+#
+# The suite now lives in ceph/ceph under src/test/rgw/s3-tests, pinned below; it is cloned
+# blobless and sparse, so only that directory's files are fetched. Its clients take a host
+# and a port, not a path, so it runs through the root-path proxy (S3C_ROOT_ENDPOINT).
+#
+# Usage: run.sh [--accept] [pytest arguments...]
+#   no arguments        s3tests/functional/test_s3.py, less the markers in markers.txt
+#   -k EXPR, FILE::test narrows the run as pytest does (markers.txt still applies)
+#   --accept            rewrite expected-failures.txt from this run's failures
+#
+# Results: results/<time>/{junit.xml,outcomes.txt,pytest.log}, results/latest.
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=../lib.sh
+. ../lib.sh
+
+CEPH_URL=https://github.com/ceph/ceph.git
+CEPH_SHA=1cfa9f84f53c4ffd25ff92fe5e0b56154eaf0bfb   # main, 2026-11-05
+SUITE=src/test/rgw/s3-tests
+
+accept=()
+if [ "${1:-}" = --accept ]; then accept=(--accept); shift; fi
+
+s3c_env
+s3c_clone "$CEPH_URL" "$CEPH_SHA" upstream "$SUITE"
+suite=$PWD/upstream/$SUITE
+python=$(s3c_venv "$PWD" -r "$suite/requirements.txt")
+
+host=$(s3c_url_host "$S3C_ROOT_ENDPOINT")
+secure=False
+if s3c_url_https "$S3C_ROOT_ENDPOINT"; then secure=True; fi
+case $host in
+  *:*) port=${host##*:}; host=${host%:*} ;;
+  *) port=443; [ $secure = True ] || port=80 ;;
+esac
+results=$(s3c_results "$PWD")
+conf=$results/s3tests.conf
+(umask 077; sed -e "s|@HOST@|$host|g" -e "s|@PORT@|$port|g" -e "s|@SECURE@|$secure|g" \
+  -e "s|@ACCESS_KEY@|$AWS_ACCESS_KEY_ID|g" -e "s|@SECRET_KEY@|$AWS_SECRET_ACCESS_KEY|g" \
+  s3tests.conf.in > "$conf")
+
+# markers.txt: one marker per line to leave out, joined into pytest's -m expression
+markers=$(sed -e 's/#.*//' -e '/^[[:space:]]*$/d' markers.txt | sed 's/^[[:space:]]*/not /; s/[[:space:]]*$//' | paste -sd '&' - | sed 's/&/ and /g')
+
+if [ $# -eq 0 ]; then set -- s3tests/functional/test_s3.py; fi
+log "pytest in $suite -> $results"
+status=0
+(cd "$suite" && S3TEST_CONF=$conf "$python" -m pytest -p no:cacheprovider -q -rfE \
+  --junitxml "$results/junit.xml" -m "$markers" "$@") 2>&1 | tee "$results/pytest.log" \
+  || status=$?
+[ -f "$results/junit.xml" ] || die "pytest wrote no junit.xml (status $status): see $results/pytest.log"
+python3 -I ../outcomes.py from-junit "$results/junit.xml" > "$results/outcomes.txt"
+s3c_compare "$results/outcomes.txt" expected-failures.txt "${accept[@]}"
diff --git a/vk-registry/s3-compat/s3-tests/s3tests.conf.in b/vk-registry/s3-compat/s3-tests/s3tests.conf.in
new file mode 100644
index 00000000..187f7621
--- /dev/null
+++ b/vk-registry/s3-compat/s3-tests/s3tests.conf.in
@@ -0,0 +1,58 @@
+# s3-tests configuration, rendered by run.sh into results/<run>/s3tests.conf.
+# The server has one credential, so main, alt and tenant are the same user: the tests
+# telling two users apart (ACLs, policies, cross-account) cannot pass here and are
+# expected failures. The iam sections exist because configure() insists on them.
+[DEFAULT]
+host = @HOST@
+port = @PORT@
+is_secure = @SECURE@
+ssl_verify = False
+
+[fixtures]
+bucket prefix = s3compat-{random}-
+iam name prefix = s3compat-
+iam path prefix = /s3compat/
+
+[s3 main]
+display_name = vk-registry
+user_id = s3compat
+email = s3compat@example.com
+api_name = default
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+
+[s3 alt]
+display_name = vk-registry
+user_id = s3compat-alt
+email = s3compat-alt@example.com
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+
+[s3 tenant]
+display_name = testx$tenanteduser
+user_id = testx$s3compat-tenant
+email = s3compat-tenant@example.com
+tenant = testx
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+
+[iam]
+display_name = s3compat-iam
+user_id = s3compat-iam
+email = s3compat-iam@example.com
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+
+[iam root]
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+account_id = RGW11111111111111111
+user_id = RGW11111111111111111
+email = s3compat-root@example.com
+
+[iam alt root]
+access_key = @ACCESS_KEY@
+secret_key = @SECRET_KEY@
+account_id = RGW22222222222222222
+user_id = RGW22222222222222222
+email = s3compat-alt-root@example.com
diff --git a/vk-registry/s3-compat/serve.sh b/vk-registry/s3-compat/serve.sh
new file mode 100755
index 00000000..aac9153e
--- /dev/null
+++ b/vk-registry/s3-compat/serve.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# The server the suites run against: a vk-registry with one Basic user, S3 on, its store
+# under .state/, plus the root-path proxy (proxy.py) for the tools that cannot address an
+# S3 API living under /s3/. Writes .state/env.sh, which every run.sh here sources.
+#
+# Usage: serve.sh start [--fresh] | stop | status | env
+#
+#   VK_REGISTRY     the binary (default: dist/vk-registry, else the debug build cargo
+#                   test leaves in target/)
+#   S3C_STATE       where the store, config, logs and pids go (default: .state/)
+#   S3C_PORT        the registry's port (default: 5300)
+#   S3C_PROXY_PORT  the proxy's port (default: 5301)
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=lib.sh
+. ./lib.sh
+
+S3C_PORT=${S3C_PORT:-5300}
+S3C_PROXY_PORT=${S3C_PROXY_PORT:-5301}
+user=s3compat
+state=$S3C_STATE
+
+usage() { sed -n '2,/^set -euo/p' "$0" | sed '$d; s/^# \{0,1\}//' >&2; exit 2; }
+
+registry_bin() {
+  if [ -n "${VK_REGISTRY:-}" ]; then printf '%s\n' "$VK_REGISTRY"; return; fi
+  local c
+  for c in "$s3c_repo/dist/vk-registry" \
+           "$s3c_repo/target/x86_64-unknown-linux-musl/debug/vk-registry"; do
+    if [ -x "$c" ]; then printf '%s\n' "$c"; return; fi
+  done
+  die "no vk-registry binary: build one with '$s3c_repo/build.sh --fast --only=vk-registry' \
+or point VK_REGISTRY at one"
+}
+
+alive() { [ -f "$1" ] && kill -0 "$(cat "$1")" 2>/dev/null; }
+
+wait_http() { # url: until something answers there (any status), 20 s at most
+  local i
+  for i in $(seq 1 100); do
+    if curl -s -o /dev/null -m 2 "$1"; then return 0; fi
+    sleep 0.2
+  done
+  return 1
+}
+
+start() {
+  local fresh=0 bin
+  case ${1:-} in --fresh) fresh=1 ;; '') ;; *) usage ;; esac
+  need curl "to wait for the server"
+  bin=$(registry_bin)
+  if alive "$state/registry.pid"; then die "already running (see '$0 status')"; fi
+  mkdir -p "$state"
+  if [ $fresh = 1 ]; then rm -rf "$state/store"; fi
+  if [ ! -f "$state/password" ]; then
+    (umask 077; head -c 24 /dev/urandom | base64 | tr -d '/+=' > "$state/password")
+  fi
+  cat > "$state/registry.toml" <<CFG
+# written by serve.sh; the suites' throwaway server
+addr = "127.0.0.1:$S3C_PORT"
+root = "$state/store"
+username = "$user"
+password_file = "$state/password"
+s3 = true
+CFG
+  log "starting $bin on 127.0.0.1:$S3C_PORT (log: $state/registry.log)"
+  nohup "$bin" serve --config "$state/registry.toml" > "$state/registry.log" 2>&1 &
+  echo $! > "$state/registry.pid"
+  if ! wait_http "http://127.0.0.1:$S3C_PORT/s3/"; then
+    tail -n 20 "$state/registry.log" >&2
+    die "the registry did not come up"
+  fi
+  log "starting proxy.py on 127.0.0.1:$S3C_PROXY_PORT -> /s3/ (log: $state/proxy.log)"
+  nohup python3 -I ./proxy.py --listen "127.0.0.1:$S3C_PROXY_PORT" \
+    --upstream "127.0.0.1:$S3C_PORT" --prefix /s3 \
+    --basic-user "$user" --password-file "$state/password" > "$state/proxy.log" 2>&1 &
+  echo $! > "$state/proxy.pid"
+  if ! wait_http "http://127.0.0.1:$S3C_PROXY_PORT/"; then
+    tail -n 20 "$state/proxy.log" >&2
+    die "the proxy did not come up"
+  fi
+  (umask 077; cat > "$state/env.sh" <<ENV
+# written by serve.sh: the server under test, for the run.sh scripts and for a shell
+export S3C_ENDPOINT='http://127.0.0.1:$S3C_PORT/s3'
+export S3C_ROOT_ENDPOINT='http://127.0.0.1:$S3C_PROXY_PORT'
+export AWS_ACCESS_KEY_ID='$user'
+export AWS_SECRET_ACCESS_KEY='$(cat "$state/password")'
+export AWS_DEFAULT_REGION='us-east-1'
+export AWS_EC2_METADATA_DISABLED=true
+ENV
+  )
+  status
+}
+
+stop() {
+  local p
+  for p in proxy registry; do
+    if alive "$state/$p.pid"; then
+      kill "$(cat "$state/$p.pid")" 2>/dev/null || true
+      log "stopped $p"
+    fi
+    rm -f "$state/$p.pid"
+  done
+}
+
+status() {
+  local p
+  for p in registry proxy; do
+    if alive "$state/$p.pid"; then echo "$p: running, pid $(cat "$state/$p.pid")"
+    else echo "$p: not running"; fi
+  done
+  if [ -f "$state/env.sh" ]; then
+    echo "S3 endpoint (path-style, under /s3): http://127.0.0.1:$S3C_PORT/s3"
+    echo "S3 endpoint at the root (proxy):      http://127.0.0.1:$S3C_PROXY_PORT"
+    echo "credentials: $state/env.sh  (eval \"\$($0 env)\" loads them into a shell)"
+  fi
+}
+
+case ${1:-} in
+  start) shift; start "$@" ;;
+  stop) stop ;;
+  status) status ;;
+  env) cat "$state/env.sh" ;;
+  *) usage ;;
+esac
diff --git a/vk-registry/s3-compat/smoke/run.sh b/vk-registry/s3-compat/smoke/run.sh
new file mode 100755
index 00000000..44253823
--- /dev/null
+++ b/vk-registry/s3-compat/smoke/run.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Real clients doing what their users do: the AWS CLI (pinned, through uv) and rclone (a
+# pinned release) each create a bucket, upload small and large objects (the large one
+# goes up in parts and comes down in ranges), list, sync, read back and compare, delete.
+# Both take an endpoint with a path, so they go straight to /s3/ with real SigV4.
+#
+# Usage: run.sh [aws|rclone]   (default: both)
+# Every step is reported PASS or FAIL and the run exits 1 when any failed; a FAIL names
+# the step, and its log is in results/<time>/<client>.log.
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=../lib.sh
+. ../lib.sh
+
+AWSCLI_VERSION=1.46.2   # 2026-10-21, from PyPI through uv
+RCLONE_VERSION=1.75.2   # 2026-10-09
+RCLONE_URL=https://github.com/rclone/rclone/releases/download/v$RCLONE_VERSION/rclone-v$RCLONE_VERSION-linux-amd64.zip
+RCLONE_SHA256=349ac8fba6ff65d6247043f1750cdcb518ec5d500ef91463a10d37c0ccdf3702
+
+s3c_env
+results=$(s3c_results "$PWD")
+work=$results/work
+mkdir -p "$work/up/dir"
+head -c 1 /dev/urandom > "$work/up/one-byte"
+head -c $((1 << 20)) /dev/urandom > "$work/up/dir/one-mib"
+head -c $((20 << 20)) /dev/urandom > "$work/up/twenty-mib"   # past the 8 MiB part size
+echo hello > "$work/up/dir/hello.txt"
+
+failed=0
+step() { # name command...: run it, log it, report it
+  local name=$1 client=$2; shift 2
+  if "$@" >> "$results/$client.log" 2>&1; then echo "PASS $client: $name"
+  else echo "FAIL $client: $name (see $results/$client.log)"; failed=1; fi
+}
+
+smoke_aws() {
+  need uvx "to run the AWS CLI (https://docs.astral.sh/uv/)"
+  aws() { uvx --from "awscli==$AWSCLI_VERSION" aws --endpoint-url "$S3C_ENDPOINT" "$@"; }
+  local b=s3compat-smoke-aws d=$work/down-aws
+  mkdir -p "$d"
+  step "make bucket" aws aws s3 mb "s3://$b"
+  step "head bucket" aws aws s3api head-bucket --bucket "$b"
+  step "put one byte" aws aws s3 cp "$work/up/one-byte" "s3://$b/one-byte"
+  step "put 1 MiB" aws aws s3 cp "$work/up/dir/one-mib" "s3://$b/dir/one-mib"
+  step "put 20 MiB (multipart)" aws aws s3 cp "$work/up/twenty-mib" "s3://$b/twenty-mib"
+  step "head object" aws aws s3api head-object --bucket "$b" --key dir/one-mib
+  step "list" aws aws s3 ls "s3://$b/"
+  step "list v2 with prefix" aws aws s3api list-objects-v2 --bucket "$b" --prefix dir/
+  step "get one byte" aws aws s3 cp "s3://$b/one-byte" "$d/one-byte"
+  step "get 1 MiB" aws aws s3 cp "s3://$b/dir/one-mib" "$d/one-mib"
+  step "get 20 MiB (ranges)" aws aws s3 cp "s3://$b/twenty-mib" "$d/twenty-mib"
+  step "get a range" aws aws s3api get-object --bucket "$b" --key twenty-mib --range bytes=1000-1999 "$d/range"
+  step "bytes round-trip" aws cmp "$work/up/twenty-mib" "$d/twenty-mib"
+  step "range is 1000 bytes" aws test "$(stat -c %s "$d/range")" = 1000
+  step "copy object" aws aws s3 cp "s3://$b/one-byte" "s3://$b/copy/one-byte"
+  step "sync up" aws aws s3 sync "$work/up" "s3://$b/sync/"
+  step "sync down" aws aws s3 sync "s3://$b/sync/" "$d/sync"
+  step "sync round-trip" aws diff -r "$work/up" "$d/sync"
+  step "delete recursive" aws aws s3 rm --recursive "s3://$b/"
+  step "remove bucket" aws aws s3 rb "s3://$b"
+}
+
+smoke_rclone() {
+  local bin=$s3c_tools/rclone-$RCLONE_VERSION/rclone zip
+  if [ ! -x "$bin" ]; then
+    need unzip "to unpack rclone"
+    zip=$(s3c_fetch "$RCLONE_URL" "$RCLONE_SHA256")
+    mkdir -p "$(dirname "$bin")"
+    unzip -q -j -o "$zip" "rclone-v$RCLONE_VERSION-linux-amd64/rclone" -d "$(dirname "$bin")"
+  fi
+  export RCLONE_CONFIG_S3C_TYPE=s3 RCLONE_CONFIG_S3C_PROVIDER=Other
+  export RCLONE_CONFIG_S3C_ENDPOINT=$S3C_ENDPOINT RCLONE_CONFIG_S3C_REGION=$AWS_DEFAULT_REGION
+  export RCLONE_CONFIG_S3C_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID
+  export RCLONE_CONFIG_S3C_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY
+  export RCLONE_CONFIG_S3C_FORCE_PATH_STYLE=true RCLONE_CONFIG=/dev/null
+  local b=s3compat-smoke-rclone d=$work/down-rclone
+  mkdir -p "$d"
+  step "make bucket" rclone "$bin" mkdir "s3c:$b"
+  step "copy up" rclone "$bin" copy "$work/up" "s3c:$b/up"
+  step "check" rclone "$bin" check "$work/up" "s3c:$b/up"
+  step "list" rclone "$bin" lsl "s3c:$b"
+  step "copy down" rclone "$bin" copy "s3c:$b/up" "$d"
+  step "round-trip" rclone diff -r "$work/up" "$d"
+  step "copy within" rclone "$bin" copyto "s3c:$b/up/one-byte" "s3c:$b/copy/one-byte"
+  step "delete one" rclone "$bin" deletefile "s3c:$b/copy/one-byte"
+  step "purge" rclone "$bin" purge "s3c:$b"
+}
+
+case ${1:-all} in
+  aws) smoke_aws ;;
+  rclone) smoke_rclone ;;
+  all) smoke_aws; smoke_rclone ;;
+  *) die "usage: run.sh [aws|rclone]" ;;
+esac
+rm -rf "$work"
+exit $failed
diff --git a/vk-registry/s3-compat/versitygw/expected-failures.txt b/vk-registry/s3-compat/versitygw/expected-failures.txt
new file mode 100644
index 00000000..66ac1fac
--- /dev/null
+++ b/vk-registry/s3-compat/versitygw/expected-failures.txt
@@ -0,0 +1,3 @@
+# Tests expected to fail, one id per line; rewritten by run.sh --accept.
+# Remove a line once the server passes its test.
+# Empty until the first run against the finished server.
diff --git a/vk-registry/s3-compat/versitygw/run.sh b/vk-registry/s3-compat/versitygw/run.sh
new file mode 100755
index 00000000..25783508
--- /dev/null
+++ b/vk-registry/s3-compat/versitygw/run.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# versitygw's client-side integration tests (Go, aws-sdk-go-v2) against the server under
+# test: `versitygw test <suite>`, a pinned release binary. The SDK takes an endpoint with a
+# path, so it goes straight to /s3/ (S3C_ENDPOINT) with real SigV4 signatures; should a
+# version of the SDK drop the path, export S3C_VGW_ENDPOINT=$S3C_ROOT_ENDPOINT to go
+# through the proxy instead.
+#
+# Usage: run.sh [--accept] [suite [flags...]]
+#   no suite     full-flow (the whole S3 flow: buckets, objects, multipart, listing...)
+#   suite        another `versitygw test` command: data-integrity-etag, noacl,
+#                access-control, bench --bucket B --upload ..., throughput, or one test
+#                by name (`versitygw test --help` lists them)
+#   --accept     rewrite expected-failures.txt from this run's failures
+#
+# Results: results/<time>/{<suite>.log,outcomes.txt}, results/latest.
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=../lib.sh
+. ../lib.sh
+
+VGW_VERSION=1.10.0   # 2026-10-22
+VGW_URL=https://github.com/versity/versitygw/releases/download/v$VGW_VERSION/versitygw_v${VGW_VERSION}_Linux_x86_64.tar.gz
+VGW_SHA256=8f9869752939d4dc9cfe1bddb935a02cc6610e95319a3a9fc2947d2a6ebd2c91
+
+accept=()
+if [ "${1:-}" = --accept ]; then accept=(--accept); shift; fi
+if [ $# -eq 0 ]; then set -- full-flow; fi
+
+s3c_env
+bin=$s3c_tools/versitygw-$VGW_VERSION/versitygw
+if [ ! -x "$bin" ]; then
+  tarball=$(s3c_fetch "$VGW_URL" "$VGW_SHA256")
+  mkdir -p "$(dirname "$bin")"
+  tar -xzf "$tarball" -C "$(dirname "$bin")" --strip-components=1
+fi
+
+results=$(s3c_results "$PWD")
+suite=$1
+log "versitygw test $* -> $results"
+"$bin" test -a "$AWS_ACCESS_KEY_ID" -s "$AWS_SECRET_ACCESS_KEY" \
+  -e "${S3C_VGW_ENDPOINT:-$S3C_ENDPOINT}" "$@" 2>&1 | tee "$results/$suite.log" || true
+python3 -I ../outcomes.py from-log "$results/$suite.log" > "$results/outcomes.txt"
+[ -s "$results/outcomes.txt" ] || die "no PASS/FAIL lines in $results/$suite.log"
+s3c_compare "$results/outcomes.txt" expected-failures.txt "${accept[@]}"
diff --git a/vk-registry/s3-compat/warp/run.sh b/vk-registry/s3-compat/warp/run.sh
new file mode 100755
index 00000000..9d9c9994
--- /dev/null
+++ b/vk-registry/s3-compat/warp/run.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# MinIO warp, the S3 benchmark, against the server under test. warp takes a host and a
+# port, not a path, so it runs through the root-path proxy (S3C_ROOT_ENDPOINT): one
+# connection per request through a Python byte pump, which is part of what gets measured.
+# Numbers from here compare one build of the registry with another, not the registry with
+# a server that is addressed directly.
+#
+# Usage: run.sh [mode] [warp flags...]
+#   mode        mixed (default), get, put, list, stat, delete, multipart
+#   flags       appended to warp's, e.g. --duration 3m --obj.size 8MiB --concurrent 16
+#
+#   S3C_WARP_DURATION    default 1m          S3C_WARP_OBJ_SIZE   default 1MiB
+#   S3C_WARP_CONCURRENT  default 8           S3C_WARP_BUCKET     default s3compat-warp
+#   S3C_WARP_PART_SIZE   default 5MiB        (multipart only: it takes --part.size and
+#                                             --parts, and refuses --obj.size)
+#
+# Results: results/<time>/<mode>.json.zst (warp's benchdata, `warp analyze` reads it) and
+# <mode>.log; results/latest.
+set -euo pipefail
+cd "$(dirname "$0")"
+# shellcheck source=../lib.sh
+. ../lib.sh
+
+WARP_VERSION=1.8.2   # 2026-09-24; the only Linux build of this release is the RDMA one,
+                     # a dynamically linked binary with its library beside it (rpath)
+WARP_URL=https://github.com/minio/warp/releases/download/v$WARP_VERSION/warp-rdma_linux_amd64.tar.gz
+WARP_SHA256=e4d27a72bb7adaec1721963419b15684c2763778d43f437b24dcb9a6545ffdfa
+
+mode=${1:-mixed}
+if [ $# -gt 0 ]; then shift; fi
+
+s3c_env
+dir=$s3c_tools/warp-$WARP_VERSION
+bin=$dir/warp
+if [ ! -x "$bin" ]; then
+  tarball=$(s3c_fetch "$WARP_URL" "$WARP_SHA256")
+  mkdir -p "$dir"
+  tar -xzf "$tarball" -C "$dir" --strip-components=1
+fi
+
+host=$(s3c_url_host "$S3C_ROOT_ENDPOINT")
+tls=()
+if s3c_url_https "$S3C_ROOT_ENDPOINT"; then tls=(--tls --insecure); fi
+# multipart builds one object from parts and has no --obj.size: warp exits on the flag.
+case $mode in
+  multipart) size=(--part.size "${S3C_WARP_PART_SIZE:-5MiB}") ;;
+  *) size=(--obj.size "${S3C_WARP_OBJ_SIZE:-1MiB}") ;;
+esac
+results=$(s3c_results "$PWD")
+log "warp $mode against $host -> $results"
+"$bin" "$mode" --host "$host" "${tls[@]}" \
+  --access-key "$AWS_ACCESS_KEY_ID" --secret-key "$AWS_SECRET_ACCESS_KEY" \
+  --region "$AWS_DEFAULT_REGION" --bucket "${S3C_WARP_BUCKET:-s3compat-warp}" \
+  --duration "${S3C_WARP_DURATION:-1m}" "${size[@]}" \
+  --concurrent "${S3C_WARP_CONCURRENT:-8}" --benchdata "$results/$mode" \
+  "$@" 2>&1 | tee "$results/$mode.log"

From 4237776c74bc72aeaa5144db1438b20d14a22392 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 15:16:54 +0100
Subject: [PATCH 14/54] vk-registry/s3: send no checksum with a byte range

A ranged GetObject now answers without x-amz-checksum-sha256, as S3
sends a checksum with the whole object only. The AWS CLI checks the
checksum it is sent against the bytes it received, so the whole
object's on a 206 failed every multi-part download of an object over
8 MiB.
---
 vk-registry/DESIGN.md        |  2 +-
 vk-registry/src/s3/object.rs |  5 ++++-
 vk-registry/tests/s3_e2e.rs  | 13 +++++++++----
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 21dda34d..f32140c3 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -661,7 +661,7 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers, the checksum being the whole object's; a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 81884a94..542dd500 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -198,12 +198,15 @@ pub(super) async fn get(
         if !head {
             files::touch_if_idle(store, &obj);
         }
+        let partial = resp.status() == StatusCode::PARTIAL_CONTENT;
         let headers = resp.headers_mut();
         headers.insert(ACCEPT_RANGES, HeaderValue::from_static("bytes"));
         headers.insert(CONTENT_DISPOSITION, HeaderValue::from_static("attachment"));
         insert(headers, ETAG, &etag);
         insert(headers, LAST_MODIFIED, &modified);
-        if checksum {
+        // The whole object's checksum, on the whole object only: S3 sends none with a part,
+        // and the AWS CLI checks what it is sent against the bytes of each part it fetches.
+        if checksum && !partial {
             insert(
                 headers,
                 hyper::header::HeaderName::from_static(CHECKSUM_SHA256),
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 8d84a48c..2a96b230 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2518,15 +2518,20 @@ async fn ranges_of_plain_and_zstd_stored_objects() {
         }
         assert!(joined == *data, "{key}: the parts are the whole");
 
-        // The checksum is the whole object's, and only when asked.
-        let resp = send(&host, ranged("bytes=0-9")).await;
+        // The checksum is the whole object's, so a part carries none even when asked: the
+        // AWS CLI checks one against each part it fetches.
+        let asked = |value: &str| ranged(value).header("x-amz-checksum-mode", "ENABLED");
+        let resp = send(&host, asked("bytes=0-9")).await;
+        is_part(&resp, data, 0, 10, &etag);
+        assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+        let resp = send(&host, asked(&format!("bytes=0-{}", n - 1))).await;
+        is_part(&resp, data, 0, n, &etag);
         assert_eq!(resp.header("x-amz-checksum-sha256"), None);
         let resp = send(
             &host,
-            ranged("bytes=0-9").header("x-amz-checksum-mode", "ENABLED"),
+            Req::new("GET", &path).header("x-amz-checksum-mode", "ENABLED"),
         )
         .await;
-        is_part(&resp, data, 0, 10, &etag);
         let sha = b64(&sha2::Sha256::digest(data));
         assert_eq!(resp.header("x-amz-checksum-sha256"), Some(&*sha));
 

From d2facb4000daa140f52975d69b7bd88d82d2cc6b Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 16:10:46 +0100
Subject: [PATCH 15/54] tests: add an S3 e2e with sccache, the AWS CLI and
 rclone

tests/s3-e2e.sh runs vk-registry in accounts mode with TLS on the
host's LAN address (a run CA, the guest trusting it) and drives the
three clients from a Debian trixie microVM against /s3/, then reads
an object back on the host with `vk registry get` across a gc.
trixie's sccache lacks its S3 backend, so the image takes the upstream
0.18.0 release, pinned by sha256.

Measured with the AWS CLI in a 2-vCPU guest, over TLS and vk's
userspace network, CLI start-up (~0.8 s) included: a 100 MiB cp up
4.0-4.3 s and down 1.9-2.4 s; a ranged get of its second 50 MiB
1.7-2.9 s.
---
 tests/s3-e2e.sh       | 166 ++++++++++++++++++++++++++++
 tests/s3/Dockerfile   |  24 +++++
 tests/s3/clients.sh   | 244 ++++++++++++++++++++++++++++++++++++++++++
 vk-registry/DESIGN.md |  11 ++
 4 files changed, 445 insertions(+)
 create mode 100755 tests/s3-e2e.sh
 create mode 100644 tests/s3/Dockerfile
 create mode 100644 tests/s3/clients.sh

diff --git a/tests/s3-e2e.sh b/tests/s3-e2e.sh
new file mode 100755
index 00000000..da76ae6d
--- /dev/null
+++ b/tests/s3-e2e.sh
@@ -0,0 +1,166 @@
+#!/usr/bin/env bash
+# vk-registry's S3 view (/s3/) driven by real clients in a microVM: sccache, the AWS CLI and
+# rclone (tests/s3/Dockerfile), against a `vk-registry serve` in accounts mode on this host.
+#
+# 1. The registry listens with TLS on the host's LAN address (a guest cannot reach the host's
+#    loopback, and credentials off loopback need TLS), with a certificate from a CA made for
+#    the run; a `write:files/*` and a `read:files/*` key are minted over the admin socket.
+# 2. The image boots detached with --net; the guest trusts the run's CA.
+# 3. sccache: one miss then one hit; a read-only key hits and writes nothing; a wrong secret
+#    fails its startup check.
+# 4. AWS CLI: mb, cp of 1 KiB, 20 MiB and 100 MiB each way (multipart, aws-chunked bodies with
+#    CRC32 trailers, ranged GETs), a paged listing, sync twice, head, ranged get, copy, batch
+#    delete, a multipart upload by hand, a presigned URL refused, rb --force.
+# 5. rclone: copy, ls, check, sync twice (the second copies nothing), delete.
+# 6. On the host, with the registry stopped: `vk registry get` reads an object the CLI wrote,
+#    and `vk-registry gc` keeps it.
+#
+# Run:  VK=vk VK_REGISTRY=./dist/vk-registry tests/s3-e2e.sh
+#       VK=./dist/vk tests/release-e2e.sh tests/s3-e2e.sh
+# VK is the vk that runs the guest (default: vk on PATH); VK_REGISTRY the vk-registry under
+# test (default: the one beside $VK, else ./dist/vk-registry; build it with
+# `./build.sh --fast --only=vk-registry`). WORK_DIR is where the store and logs go (default
+# $HOME: the store holds a few hundred MiB, too much for a tmpfs /tmp); KEEP_WORK=1 keeps it.
+# Needs: KVM, network (the image's packages), a host LAN IPv4 address, openssl, curl, python3.
+set -euo pipefail
+
+VK=$(command -v "${VK:-vk}" || true)
+[ -n "$VK" ] && [ -x "$VK" ] || { echo "no usable vk (build one: ./build.sh --fast)"; exit 2; }
+VK=$(cd "$(dirname "$VK")" && pwd)/$(basename "$VK")
+if [ -z "${VK_REGISTRY:-}" ]; then
+  VK_REGISTRY=./dist/vk-registry
+  [ -x "$(dirname "$VK")/vk-registry" ] && VK_REGISTRY=$(dirname "$VK")/vk-registry
+fi
+[ -x "$VK_REGISTRY" ] || { echo "no $VK_REGISTRY (build it: ./build.sh --fast --only=vk-registry)"; exit 2; }
+VK_REGISTRY=$(cd "$(dirname "$VK_REGISTRY")" && pwd)/$(basename "$VK_REGISTRY")
+cd "$(dirname "$0")/.."
+for t in openssl curl python3; do command -v "$t" >/dev/null || { echo "need $t"; exit 2; }; done
+
+# The guest reaches the host's private LAN address through ordinary egress.
+IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{ for (i = 1; i < NF; i++) if ($i == "src") { print $(i + 1); exit } }')
+[ -n "$IP" ] || IP=$(hostname -I 2>/dev/null | awk '{ print $1 }')
+case $IP in
+  '' | 127.* | 169.254.*) echo "no LAN IPv4 address on this host for the guest to reach the registry"; exit 2 ;;
+esac
+
+WORK=$(mktemp -d "${WORK_DIR:-$HOME}/vk-s3-e2e.XXXXXX")
+# Unix sockets (the admin socket, the VM's vsock) need a short path.
+SOCKS=$(mktemp -d /tmp/vk-s3-e2e.XXXXXX)
+VM=$SOCKS/vm
+SHARE=$WORK/share
+LOGS=$SHARE/logs
+mkdir -p "$WORK/pki" "$WORK/store" "$LOGS"
+reg_pid=
+cleanup() {
+  "$VK" stop "$VM" >/dev/null 2>&1 || true
+  [ -z "$reg_pid" ] || kill "$reg_pid" 2>/dev/null || true
+  wait 2>/dev/null || true
+  rm -rf "$SOCKS"
+  if [ -n "${KEEP_WORK:-}" ]; then echo "kept $WORK"; else rm -rf "$WORK"; fi
+}
+trap cleanup EXIT
+fail() {
+  echo "FAIL: $*"
+  echo "--- registry log"; tail -n 40 "$WORK/registry.log" || true
+  for f in "$LOGS"/*; do
+    [ -f "$f" ] && [ -s "$f" ] || continue
+    echo "--- $(basename "$f")"; tail -n 40 "$f"
+  done
+  exit 1
+}
+wait_for() {
+  local secs=$1; shift
+  for _ in $(seq "$((secs * 2))"); do
+    if "$@" >/dev/null 2>&1; then return 0; fi
+    sleep 0.5
+  done
+  return 1
+}
+port() { python3 -c 'import socket; s=socket.socket(); s.bind(("0.0.0.0",0)); print(s.getsockname()[1])'; }
+# One client's scenario in the guest (tests/s3/clients.sh), its output kept in logs/.
+client() {
+  echo "== $1 =="
+  if ! "$VK" exec "$VM" -- bash /e2e/clients.sh "$1" 2>&1 | tee "$LOGS/$1.out"; then fail "$1"; fi
+}
+
+echo "== 1. the registry, with TLS on $IP, and two keys =="
+d=$WORK/pki
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -days 2 \
+  -subj /CN=vk-s3-e2e-ca -keyout "$d/ca.key" -out "$d/ca.pem" \
+  -addext basicConstraints=critical,CA:TRUE -addext keyUsage=critical,keyCertSign 2>/dev/null
+openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -subj /CN=vk-registry \
+  -keyout "$d/server.key" -out "$d/server.csr" 2>/dev/null
+printf '%s\n' "subjectAltName=IP:$IP" 'basicConstraints=critical,CA:FALSE' \
+  'keyUsage=critical,digitalSignature' 'extendedKeyUsage=serverAuth' >"$d/server.ext"
+openssl x509 -req -in "$d/server.csr" -CA "$d/ca.pem" -CAkey "$d/ca.key" \
+  -CAcreateserial -days 2 -extfile "$d/server.ext" -out "$d/server.pem" 2>/dev/null
+cp "$d/ca.pem" "$SHARE/ca.pem"
+
+PORT=$(port)
+# Accounts mode needs an [oidc] table; no one signs in, so its provider is never asked.
+printf 'unused\n' >"$WORK/oidc-secret"
+cat >"$WORK/registry.toml" <<EOF
+addr = "$IP:$PORT"
+root = "$WORK/store"
+tls_cert = "$d/server.pem"
+tls_key = "$d/server.key"
+mode = "accounts"
+admin_socket = "$SOCKS/admin.sock"
+s3 = true
+
+[oidc]
+issuer = "https://login.example.com"
+client_id = "vk-registry"
+client_secret_file = "$WORK/oidc-secret"
+public_url = "https://$IP:$PORT"
+EOF
+"$VK_REGISTRY" serve --config "$WORK/registry.toml" >"$WORK/registry.log" 2>&1 &
+reg_pid=$!
+URL=https://$IP:$PORT
+wait_for 30 curl -sS --cacert "$d/ca.pem" -o /dev/null "$URL/v2/" || fail "the registry did not come up"
+key() {
+  "$VK_REGISTRY" accounts create-key --config "$WORK/registry.toml" --name "$1" --scope "$2" \
+    2>>"$WORK/keys.log" || fail "create-key $1"
+}
+WKEY=$(key s3-e2e-write 'write:files/*')
+RKEY=$(key s3-e2e-read 'read:files/*')
+code=$(curl -sS --cacert "$d/ca.pem" -o /dev/null -w '%{http_code}' "$URL/s3/")
+[ "$code" = 403 ] || fail "an unsigned ListBuckets got $code, not 403"
+cat >"$SHARE/env" <<EOF
+S3_ENDPOINT=$URL/s3
+WKEY=$WKEY
+RKEY=$RKEY
+EOF
+chmod 600 "$SHARE/env"
+cp tests/s3/clients.sh "$SHARE/clients.sh"
+
+echo "== 2. the clients' image, booted detached =="
+start=$(date +%s)
+"$VK" run -f tests/s3/Dockerfile --build-net all --net --mem 2G --cpus 2 \
+  -v "$SHARE:/e2e" --state-dir "$VM" --detach --inactivity-timeout 0 \
+  -- sleep infinity >"$WORK/vm.log" 2>&1 || { cat "$WORK/vm.log"; fail "the guest did not boot"; }
+client trust
+
+echo "== 3. sccache =="
+client sccache
+echo "== 4. AWS CLI =="
+client awscli
+echo "== 5. rclone =="
+client rclone
+
+echo "== 6. the host side: vk registry get, and gc keeps it =="
+"$VK" stop "$VM" >/dev/null
+kill "$reg_pid"
+wait "$reg_pid" 2>/dev/null || true
+reg_pid=
+got() {
+  rm -f "$WORK/got"
+  "$VK" registry get --cache-registry "$WORK/store" -o "$WORK/got" keep/from-cli.bin \
+    >>"$LOGS/vk-registry-get.log" 2>&1 &&
+    [ "$(sha256sum <"$WORK/got" | cut -d' ' -f1)" = "$(cat "$SHARE/keep.sha256")" ]
+}
+got || fail "vk registry get does not fetch what the AWS CLI wrote"
+"$VK_REGISTRY" gc --root "$WORK/store" >"$LOGS/gc.log" 2>&1 || fail "vk-registry gc"
+got || fail "the gc did not keep what the AWS CLI wrote"
+
+echo "PASS: sccache, the AWS CLI and rclone over /s3/, and the store keeps what they wrote, in $(($(date +%s) - start))s"
diff --git a/tests/s3/Dockerfile b/tests/s3/Dockerfile
new file mode 100644
index 00000000..b5f5e447
--- /dev/null
+++ b/tests/s3/Dockerfile
@@ -0,0 +1,24 @@
+# The S3 clients tests/s3-e2e.sh drives against vk-registry's /s3/: sccache, the AWS CLI and
+# rclone, plus gcc for sccache to wrap. No credential is baked in: the script passes keys and
+# the run's CA at run time.
+#
+# The digest is trixie-slim's multi-platform index on Docker Hub, read with
+#   docker manifest inspect -v debian:trixie-slim   (or, without docker, the
+#   Docker-Content-Digest of GET registry-1.docker.io/v2/library/debian/manifests/trixie-slim)
+FROM debian:trixie-slim@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2
+# awscli 2.23 and rclone 1.60 from trixie.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      awscli rclone gcc libc6-dev ca-certificates coreutils curl \
+ && rm -rf /var/lib/apt/lists/*
+# trixie's sccache (0.10) is built without its S3 backend, so the upstream static release,
+# checked against the sha256 published beside it.
+ARG SCCACHE_VERSION=0.18.0
+ARG SCCACHE_SHA256=45f1447fbe231e3037bde351ef70677dd212216c8d62ae7ca409fecc4d6acc89
+RUN cd /tmp \
+ && t=sccache-v$SCCACHE_VERSION-x86_64-unknown-linux-musl \
+ && curl -fsSLO https://github.com/mozilla/sccache/releases/download/v$SCCACHE_VERSION/$t.tar.gz \
+ && echo "$SCCACHE_SHA256  $t.tar.gz" | sha256sum -c - \
+ && tar xzf $t.tar.gz $t/sccache \
+ && install -m 0755 $t/sccache /usr/local/bin/sccache \
+ && rm -rf $t $t.tar.gz
diff --git a/tests/s3/clients.sh b/tests/s3/clients.sh
new file mode 100644
index 00000000..00800cbc
--- /dev/null
+++ b/tests/s3/clients.sh
@@ -0,0 +1,244 @@
+#!/usr/bin/env bash
+# The guest side of tests/s3-e2e.sh: one client's scenario against the registry's /s3/, run as
+#   bash /e2e/clients.sh <trust|sccache|awscli|rclone>
+# in the tests/s3/Dockerfile image. /e2e is the host's share: `env` (S3_ENDPOINT, WKEY, RKEY,
+# written by the host script), `ca.pem` (the run's CA) and `logs/`, where each
+# client's own output goes. A failed check prints FAIL and exits non-zero.
+set -euo pipefail
+. /e2e/env
+LOGS=/e2e/logs
+mkdir -p "$LOGS"
+T=$(mktemp -d)
+trap 'rm -rf "$T"' EXIT
+
+fail() { echo "FAIL: $*"; exit 1; }
+secs() { awk -v a="$1" -v b="$(date +%s.%N)" 'BEGIN { printf "%.2fs", b - a }'; }
+same() { [ "$(sha256sum <"$1" | cut -d' ' -f1)" = "$(sha256sum <"$2" | cut -d' ' -f1)" ]; }
+
+# The run's CA in the system store, which curl, rclone and sccache read; the AWS CLI does not
+# (it takes AWS_CA_BUNDLE), and each client is also given the file explicitly below
+# (sccache SSL_CERT_FILE, rclone --ca-cert).
+trust() {
+  cp /e2e/ca.pem /usr/local/share/ca-certificates/vk-s3-e2e.crt
+  update-ca-certificates >/dev/null 2>&1
+  curl -sS -o /dev/null "$S3_ENDPOINT/" || fail "curl does not reach $S3_ENDPOINT over TLS"
+}
+
+# ---------------------------------------------------------------------------- sccache
+sccache_env() {
+  export SCCACHE_BUCKET=sccache SCCACHE_ENDPOINT=$S3_ENDPOINT SCCACHE_S3_USE_SSL=true
+  export SCCACHE_REGION=auto SCCACHE_S3_KEY_PREFIX=ci/ SCCACHE_IDLE_TIMEOUT=0
+  export SSL_CERT_FILE=/e2e/ca.pem SCCACHE_LOG=debug
+  export AWS_ACCESS_KEY_ID=$1 AWS_SECRET_ACCESS_KEY=$2
+  export SCCACHE_ERROR_LOG=$LOGS/sccache-$3.server.log
+}
+# The value of one `--show-stats` counter, e.g. `stat "Cache hits"`.
+stat() { sccache --show-stats | awk -v k="$1" 'index($0, k) == 1 { print $NF; exit }'; }
+compile() {
+  sccache gcc -c "$T/hello.c" -o "$T/hello.o"
+  sccache --show-stats >"$LOGS/sccache-$1.stats"
+}
+
+# The bucket's entries, listed with the write key.
+keys() {
+  AWS_ACCESS_KEY_ID=$WKEY AWS_SECRET_ACCESS_KEY=$WKEY AWS_DEFAULT_REGION=us-east-1 \
+    AWS_ENDPOINT_URL=$S3_ENDPOINT AWS_CA_BUNDLE=/e2e/ca.pem aws s3 ls --recursive s3://sccache/ |
+    awk '{ print $NF }'
+}
+
+run_sccache() {
+  # SCCACHE_LOG makes the client talk too: its stderr goes to a log of its own.
+  exec 2>>"$LOGS/sccache-client.log"
+  cat >"$T/hello.c" <<'EOF'
+int hello(int x) { return x * 42; }
+EOF
+  # sccache never creates its bucket.
+  AWS_ACCESS_KEY_ID=$WKEY AWS_SECRET_ACCESS_KEY=$WKEY AWS_DEFAULT_REGION=us-east-1 \
+    AWS_ENDPOINT_URL=$S3_ENDPOINT AWS_CA_BUNDLE=/e2e/ca.pem aws s3 mb s3://sccache
+
+  sccache_env "$WKEY" "$WKEY" write
+  sccache --start-server
+  compile miss
+  [ "$(stat "Cache misses")" = 1 ] || fail "the first compile was not one miss"
+  [ "$(stat "Cache hits")" = 0 ] || fail "the first compile hit"
+  [ "$(stat "Cache write errors")" = 0 ] || fail "sccache could not write its entry"
+  sccache --stop-server >/dev/null
+  sccache --start-server
+  compile hit
+  [ "$(stat "Cache hits")" = 1 ] || fail "the second compile was not one hit"
+  [ "$(stat "Cache misses")" = 0 ] || fail "the second compile missed"
+  sccache --stop-server >/dev/null
+
+  # A read-only key: the startup check finds the bucket read-only (its write of
+  # .sccache_check is refused), the entry is still a hit, and a new one is not written.
+  entries=$(keys)
+  sccache_env "$RKEY" "$RKEY" read
+  sccache --start-server
+  grep -q 'server has setup with ReadOnly' "$SCCACHE_ERROR_LOG" ||
+    fail "sccache did not find the bucket read-only with a read key"
+  compile read-hit
+  [ "$(stat "Cache hits")" = 1 ] || fail "the read-only key did not hit"
+  echo 'int other(int x) { return x - 1; }' >"$T/hello.c"
+  compile read-miss
+  [ "$(stat "Cache misses")" = 1 ] || fail "the read-only key's new compile was not a miss"
+  sccache --stop-server >/dev/null
+  [ "$(keys)" = "$entries" ] || fail "an entry was written with the read-only key"
+
+  # A wrong secret: the storage check at startup fails, and so does the server.
+  sccache_env "$WKEY" "${WKEY}x" wrong
+  if sccache --start-server >"$LOGS/sccache-wrong.out" 2>&1; then
+    sccache --stop-server >/dev/null 2>&1 || true
+    fail "sccache started with a wrong secret"
+  fi
+  grep -q SignatureDoesNotMatch "$LOGS/sccache-wrong.out" ||
+    fail "sccache's startup failure does not name the signature"
+  echo "sccache: a miss then a hit, read-only with a read key, refused with a wrong secret"
+}
+
+# ---------------------------------------------------------------------------- AWS CLI
+run_awscli() {
+  export AWS_ACCESS_KEY_ID=$WKEY AWS_SECRET_ACCESS_KEY=$WKEY AWS_DEFAULT_REGION=us-east-1
+  export AWS_ENDPOINT_URL=$S3_ENDPOINT AWS_CA_BUNDLE=/e2e/ca.pem
+  aws s3 mb s3://cli
+  for size in 1K 20M 100M; do
+    head -c "$size" /dev/urandom >"$T/$size.bin"
+    s=$(date +%s.%N)
+    aws s3 cp --no-progress "$T/$size.bin" "s3://cli/obj/$size.bin"
+    put=$(secs "$s")
+    s=$(date +%s.%N)
+    aws s3 cp --no-progress "s3://cli/obj/$size.bin" "$T/$size.back"
+    echo "timing: $size put $put, get $(secs "$s")"
+    same "$T/$size.bin" "$T/$size.back" || fail "$size came back different"
+  done
+  # The CLI's default checksum, CRC64NVME, is taken unchecked: these the server checks, in a
+  # PutObject's trailer and in each part's of a multipart upload.
+  for algo in CRC32 SHA1 SHA256; do
+    for size in 1K 20M; do
+      aws s3 cp --no-progress --checksum-algorithm "$algo" "$T/$size.bin" "s3://cli/sum/$algo-$size"
+      aws s3 cp --no-progress "s3://cli/sum/$algo-$size" "$T/sum.back"
+      same "$T/$size.bin" "$T/sum.back" || fail "$size with $algo came back different"
+    done
+  done
+  aws s3 ls s3://cli/obj/ | tee "$T/ls"
+  [ "$(wc -l <"$T/ls")" = 3 ] || fail "s3 ls does not list 3 objects"
+
+  # Seven keys, two a page.
+  for i in 1 2 3 4 5 6 7; do echo "$i" | aws s3 cp - "s3://cli/page/k$i"; done
+  token= pages=0
+  : >"$T/keys"
+  while :; do
+    aws s3api list-objects-v2 --bucket cli --prefix page/ --max-keys 2 --no-paginate \
+      ${token:+--continuation-token "$token"} --output json >"$T/page.json"
+    python3 -I -c '
+import json, sys
+p = json.load(open(sys.argv[1]))
+for o in p.get("Contents", []): print(o["Key"], file=open(sys.argv[2], "a"))
+print(p.get("NextContinuationToken", "") if p["IsTruncated"] else "")' \
+      "$T/page.json" "$T/keys" >"$T/next"
+    pages=$((pages + 1))
+    token=$(cat "$T/next")
+    [ -n "$token" ] || break
+    [ "$pages" -lt 10 ] || fail "the listing does not end"
+  done
+  [ "$pages" = 4 ] || fail "7 keys came in $pages pages of 2"
+  [ "$(printf 'page/k%s\n' 1 2 3 4 5 6 7)" = "$(cat "$T/keys")" ] || fail "the pages: $(cat "$T/keys")"
+
+  mkdir -p "$T/tree/sub"
+  for f in a b sub/c; do head -c 3000 /dev/urandom >"$T/tree/$f"; done
+  # sync uploads a file newer than its object, whose LastModified is in whole seconds, as
+  # S3's is: a file written in the second its upload lands would go again.
+  touch -d '-1 minute' "$T/tree/a" "$T/tree/b" "$T/tree/sub/c"
+  aws s3 sync --no-progress "$T/tree" s3://cli/tree | tee "$T/sync1"
+  [ "$(grep -c '^upload:' "$T/sync1")" = 3 ] || fail "the first sync did not upload 3 files"
+  aws s3 sync --no-progress "$T/tree" s3://cli/tree >"$T/sync2"
+  [ ! -s "$T/sync2" ] || fail "the second sync did something: $(cat "$T/sync2")"
+
+  aws s3api head-object --bucket cli --key obj/1K.bin --output json >"$T/head.json"
+  grep -q '"ContentLength": 1024' "$T/head.json" || fail "head-object: $(cat "$T/head.json")"
+  aws s3api get-object --bucket cli --key obj/100M.bin --range bytes=0-9 "$T/range" >/dev/null
+  [ "$(head -c 10 "$T/100M.bin" | od -An -tx1)" = "$(od -An -tx1 <"$T/range")" ] ||
+    fail "get-object --range bytes=0-9 is not the first 10 bytes"
+  s=$(date +%s.%N)
+  aws s3api get-object --bucket cli --key obj/100M.bin --range bytes=52428800- "$T/tail" >/dev/null
+  echo "timing: 100M ranged get of the second half $(secs "$s")"
+  tail -c 52428800 "$T/100M.bin" | same /dev/stdin "$T/tail" || fail "the ranged second half differs"
+  aws s3api copy-object --bucket cli --key obj/copy.bin --copy-source cli/obj/20M.bin >/dev/null
+  aws s3 cp --no-progress s3://cli/obj/copy.bin "$T/copy.back"
+  same "$T/20M.bin" "$T/copy.back" || fail "copy-object made other bytes"
+  aws s3api delete-objects --bucket cli --output json \
+    --delete '{"Objects":[{"Key":"page/k1"},{"Key":"page/k2"},{"Key":"page/none"}]}' >"$T/del.json"
+  [ "$(grep -c '"Key"' "$T/del.json")" = 3 ] || fail "delete-objects: $(cat "$T/del.json")"
+  [ "$(aws s3 ls s3://cli/page/ | wc -l)" = 5 ] || fail "delete-objects left the wrong keys"
+
+  # A multipart upload by hand: three parts of 5 MiB, 5 MiB and 1 MiB.
+  head -c 11534336 /dev/urandom >"$T/mp.bin"
+  split -b 5242880 -d -a 1 "$T/mp.bin" "$T/mp.part"
+  id=$(aws s3api create-multipart-upload --bucket cli --key obj/manual.bin --query UploadId --output text)
+  parts=
+  for n in 1 2 3; do
+    etag=$(aws s3api upload-part --bucket cli --key obj/manual.bin --upload-id "$id" \
+      --part-number "$n" --body "$T/mp.part$((n - 1))" --query ETag --output text)
+    parts="$parts${parts:+,}{\"PartNumber\":$n,\"ETag\":$etag}"
+  done
+  aws s3api complete-multipart-upload --bucket cli --key obj/manual.bin --upload-id "$id" \
+    --multipart-upload "{\"Parts\":[$parts]}" --output json >"$T/complete.json"
+  grep -q -- '-3\\"' "$T/complete.json" || fail "complete-multipart-upload: $(cat "$T/complete.json")"
+  aws s3 cp --no-progress s3://cli/obj/manual.bin "$T/manual.back"
+  same "$T/mp.bin" "$T/manual.back" || fail "the manual multipart object differs"
+
+  # Presigned URLs put a credential in a URL: refused.
+  url=$(aws s3 presign s3://cli/obj/1K.bin)
+  code=$(curl -sS --cacert /e2e/ca.pem -o "$T/presigned" -w '%{http_code}' "$url")
+  [ "$code" = 400 ] && grep -q AuthorizationQueryParametersError "$T/presigned" ||
+    fail "a presigned URL got $code: $(cat "$T/presigned")"
+
+  # Kept for the host side: vk registry get, and the gc keeping it.
+  aws s3 mb s3://keep
+  aws s3 cp --no-progress "$T/1K.bin" s3://keep/from-cli.bin
+  sha256sum <"$T/1K.bin" | cut -d' ' -f1 >/e2e/keep.sha256
+
+  aws s3 rb --force s3://cli
+  if aws s3api head-bucket --bucket cli 2>/dev/null; then fail "s3 rb --force left the bucket"; fi
+  echo "awscli: cp up and down to 100 MiB, CRC32/SHA-1/SHA-256 checksums, paged listing, sync, ranges, copy, batch delete, multipart, presign refused, rb"
+}
+
+# ---------------------------------------------------------------------------- rclone
+run_rclone() {
+  export RCLONE_CONFIG_VKR_TYPE=s3 RCLONE_CONFIG_VKR_PROVIDER=Other
+  export RCLONE_CONFIG_VKR_ENDPOINT=$S3_ENDPOINT RCLONE_CONFIG_VKR_FORCE_PATH_STYLE=true
+  export RCLONE_CONFIG_VKR_ACCESS_KEY_ID=$WKEY RCLONE_CONFIG_VKR_SECRET_ACCESS_KEY=$WKEY
+  export RCLONE_CONFIG_VKR_REGION=us-east-1
+  r() { rclone --ca-cert /e2e/ca.pem --log-file "$LOGS/rclone.log" -v "$@"; }
+  mkdir -p "$T/src/d"
+  for f in one two d/three; do head -c 70000 /dev/urandom >"$T/src/$f"; done
+  # A multipart upload of rclone's own (5 MiB parts, its MD5 kept in metadata).
+  head -c 12M /dev/urandom >"$T/src/d/big"
+  touch -d '2024-01-02 03:04:05' "$T/src/one"
+  r mkdir vkr:rcl
+  r copy --s3-upload-cutoff 5M --s3-chunk-size 5M "$T/src" vkr:rcl/data
+  r ls vkr:rcl/data | tee "$T/ls"
+  [ "$(wc -l <"$T/ls")" = 4 ] || fail "rclone ls does not list 4 files"
+  r check "$T/src" vkr:rcl/data || fail "rclone check"
+  r lsl vkr:rcl/data/one | grep -q '2024-01-02 03:04:05' || fail "rclone lost the modification time"
+  head -c 500 /dev/urandom >"$T/src/four"
+  : >"$LOGS/rclone.log"
+  r sync "$T/src" vkr:rcl/data
+  [ "$(grep -c ': Copied' "$LOGS/rclone.log")" = 1 ] || fail "the first sync did not copy one file"
+  : >"$LOGS/rclone.log"
+  r sync "$T/src" vkr:rcl/data
+  if grep -q ': Copied\|: Updated' "$LOGS/rclone.log"; then fail "the second sync copied again"; fi
+  r delete vkr:rcl/data
+  [ -z "$(r ls vkr:rcl)" ] || fail "rclone delete left files"
+  # Lists the bucket's multipart uploads to abort the stale ones.
+  r cleanup vkr:rcl
+  r rmdirs vkr:rcl
+  echo "rclone: copy (multipart too), ls, check, sync twice, delete, cleanup"
+}
+
+case ${1:-} in
+  trust) trust ;;
+  sccache) run_sccache ;;
+  awscli) run_awscli ;;
+  rclone) run_rclone ;;
+  *) echo "usage: $0 <trust|sccache|awscli|rclone>" >&2; exit 2 ;;
+esac
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index f32140c3..f8149c80 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -778,6 +778,17 @@ blocking pool and stream their bodies on the runtime. Objects expire under the g
 retention like every `files/` entry ("Lifecycle" above): a PutObject writes no retention
 annotation.
 
+**Tests.** Besides the in-process suite (`tests/s3_e2e.rs`), `tests/s3-e2e.sh` at the
+repository root drives real clients in a microVM (`tests/s3/Dockerfile`) against a
+`vk-registry serve` in accounts mode, with TLS on the host's LAN address: `sccache` (a miss
+then a hit, read-only with a `read:files/*` key, a wrong secret failing its startup check),
+the AWS CLI (`cp` up to 100 MiB each way through multipart uploads and ranged downloads, its
+default CRC64NVME and CRC32/SHA-1/SHA-256 checksums, paged `list-objects-v2`, `sync`,
+`head-object`, ranged `get-object`, `copy-object`, `delete-objects`, a multipart upload by
+hand, a presigned URL refused, `rb --force`) and rclone (`copy` with a multipart upload,
+`ls`, `check`, `sync` twice with modification times from metadata, `delete`, `cleanup`); then
+`vk registry get` reads an object the CLI wrote and `vk-registry gc` keeps it.
+
 ## Accounts administration
 
 `vk-registry accounts` manages users, sessions, administrators, and API keys. The command

From 83d3c43910b34a445e7fc0429de4e3711dd055bc Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 16:40:32 +0100
Subject: [PATCH 16/54] vk-driver/regproxy: forward /s3/ to jobs

A job's token now also reaches the registry's S3 view through the guest
proxy, which replaces the guest's SigV4 Authorization (dummy keys or none)
with the token. /s3/job/<alias>/<key> maps to the key below the area's
prefix, and /s3/job/<alias> alone is the area as a bucket: its listings
get the key prefix in their query and continuation token, and the S3
documents answering them, a created bucket's Location and error
Resources name the area back by its alias. An area below its bucket
takes only reads at the bucket level, since a bucket write or a batch
delete would act outside it.
---
 CHANGELOG.md              |   5 +-
 docs/gitlab-dispatch.md   |  19 +-
 docs/registry-hub.md      |  27 +-
 vk-driver/src/regproxy.rs | 933 ++++++++++++++++++++++++++++++++++----
 vk-registry/DESIGN.md     |  22 +-
 5 files changed, 906 insertions(+), 100 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dd1d7383..c6f8b835 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,10 @@ All notable changes to virtkit will be documented in this file.
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
   shown as the S3 key pair, ready to paste. With wildcard DNS, setting `s3_host` also serves
-  each bucket at its own host name, as clients using virtual-hosted style address it.
+  each bucket at its own host name, as clients using virtual-hosted style address it. Jobs a
+  fleet hub places with their own registry token reach it too through the guest registry
+  proxy, holding no credential: `sccache` there takes bucket `job` with its area's alias as the
+  key prefix.
 
 ## [0.106.0] - 2026-11-05
 
diff --git a/docs/gitlab-dispatch.md b/docs/gitlab-dispatch.md
index fb4cea7b..75d349eb 100644
--- a/docs/gitlab-dispatch.md
+++ b/docs/gitlab-dispatch.md
@@ -664,10 +664,21 @@ job and injects the job's token, never the node's credential. A job with no toke
 proxy that refuses everything; so does every job a local gitlab-runner gives the node, which
 under `"job"` reaches the registry only by its own means.
 
-With a token, the proxy forwards the lock API (`/lock/`) and plain files (`/dav/files/`) as
-well as `/v2/`; the registry enforces the token's grants. Under `/dav/files/` only GET,
-HEAD, PROPFIND, PUT, MKCOL, DELETE and OPTIONS pass: MOVE and COPY would name the proxy in
-their `Destination`. The job's steps find the proxy in `VK_REGISTRY` (`http://registry.vk`)
+With a token, the proxy forwards the lock API (`/lock/`), plain files (`/dav/files/`) and their
+S3 view (`/s3`) as well as `/v2/`; the registry enforces the token's grants. Under
+`/dav/files/` only GET, HEAD, PROPFIND, PUT, MKCOL, DELETE and OPTIONS pass: MOVE and COPY
+would name the proxy in their `Destination`. On `/s3`, the guest's own signature is replaced by
+the token, so a job points `sccache` at its area with no key at all:
+
+```sh
+export SCCACHE_BUCKET=job SCCACHE_S3_KEY_PREFIX=<alias>/ SCCACHE_ENDPOINT=$VK_REGISTRY/s3
+export SCCACHE_REGION=auto SCCACHE_S3_NO_CREDENTIALS=true
+```
+
+`job/<alias>` there stands for the area's prefix, as on `/dav/files/job/<alias>`
+([4b](registry-hub.md#4b-registry-access-from-inside-a-job)); `SCCACHE_S3_NO_CREDENTIALS`
+sends the requests unsigned, and dummy `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` work as
+well. The job's steps find the proxy in `VK_REGISTRY` (`http://registry.vk`)
 and their grants in `VK_REGISTRY_NAMESPACES`, space-separated `<prefix>=<rights>` with `r`,
 `w` and `l` for read, write and lock. The proxy needs `net.mode = "switch"`, the only network
 that serves `registry.vk`; under any other, a job gets neither the proxy nor these variables.
diff --git a/docs/registry-hub.md b/docs/registry-hub.md
index 0191231a..522369ef 100644
--- a/docs/registry-hub.md
+++ b/docs/registry-hub.md
@@ -632,8 +632,8 @@ though within them it can claim protection.
 
 ### 4b: registry access from inside a job
 
-- **The proxy.** When it injects a job token, the credential proxy forwards `/lock/` and
-  `/dav/files/` as well as `/v2/`. With the node's credential it keeps refusing anything
+- **The proxy.** When it injects a job token, the credential proxy forwards `/lock/`,
+  `/dav/files/` and the S3 view (`/s3`) as well as `/v2/`. With the node's credential it keeps refusing anything
   outside `/v2/`, since that credential is not scoped. The proxy filters no namespace
   itself: the registry enforces the token.
   - It sets no response timeout of its own: `/lock/acquire` long-polls for up to an hour by
@@ -674,12 +674,21 @@ though within them it can claim protection.
     (`name=job/<alias>/…:<key>`, decoded as the registry decodes it). The mapped URL goes
     through the proxy's checks again. Any other path is forwarded as it is; `job/…` naming no
     alias of the job is refused with 403 and not forwarded.
+  - On the S3 view, `/s3/job/<alias>/<key…>` is likewise the key below the area's prefix, and
+    `x-amz-copy-source: /job/<alias>/<key>` the same. A prefix `a/b/c` is bucket `a` and key
+    prefix `b/c/`. `/s3/job/<alias>` alone is the area as a bucket: its listings go to bucket
+    `a` with `b/c/` put before their `prefix`, `start-after`, `marker` and `key-marker` and
+    into their `continuation-token` (base64url of a key), so they stay in the area; when the
+    prefix has more than one component, only reads pass there. The guest's SigV4
+    `Authorization`, with dummy keys or none, is replaced by the token, as any other.
   - No other query parameter is mapped: an OCI cross-repository mount's `from=job/<alias>/…`
     reaches the registry as it is.
   - Only requests are mapped. The registry answers with real names, an upload's `Location`
     among them, which the proxy forwards unchanged, so a client continues on the real path.
     A `PROPFIND`'s hrefs are mapped back to the alias, since a WebDAV client resolves a
-    listing against the root it asked for.
+    listing against the root it asked for, and so are the names in an S3 document answering
+    a request through an area — the bucket, keys, prefixes, markers, continuation tokens, a
+    `Location` and an error's `Resource` — and a created bucket's `Location`.
   - No namespace's path may start with `job`. The hub refuses an alias while one stored
     before that rule has such a path, and gives no job any alias until it moves.
   - The hub sends a job's areas (`JobRegistry.areas`) only to a node announcing
@@ -694,7 +703,17 @@ though within them it can claim protection.
 - **In-job tools.** task-rs takes `vk: http://registry.vk/job/task-cache` as its cache:
   entries under the alias and lock names `job/task-cache/<namespace>:<key>`. sccache uses
   `$VK_REGISTRY/dav/files/job/<alias>` as its WebDAV endpoint (the alias in the endpoint, not
-  in `key_prefix`, so it never creates `/dav/files/job/` itself). Neither holds a credential.
+  in `key_prefix`, so it never creates `/dav/files/job/` itself), or the S3 view:
+
+  ```sh
+  SCCACHE_BUCKET=job SCCACHE_S3_KEY_PREFIX=<alias>/ SCCACHE_ENDPOINT=$VK_REGISTRY/s3 \
+    SCCACHE_REGION=auto SCCACHE_S3_NO_CREDENTIALS=true
+  ```
+
+  `SCCACHE_S3_NO_CREDENTIALS` sends unsigned requests; dummy `AWS_ACCESS_KEY_ID` and
+  `AWS_SECRET_ACCESS_KEY` do as well, since the proxy drops the signature. Other S3 clients
+  list an area as the bucket `<alias>` at the endpoint `$VK_REGISTRY/s3/job`, path-style
+  (`aws --endpoint-url $VK_REGISTRY/s3/job s3 ls s3://<alias>/`). None holds a credential.
 
 ### 4c: pipeline caches and captures
 
diff --git a/vk-driver/src/regproxy.rs b/vk-driver/src/regproxy.rs
index edeebce9..c8002614 100644
--- a/vk-driver/src/regproxy.rs
+++ b/vk-driver/src/regproxy.rs
@@ -25,9 +25,9 @@
 //! What the proxy lends decides what it forwards ([`Scope`]). The node's own credential is
 //! not scoped, so it reaches the OCI API only (`/v2/`). A job's registry token, which the hub
 //! scoped to the job's namespaces (`[registry] guest_credential = "job"`), also reaches the
-//! lock API (`/lock/`) and plain files (`/dav/files/`): the registry enforces the token's
-//! grants on each. A job meant to have a token and given none gets a proxy that forwards
-//! nothing.
+//! lock API (`/lock/`), plain files (`/dav/files/`) and their S3 view (`/s3`): the registry
+//! enforces the token's grants on each. A job meant to have a token and given none gets a proxy
+//! that forwards nothing.
 //!
 //! A job's token may come with areas ([`Area`]): `job/<alias>` in an OCI or plain-file path, or
 //! before the `:` of a lock name, stands for the area's prefix, so a guest names a fixed path
@@ -36,6 +36,13 @@
 //! (an upload's `Location`, a lock's holders), which the proxy forwards too. A `PROPFIND`'s
 //! hrefs are the exception, mapped back to the alias, since a WebDAV client resolves a listing
 //! against the root it asked for.
+//!
+//! Under `/s3/`, `job/<alias>/<key…>` names a key below the area's prefix, and `job/<alias>` alone
+//! names the area as a bucket of its own ([`map_s3`]): the prefix's first component is the real
+//! bucket, the rest a key prefix the proxy adds to a listing's query and takes off the names in
+//! the documents it answers ([`S3Names`]). The guest's own `Authorization`, SigV4 with whatever
+//! keys or none, is replaced by the token, so the registry decodes an `aws-chunked` body without
+//! checking chunk signatures made with keys it does not know.
 
 use std::convert::Infallible;
 use std::net::SocketAddr;
@@ -71,12 +78,17 @@ const DAV_FILES_METHODS: &[&str] = &[
     "GET", "HEAD", "PROPFIND", "PUT", "MKCOL", "DELETE", "OPTIONS",
 ];
 
+/// The S3 view's path, and the methods forwarded under it: vk-registry's for `/s3`.
+const S3: &str = "/s3";
+const S3_METHODS: &[&str] = &["GET", "HEAD", "PUT", "POST", "DELETE", "OPTIONS"];
+
 /// Which of the registry's paths the proxy forwards.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Scope {
     /// The OCI API only, `/v2/`: what an unscoped credential may be lent for.
     Oci,
-    /// `/v2/`, `/lock/` and `/dav/files/`: a job token's, whose grants the registry enforces.
+    /// `/v2/`, `/lock/`, `/dav/files/` and `/s3`: a job token's, whose grants the registry
+    /// enforces.
     Job,
     /// Nothing: a job that should have had a token and has none.
     Deny,
@@ -87,7 +99,7 @@ impl Scope {
     fn paths(self) -> &'static [&'static str] {
         match self {
             Scope::Oci => &["/v2/"],
-            Scope::Job => &["/v2/", "/lock/", DAV_FILES],
+            Scope::Job => &["/v2/", "/lock/", DAV_FILES, S3],
             Scope::Deny => &[],
         }
     }
@@ -304,19 +316,23 @@ async fn handle(
     }))
 }
 
+/// Whether `path` lies under the forwarded path `scoped`: below it when it ends in `/`, else
+/// also the path itself, as [`S3`] alone names the service, with or without a query.
+fn within(path: &str, scoped: &str) -> bool {
+    match path.strip_prefix(scoped) {
+        Some(_) if scoped.ends_with('/') => true,
+        Some(rest) => rest.is_empty() || rest.starts_with(['/', '?']),
+        None => false,
+    }
+}
+
 /// The upstream URL a guest's request target names, or `None` when, once resolved, it is not
 /// under one of the scope's paths below the upstream's own. Checked after resolving, not on
 /// the text: the URL parser resolves `..` and its percent-encoded spellings (`%2e%2e`), so
 /// `/v2/../lock/acquire` starts with `/v2/` and still reaches `/lock/acquire`, carrying the
 /// credential.
 fn upstream_url(cfg: &ProxyCfg, path_and_query: &str) -> Option<reqwest::Url> {
-    let scoped = |p: &str| {
-        cfg.scope
-            .paths()
-            .iter()
-            .find(|s| p.starts_with(*s))
-            .copied()
-    };
+    let scoped = |p: &str| cfg.scope.paths().iter().find(|s| within(p, s)).copied();
     let prefix = scoped(path_and_query)?;
     // An encoded separator stays encoded through the parser, so `/v2/..%2Flock` passes the
     // check below — and reaches `/lock` through a front proxy that decodes `%2F`/`%5C` once
@@ -332,7 +348,7 @@ fn upstream_url(cfg: &ProxyCfg, path_and_query: &str) -> Option<reqwest::Url> {
     }
     let url = reqwest::Url::parse(&format!("{}{path_and_query}", cfg.upstream)).ok()?;
     let resolved = url.path().strip_prefix(cfg.root.as_str())?;
-    (url.origin() == cfg.base.origin() && resolved.starts_with(prefix)).then_some(url)
+    (url.origin() == cfg.base.origin() && within(resolved, prefix)).then_some(url)
 }
 
 /// What a request becomes under the job's areas.
@@ -344,11 +360,13 @@ enum Mapped<'a> {
     To(String, &'a Area),
     /// `job/…` naming no area of this job.
     Unknown,
+    /// An area named in a way the request cannot take, refused with this message.
+    Refused(&'static [u8]),
 }
 
 /// `url` (an accepted upstream URL) under `cfg`'s areas: `job/<alias>` at the start of an
-/// OCI or plain-file path, or of a lock name's path part, becomes the area's prefix.
-fn map_aliases<'a>(cfg: &'a ProxyCfg, url: &reqwest::Url) -> Mapped<'a> {
+/// OCI, plain-file or S3 path, or of a lock name's path part, becomes the area's prefix.
+fn map_aliases<'a>(cfg: &'a ProxyCfg, method: &Method, url: &reqwest::Url) -> Mapped<'a> {
     if cfg.scope != Scope::Job {
         return Mapped::Unchanged;
     }
@@ -363,6 +381,9 @@ fn map_aliases<'a>(cfg: &'a ProxyCfg, url: &reqwest::Url) -> Mapped<'a> {
             Err(()) => Mapped::Unknown,
         };
     }
+    if let Some(rest) = path.strip_prefix(S3).and_then(|p| p.strip_prefix('/')) {
+        return map_s3(&cfg.areas, method, rest, url.query());
+    }
     for base in ["/v2/", DAV_FILES] {
         let Some(rest) = path.strip_prefix(base) else {
             continue;
@@ -398,6 +419,189 @@ fn map_name<'a>(
     Ok(Some((format!("{}{tail}", area.prefix), area)))
 }
 
+/// `/s3/<rest>` under the job's areas. `job/<alias>/<key…>` is the key below the area's
+/// prefix, as on `/dav/files/`. `job/<alias>` alone, with or without a `/`, is the area as a
+/// bucket: the real bucket, with a listing's query given the key prefix ([`listing_query`]).
+/// When the area lies below its bucket, only reads pass there: creating or deleting the bucket
+/// would act on the whole real bucket, and a batch delete's keys sit in a body the proxy does
+/// not rewrite, under checksums it could not keep.
+fn map_s3<'a>(areas: &'a [Area], method: &Method, rest: &str, query: Option<&str>) -> Mapped<'a> {
+    let (name, area) = match map_name(areas, rest, '/') {
+        Ok(None) => return Mapped::Unchanged,
+        Ok(Some(mapped)) => mapped,
+        Err(()) => return Mapped::Unknown,
+    };
+    let tail = name.strip_prefix(area.prefix.as_str()).unwrap_or_default();
+    if !matches!(tail, "" | "/") {
+        let query = query.map(|q| format!("?{q}")).unwrap_or_default();
+        return Mapped::To(format!("{S3}/{name}{query}"), area);
+    }
+    let names = S3Names::new(area);
+    let query = match query {
+        _ if names.keys.is_empty() => query.map(str::to_string),
+        _ if !matches!(method.as_str(), "GET" | "HEAD" | "OPTIONS") => {
+            return Mapped::Refused(
+                b"registry proxy: an area below its bucket takes reads only, not bucket writes",
+            );
+        }
+        _ if *method == Method::GET => Some(listing_query(&names, query.unwrap_or_default())),
+        _ => query.map(str::to_string),
+    };
+    let query = query
+        .filter(|q| !q.is_empty())
+        .map(|q| format!("?{q}"))
+        .unwrap_or_default();
+    Mapped::To(format!("{S3}/{}{query}", names.bucket), area)
+}
+
+/// The parameters a bucket listing takes, of either version, and a listing of its multipart
+/// uploads; an SDK's `x-id` hint too. A query naming another is not a listing.
+const LISTING_PARAMS: &[&str] = &[
+    "list-type",
+    "prefix",
+    "delimiter",
+    "max-keys",
+    "continuation-token",
+    "start-after",
+    "marker",
+    "encoding-type",
+    "fetch-owner",
+    "x-id",
+];
+const UPLOADS_PARAMS: &[&str] = &[
+    "uploads",
+    "prefix",
+    "delimiter",
+    "key-marker",
+    "upload-id-marker",
+    "max-uploads",
+    "encoding-type",
+    "x-id",
+];
+
+/// A bucket `GET`'s query through an area below its bucket: a listing's keys are the area's,
+/// so the key prefix goes before each `prefix`, `start-after`, `marker` and `key-marker`, and
+/// into the key a `continuation-token` names; a `prefix` is added when none is given, so the
+/// listing stays in the area. Any other query, a configuration's, is kept as sent.
+fn listing_query(names: &S3Names, query: &str) -> String {
+    let name = |p: &str| p.split_once('=').map_or(p, |(n, _)| n).to_string();
+    let pairs: Vec<&str> = query.split('&').filter(|p| !p.is_empty()).collect();
+    let known = match pairs.iter().any(|p| name(p) == "uploads") {
+        true => UPLOADS_PARAMS,
+        false => LISTING_PARAMS,
+    };
+    if !pairs.iter().all(|p| known.contains(&name(p).as_str())) {
+        return query.to_string();
+    }
+    // A prefix is lowercase alphanumerics and `._-/`, so encoding escapes the `/` alone.
+    let keys = vk_registry::percent_encode(&names.keys);
+    let value = |p: &str| p.split_once('=').map_or("", |(_, v)| v).to_string();
+    let mut out: Vec<String> = pairs
+        .iter()
+        .map(|p| match name(p).as_str() {
+            n @ ("prefix" | "start-after" | "marker" | "key-marker") => {
+                format!("{n}={keys}{}", value(p))
+            }
+            "continuation-token" => format!("continuation-token={}", names.token_in(&value(p))),
+            _ => p.to_string(),
+        })
+        .collect();
+    if !pairs.iter().any(|p| name(p) == "prefix") {
+        out.push(format!("prefix={keys}"));
+    }
+    out.join("&")
+}
+
+/// An `x-amz-copy-source` under the job's areas: `[/]job/<alias>/<key…>`, escaped as a whole
+/// or not, becomes `/<prefix>/<key…>`, unescaped as the registry also takes it. `Ok(None)` for
+/// a source not under [`ALIAS_ROOT`], forwarded as sent; `Err` for no such alias.
+fn map_copy_source(areas: &[Area], source: &str) -> Result<Option<String>, ()> {
+    let decoded = vk_registry::percent_decode(source);
+    let name = decoded.strip_prefix('/').unwrap_or(&decoded);
+    Ok(map_name(areas, name, '/')?.map(|(name, _)| format!("/{name}")))
+}
+
+/// An area as the S3 view sees it, and its names mapped back from the registry's.
+#[derive(Clone)]
+struct S3Names {
+    /// The prefix's first component, the real bucket
+    bucket: String,
+    /// The rest of the prefix with a `/`, or nothing when the prefix is the bucket alone
+    keys: String,
+    /// `/s3/<prefix>` and `/s3/<bucket>`, as the registry names a request's path
+    real: String,
+    real_bucket: String,
+    alias: String,
+    /// `/s3/job/<alias>`, which a guest names the area by
+    aliased: String,
+}
+
+impl S3Names {
+    fn new(area: &Area) -> Self {
+        let (bucket, keys) = match area.prefix.split_once('/') {
+            Some((bucket, rest)) => (bucket, format!("{rest}/")),
+            None => (area.prefix.as_str(), String::new()),
+        };
+        S3Names {
+            bucket: bucket.to_string(),
+            keys,
+            real: format!("{S3}/{}", area.prefix),
+            real_bucket: format!("{S3}/{bucket}"),
+            alias: area.alias.clone(),
+            aliased: format!("{S3}/{ALIAS_ROOT}/{}", area.alias),
+        }
+    }
+
+    /// A guest's continuation token, the key it names put below the key prefix; one that does
+    /// not decode is kept for the registry to refuse.
+    fn token_in(&self, token: &str) -> String {
+        use vk_hub_proto::token::{from_base64url, to_base64url};
+        match from_base64url(&vk_registry::percent_decode(token)) {
+            Some(key) if !token.is_empty() => to_base64url(&[self.keys.as_bytes(), &key].concat()),
+            _ => token.to_string(),
+        }
+    }
+
+    /// The registry's continuation token, the key it names taken from below the key prefix.
+    fn token_out(&self, token: &[u8]) -> Option<Vec<u8>> {
+        use vk_hub_proto::token::{from_base64url, to_base64url};
+        let key = from_base64url(std::str::from_utf8(token).ok()?)?;
+        let key = key.strip_prefix(self.keys.as_bytes())?;
+        Some(to_base64url(key).into_bytes())
+    }
+
+    /// A path the registry names, `/s3/<prefix>[/…]` or the bucket `/s3/<bucket>[/]`, as the
+    /// guest names it, `/s3/job/<alias>[/…]`.
+    fn path_out(&self, path: &[u8]) -> Option<Vec<u8>> {
+        let tail = path
+            .strip_prefix(self.real.as_bytes())
+            .filter(|r| r.is_empty() || r.starts_with(b"/"))
+            .or_else(|| {
+                path.strip_prefix(self.real_bucket.as_bytes())
+                    .filter(|r| matches!(r, [] | [b'/']))
+            })?;
+        Some([self.aliased.as_bytes(), tail].concat())
+    }
+
+    /// The text of the element `name` as the guest names it, or `None` to keep it: a bucket
+    /// becomes the alias, a key or key prefix loses the area's key prefix, a continuation
+    /// token the same in the key it names, and a path the alias form. A name outside the area
+    /// is kept. Every one of these is the registry's escaped XML text, which the prefix's
+    /// characters pass through unchanged, under `encoding-type=url` too.
+    fn text(&self, name: &[u8], text: &[u8]) -> Option<Vec<u8>> {
+        match name {
+            b"Name" | b"Bucket" => {
+                (text == self.bucket.as_bytes()).then(|| self.alias.clone().into_bytes())
+            }
+            b"Prefix" | b"StartAfter" | b"Marker" | b"NextMarker" | b"Key" | b"KeyMarker"
+            | b"NextKeyMarker" => text.strip_prefix(self.keys.as_bytes()).map(<[u8]>::to_vec),
+            b"ContinuationToken" | b"NextContinuationToken" => self.token_out(text),
+            b"Location" | b"Resource" => self.path_out(text),
+            _ => None,
+        }
+    }
+}
+
 /// A lock request's query with each `name=` under [`ALIAS_ROOT`] mapped, decoded as the
 /// registry decodes it and encoded again; every other pair is kept as it came, in order.
 /// `Ok(None)` when no name was mapped. The area returned is the first mapped name's. One
@@ -421,10 +625,18 @@ fn map_lock_names<'a>(areas: &'a [Area], query: &str) -> Result<Option<(String,
     Ok(first.map(|area| (pairs.join("&"), area)))
 }
 
+/// The refusal of a `job/…` naming no area of this job.
+const NO_SUCH_AREA: &[u8] = b"registry proxy: this job has no area of that alias";
+
 /// A 403 with `msg`.
 fn forbidden(msg: &'static [u8]) -> Response<ProxyBody> {
+    refusal(StatusCode::FORBIDDEN, msg)
+}
+
+/// A `status` answer with `msg`, never forwarded.
+fn refusal(status: StatusCode, msg: &'static [u8]) -> Response<ProxyBody> {
     Response::builder()
-        .status(StatusCode::FORBIDDEN)
+        .status(status)
         .body(
             Full::new(Bytes::from_static(msg))
                 .map_err(|never| match never {})
@@ -445,6 +657,14 @@ struct HrefMap {
     carry: Vec<u8>,
 }
 
+/// A rewrite of a response body as it streams, holding back at most a bounded tail.
+trait BodyMap {
+    /// The bytes that can be sent now, mapped, once `chunk` has arrived.
+    fn push(&mut self, chunk: &[u8]) -> Bytes;
+    /// The rest, mapped, once the body has ended.
+    fn finish(&mut self) -> Bytes;
+}
+
 impl HrefMap {
     fn new(area: &Area) -> Self {
         let href = |p: &str| format!("<D:href>{DAV_FILES}{p}").into_bytes();
@@ -455,18 +675,6 @@ impl HrefMap {
         }
     }
 
-    /// The bytes of `chunk` that can be sent now, mapped; a tail as long as the pattern waits
-    /// for the next chunk, which holds the byte after a match.
-    fn push(&mut self, chunk: &[u8]) -> Bytes {
-        self.carry.extend_from_slice(chunk);
-        self.emit(self.carry.len().saturating_sub(self.from.len()))
-    }
-
-    /// The rest, mapped, once the body has ended.
-    fn finish(&mut self) -> Bytes {
-        self.emit(self.carry.len())
-    }
-
     /// The carry up to `upto`, mapped; a match starting before `upto` is taken whole.
     fn emit(&mut self, upto: usize) -> Bytes {
         let mut out = Vec::with_capacity(upto);
@@ -486,34 +694,168 @@ impl HrefMap {
         self.carry.drain(..i.min(self.carry.len()));
         Bytes::from(out)
     }
+}
 
-    /// `body` with its hrefs mapped; a chunk that leaves nothing to send yet yields no frame.
-    fn over<S>(self, body: S) -> impl futures::Stream<Item = reqwest::Result<Bytes>>
-    where
-        S: futures::Stream<Item = reqwest::Result<Bytes>> + Send + 'static,
-    {
-        use futures::StreamExt;
-        futures::stream::unfold((Box::pin(body), Some(self)), |(mut body, map)| async move {
-            let mut map = map?;
-            loop {
-                match body.next().await {
-                    Some(Ok(chunk)) => {
-                        let out = map.push(&chunk);
-                        if !out.is_empty() {
-                            return Some((Ok(out), (body, Some(map))));
-                        }
-                    }
-                    Some(Err(e)) => return Some((Err(e), (body, None))),
-                    None => {
-                        let out = map.finish();
-                        return (!out.is_empty()).then_some((Ok(out), (body, None)));
-                    }
+impl BodyMap for HrefMap {
+    /// A tail as long as the pattern waits for the next chunk, which holds the byte after a
+    /// match.
+    fn push(&mut self, chunk: &[u8]) -> Bytes {
+        self.carry.extend_from_slice(chunk);
+        self.emit(self.carry.len().saturating_sub(self.from.len()))
+    }
+
+    fn finish(&mut self) -> Bytes {
+        self.emit(self.carry.len())
+    }
+}
+
+/// The longest element [`S3Map`] waits for whole: past it, the element streams on unmapped.
+/// A key is at most 1024 bytes, 3 KiB once URL-encoded, and a token or path not much more.
+const MAX_ELEMENT: usize = 8 << 10;
+
+/// The elements of an S3 document [`S3Names::text`] maps.
+const S3_ELEMENTS: &[&[u8]] = &[
+    b"Name",
+    b"Bucket",
+    b"Prefix",
+    b"StartAfter",
+    b"Marker",
+    b"NextMarker",
+    b"Key",
+    b"KeyMarker",
+    b"NextKeyMarker",
+    b"ContinuationToken",
+    b"NextContinuationToken",
+    b"Location",
+    b"Resource",
+];
+
+/// Maps an S3 document answering a request through an area back to the area's names, as the
+/// body streams: each `<E>text</E>` of [`S3_ELEMENTS`] has its text mapped by [`S3Names::text`],
+/// whatever element holds it (a common prefix's `Prefix` as the listing's). vk-registry writes
+/// these elements with no attribute and their text escaped, so no `<` is in it. At most
+/// [`MAX_ELEMENT`] bytes wait for the next chunk.
+struct S3Map {
+    names: S3Names,
+    /// Bytes not sent yet: an element, or the start of a tag, still arriving.
+    carry: Vec<u8>,
+}
+
+/// What the carry holds from a `<` on.
+enum Scan {
+    /// One of [`S3_ELEMENTS`], whole: its bytes mapped, and how many it took.
+    Mapped(Vec<u8>, usize),
+    /// Something else, sent as it is.
+    Other,
+    /// Too little to tell yet.
+    Short,
+}
+
+impl S3Map {
+    fn new(names: S3Names) -> Self {
+        S3Map {
+            names,
+            carry: Vec::new(),
+        }
+    }
+
+    /// `at`, which starts with `<`, read as one of [`S3_ELEMENTS`].
+    fn scan(&self, at: &[u8]) -> Scan {
+        let Some(gt) = at.iter().position(|&b| b == b'>') else {
+            return Scan::Short;
+        };
+        let name = at.get(1..gt).unwrap_or_default();
+        if !S3_ELEMENTS.contains(&name) {
+            return Scan::Other;
+        }
+        let rest = at.get(gt + 1..).unwrap_or_default();
+        let Some(lt) = rest.iter().position(|&b| b == b'<') else {
+            return Scan::Short;
+        };
+        let (text, after) = rest.split_at(lt);
+        let close = [b"</", name, b">"].concat();
+        if !after.starts_with(&close) {
+            return match close.starts_with(after) {
+                true => Scan::Short,
+                false => Scan::Other,
+            };
+        }
+        let text = self.names.text(name, text).unwrap_or_else(|| text.to_vec());
+        let open = at.get(..=gt).unwrap_or_default();
+        let used = gt + 1 + lt + close.len();
+        Scan::Mapped([open, &text, &close].concat(), used)
+    }
+
+    /// The carry, mapped, up to an element still arriving unless the body has `ended`.
+    fn emit(&mut self, ended: bool) -> Bytes {
+        let mut out = Vec::with_capacity(self.carry.len());
+        let mut i = 0;
+        while let Some(rest) = self.carry.get(i..).filter(|r| !r.is_empty()) {
+            let Some(lt) = rest.iter().position(|&b| b == b'<') else {
+                out.extend_from_slice(rest);
+                i = self.carry.len();
+                break;
+            };
+            out.extend_from_slice(rest.get(..lt).unwrap_or_default());
+            i += lt;
+            let at = self.carry.get(i..).unwrap_or_default();
+            match self.scan(at) {
+                Scan::Mapped(bytes, used) => {
+                    out.extend_from_slice(&bytes);
+                    i += used;
+                }
+                Scan::Short if !ended && at.len() <= MAX_ELEMENT => break,
+                Scan::Short | Scan::Other => {
+                    out.push(b'<');
+                    i += 1;
                 }
             }
-        })
+        }
+        self.carry.drain(..i.min(self.carry.len()));
+        Bytes::from(out)
+    }
+}
+
+impl BodyMap for S3Map {
+    fn push(&mut self, chunk: &[u8]) -> Bytes {
+        self.carry.extend_from_slice(chunk);
+        self.emit(false)
+    }
+
+    fn finish(&mut self) -> Bytes {
+        self.emit(true)
     }
 }
 
+/// `body` with `map` applied; a chunk that leaves nothing to send yet yields no frame.
+fn mapped<S>(
+    map: Box<dyn BodyMap + Send>,
+    body: S,
+) -> impl futures::Stream<Item = reqwest::Result<Bytes>>
+where
+    S: futures::Stream<Item = reqwest::Result<Bytes>> + Send + 'static,
+{
+    use futures::StreamExt;
+    futures::stream::unfold((Box::pin(body), Some(map)), |(mut body, map)| async move {
+        let mut map = map?;
+        loop {
+            match body.next().await {
+                Some(Ok(chunk)) => {
+                    let out = map.push(&chunk);
+                    if !out.is_empty() {
+                        return Some((Ok(out), (body, Some(map))));
+                    }
+                }
+                Some(Err(e)) => return Some((Err(e), (body, None))),
+                None => {
+                    let out = map.finish();
+                    return (!out.is_empty()).then_some((Ok(out), (body, None)));
+                }
+            }
+        }
+    })
+}
+
 /// Headers that must not be copied across the proxy (connection-scoped, credential-bearing,
 /// or ones we set ourselves).
 fn is_skipped(name: &str) -> bool {
@@ -526,6 +868,8 @@ fn is_skipped(name: &str) -> bool {
             | "content-length"
             | "connection"
             | "transfer-encoding"
+            // a SigV4 session token, meaningless once the guest's signature is replaced
+            | "x-amz-security-token"
     )
 }
 
@@ -538,13 +882,13 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
         .to_string();
     // The proxy signs requests with a credential, so confine it to the paths its scope lends
     // that credential for: the OCI distribution API surface (`/v2/…`) for the host's own,
-    // the lock API and plain files too for a job's token. A guest-chosen path outside them —
+    // the lock API, plain files and their S3 view too for a job's token. A guest-chosen path outside them —
     // a foreign authority smuggled via `//host`, or the `/lock/` control plane under the
     // host's credential — is refused rather than authenticated on the guest's behalf.
     let Some(url) = upstream_url(cfg, &path_and_query) else {
         return Ok(forbidden(match cfg.scope {
             Scope::Oci => b"registry proxy: only /v2/ registry paths are proxied",
-            Scope::Job => b"registry proxy: only /v2/, /lock/ and /dav/files/ are proxied",
+            Scope::Job => b"registry proxy: only /v2/, /lock/, /dav/files/ and /s3/ are proxied",
             Scope::Deny => b"registry proxy: this job has no registry credential",
         }));
     };
@@ -552,33 +896,35 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
     // Plain files take the verbs vk-registry serves there, and no MOVE or COPY, whose
     // `Destination` names the proxy rather than the registry.
     if path_and_query.starts_with(DAV_FILES) && !DAV_FILES_METHODS.contains(&method.as_str()) {
-        let body = Full::new(Bytes::from_static(
+        return Ok(refusal(
+            StatusCode::METHOD_NOT_ALLOWED,
             b"registry proxy: this method is not proxied under /dav/files/",
-        ))
-        .map_err(|never| match never {})
-        .boxed_unsync();
-        return Ok(Response::builder()
-            .status(StatusCode::METHOD_NOT_ALLOWED)
-            .body(body)?);
+        ));
+    }
+    if within(&path_and_query, S3) && !S3_METHODS.contains(&method.as_str()) {
+        return Ok(refusal(
+            StatusCode::METHOD_NOT_ALLOWED,
+            b"registry proxy: this method is not proxied under /s3/",
+        ));
     }
     // The job's aliases, mapped on the resolved URL, which then goes through the same checks
     // again: the prefix is the hub's, but the rest of the path is still the guest's.
-    let (url, area) = match map_aliases(cfg, &url) {
+    let (url, area) = match map_aliases(cfg, &method, &url) {
         Mapped::Unchanged => (url, None),
         Mapped::To(target, area) => match upstream_url(cfg, &target) {
             Some(url) => (url, Some(area)),
             None => return Ok(forbidden(b"registry proxy: an area's path is refused")),
         },
-        Mapped::Unknown => {
-            return Ok(forbidden(
-                b"registry proxy: this job has no area of that alias",
-            ));
-        }
+        Mapped::Unknown => return Ok(forbidden(NO_SUCH_AREA)),
+        Mapped::Refused(msg) => return Ok(forbidden(msg)),
     };
     let path = url.path().strip_prefix(cfg.root.as_str()).unwrap_or("");
     // A listing's hrefs go back to the alias the guest asked for (see the module's doc).
     let listing = method.as_str() == "PROPFIND" && path.starts_with(DAV_FILES);
     let hrefs = area.filter(|_| listing).map(HrefMap::new);
+    let s3 = cfg.scope == Scope::Job && within(path, S3);
+    // An S3 answer through an area names the area back (see [`S3Map`]).
+    let s3_names = area.filter(|_| s3).map(S3Names::new);
     // OCI writes and WebDAV PROPFIND always stream a body upstream, even when empty.
     // Forward other bodies for the registry to validate: dropping a MKCOL body
     // would create the collection instead of rejecting the request (RFC 4918 §9.3).
@@ -586,12 +932,28 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
     let bodyful = matches!(method, Method::POST | Method::PUT | Method::PATCH)
         || method.as_str() == "PROPFIND"
         || !hyper::body::Body::is_end_stream(&incoming);
-    let headers: Vec<_> = parts
+    let mut headers: Vec<_> = parts
         .headers
         .iter()
         .filter(|(k, _)| !is_skipped(&k.as_str().to_ascii_lowercase()))
         .map(|(k, v)| (k.clone(), v.clone()))
         .collect();
+    // A copy's source names its area as a path does. One that is not text is forwarded for
+    // the registry to refuse.
+    for (_, v) in headers
+        .iter_mut()
+        .filter(|(k, _)| s3 && k.as_str() == "x-amz-copy-source")
+    {
+        let Ok(source) = v.to_str() else { continue };
+        match map_copy_source(&cfg.areas, source) {
+            Ok(None) => {}
+            Ok(Some(mapped)) => match hyper::header::HeaderValue::from_str(&mapped) {
+                Ok(mapped) => *v = mapped,
+                Err(_) => return Ok(forbidden(b"registry proxy: an area's path is refused")),
+            },
+            Err(()) => return Ok(forbidden(NO_SUCH_AREA)),
+        }
+    }
     let sent = match (repeatable(&method, path), bodyful) {
         (true, false) => Outgoing::Whole(Bytes::new()),
         (true, true) => held(incoming, MAX_HELD).await?,
@@ -632,11 +994,19 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
         && !headers_out.contains_key(hyper::header::CONTENT_ENCODING))
     .then(|| resp.content_length())
     .flatten();
+    let xml = headers_out
+        .get(hyper::header::CONTENT_TYPE)
+        .is_some_and(|v| v.as_bytes().starts_with(b"application/xml"));
+    let body_map: Option<Box<dyn BodyMap + Send>> = match (hrefs, &s3_names) {
+        (Some(map), _) => Some(Box::new(map)),
+        (None, Some(names)) if xml => Some(Box::new(S3Map::new(names.clone()))),
+        _ => None,
+    };
     // stream the upstream response back without buffering (blob pulls).
     let stream = resp.bytes_stream();
-    let body = match (hrefs, resume) {
+    let body = match (body_map, resume) {
         (Some(map), _) => StreamBody::new(
-            map.over(stream)
+            mapped(map, stream)
                 .map_ok(Frame::data)
                 .map_err(|e| std::io::Error::other(e.to_string())),
         )
@@ -683,9 +1053,16 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
 
     let mut out = Response::builder().status(status);
     for (k, v) in headers_out.iter() {
-        if !is_skipped(&k.as_str().to_ascii_lowercase()) {
-            out = out.header(k, v);
+        if is_skipped(&k.as_str().to_ascii_lowercase()) {
+            continue;
         }
+        // A bucket created through an area is located at the alias.
+        let aliased = s3_names
+            .as_ref()
+            .filter(|_| k == hyper::header::LOCATION)
+            .and_then(|names| names.path_out(v.as_bytes()))
+            .and_then(|p| hyper::header::HeaderValue::from_bytes(&p).ok());
+        out = out.header(k, aliased.as_ref().unwrap_or(v));
     }
     out.body(body).map_err(Into::into)
 }
@@ -704,8 +1081,8 @@ enum Outgoing {
 /// Whether a request to `path`, relative to the upstream root, can be repeated after
 /// a refused connection, a connection cut before the response, or a 503/429.
 /// Repeating it must have the same effect even if the first request reached the registry:
-/// reads, manifest PUTs by tag or digest, whole-file PUTs, and upload starts (which leave
-/// the first upload unused). Excludes upload chunks (`PATCH`), upload completion (`PUT`
+/// reads, manifest PUTs by tag or digest, whole-file PUTs, S3 PUTs of an object, a part or a
+/// copy, and upload starts (which leave the first upload unused). Excludes upload chunks (`PATCH`), upload completion (`PUT`
 /// under `blobs/uploads/`, whose upload is then gone), deletions, collection creation,
 /// and all `/lock/` requests regardless of method. A retried PUT lands last, like a
 /// later PUT from another writer.
@@ -719,6 +1096,9 @@ fn repeatable(method: &Method, path: &str) -> bool {
         "PUT" => {
             oci.is_some_and(|p| p.rsplit('/').nth(1) == Some("manifests"))
                 || path.starts_with(DAV_FILES)
+                || path
+                    .strip_prefix("/s3/")
+                    .is_some_and(|p| p.trim_end_matches('/').contains('/'))
         }
         "POST" => oci.is_some_and(|p| p.ends_with("/blobs/uploads/")),
         _ => false,
@@ -934,20 +1314,30 @@ fn resumed_at(
 mod tests {
     use super::*;
 
-    // A fake upstream that records the Authorization header + path and query of the last
-    // request and replies 200 with a marker body. It runs on its own dedicated thread + runtime
+    /// What [`fake_upstream`] saw of the last request: its `Authorization`, its path and
+    /// query, and every header forwarded.
+    type Seen = (String, String, hyper::HeaderMap);
+
+    // A fake upstream that records the Authorization header, path and query, and headers of
+    // the last request and replies 200 with a marker body. It runs on its own dedicated thread + runtime
     // (like the proxy's `spawn_blocking` and the vk-registry e2e servers) so its accept
     // loop never competes with the test's runtime threads — which caused acceptance stalls
     // and flakes when many of these servers ran concurrently under `cargo test`.
-    fn fake_upstream() -> (SocketAddr, Arc<std::sync::Mutex<(String, String)>>) {
+    fn fake_upstream() -> (SocketAddr, Arc<std::sync::Mutex<Seen>>) {
         fake_upstream_replying(b"ok")
     }
 
     /// [`fake_upstream`], replying `body` to every request.
-    fn fake_upstream_replying(
+    fn fake_upstream_replying(body: &'static [u8]) -> (SocketAddr, Arc<std::sync::Mutex<Seen>>) {
+        fake_upstream_answering(body, &[])
+    }
+
+    /// [`fake_upstream_replying`], with these headers.
+    fn fake_upstream_answering(
         body: &'static [u8],
-    ) -> (SocketAddr, Arc<std::sync::Mutex<(String, String)>>) {
-        let seen = Arc::new(std::sync::Mutex::new((String::new(), String::new())));
+        headers: &'static [(&'static str, &'static str)],
+    ) -> (SocketAddr, Arc<std::sync::Mutex<Seen>>) {
+        let seen = Arc::new(std::sync::Mutex::new(Seen::default()));
         let listener = std::net::TcpListener::bind(("127.0.0.1", 0)).unwrap();
         listener.set_nonblocking(true).unwrap();
         let addr = listener.local_addr().unwrap();
@@ -976,10 +1366,12 @@ mod tests {
                                     .unwrap_or("")
                                     .to_string();
                                 let path = req.uri().path_and_query().unwrap().to_string();
-                                *s.lock().unwrap() = (auth, path);
-                                Ok::<_, Infallible>(Response::new(Full::new(Bytes::from_static(
-                                    body,
-                                ))))
+                                *s.lock().unwrap() = (auth, path, req.headers().clone());
+                                let mut resp = Response::new(Full::new(Bytes::from_static(body)));
+                                for (k, v) in headers {
+                                    resp.headers_mut().insert(*k, v.parse().unwrap());
+                                }
+                                Ok::<_, Infallible>(resp)
                             }
                         });
                         let _ = http1::Builder::new().serve_connection(io, svc).await;
@@ -1019,7 +1411,7 @@ mod tests {
         assert!(r.status().is_success());
         assert_eq!(r.text().await.unwrap(), "ok");
 
-        let (auth, path) = seen.lock().unwrap().clone();
+        let (auth, path, _) = seen.lock().unwrap().clone();
         assert_eq!(
             path, "/v2/app/manifests/latest",
             "path must be forwarded as resolved"
@@ -1124,7 +1516,7 @@ mod tests {
             .unwrap();
         assert!(r.status().is_success());
 
-        let (auth, _) = seen.lock().unwrap().clone();
+        let (auth, ..) = seen.lock().unwrap().clone();
         assert_eq!(
             auth, "Bearer vkr_x",
             "the proxy must inject the bearer token"
@@ -1174,9 +1566,9 @@ mod tests {
         proxy: SocketAddr,
         method: &str,
         target: &str,
-        seen: &std::sync::Mutex<(String, String)>,
+        seen: &std::sync::Mutex<Seen>,
     ) -> (u16, String, String) {
-        *seen.lock().unwrap() = (String::new(), String::new());
+        *seen.lock().unwrap() = Seen::default();
         let r = reqwest::Client::new()
             .request(
                 reqwest::Method::from_bytes(method.as_bytes()).unwrap(),
@@ -1186,7 +1578,7 @@ mod tests {
             .send()
             .await
             .unwrap();
-        let (auth, path) = seen.lock().unwrap().clone();
+        let (auth, path, _) = seen.lock().unwrap().clone();
         (r.status().as_u16(), auth, path)
     }
 
@@ -1372,7 +1764,7 @@ mod tests {
         let status = raw_status(proxy, "GET", "/dav/files/job/task-cache/../../other").await;
         assert_eq!(status, 200);
         assert_eq!(seen.lock().unwrap().1, "/dav/files/other");
-        *seen.lock().unwrap() = (String::new(), String::new());
+        *seen.lock().unwrap() = Seen::default();
         let status = raw_status(proxy, "GET", "/v2/job/task-cache/..%2F..%2Flock/x").await;
         assert_eq!(status, 403);
         assert_eq!(seen.lock().unwrap().1, "", "nothing forwarded");
@@ -1436,6 +1828,352 @@ mod tests {
         }
     }
 
+    /// The areas the S3 tests map: a prefix of one, two and three components.
+    fn s3_areas() -> [Area; 3] {
+        [
+            area("one", "solo"),
+            area("two", "duo/b"),
+            area("three", "tri/b/c"),
+        ]
+    }
+
+    /// A job's token reaches the S3 view, every method it serves, injected in place of the
+    /// guest's own `Authorization`, SigV4 included; the node's credential does not, nor a job
+    /// without a token.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn a_job_token_reaches_s3_too() {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let (up_addr, seen) = fake_upstream();
+        let proxy = spawn_blocking(ProxyCfg::for_job(&registry(up_addr), Some("vkt_job")).unwrap())
+            .unwrap();
+        for (method, target) in [
+            ("GET", "/s3"),
+            ("GET", "/s3/"),
+            ("HEAD", "/s3/b"),
+            ("GET", "/s3/b?list-type=2&prefix=x/"),
+            ("PUT", "/s3/b/k"),
+            ("POST", "/s3/b/k?uploads"),
+            ("DELETE", "/s3/b/k"),
+            ("OPTIONS", "/s3/b/k"),
+        ] {
+            let (status, auth, path) = status_and_auth(proxy, method, target, &seen).await;
+            assert_eq!(status, 200, "{method} {target}");
+            assert_eq!(auth, "Bearer vkt_job", "{method} {target}");
+            assert_eq!(path, target, "{method} {target}");
+        }
+        *seen.lock().unwrap() = Seen::default();
+        let r = reqwest::Client::new()
+            .put(format!("http://{proxy}/s3/b/k"))
+            .header(
+                "authorization",
+                "AWS4-HMAC-SHA256 Credential=dummy/20261105/auto/s3/aws4_request, \
+                 SignedHeaders=host;x-amz-date, Signature=00",
+            )
+            .header("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD")
+            .header("x-amz-security-token", "dummy")
+            .body("0;chunk-signature=00\r\n\r\n")
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(r.status(), 200);
+        let (auth, _, headers) = seen.lock().unwrap().clone();
+        assert_eq!(auth, "Bearer vkt_job");
+        assert_eq!(headers.get_all("authorization").iter().count(), 1);
+        assert!(!headers.contains_key("x-amz-security-token"));
+        assert_eq!(
+            headers["x-amz-content-sha256"],
+            "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
+        );
+        for (method, target) in [("PROPFIND", "/s3/b/k"), ("PATCH", "/s3/b"), ("COPY", "/s3")] {
+            let (status, _, path) = status_and_auth(proxy, method, target, &seen).await;
+            assert_eq!(status, 405, "{method} {target}");
+            assert_eq!(path, "", "{method} {target} must not be forwarded");
+        }
+        let node = spawn_blocking(basic_cfg(up_addr)).unwrap();
+        let deny = spawn_blocking(ProxyCfg::for_job(&registry(up_addr), None).unwrap()).unwrap();
+        for proxy in [node, deny] {
+            for target in ["/s3", "/s3/b/k"] {
+                let (status, _, path) = status_and_auth(proxy, "GET", target, &seen).await;
+                assert_eq!(status, 403, "{target}");
+                assert_eq!(path, "", "{target} must not be forwarded");
+            }
+        }
+    }
+
+    /// `/s3/job/<alias>/<key…>` is the key below the area's prefix; `/s3/job/<alias>` alone is
+    /// the area as a bucket, its listings kept to the area by their query; anything else
+    /// under `job/` is refused unforwarded.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn a_job_reaches_s3_areas_by_alias() {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let (up_addr, seen) = fake_upstream();
+        let cfg = ProxyCfg::for_job(&registry(up_addr), Some("vkt_job"))
+            .unwrap()
+            .with_areas(&s3_areas());
+        let proxy = spawn_blocking(cfg).unwrap();
+        for (method, target, want) in [
+            ("GET", "/s3/job/one/a/b", "/s3/solo/a/b"),
+            (
+                "PUT",
+                "/s3/job/two/.sccache_check",
+                "/s3/duo/b/.sccache_check",
+            ),
+            (
+                "PUT",
+                "/s3/job/three/k?partNumber=1&uploadId=u",
+                "/s3/tri/b/c/k?partNumber=1&uploadId=u",
+            ),
+            ("GET", "/s3/job/one", "/s3/solo"),
+            (
+                "GET",
+                "/s3/job/one/?list-type=2&prefix=a",
+                "/s3/solo?list-type=2&prefix=a",
+            ),
+            ("PUT", "/s3/job/one", "/s3/solo"),
+            ("DELETE", "/s3/job/one/", "/s3/solo"),
+            ("POST", "/s3/job/one?delete", "/s3/solo?delete"),
+            ("GET", "/s3/job/two", "/s3/duo?prefix=b%2F"),
+            ("GET", "/s3/job/three", "/s3/tri?prefix=b%2Fc%2F"),
+            ("GET", "/s3/job/three/", "/s3/tri?prefix=b%2Fc%2F"),
+            (
+                "GET",
+                "/s3/job/three?list-type=2&prefix=d/&delimiter=/&start-after=d/a",
+                "/s3/tri?list-type=2&prefix=b%2Fc%2Fd/&delimiter=/&start-after=b%2Fc%2Fd/a",
+            ),
+            (
+                "GET",
+                "/s3/job/three?marker=k",
+                "/s3/tri?marker=b%2Fc%2Fk&prefix=b%2Fc%2F",
+            ),
+            (
+                "GET",
+                "/s3/job/three?uploads&key-marker=k",
+                "/s3/tri?uploads&key-marker=b%2Fc%2Fk&prefix=b%2Fc%2F",
+            ),
+            ("GET", "/s3/job/three?location", "/s3/tri?location"),
+            ("HEAD", "/s3/job/three", "/s3/tri"),
+            ("GET", "/s3/jobs/k", "/s3/jobs/k"),
+            ("GET", "/s3/tri/b/c/k", "/s3/tri/b/c/k"),
+        ] {
+            let (status, auth, path) = status_and_auth(proxy, method, target, &seen).await;
+            assert_eq!(status, 200, "{method} {target}");
+            assert_eq!(auth, "Bearer vkt_job", "{method} {target}");
+            assert_eq!(path, want, "{method} {target}");
+        }
+        for (method, target) in [
+            ("GET", "/s3/job"),
+            ("GET", "/s3/job/"),
+            ("GET", "/s3/job?list-type=2&prefix=one/"),
+            ("GET", "/s3/job/other/k"),
+            ("PUT", "/s3/job/other"),
+            ("PUT", "/s3/job/three"),
+            ("DELETE", "/s3/job/two/"),
+            ("POST", "/s3/job/three?delete"),
+        ] {
+            let (status, _, path) = status_and_auth(proxy, method, target, &seen).await;
+            assert_eq!(status, 403, "{method} {target}");
+            assert_eq!(path, "", "{method} {target} must not be forwarded");
+        }
+    }
+
+    /// An S3 alias opens no way out either: `..` resolves before mapping and an encoded
+    /// separator is refused.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn an_s3_alias_does_not_escape_its_scope() {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let (up_addr, seen) = fake_upstream();
+        let cfg = ProxyCfg::for_job(&registry(up_addr), Some("vkt_job"))
+            .unwrap()
+            .with_areas(&s3_areas());
+        let proxy = spawn_blocking(cfg).unwrap();
+        for (target, status, want) in [
+            ("/s3/job/three/../../other", 200, "/s3/other"),
+            ("/s3/job/../", 200, "/s3/"),
+            ("/s3/job/three/../../../settings/keys", 403, ""),
+            ("/s3/job/three/%2e%2e/%2e%2e/%2e%2e/browse", 403, ""),
+            ("/s3/job/three/..%2F..%2F..%2Fv2", 403, ""),
+            ("/s3/job/three/..%5Cx", 403, ""),
+        ] {
+            *seen.lock().unwrap() = Seen::default();
+            assert_eq!(raw_status(proxy, "GET", target).await, status, "{target}");
+            assert_eq!(seen.lock().unwrap().1, want, "{target}");
+        }
+    }
+
+    /// A listing's keys and markers get the key prefix, a continuation token in the key it
+    /// names, and back again; a query that is not a listing's is kept.
+    #[test]
+    fn listing_queries_take_the_key_prefix() {
+        use vk_hub_proto::token::to_base64url;
+        let [_, _, three] = s3_areas();
+        let names = S3Names::new(&three);
+        assert_eq!(names.bucket, "tri");
+        assert_eq!(names.keys, "b/c/");
+        let token = to_base64url(b"d/k");
+        let real = to_base64url(b"b/c/d/k");
+        assert_eq!(
+            listing_query(
+                &names,
+                &format!("list-type=2&continuation-token={token}&max-keys=2")
+            ),
+            format!("list-type=2&continuation-token={real}&max-keys=2&prefix=b%2Fc%2F")
+        );
+        assert_eq!(
+            names.token_out(real.as_bytes()),
+            Some(token.clone().into_bytes())
+        );
+        assert_eq!(names.token_in(&token), real);
+        // One the registry did not give, or naming a key outside the area, is kept.
+        assert_eq!(names.token_in("!!"), "!!");
+        assert_eq!(names.token_in(""), "");
+        assert_eq!(names.token_out(to_base64url(b"x/k").as_bytes()), None);
+        assert_eq!(names.token_out(b"!!"), None);
+        assert_eq!(
+            listing_query(&names, "prefix&start-after"),
+            "prefix=b%2Fc%2F&start-after=b%2Fc%2F"
+        );
+        for kept in [
+            "versioning",
+            "acl",
+            "list-type=2&tagging",
+            "uploads&list-type=2",
+        ] {
+            assert_eq!(listing_query(&names, kept), kept);
+        }
+        // A one-component prefix is the bucket alone.
+        let one = S3Names::new(&area("one", "solo"));
+        assert_eq!((one.bucket.as_str(), one.keys.as_str()), ("solo", ""));
+    }
+
+    /// A copy's source names its area as a path does, escaped or not.
+    #[test]
+    fn copy_sources_map_their_alias() {
+        let areas = s3_areas();
+        for (source, want) in [
+            ("/job/three/k", "/tri/b/c/k"),
+            ("job/two/a/k", "/duo/b/a/k"),
+            ("job%2Fone%2Fk", "/solo/k"),
+            ("%2Fjob%2Fthree%2Fk", "/tri/b/c/k"),
+        ] {
+            assert_eq!(
+                map_copy_source(&areas, source),
+                Ok(Some(want.to_string())),
+                "{source}"
+            );
+        }
+        assert_eq!(map_copy_source(&areas, "/b/k"), Ok(None));
+        assert_eq!(map_copy_source(&areas, "jobs/k"), Ok(None));
+        assert_eq!(map_copy_source(&areas, "/job/other/k"), Err(()));
+        assert_eq!(map_copy_source(&areas, "job"), Err(()));
+    }
+
+    /// An S3 document's names in the area go back to the alias, wherever the chunks split; a
+    /// key outside the area, and other elements, are left alone.
+    #[test]
+    fn s3_documents_map_back_to_the_alias() {
+        use vk_hub_proto::token::to_base64url;
+        let (tok_in, tok_out) = (to_base64url(b"b/c/d/"), to_base64url(b"d/"));
+        let body = format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><ListBucketResult xmlns=\"x\">\
+             <Name>tri</Name><Prefix>b/c/</Prefix><MaxKeys>2</MaxKeys><Delimiter>/</Delimiter>\
+             <IsTruncated>true</IsTruncated><ContinuationToken>{tok_in}</ContinuationToken>\
+             <NextContinuationToken>{tok_in}</NextContinuationToken>\
+             <StartAfter>b/c/a</StartAfter>\
+             <Contents><Key>b/c/a&amp;b</Key><Size>1</Size></Contents>\
+             <Contents><Key>b/cd/x</Key><Size>2</Size></Contents>\
+             <CommonPrefixes><Prefix>b/c/d/</Prefix></CommonPrefixes>\
+             <Key></Key><Marker>b/c/</Marker><Bucket>tri</Bucket><Bucket>trio</Bucket>\
+             <Resource>/s3/tri/b/c/k</Resource><Location>/s3/tri</Location>\
+             <Location>/s3/trio</Location><Contents ><Key/></ListBucketResult>"
+        );
+        let want = format!(
+            "<?xml version=\"1.0\" encoding=\"UTF-8\"?><ListBucketResult xmlns=\"x\">\
+             <Name>three</Name><Prefix></Prefix><MaxKeys>2</MaxKeys><Delimiter>/</Delimiter>\
+             <IsTruncated>true</IsTruncated><ContinuationToken>{tok_out}</ContinuationToken>\
+             <NextContinuationToken>{tok_out}</NextContinuationToken>\
+             <StartAfter>a</StartAfter>\
+             <Contents><Key>a&amp;b</Key><Size>1</Size></Contents>\
+             <Contents><Key>b/cd/x</Key><Size>2</Size></Contents>\
+             <CommonPrefixes><Prefix>d/</Prefix></CommonPrefixes>\
+             <Key></Key><Marker></Marker><Bucket>three</Bucket><Bucket>trio</Bucket>\
+             <Resource>/s3/job/three/k</Resource><Location>/s3/job/three</Location>\
+             <Location>/s3/trio</Location><Contents ><Key/></ListBucketResult>"
+        );
+        let names = S3Names::new(&area("three", "tri/b/c"));
+        for size in [1, 2, 3, 7, 25, body.len()] {
+            let mut map = S3Map::new(names.clone());
+            let mut out = Vec::new();
+            for chunk in body.as_bytes().chunks(size) {
+                out.extend_from_slice(&map.push(chunk));
+                assert!(map.carry.len() <= MAX_ELEMENT + size, "chunks of {size}");
+            }
+            out.extend_from_slice(&map.finish());
+            assert_eq!(String::from_utf8(out).unwrap(), want, "chunks of {size}");
+        }
+        // An element past the bound streams on unmapped rather than waiting.
+        let long = format!("<Key>b/c/{}", "x".repeat(MAX_ELEMENT));
+        let mut map = S3Map::new(names);
+        let mut out = map.push(long.as_bytes()).to_vec();
+        assert!(map.carry.is_empty());
+        out.extend_from_slice(&map.push(b"</Key>"));
+        out.extend_from_slice(&map.finish());
+        assert_eq!(out, format!("{long}</Key>").into_bytes());
+    }
+
+    /// An S3 document reached through an area, and a bucket's `Location`, come back under the
+    /// alias; an object's bytes, and an answer reached by the real path, are left alone.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn only_an_s3_document_through_the_alias_is_mapped_back() {
+        const LISTING: &str = "<ListBucketResult><Name>tri</Name><Prefix>b/c/</Prefix>\
+                               <Contents><Key>b/c/k</Key></Contents></ListBucketResult>";
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let start = |content_type: &'static str| {
+            let (up_addr, _) = fake_upstream_answering(
+                LISTING.as_bytes(),
+                if content_type == "application/xml" {
+                    &[("content-type", "application/xml"), ("location", "/s3/tri")]
+                } else {
+                    &[
+                        ("content-type", "application/octet-stream"),
+                        ("location", "/s3/tri"),
+                    ]
+                },
+            );
+            let cfg = ProxyCfg::for_job(&registry(up_addr), Some("vkt_job"))
+                .unwrap()
+                .with_areas(&s3_areas());
+            spawn_blocking(cfg).unwrap()
+        };
+        let get = |proxy: SocketAddr, target: &'static str| async move {
+            let r = reqwest::Client::new()
+                .get(format!("http://{proxy}{target}"))
+                .send()
+                .await
+                .unwrap();
+            let location = r.headers()["location"].to_str().unwrap().to_string();
+            (location, r.text().await.unwrap())
+        };
+        let xml = start("application/xml");
+        assert_eq!(
+            get(xml, "/s3/job/three?list-type=2").await,
+            (
+                "/s3/job/three".to_string(),
+                "<ListBucketResult><Name>three</Name><Prefix></Prefix>\
+                 <Contents><Key>k</Key></Contents></ListBucketResult>"
+                    .to_string()
+            )
+        );
+        assert_eq!(
+            get(xml, "/s3/tri?list-type=2").await,
+            ("/s3/tri".to_string(), LISTING.to_string())
+        );
+        let bytes = start("application/octet-stream");
+        assert_eq!(
+            get(bytes, "/s3/job/three/k").await,
+            ("/s3/job/three".to_string(), LISTING.to_string())
+        );
+    }
+
     /// A job meant to have a token and given none gets a proxy that lends nothing.
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn a_job_without_a_token_gets_nothing() {
@@ -1489,6 +2227,11 @@ mod tests {
             "/lock/acquire?name=p:k",
             "/dav/files/p/x",
             "/v2/p/tags/list",
+            "/s3",
+            "/s3?x-id=ListBuckets",
+            "/s3/",
+            "/s3/b/k",
+            "/s3/job/../b",
         ] {
             assert!(ok(fine).is_some(), "{fine}");
         }
@@ -1499,9 +2242,17 @@ mod tests {
             "/dav/files/../../x",
             "/dav/files/../repos/x",
             "/lock/%2e%2e/browse",
+            "/s3x",
+            "/s3../x",
+            "/s3/../settings/keys",
+            "/s3/%2e%2e/browse",
+            "/s3/b/..%2f..%2fv2",
+            "/s3/job/%2e%2e/%2e%2e/dav/repos",
         ] {
             assert_eq!(ok(escape), None, "{escape}");
         }
+        // Nor the node's credential the S3 view.
+        assert_eq!(upstream_url(&up, "/s3/b/k"), None);
     }
 
     #[test]
@@ -1832,6 +2583,12 @@ mod tests {
         assert!(repeatable(&put, "/v2/app/manifests/latest"));
         assert!(repeatable(&put, "/v2/team/app/manifests/sha256:ab"));
         assert!(repeatable(&put, "/dav/files/p/x"));
+        assert!(repeatable(&put, "/s3/b/k"));
+        assert!(repeatable(&get, "/s3/b"));
+        assert!(!repeatable(&put, "/s3/b"));
+        assert!(!repeatable(&put, "/s3/b/"));
+        assert!(!repeatable(&post, "/s3/b/k?uploadId=u"));
+        assert!(!repeatable(&Method::DELETE, "/s3/b/k"));
         assert!(repeatable(&post, "/v2/app/blobs/uploads/"));
         assert!(!repeatable(&put, "/v2/app/blobs/uploads/u1"));
         assert!(!repeatable(&Method::PATCH, "/v2/app/blobs/uploads/u1"));
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index f8149c80..1dc7658d 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -991,9 +991,25 @@ layers. The feature is opt-in and requires guest networking.
 The runner's credential is not scoped, so the proxy lends it for `/v2/` only. Under
 `[registry] guest_credential = "job"` it lends a hub-placed job's own token instead, whose
 grants this registry enforces ([Hub tokens](#hub-tokens)), and forwards `/lock/` and
-`/dav/files/` too; under `/dav/files/` only GET, HEAD, PROPFIND, PUT, MKCOL, DELETE and
-OPTIONS pass, MOVE and COPY naming the proxy in their `Destination`. A job without a token,
-a gitlab-runner job included, gets a proxy that refuses everything.
+`/dav/files/` and the S3 view (`/s3`) too; under `/dav/files/` only GET, HEAD, PROPFIND, PUT,
+MKCOL, DELETE and OPTIONS pass, MOVE and COPY naming the proxy in their `Destination`, and
+under `/s3` GET, HEAD, PUT, POST, DELETE and OPTIONS. A job without a token, a gitlab-runner
+job included, gets a proxy that refuses everything.
+
+On `/s3/`, the proxy replaces the guest's `Authorization` — SigV4 with dummy keys, or none —
+with the job's token, so the guest holds no key, and drops `x-amz-security-token`. An
+`aws-chunked` body passes as sent: authenticated by a bearer, its framing is decoded and its
+chunk signatures are not checked (see `aws-chunked` bodies above). The job's areas map as on
+`/dav/files/`: `/s3/job/<alias>/<key…>` is the key below the area's prefix, so for the prefix
+`a/b/c`, bucket `a` and key `b/c/<key…>`, and a copy's `x-amz-copy-source: /job/<alias>/<key>`
+likewise. `/s3/job/<alias>` alone is the area as a bucket: the real bucket `a`, whose listings
+(`ListObjects`, `ListObjectsV2`, `ListMultipartUploads`) are given the key prefix `b/c/`
+before their `prefix`, `start-after`, `marker` and `key-marker` and inside their
+`continuation-token`, a `prefix` when they name none; an area below its bucket takes only
+reads there, since creating, deleting or batch-deleting its bucket would act on all of `a`.
+The documents answering a request through an area name it back: the bucket as `<alias>`, keys,
+prefixes, markers and continuation tokens without `b/c/` (a key outside the area as it is),
+and the paths in `Location` and `Resource` as `/s3/job/<alias>/…`.
 
 ## Connection limits
 

From c512a9c8af1b415396daaac538fdb59fe03b4b99 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:01:18 +0100
Subject: [PATCH 17/54] vk-driver/regproxy: keep the length on a HEAD answer

The proxy now keeps an answer's Content-Length whenever the body is
passed on as it came, and never maps a HEAD's body; only a rewritten
document loses it. The length was dropped with the request's, so a HEAD
reached the guest without the object's size, which the AWS CLI reads
before a download.
---
 vk-driver/src/regproxy.rs | 61 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 59 insertions(+), 2 deletions(-)

diff --git a/vk-driver/src/regproxy.rs b/vk-driver/src/regproxy.rs
index c8002614..856a3d4e 100644
--- a/vk-driver/src/regproxy.rs
+++ b/vk-driver/src/regproxy.rs
@@ -857,7 +857,8 @@ where
 }
 
 /// Headers that must not be copied across the proxy (connection-scoped, credential-bearing,
-/// or ones we set ourselves).
+/// or ones we set ourselves). An answer's `content-length` is kept when its body is not
+/// rewritten ([`forward`]).
 fn is_skipped(name: &str) -> bool {
     matches!(
         name,
@@ -997,11 +998,16 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
     let xml = headers_out
         .get(hyper::header::CONTENT_TYPE)
         .is_some_and(|v| v.as_bytes().starts_with(b"application/xml"));
+    // A HEAD answer has no body to map, and its length is what a GET would send: an object's.
     let body_map: Option<Box<dyn BodyMap + Send>> = match (hrefs, &s3_names) {
+        _ if method == Method::HEAD => None,
         (Some(map), _) => Some(Box::new(map)),
         (None, Some(names)) if xml => Some(Box::new(S3Map::new(names.clone()))),
         _ => None,
     };
+    // A rewritten body's length is not the upstream's; any other is the upstream's bytes,
+    // whole or resumed, so its length holds.
+    let rewritten = body_map.is_some();
     // stream the upstream response back without buffering (blob pulls).
     let stream = resp.bytes_stream();
     let body = match (body_map, resume) {
@@ -1053,7 +1059,8 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
 
     let mut out = Response::builder().status(status);
     for (k, v) in headers_out.iter() {
-        if is_skipped(&k.as_str().to_ascii_lowercase()) {
+        let keep_length = k == hyper::header::CONTENT_LENGTH && !rewritten;
+        if is_skipped(&k.as_str().to_ascii_lowercase()) && !keep_length {
             continue;
         }
         // A bucket created through an area is located at the alias.
@@ -2174,6 +2181,56 @@ mod tests {
         );
     }
 
+    /// An answer whose body is passed on as it came keeps its length, a HEAD's included, which
+    /// is how a client learns an object's size; a rewritten document drops the stale one.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn an_answer_keeps_its_length_unless_rewritten() {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+        let (up_addr, _) = fake_upstream_answering(
+            b"<ListBucketResult><Name>tri</Name></ListBucketResult>",
+            &[
+                ("content-type", "application/xml"),
+                ("accept-ranges", "bytes"),
+                ("content-range", "bytes 0-52/100"),
+            ],
+        );
+        let cfg = ProxyCfg::for_job(&registry(up_addr), Some("vkt_job"))
+            .unwrap()
+            .with_areas(&s3_areas());
+        let proxy = spawn_blocking(cfg).unwrap();
+        let client = reqwest::Client::new();
+        for (method, target) in [
+            (reqwest::Method::HEAD, "/s3/tri/b/c/k"),
+            (reqwest::Method::GET, "/s3/tri/b/c/k"),
+            (reqwest::Method::HEAD, "/s3/job/three/k"),
+            (reqwest::Method::HEAD, "/s3/job/three"),
+        ] {
+            let r = client
+                .request(method.clone(), format!("http://{proxy}{target}"))
+                .send()
+                .await
+                .unwrap();
+            let h = r.headers();
+            assert_eq!(h.get("content-length").unwrap(), "53", "{method} {target}");
+            assert_eq!(
+                h.get("accept-ranges").unwrap(),
+                "bytes",
+                "{method} {target}"
+            );
+            assert_eq!(h.get("content-range").unwrap(), "bytes 0-52/100");
+        }
+        let r = client
+            .get(format!("http://{proxy}/s3/job/three?list-type=2"))
+            .send()
+            .await
+            .unwrap();
+        assert!(!r.headers().contains_key("content-length"));
+        assert_eq!(
+            r.text().await.unwrap(),
+            "<ListBucketResult><Name>three</Name></ListBucketResult>"
+        );
+    }
+
     /// A job meant to have a token and given none gets a proxy that lends nothing.
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn a_job_without_a_token_gets_nothing() {

From c418c7048de2dfe53502a889d78bc99a1b71467a Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:07:01 +0100
Subject: [PATCH 18/54] vk-driver/regproxy: refuse a listing the alias cannot
 confine

A bucket GET through an area below its bucket is now refused when its
query names a listing parameter with any other, as is a delimiter on
?uploads, and parameter names are compared decoded, as the registry
takes them; a configuration's query is still kept. Such a query was
kept as sent, so a listing with an extra parameter reached the real
bucket without the area's key prefix.
---
 vk-driver/src/regproxy.rs | 63 +++++++++++++++++++++++++++++----------
 1 file changed, 48 insertions(+), 15 deletions(-)

diff --git a/vk-driver/src/regproxy.rs b/vk-driver/src/regproxy.rs
index 856a3d4e..f57d8759 100644
--- a/vk-driver/src/regproxy.rs
+++ b/vk-driver/src/regproxy.rs
@@ -444,7 +444,14 @@ fn map_s3<'a>(areas: &'a [Area], method: &Method, rest: &str, query: Option<&str
                 b"registry proxy: an area below its bucket takes reads only, not bucket writes",
             );
         }
-        _ if *method == Method::GET => Some(listing_query(&names, query.unwrap_or_default())),
+        _ if *method == Method::GET => match listing_query(&names, query.unwrap_or_default()) {
+            Some(query) => Some(query),
+            None => {
+                return Mapped::Refused(
+                    b"registry proxy: a listing through an area takes only a listing's parameters",
+                );
+            }
+        },
         _ => query.map(str::to_string),
     };
     let query = query
@@ -455,7 +462,8 @@ fn map_s3<'a>(areas: &'a [Area], method: &Method, rest: &str, query: Option<&str
 }
 
 /// The parameters a bucket listing takes, of either version, and a listing of its multipart
-/// uploads; an SDK's `x-id` hint too. A query naming another is not a listing.
+/// uploads, without a `delimiter`, which the registry does not serve there; an SDK's `x-id`
+/// hint too.
 const LISTING_PARAMS: &[&str] = &[
     "list-type",
     "prefix",
@@ -471,7 +479,6 @@ const LISTING_PARAMS: &[&str] = &[
 const UPLOADS_PARAMS: &[&str] = &[
     "uploads",
     "prefix",
-    "delimiter",
     "key-marker",
     "upload-id-marker",
     "max-uploads",
@@ -482,16 +489,22 @@ const UPLOADS_PARAMS: &[&str] = &[
 /// A bucket `GET`'s query through an area below its bucket: a listing's keys are the area's,
 /// so the key prefix goes before each `prefix`, `start-after`, `marker` and `key-marker`, and
 /// into the key a `continuation-token` names; a `prefix` is added when none is given, so the
-/// listing stays in the area. Any other query, a configuration's, is kept as sent.
-fn listing_query(names: &S3Names, query: &str) -> String {
-    let name = |p: &str| p.split_once('=').map_or(p, |(n, _)| n).to_string();
+/// listing stays in the area. A query naming no listing parameter, a configuration's, is
+/// kept as sent. `None` for one naming a listing's parameters with others, which the prefix
+/// could not be trusted to confine. Names are compared decoded, as the registry takes them.
+fn listing_query(names: &S3Names, query: &str) -> Option<String> {
+    let name = |p: &str| vk_registry::percent_decode(p.split_once('=').map_or(p, |(n, _)| n));
     let pairs: Vec<&str> = query.split('&').filter(|p| !p.is_empty()).collect();
     let known = match pairs.iter().any(|p| name(p) == "uploads") {
         true => UPLOADS_PARAMS,
         false => LISTING_PARAMS,
     };
+    let listing = |n: &str| n != "x-id" && (LISTING_PARAMS.contains(&n) || n == "uploads");
     if !pairs.iter().all(|p| known.contains(&name(p).as_str())) {
-        return query.to_string();
+        return match pairs.iter().any(|p| listing(&name(p))) {
+            true => None,
+            false => Some(query.to_string()),
+        };
     }
     // A prefix is lowercase alphanumerics and `._-/`, so encoding escapes the `/` alone.
     let keys = vk_registry::percent_encode(&names.keys);
@@ -509,7 +522,7 @@ fn listing_query(names: &S3Names, query: &str) -> String {
     if !pairs.iter().any(|p| name(p) == "prefix") {
         out.push(format!("prefix={keys}"));
     }
-    out.join("&")
+    Some(out.join("&"))
 }
 
 /// An `x-amz-copy-source` under the job's areas: `[/]job/<alias>/<key…>`, escaped as a whole
@@ -1976,6 +1989,9 @@ mod tests {
             ("PUT", "/s3/job/three"),
             ("DELETE", "/s3/job/two/"),
             ("POST", "/s3/job/three?delete"),
+            ("GET", "/s3/job/three?list-type=2&x=1"),
+            ("GET", "/s3/job/two?uploads&delimiter=/"),
+            ("GET", "/s3/job/two?prefix=a&acl"),
         ] {
             let (status, _, path) = status_and_auth(proxy, method, target, &seen).await;
             assert_eq!(status, 403, "{method} {target}");
@@ -2023,7 +2039,9 @@ mod tests {
                 &names,
                 &format!("list-type=2&continuation-token={token}&max-keys=2")
             ),
-            format!("list-type=2&continuation-token={real}&max-keys=2&prefix=b%2Fc%2F")
+            Some(format!(
+                "list-type=2&continuation-token={real}&max-keys=2&prefix=b%2Fc%2F"
+            ))
         );
         assert_eq!(
             names.token_out(real.as_bytes()),
@@ -2036,16 +2054,31 @@ mod tests {
         assert_eq!(names.token_out(to_base64url(b"x/k").as_bytes()), None);
         assert_eq!(names.token_out(b"!!"), None);
         assert_eq!(
-            listing_query(&names, "prefix&start-after"),
-            "prefix=b%2Fc%2F&start-after=b%2Fc%2F"
+            listing_query(&names, "prefix&start-after").as_deref(),
+            Some("prefix=b%2Fc%2F&start-after=b%2Fc%2F")
         );
-        for kept in [
-            "versioning",
-            "acl",
+        // A name is taken decoded, as the registry takes it.
+        assert_eq!(
+            listing_query(&names, "list-type=2&prefi%78=d/").as_deref(),
+            Some("list-type=2&prefix=b%2Fc%2Fd/")
+        );
+        assert_eq!(
+            listing_query(&names, "upload%73").as_deref(),
+            Some("upload%73&prefix=b%2Fc%2F")
+        );
+        // A configuration's query is kept; a listing's with anything else is refused.
+        for kept in ["versioning", "acl", "acl&x-id=GetBucketAcl"] {
+            assert_eq!(listing_query(&names, kept).as_deref(), Some(kept));
+        }
+        for refused in [
             "list-type=2&tagging",
             "uploads&list-type=2",
+            "uploads&delimiter=/",
+            "prefix=a&acl",
+            "list-type=2&x",
+            "list-type=2&%78",
         ] {
-            assert_eq!(listing_query(&names, kept), kept);
+            assert_eq!(listing_query(&names, refused), None, "{refused}");
         }
         // A one-component prefix is the bucket alone.
         let one = S3Names::new(&area("one", "solo"));

From 012d48aa81623a1a34fcecc4f6377172e2d646eb Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:09:09 +0100
Subject: [PATCH 19/54] vk-driver/regproxy: do not repeat a conditional PUT

A PUT under If-Match, If-None-Match, If-Unmodified-Since or a copy
source's x-amz-copy-source-if-* is sent once: repeated after a write
that reached the registry, it would fail its own precondition and answer
412 for a write that succeeded.
---
 vk-driver/src/regproxy.rs | 88 ++++++++++++++++++++++++++++-----------
 1 file changed, 64 insertions(+), 24 deletions(-)

diff --git a/vk-driver/src/regproxy.rs b/vk-driver/src/regproxy.rs
index f57d8759..575c8818 100644
--- a/vk-driver/src/regproxy.rs
+++ b/vk-driver/src/regproxy.rs
@@ -968,7 +968,7 @@ async fn forward(req: Request<Incoming>, cfg: &ProxyCfg) -> Result<Response<Prox
             Err(()) => return Ok(forbidden(NO_SUCH_AREA)),
         }
     }
-    let sent = match (repeatable(&method, path), bodyful) {
+    let sent = match (repeatable(&method, path, &parts.headers), bodyful) {
         (true, false) => Outgoing::Whole(Bytes::new()),
         (true, true) => held(incoming, MAX_HELD).await?,
         (false, false) => Outgoing::Once(None),
@@ -1102,14 +1102,25 @@ enum Outgoing {
 /// a refused connection, a connection cut before the response, or a 503/429.
 /// Repeating it must have the same effect even if the first request reached the registry:
 /// reads, manifest PUTs by tag or digest, whole-file PUTs, S3 PUTs of an object, a part or a
-/// copy, and upload starts (which leave the first upload unused). Excludes upload chunks (`PATCH`), upload completion (`PUT`
-/// under `blobs/uploads/`, whose upload is then gone), deletions, collection creation,
-/// and all `/lock/` requests regardless of method. A retried PUT lands last, like a
-/// later PUT from another writer.
-fn repeatable(method: &Method, path: &str) -> bool {
+/// copy, and upload starts (which leave the first upload unused). A retried PUT lands last,
+/// like a later PUT from another writer. Excludes upload chunks (`PATCH`), upload completion
+/// (`PUT` under `blobs/uploads/`, whose upload is then gone), deletions, collection
+/// creation, a PUT under a precondition (`If-Match`, `If-None-Match`, `If-Unmodified-Since`
+/// or a copy source's `x-amz-copy-source-if-*`), which its own first write would fail
+/// again, and all `/lock/` requests regardless of method.
+fn repeatable(method: &Method, path: &str, headers: &hyper::HeaderMap) -> bool {
     if path.starts_with("/lock/") {
         return false;
     }
+    let conditional = headers.keys().any(|k| {
+        matches!(
+            k.as_str(),
+            "if-match" | "if-none-match" | "if-unmodified-since"
+        ) || k.as_str().starts_with("x-amz-copy-source-if-")
+    });
+    if *method == Method::PUT && conditional {
+        return false;
+    }
     let oci = path.strip_prefix("/v2/");
     match method.as_str() {
         "GET" | "HEAD" | "OPTIONS" | "PROPFIND" => true,
@@ -2668,27 +2679,56 @@ mod tests {
         let get = Method::GET;
         let put = Method::PUT;
         let post = Method::POST;
-        assert!(repeatable(&get, "/v2/app/blobs/sha256:ab"));
-        assert!(repeatable(&Method::HEAD, "/v2/app/manifests/latest"));
-        assert!(repeatable(&put, "/v2/app/manifests/latest"));
-        assert!(repeatable(&put, "/v2/team/app/manifests/sha256:ab"));
-        assert!(repeatable(&put, "/dav/files/p/x"));
-        assert!(repeatable(&put, "/s3/b/k"));
-        assert!(repeatable(&get, "/s3/b"));
-        assert!(!repeatable(&put, "/s3/b"));
-        assert!(!repeatable(&put, "/s3/b/"));
-        assert!(!repeatable(&post, "/s3/b/k?uploadId=u"));
-        assert!(!repeatable(&Method::DELETE, "/s3/b/k"));
-        assert!(repeatable(&post, "/v2/app/blobs/uploads/"));
-        assert!(!repeatable(&put, "/v2/app/blobs/uploads/u1"));
-        assert!(!repeatable(&Method::PATCH, "/v2/app/blobs/uploads/u1"));
-        assert!(!repeatable(&Method::DELETE, "/v2/app/manifests/sha256:ab"));
-        assert!(!repeatable(&post, "/lock/acquire"));
-        assert!(!repeatable(&get, "/lock/acquire"));
+        let none = hyper::HeaderMap::new();
+        assert!(repeatable(&get, "/v2/app/blobs/sha256:ab", &none));
+        assert!(repeatable(&Method::HEAD, "/v2/app/manifests/latest", &none));
+        assert!(repeatable(&put, "/v2/app/manifests/latest", &none));
+        assert!(repeatable(&put, "/v2/team/app/manifests/sha256:ab", &none));
+        assert!(repeatable(&put, "/dav/files/p/x", &none));
+        assert!(repeatable(&put, "/s3/b/k", &none));
+        assert!(repeatable(&get, "/s3/b", &none));
+        assert!(!repeatable(&put, "/s3/b", &none));
+        assert!(!repeatable(&put, "/s3/b/", &none));
+        assert!(!repeatable(&post, "/s3/b/k?uploadId=u", &none));
+        assert!(!repeatable(&Method::DELETE, "/s3/b/k", &none));
+        assert!(repeatable(&post, "/v2/app/blobs/uploads/", &none));
+        assert!(!repeatable(&put, "/v2/app/blobs/uploads/u1", &none));
+        assert!(!repeatable(
+            &Method::PATCH,
+            "/v2/app/blobs/uploads/u1",
+            &none
+        ));
+        assert!(!repeatable(
+            &Method::DELETE,
+            "/v2/app/manifests/sha256:ab",
+            &none
+        ));
+        assert!(!repeatable(&post, "/lock/acquire", &none));
+        assert!(!repeatable(&get, "/lock/acquire", &none));
         assert!(!repeatable(
             &Method::from_bytes(b"MKCOL").unwrap(),
-            "/dav/files/p/x"
+            "/dav/files/p/x",
+            &none
         ));
+        // A write under a precondition its first attempt may have spent is sent once.
+        for name in [
+            "if-none-match",
+            "if-match",
+            "if-unmodified-since",
+            "x-amz-copy-source-if-match",
+            "x-amz-copy-source-if-none-match",
+            "x-amz-copy-source-if-modified-since",
+            "x-amz-copy-source-if-unmodified-since",
+        ] {
+            let mut conditional = hyper::HeaderMap::new();
+            conditional.insert(
+                hyper::header::HeaderName::from_static(name),
+                hyper::header::HeaderValue::from_static("*"),
+            );
+            assert!(!repeatable(&put, "/s3/b/k", &conditional), "{name}");
+            assert!(!repeatable(&put, "/dav/files/p/x", &conditional), "{name}");
+            assert!(repeatable(&get, "/s3/b/k", &conditional), "{name}");
+        }
         assert!(digest_addressed("/v2/app/blobs/sha256:ab"));
         assert!(digest_addressed("/v2/team/app/manifests/sha256:ab"));
         assert!(!digest_addressed("/v2/app/manifests/latest"));

From 7b7135545f09f69b157919fc08942847afc12d53 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:11:26 +0100
Subject: [PATCH 20/54] vk-registry/s3: let a write-only grant delete

Writing a key's repository is now what deletes it: a caller that may
write but not read the repository deletes, and one that may do neither
still finds the key absent. On a write-only grant the object was taken
for absent, so DeleteObject answered 204 and DeleteObjects <Deleted>
while it stayed.
---
 vk-registry/DESIGN.md        |  2 +-
 vk-registry/src/s3/object.rs | 13 +++++++-----
 vk-registry/tests/s3_e2e.rs  | 38 ++++++++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 1dc7658d..9856f82e 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -663,7 +663,7 @@ reads; a replaced object keeps only what its own write sent.
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
-| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it |
+| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 542dd500..dbd84bb1 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -911,19 +911,22 @@ pub(super) enum Deleted {
 }
 
 /// Delete the object at `segs` for this caller, the namespace held (`_namespace`): a key
-/// that is a directory holds no object to delete, and one the caller may not read is absent.
+/// that is a directory holds no object to delete. Writing the repository it is in is what
+/// deletes it, reading it or not; one the caller may neither read nor write is absent.
 pub(super) fn delete_one(
     store: &Store,
     _namespace: &files::Namespace,
     authz: &Authz<'_>,
     segs: &[String],
 ) -> Result<Deleted> {
-    let node = match files::resolve(store, segs)? {
-        Some(node) if allowed(authz, accounts::Action::Read, node.repo()) => node,
-        _ => return Ok(Deleted::Gone),
+    let Some(node) = files::resolve(store, segs)? else {
+        return Ok(Deleted::Gone);
     };
     if !allowed(authz, accounts::Action::Write, node.repo()) {
-        return Ok(Deleted::Denied);
+        return Ok(match allowed(authz, accounts::Action::Read, node.repo()) {
+            true => Deleted::Denied,
+            false => Deleted::Gone,
+        });
     }
     match node {
         Node::Object(obj) => {
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 2a96b230..a674c4f9 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2390,6 +2390,44 @@ async fn a_hub_token_writes_and_reads_below_its_grant() {
     )
     .await
     .is(403, "AccessDenied");
+    // A grant to write and not read deletes, one key or a batch; nothing beyond it.
+    let mut claims = hub_claims(AUD, now - 1, now + 600);
+    claims.grants[0].read = false;
+    let writer = signer.sign(claims).unwrap();
+    let as_writer = |r: Req| r.signed(&host, (&writer, &writer), 0);
+    send(&host, as_writer(Req::new("GET", "/s3/p/gl/42/k")))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, as_writer(Req::new("DELETE", "/s3/p/gl/42/k")))
+        .await
+        .ok(204);
+    send(&host, as_token(Req::new("GET", "/s3/p/gl/42/k")))
+        .await
+        .is(404, "NoSuchKey");
+    send(
+        &host,
+        as_token(Req::new("PUT", "/s3/p/gl/42/b").body(HELLO.to_vec())),
+    )
+    .await
+    .ok(200);
+    let (deleted, errors) = delete_result(
+        &send(
+            &host,
+            as_writer(delete_objects(
+                "p",
+                delete_doc(&[&key_of("gl/42/b"), &key_of("gl/43/k")], false),
+            )),
+        )
+        .await,
+    );
+    assert_eq!(deleted, ["gl/42/b"]);
+    assert_eq!(
+        errors,
+        [("gl/43/k".to_string(), "AccessDenied".to_string())]
+    );
+    send(&host, as_token(Req::new("GET", "/s3/p/gl/42/b")))
+        .await
+        .is(404, "NoSuchKey");
 }
 
 /// One object, three views: what S3 writes WebDAV and `/v2/` read, and the other way round.

From 802953b72477ca11bf91f6f5c040f29d2db49521 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:15:45 +0100
Subject: [PATCH 21/54] vk-registry/s3: require every x-amz header to be signed

A SigV4 request carrying an x-amz-* header its SignedHeaders leaves out
is refused with 403 AccessDenied naming it in HeadersNotSigned, as S3
refuses it: anything on the way could have added the header. The test
signer now signs every x-amz-* header a request carries, as SDKs do.
---
 vk-registry/DESIGN.md       |   5 +-
 vk-registry/src/s3/mod.rs   |  14 ++++-
 vk-registry/src/s3/sigv4.rs |  39 ++++++++++++
 vk-registry/tests/s3_e2e.rs | 121 +++++++++++++++++++++++-------------
 4 files changed, 133 insertions(+), 46 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 9856f82e..fe7ab589 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -605,7 +605,10 @@ access key id, since the credential scope is split from the right. The access ke
 authenticated first, exactly as the bearer it would be, so revocation, expiry and scopes
 apply unchanged, and only then is its secret used to check the signature; an unknown id is
 403 `InvalidAccessKeyId`, a wrong signature 403 `SignatureDoesNotMatch` (with the string to
-sign and canonical request, as AWS answers). The request's time must be on the scope's day
+sign and canonical request, as AWS answers). The signature must cover `host`, `x-amz-content-sha256`
+and, as S3 requires, every `x-amz-*` header the request carries: one left out is 403
+`AccessDenied` naming it in `HeadersNotSigned`, since anything on the way could have added
+it. The request's time must be on the scope's day
 and within 15 minutes of the server's (403 `RequestTimeTooSkewed`, naming the server's
 time). The usual `Authorization: Bearer|Basic` and the session cookie keep working on `/s3/`;
 a request with no credential on a server that requires one is S3's 403 `AccessDenied`, not
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index ad2f7388..1bf8d18a 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -479,8 +479,8 @@ fn resolve_failed(e: anyhow::Error, ctx: &Ctx) -> Box<Response<Body>> {
     Box::new(internal_error(ctx))
 }
 
-/// A request with a SigV4 header. In order: the header parses and names S3's scope; the
-/// request's time is on the scope's day and within [`sigv4::MAX_SKEW_SECS`] of the server's;
+/// A request with a SigV4 header. In order: the header parses, names S3's scope and signs
+/// every `x-amz-*` header the request carries; the request's time is on the scope's day and within [`sigv4::MAX_SKEW_SECS`] of the server's;
 /// the access key id is authenticated exactly as a bearer would be, by the resolvers the
 /// other routes use; only then is the secret it maps to used as a key, to check the
 /// signature. On a server with no credential configured, an id that is not a hub token is
@@ -504,6 +504,16 @@ fn signed_by(
     if let Some(why) = sigv4::s3_refusal(&credential) {
         return Err(malformed(why));
     }
+    if let Some(name) = sigv4::unsigned_amz_header(&credential, headers) {
+        return Err(Box::new(xml::error(
+            StatusCode::FORBIDDEN,
+            "AccessDenied",
+            "There were headers present in the request which were not signed",
+            &[("HeadersNotSigned", name)],
+            &ctx.path,
+            &ctx.id,
+        )));
+    }
 
     let now = vk_peer::now_secs();
     let stamp = headers
diff --git a/vk-registry/src/s3/sigv4.rs b/vk-registry/src/s3/sigv4.rs
index 3a72ebb6..cddcc905 100644
--- a/vk-registry/src/s3/sigv4.rs
+++ b/vk-registry/src/s3/sigv4.rs
@@ -146,6 +146,18 @@ pub(crate) fn s3_refusal(credential: &Credential<'_>) -> Option<&'static str> {
     None
 }
 
+/// The first `x-amz-*` header of `headers` the signature does not cover: S3 refuses a request
+/// carrying one, as anything on its way could have added it.
+pub(crate) fn unsigned_amz_header<'h>(
+    credential: &Credential<'_>,
+    headers: &'h HeaderMap,
+) -> Option<&'h str> {
+    headers
+        .keys()
+        .map(|name| name.as_str())
+        .find(|name| name.starts_with("x-amz-") && !credential.signed_headers.contains(name))
+}
+
 /// Why a request's time is refused.
 #[derive(Debug, PartialEq, Eq)]
 pub(crate) enum Clock {
@@ -809,6 +821,33 @@ mod tests {
         }
     }
 
+    #[test]
+    fn every_x_amz_header_is_signed() {
+        let header = authorization(
+            "id/20130524/us-east-1/s3/aws4_request",
+            "host;x-amz-content-sha256;x-amz-date;x-amz-meta-x",
+        );
+        let cred = parse_authorization(&header).unwrap();
+        let mut headers = HeaderMap::new();
+        for name in [
+            "x-amz-content-sha256",
+            "x-amz-date",
+            "x-amz-meta-x",
+            "range",
+        ] {
+            headers.insert(
+                hyper::header::HeaderName::from_static(name),
+                hyper::header::HeaderValue::from_static("v"),
+            );
+        }
+        assert_eq!(unsigned_amz_header(&cred, &headers), None);
+        headers.insert(
+            hyper::header::HeaderName::from_static("x-amz-meta-y"),
+            hyper::header::HeaderValue::from_static("v"),
+        );
+        assert_eq!(unsigned_amz_header(&cred, &headers), Some("x-amz-meta-y"));
+    }
+
     #[test]
     fn s3_requires_its_service_and_both_headers_signed() {
         let refusal = |credential: &str, signed: &str| {
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index a674c4f9..e76ae1af 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -361,22 +361,37 @@ impl Req {
     /// [`Req::signed`] with `payload` as the `x-amz-content-sha256` the signature binds.
     fn signed_payload(self, host: &str, key: (&str, &str), skew: i64, payload: &str) -> Self {
         let at = stamp(vk_peer::now_secs().saturating_add_signed(skew));
-        let auth = authorization(
+        let req = self
+            .header("x-amz-content-sha256", payload)
+            .header("x-amz-date", &at);
+        let auth = req.authorization(host, payload, key, &at);
+        req.header("Authorization", &auth)
+    }
+
+    /// The `Authorization` for this request as it is, signing `host` and every `x-amz-*`
+    /// header it carries, as S3 requires and SDKs do.
+    fn authorization(&self, host: &str, payload: &str, key: (&str, &str), at: &str) -> String {
+        let mut signed: Vec<(String, String)> = self
+            .headers
+            .iter()
+            .map(|(n, v)| (n.to_ascii_lowercase(), v.clone()))
+            .filter(|(n, _)| n.starts_with("x-amz-"))
+            .chain([("host".to_string(), host.to_string())])
+            .collect();
+        signed.sort();
+        let signed: Vec<(&str, &str)> = signed
+            .iter()
+            .map(|(n, v)| (n.as_str(), v.as_str()))
+            .collect();
+        authorization(
             self.method,
             &self.path,
             &self.query,
-            &[
-                ("host", host),
-                ("x-amz-content-sha256", payload),
-                ("x-amz-date", &at),
-            ],
+            &signed,
             payload,
             key,
-            &at,
-        );
-        self.header("x-amz-content-sha256", payload)
-            .header("x-amz-date", &at)
-            .header("Authorization", &auth)
+            at,
+        )
     }
 
     /// `data` sent as an `aws-chunked` body framed by `mode` in 64 KiB chunks, signed for
@@ -388,35 +403,37 @@ impl Req {
         mode: Chunked,
         data: &[u8],
         trailer: Option<(&str, &str)>,
+    ) -> Self {
+        self.chunked_declaring(host, key, mode, data, trailer, Some(data.len()))
+    }
+
+    /// [`Req::chunked`] declaring `decoded` as its `x-amz-decoded-content-length`, or none.
+    fn chunked_declaring(
+        self,
+        host: &str,
+        key: (&str, &str),
+        mode: Chunked,
+        data: &[u8],
+        trailer: Option<(&str, &str)>,
+        decoded: Option<usize>,
     ) -> Self {
         let at = stamp(vk_peer::now_secs());
         let payload = mode.content_sha256();
-        let auth = authorization(
-            self.method,
-            &self.path,
-            &self.query,
-            &[
-                ("host", host),
-                ("x-amz-content-sha256", payload),
-                ("x-amz-date", &at),
-            ],
-            payload,
-            key,
-            &at,
-        );
-        let seed = auth.rsplit("Signature=").next().unwrap().to_string();
-        let signing = signing_key(key.1, &at[..8]);
-        let body = aws_chunked(mode, data, 64 * 1024, (&signing, &at, &seed), trailer);
         let mut req = self
             .header("x-amz-content-sha256", payload)
             .header("x-amz-date", &at)
-            .header("Authorization", &auth)
-            .header("Content-Encoding", "aws-chunked")
-            .header("x-amz-decoded-content-length", &data.len().to_string());
+            .header("Content-Encoding", "aws-chunked");
+        if let Some(decoded) = decoded {
+            req = req.header("x-amz-decoded-content-length", &decoded.to_string());
+        }
         if let Some((name, _)) = trailer {
             req = req.header("x-amz-trailer", name);
         }
-        req.body(body)
+        let auth = req.authorization(host, payload, key, &at);
+        let seed = auth.rsplit("Signature=").next().unwrap().to_string();
+        let signing = signing_key(key.1, &at[..8]);
+        let body = aws_chunked(mode, data, 64 * 1024, (&signing, &at, &seed), trailer);
+        req.header("Authorization", &auth).body(body)
     }
 
     /// This request with `name` sent as `value` instead of as it was.
@@ -647,6 +664,25 @@ async fn sigv4_refusals(host: &str, good: (&str, &str)) {
     )
     .await
     .is(400, "AuthorizationHeaderMalformed");
+    // An x-amz-* header the signature does not cover; signed, it passes.
+    let resp = send(
+        host,
+        get().signed(host, good, 0).header("X-Amz-Meta-X", "1"),
+    )
+    .await;
+    resp.is(403, "AccessDenied");
+    assert!(
+        resp.body
+            .contains("<HeadersNotSigned>x-amz-meta-x</HeadersNotSigned>"),
+        "{}",
+        resp.body
+    );
+    send(
+        host,
+        get().header("X-Amz-Meta-X", "1").signed(host, good, 0),
+    )
+    .await
+    .is(404, "NoSuchKey");
     // And the good key passes the gate, to find nothing yet.
     send(host, get().signed(host, good, 0))
         .await
@@ -1506,12 +1542,13 @@ async fn a_chunked_body_that_does_not_hold_leaves_nothing() {
     flip_after_last(&mut req.body, b"x-amz-trailer-signature:");
     cases.push(("/s3/b/trailer-sig", req, 403, "SignatureDoesNotMatch"));
     // The length the chunks hold, and what follows their end.
-    let short = (data.len() - 1).to_string();
-    let req = put("/s3/b/short", Chunked::Signed).replace("x-amz-decoded-content-length", &short);
+    let declaring = |path: &str, mode: Chunked, decoded: Option<usize>| {
+        let trailer = (mode != Chunked::Signed).then_some(("x-amz-checksum-crc32", crc.as_str()));
+        Req::new("PUT", path).chunked_declaring(&host, BEARER, mode, &data, trailer, decoded)
+    };
+    let req = declaring("/s3/b/short", Chunked::Signed, Some(data.len() - 1));
     cases.push(("/s3/b/short", req, 400, "InvalidChunkSizeError"));
-    let long = (data.len() + 1).to_string();
-    let req =
-        put("/s3/b/long", Chunked::UnsignedTrailer).replace("x-amz-decoded-content-length", &long);
+    let req = declaring("/s3/b/long", Chunked::UnsignedTrailer, Some(data.len() + 1));
     cases.push(("/s3/b/long", req, 400, "IncompleteBody"));
     let mut req = put("/s3/b/garbage", Chunked::Signed);
     req.body.extend_from_slice(b"\r\n");
@@ -1523,9 +1560,7 @@ async fn a_chunked_body_that_does_not_hold_leaves_nothing() {
     req.body.truncate(req.body.len() - 50);
     cases.push(("/s3/b/truncated", req, 400, "IncompleteBody"));
     // No decoded length at all.
-    let mut req = put("/s3/b/no-length", Chunked::Signed);
-    req.headers
-        .retain(|(n, _)| n != "x-amz-decoded-content-length");
+    let req = declaring("/s3/b/no-length", Chunked::Signed, None);
     cases.push(("/s3/b/no-length", req, 400, "InvalidRequest"));
 
     for (path, req, status, code) in cases {
@@ -1624,19 +1659,19 @@ async fn a_trailer_checksum_must_be_the_body_s() {
         let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(crc));
         send(&host, req).await.is(400, "InvalidRequest");
         let req = Req::new("PUT", "/s3/b/x")
-            .chunked(&host, BEARER, mode, &data, None)
-            .header("x-amz-trailer", "x-amz-checksum-crc32");
+            .header("x-amz-trailer", "x-amz-checksum-crc32")
+            .chunked(&host, BEARER, mode, &data, None);
         send(&host, req).await.is(400, "MalformedTrailerError");
         let crc = crc32_b64(&data);
         let req = Req::new("PUT", "/s3/b/x")
+            .header("x-amz-checksum-crc32", &crc)
             .chunked(
                 &host,
                 BEARER,
                 mode,
                 &data,
                 Some(("x-amz-checksum-crc32", crc.as_str())),
-            )
-            .header("x-amz-checksum-crc32", &crc);
+            );
         send(&host, req).await.is(400, "InvalidRequest");
         send(&host, get("/s3/b/x")).await.is(404, "NoSuchKey");
     }

From 9cb45fc8b94eed03b7f67e41077b1cab73e6c044 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:19:19 +0100
Subject: [PATCH 22/54] vk-registry/s3: decode query parameter names before
 dispatch

The query is now parsed once into decoded names and values, with the
signature's decoding, and every dispatch and operation reads that; a
malformed escape is 400 InvalidArgument, and multipart parameters no
longer take a + for a space. Dispatch matched raw names while the
signature decoded them, so a name sent escaped was signed as one
operation and served as another.
---
 vk-registry/DESIGN.md           |  4 +-
 vk-registry/src/s3/list.rs      | 27 +++++------
 vk-registry/src/s3/mod.rs       | 82 +++++++++++++++++++++++++--------
 vk-registry/src/s3/multipart.rs | 53 ++++++++++-----------
 vk-registry/tests/s3_e2e.rs     | 41 +++++++++++++++++
 5 files changed, 145 insertions(+), 62 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index fe7ab589..d32873ec 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -630,7 +630,9 @@ key at most 1024 bytes, no empty component and no trailing slash, so there are n
 marker" objects. Paths are split before they are percent-decoded, as WebDAV's are, so `%2F`
 cannot smuggle a separator. Anything else is 400 `InvalidArgument`, `KeyTooLongError` or
 `InvalidBucketName`, with a message naming the rule. `sccache`'s keys (`a/b/c/<hex>`,
-`.sccache_check`) pass.
+`.sccache_check`) pass. A query's parameters, names and values alike, are percent-decoded
+once, as the signature decodes them, before the request is dispatched on them; a malformed
+escape is 400 `InvalidArgument`.
 
 **Authorization** is the WebDAV view's: a `PUT` needs `Write` on the key's parent repository,
 a read `Read` on the repository the key resolves to, and a `DELETE` `Write` there; a caller
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 651d45ec..0e5c9dbb 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -16,7 +16,7 @@ use hyper::body::Incoming;
 use hyper::{Request, Response, StatusCode};
 
 use super::path::MAX_KEY;
-use super::{Ctx, bucket, conditional, refuse, sigv4, xml};
+use super::{Ctx, Params, bucket, conditional, refuse, sigv4, xml};
 use crate::files::{self, FILES_REPO, Node, Object, allowed, repo_name};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
@@ -38,11 +38,8 @@ const PARAMS: &[&str] = &[
 ];
 
 /// Whether a bucket `GET` with this query is a listing: one that names only [`PARAMS`].
-pub(super) fn is_listing(query: &str) -> bool {
-    query
-        .split('&')
-        .filter(|p| !p.is_empty())
-        .all(|p| PARAMS.contains(&p.split_once('=').map_or(p, |(n, _)| n)))
+pub(super) fn is_listing(params: &Params) -> bool {
+    params.iter().all(|(n, _)| PARAMS.contains(&n.as_str()))
 }
 
 /// What a listing asks for.
@@ -66,22 +63,20 @@ struct Query {
 }
 
 /// The listing a query asks for, or why it is refused (400 `InvalidArgument`).
-fn parse(query: &str) -> std::result::Result<Query, &'static str> {
+fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
     let mut q = Query {
         max_keys: MAX_KEYS,
         ..Query::default()
     };
     let (mut start_after, mut marker) = (None, None);
     let mut seen: Vec<&str> = Vec::new();
-    for pair in query.split('&').filter(|p| !p.is_empty()) {
-        let (name, raw) = pair.split_once('=').unwrap_or((pair, ""));
+    for (name, value) in params {
+        let (name, value) = (name.as_str(), value.clone());
         // The first of a repeated parameter is the one taken.
         if seen.contains(&name) {
             continue;
         }
         seen.push(name);
-        let value = crate::dav::decode_segment(raw)
-            .ok_or("a query parameter has a malformed percent escape or is not UTF-8")?;
         match name {
             "list-type" if value == "2" => q.v2 = true,
             "list-type" => return Err("list-type is 2, or absent for the first version"),
@@ -357,11 +352,11 @@ pub(super) async fn list(
     state: &ServerState,
     authz: &Authz<'_>,
     bucket: String,
-    query: &str,
+    params: &Params,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
-    let q = match parse(query) {
+    let q = match parse(params) {
         Ok(q) => q,
         Err(message) => {
             let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", message);
@@ -823,7 +818,13 @@ mod tests {
 
     #[test]
     fn a_query_names_a_listing_of_either_version() {
+        let is_listing = |q: &str| super::is_listing(&crate::s3::parse_query(q).unwrap());
+        let parse = |q: &str| match crate::s3::parse_query(q) {
+            Some(params) => super::parse(&params),
+            None => Err("malformed"),
+        };
         assert!(is_listing(""));
+        assert!(is_listing("list-%74ype=2"));
         assert!(is_listing("list-type=2&prefix=a%2F&delimiter=%2F"));
         assert!(is_listing("marker=a&max-keys=2&x-id=ListObjects"));
         assert!(!is_listing("location"));
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 1bf8d18a..fc6475fa 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -248,17 +248,33 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
 /// the method and path do not.
 const OPERATION_HINT: &str = "x-id";
 
+/// A request's query parameters, name and value, in order.
+type Params = [(String, String)];
+
+/// `raw`'s parameters, each name and value percent-decoded as the signature decodes them (a
+/// `+` is itself), so that what dispatches a request and what an operation reads is what was
+/// signed. `None` for a malformed escape, or a name or value that is not UTF-8.
+fn parse_query(raw: &str) -> Option<Vec<(String, String)>> {
+    raw.split('&')
+        .filter(|p| !p.is_empty())
+        .map(|p| {
+            let (name, value) = p.split_once('=').unwrap_or((p, ""));
+            Some((
+                crate::dav::decode_segment(name)?,
+                crate::dav::decode_segment(value)?,
+            ))
+        })
+        .collect()
+}
+
 /// The subresource a query names (`location`, `attributes`, `uploads`…): `None` for a query
 /// of [`OPERATION_HINT`] at most, `Some("")` when it names more than one parameter or names
 /// one with a value — which nothing served here takes.
-fn subresource(query: &str) -> Option<&str> {
-    let mut names = query
-        .split('&')
-        .filter(|p| !p.is_empty())
-        .filter(|p| p.split_once('=').map_or(*p, |(n, _)| n) != OPERATION_HINT);
-    let first = names.next()?;
-    Some(match (first.split_once('='), names.next()) {
-        (None | Some((_, "")), None) => first.trim_end_matches('='),
+fn subresource(params: &Params) -> Option<&str> {
+    let mut named = params.iter().filter(|(n, _)| n != OPERATION_HINT);
+    let (name, value) = named.next()?;
+    Some(match (value.is_empty(), named.next()) {
+        (true, None) => name,
         _ => "",
     })
 }
@@ -280,7 +296,14 @@ async fn operate(
             return refuse(req, resp, ctx).await;
         }
     };
-    let query = req.uri().query().unwrap_or("").to_string();
+    let Some(query) = parse_query(req.uri().query().unwrap_or("")) else {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidArgument",
+            "a query parameter has a malformed percent escape or is not UTF-8",
+        );
+        return refuse(req, resp, ctx).await;
+    };
     let sub = subresource(&query);
     let method = req.method().clone();
     match (target, &method, sub) {
@@ -690,19 +713,38 @@ mod tests {
 
     #[test]
     fn a_query_names_one_subresource_or_none() {
-        assert_eq!(subresource(""), None);
-        assert_eq!(subresource("x-id=GetObject"), None);
-        assert_eq!(subresource("location"), Some("location"));
-        assert_eq!(subresource("location="), Some("location"));
+        let sub = |q: &str| subresource(&parse_query(q).unwrap()).map(str::to_string);
+        assert_eq!(sub(""), None);
+        assert_eq!(sub("x-id=GetObject"), None);
+        assert_eq!(sub("location"), Some("location".to_string()));
+        assert_eq!(sub("location="), Some("location".to_string()));
         assert_eq!(
-            subresource("attributes&x-id=GetObjectAttributes"),
-            Some("attributes")
+            sub("attributes&x-id=GetObjectAttributes"),
+            Some("attributes".to_string())
         );
-        assert_eq!(subresource("x-id=PutObject&tagging"), Some("tagging"));
-        assert_eq!(subresource("list-type=2"), Some(""));
-        assert_eq!(subresource("partNumber=1&uploadId=a"), Some(""));
-        assert_eq!(subresource("location&acl"), Some(""));
-        assert_eq!(subresource("versionId=null"), Some(""));
+        assert_eq!(sub("x-id=PutObject&tagging"), Some("tagging".to_string()));
+        assert_eq!(sub("list-type=2"), Some("".to_string()));
+        assert_eq!(sub("partNumber=1&uploadId=a"), Some("".to_string()));
+        assert_eq!(sub("location&acl"), Some("".to_string()));
+        assert_eq!(sub("versionId=null"), Some("".to_string()));
+        // Names are decoded as the signature decodes them.
+        assert_eq!(sub("upload%73"), Some("uploads".to_string()));
+        assert_eq!(sub("x%2Did=GetObject"), None);
+    }
+
+    #[test]
+    fn a_query_is_decoded_once_or_refused() {
+        assert_eq!(
+            parse_query("upload%49d=a%2Bb+c&&prefix=&x").unwrap(),
+            [
+                ("uploadId".to_string(), "a+b+c".to_string()),
+                ("prefix".to_string(), String::new()),
+                ("x".to_string(), String::new()),
+            ]
+        );
+        for bad in ["a%2", "a=%zz", "%ff", "a=%C3"] {
+            assert!(parse_query(bad).is_none(), "{bad}");
+        }
     }
 
     #[test]
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 2535e953..f2bdd7e9 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -34,8 +34,8 @@ use super::copy::{self, COPY_SOURCE, Source};
 use super::object::{self, Refused, admitted, no_such_key, readable, unwritable};
 use super::xml::scan::{self, Malformed};
 use super::{
-    Ctx, OPERATION_HINT, UNCOMPRESSED_FROM, bucket, chunked, drain, list, meta, read_small, refuse,
-    xml,
+    Ctx, OPERATION_HINT, Params, UNCOMPRESSED_FROM, bucket, chunked, drain, list, meta, read_small,
+    refuse, xml,
 };
 use crate::files::{self, Commit, FILES_REPO, MAX_OBJECT, Staged, Written, allowed, object_of};
 use crate::{Authz, Body, STREAM_CHUNK, ServerState, Store, accounts, body_of};
@@ -97,35 +97,28 @@ fn bucket_of(segs: &[String]) -> &str {
     segs.first().map_or("", String::as_str)
 }
 
-/// `query`'s parameters with their values percent-decoded, in order, the SDK's operation
-/// hint left out.
-fn params(query: &str) -> Vec<(&str, String)> {
+/// A query's parameters, already decoded ([`super::parse_query`]), the SDK's operation hint
+/// left out.
+fn params(query: &Params) -> Vec<(&str, &str)> {
     query
-        .split('&')
-        .filter(|p| !p.is_empty())
-        .map(|p| {
-            let (n, v) = p.split_once('=').unwrap_or((p, ""));
-            (n, crate::percent_decode(v))
-        })
+        .iter()
+        .map(|(n, v)| (n.as_str(), v.as_str()))
         .filter(|(n, _)| *n != OPERATION_HINT)
         .collect()
 }
 
 /// The value of the first parameter named `name`.
-fn param<'a>(params: &'a [(&str, String)], name: &str) -> Option<&'a str> {
-    params
-        .iter()
-        .find(|(n, _)| *n == name)
-        .map(|(_, v)| v.as_str())
+fn param<'a>(params: &[(&str, &'a str)], name: &str) -> Option<&'a str> {
+    params.iter().find(|(n, _)| *n == name).map(|(_, v)| *v)
 }
 
 /// Whether `query` names a parameter `name`: what dispatches a request here.
-pub(super) fn names(query: &str, name: &str) -> bool {
-    params(query).iter().any(|(n, _)| *n == name)
+pub(super) fn names(query: &Params, name: &str) -> bool {
+    query.iter().any(|(n, _)| n == name)
 }
 
 /// Whether every parameter is one of `taken`.
-fn only(params: &[(&str, String)], taken: &[&str]) -> bool {
+fn only(params: &[(&str, &str)], taken: &[&str]) -> bool {
     params.iter().all(|(n, _)| taken.contains(n))
 }
 
@@ -228,7 +221,7 @@ pub(super) async fn create(
     state: &ServerState,
     authz: &Authz<'_>,
     segs: Vec<String>,
-    query: &str,
+    query: &Params,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -323,7 +316,7 @@ pub(super) async fn upload(
     authz: &Authz<'_>,
     segs: Vec<String>,
     seed: Option<chunked::Seed>,
-    query: &str,
+    query: &Params,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -940,7 +933,7 @@ async fn list_parts(
     authz: &Authz<'_>,
     segs: Vec<String>,
     id: String,
-    params: &[(&str, String)],
+    params: &[(&str, &str)],
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -1027,7 +1020,7 @@ pub(super) async fn list_uploads(
     state: &ServerState,
     authz: &Authz<'_>,
     bucket: String,
-    query: &str,
+    query: &Params,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -1268,15 +1261,19 @@ mod tests {
 
     #[test]
     fn queries_name_their_parameters_decoded() {
-        let p = params("uploadId=1-2-ab&partNumber=3&x-id=UploadPart");
+        let query = |q: &str| crate::s3::parse_query(q).unwrap();
+        let q = query("uploadId=1-2-ab&partNumber=3&x-id=UploadPart");
+        let p = params(&q);
         assert_eq!(param(&p, "uploadId"), Some("1-2-ab"));
         assert_eq!(param(&p, "partNumber"), Some("3"));
         assert!(only(&p, &["uploadId", "partNumber"]));
         assert!(!only(&p, &["uploadId"]));
-        assert!(names("uploads", "uploads"));
-        assert!(names("uploads=&prefix=a%2Fb", "uploads"));
-        assert_eq!(param(&params("prefix=a%2Fb"), "prefix"), Some("a/b"));
-        assert!(!names("uploadIds=1", "uploadId"));
+        assert!(names(&query("uploads"), "uploads"));
+        assert!(names(&query("uploads=&prefix=a%2Fb"), "uploads"));
+        assert!(names(&query("upload%49d=u"), "uploadId"));
+        let q = query("prefix=a%2Fb+c");
+        assert_eq!(param(&params(&q), "prefix"), Some("a/b+c"));
+        assert!(!names(&query("uploadIds=1"), "uploadId"));
         assert_eq!(page_size(None), Some(MAX_LISTED));
         assert_eq!(page_size(Some("5")), Some(5));
         assert_eq!(
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index e76ae1af..151f3a6c 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1937,6 +1937,47 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     assert_eq!(staging_left(&dir), 0);
 }
 
+/// A query's names are taken decoded, as the signature takes them, wherever they dispatch;
+/// a malformed escape is refused.
+#[tokio::test]
+async fn query_names_are_decoded_before_dispatch() {
+    let dir = tmp("query-names");
+    let host = spawn(open_state(&dir, true));
+    for key in ["d/k", "e/k"] {
+        send(
+            &host,
+            Req::new("PUT", &format!("/s3/b/{key}")).body(HELLO.to_vec()),
+        )
+        .await
+        .ok(200);
+    }
+    let resp = send(
+        &host,
+        Req::new("GET", "/s3/b").query("list-%74ype=2&prefi%78=d%2F"),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(keys(&resp.body), ["d/k"]);
+    send(&host, Req::new("GET", "/s3/b").query("%6Cocation"))
+        .await
+        .ok(200);
+    send(&host, Req::new("GET", "/s3/b/d/k").query("upload%49d=nope"))
+        .await
+        .is(404, "NoSuchUpload");
+    let resp = send(&host, Req::new("GET", "/s3/b").query("upload%73")).await;
+    resp.ok(200);
+    assert!(
+        resp.body.contains("<ListMultipartUploadsResult"),
+        "{}",
+        resp.body
+    );
+    for bad in ["prefix=%2", "%zz", "list-type=2&prefix=%FF"] {
+        send(&host, Req::new("GET", "/s3/b").query(bad))
+            .await
+            .is(400, "InvalidArgument");
+    }
+}
+
 impl Req {
     /// The same request at another path.
     fn path_of(mut self, path: &str) -> Self {

From 2b9d41b63b9a71be9e0bc81dbd645806b8397059 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:20:27 +0100
Subject: [PATCH 23/54] vk-registry/s3: report a failed key in a batch delete

A key DeleteObjects fails to delete now gets an InternalError of its
own, logged with the request id, and the batch goes on. The whole
request answered 500 after the keys before it were deleted, so the
client could not tell what was gone.
---
 vk-registry/DESIGN.md       |  2 +-
 vk-registry/src/s3/batch.rs | 15 +++++++++++++--
 vk-registry/tests/s3_e2e.rs | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index d32873ec..a289c33d 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -670,7 +670,7 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
-| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through |
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index 811d2ba2..dabf2b67 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -105,7 +105,7 @@ fn delete_key(
 }
 
 /// `POST /s3/<bucket>?delete`: each key of the document deleted, or the reason it was not,
-/// in the order asked. A bucket that does not exist holds none of the keys, which all count
+/// in the order asked, a key the store fails on included. A bucket that does not exist holds none of the keys, which all count
 /// as deleted, as DeleteObject answers for each.
 pub(super) async fn delete(
     state: &ServerState,
@@ -131,6 +131,7 @@ pub(super) async fn delete(
         Ok(asked) => asked,
         Err(Malformed(why)) => return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why)),
     };
+    let id = ctx.id.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let namespace = files::namespace(store)?;
         let mut out = String::new();
@@ -141,7 +142,17 @@ pub(super) async fn delete(
                     "this registry keeps no versions: a key is deleted without a VersionId",
                 ))
             } else {
-                delete_key(store, &namespace, authz, &bucket, &entry.key)?
+                // A key the store fails on is that key's error; the batch goes on.
+                delete_key(store, &namespace, authz, &bucket, &entry.key).unwrap_or_else(|e| {
+                    eprintln!(
+                        "vk-registry: S3 request {id} could not delete {:?}: {e:#}",
+                        entry.key
+                    );
+                    Err((
+                        "InternalError",
+                        "the server could not delete this key; its log names this request id",
+                    ))
+                })
             };
             match outcome {
                 Ok(()) if asked.quiet => {}
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 151f3a6c..01629978 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1937,6 +1937,39 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     assert_eq!(staging_left(&dir), 0);
 }
 
+/// A key the store fails to delete is reported on its own, and the batch goes on past it.
+#[tokio::test]
+async fn a_key_that_fails_to_delete_is_reported_and_the_batch_goes_on() {
+    use std::os::unix::fs::PermissionsExt as _;
+    let dir = tmp("batch-io");
+    let host = spawn(open_state(&dir, true));
+    for key in ["a", "d/x", "c"] {
+        send(
+            &host,
+            Req::new("PUT", &format!("/s3/b/{key}")).body(HELLO.to_vec()),
+        )
+        .await
+        .ok(200);
+    }
+    let tags = dir.join("store/repos/files/b/d/tags");
+    std::fs::set_permissions(&tags, std::fs::Permissions::from_mode(0o555)).unwrap();
+    // Whoever may write a read-only directory (root) cannot make the store fail this way.
+    let probe = tags.join("probe");
+    if std::fs::File::create(&probe).is_ok() {
+        std::fs::remove_file(&probe).unwrap();
+        std::fs::set_permissions(&tags, std::fs::Permissions::from_mode(0o755)).unwrap();
+        eprintln!("skipped: a read-only directory does not stop this user");
+        return;
+    }
+    let doc = delete_doc(&[&key_of("a"), &key_of("d/x"), &key_of("c")], false);
+    let resp = send(&host, delete_objects("b", doc)).await;
+    std::fs::set_permissions(&tags, std::fs::Permissions::from_mode(0o755)).unwrap();
+    let (deleted, errors) = delete_result(&resp);
+    assert_eq!(deleted, ["a", "c"]);
+    assert_eq!(errors, [("d/x".to_string(), "InternalError".to_string())]);
+    is_object(&send(&host, Req::new("GET", "/s3/b/d/x")).await, HELLO);
+}
+
 /// A query's names are taken decoded, as the signature takes them, wherever they dispatch;
 /// a malformed escape is refused.
 #[tokio::test]

From f8ec349e42d75ad4264b2f480fb85dd19b5303c2 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:22:58 +0100
Subject: [PATCH 24/54] vk-registry: keep s3_host away from the registry's own
 name

The server now refuses at startup an [oidc] public_url whose host is
below s3_host, and s3_host with s3 = false; the help and design say the
registry's own name must not be below it. Every <label>.<s3_host> is
served as a bucket, so a registry whose own name sat there had its
/v2/, /login and /browse answered as S3.
---
 vk-registry/DESIGN.md          |  7 +++-
 vk-registry/src/config.rs      | 72 +++++++++++++++++++++++++++++++++-
 vk-registry/src/config/help.rs |  4 +-
 3 files changed, 80 insertions(+), 3 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index a289c33d..3338ee63 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -592,7 +592,12 @@ path included, so nothing about credentials changes. It needs a wildcard DNS rec
 wildcard (one label deep: a bucket name with a dot is not covered). A host whose label cannot
 be a bucket, `s3_host` itself, and every other host are served as before, and path-style
 `/s3/` keeps working on any of them. The setting is a lowercase host name with no port; the
-server refuses anything else at startup.
+server refuses anything else at startup. The registry's own host name must not be below
+`s3_host`, since every `<label>.<s3_host>` is taken for a bucket, `/v2/`, `/login` and
+`/browse` included: `s3_host = "example.com"` would serve `reg.example.com` as bucket `reg`.
+The server refuses at startup an `[oidc] public_url` whose host is below `s3_host`, and
+`s3_host` with `s3 = false`; `s3_host` may be the registry's own name, which is not a
+bucket's.
 
 **Credentials.** SigV4 needs the server to hold the signing secret, and this registry stores
 API keys only as hashes and never mints hub tokens, so no new secret is introduced: the
diff --git a/vk-registry/src/config.rs b/vk-registry/src/config.rs
index 58b928ac..0c13a598 100644
--- a/vk-registry/src/config.rs
+++ b/vk-registry/src/config.rs
@@ -712,6 +712,8 @@ impl ServerConfig {
         cfg.check_connection_limits()?;
         if let Some(host) = &cfg.s3_host {
             check_s3_host(host)?;
+            let public_url = cfg.oidc.as_ref().map(|o| o.public_url.as_str());
+            check_s3_host_apart(host, cfg.s3, public_url)?;
         }
         cfg.check_hub()?;
         check_gc_prefixes(&cfg.gc_prefixes)?;
@@ -1032,7 +1034,6 @@ fn parse_addr(addr: Option<String>) -> Result<Option<SocketAddr>> {
         .transpose()
 }
 
-/// Each `[[gc.prefix]]` names a repository prefix, once, with a window of a day or more.
 /// `s3_host` is a host name its buckets are subdomains of: lowercase DNS labels, as a
 /// wildcard certificate and record name them, and no port, which a request's own `Host`
 /// carries and the match ignores.
@@ -1053,6 +1054,42 @@ fn check_s3_host(host: &str) -> Result<()> {
     Ok(())
 }
 
+/// `s3_host` serves only S3, and the registry's own name, `public_url`'s host, is not below
+/// it: every request to `<label>.<s3_host>` is served as that bucket, so a registry named
+/// there would have its `/v2/`, `/login` and `/browse` taken for objects. The name itself is
+/// not a bucket's, and stays the registry's.
+fn check_s3_host_apart(host: &str, s3: bool, public_url: Option<&str>) -> Result<()> {
+    if !s3 {
+        bail!("s3_host = {host:?} needs S3 on: drop it, or s3 = false");
+    }
+    let Some(url) = public_url else {
+        return Ok(());
+    };
+    // `scheme://[userinfo@]host[:port][/…]`, as `[oidc] public_url` is checked to be.
+    let authority = url.split_once("://").map_or(url, |(_, rest)| rest);
+    let authority = authority.split(['/', '?', '#']).next().unwrap_or_default();
+    let authority = authority.rsplit_once('@').map_or(authority, |(_, h)| h);
+    // A port goes; an IPv6 literal, which holds colons of its own, is no name below a host.
+    let own = match authority.rsplit_once(':') {
+        Some((name, port)) if !name.contains(':') && port.bytes().all(|b| b.is_ascii_digit()) => {
+            name
+        }
+        _ => authority,
+    };
+    let below = own.len() > host.len()
+        && own
+            .get(own.len() - host.len() - 1..)
+            .is_some_and(|tail| tail.eq_ignore_ascii_case(&format!(".{host}")));
+    if below {
+        bail!(
+            "s3_host = {host:?} would take the registry's own name {own:?} ([oidc] public_url) \
+             for a bucket: the registry must not be named below s3_host"
+        );
+    }
+    Ok(())
+}
+
+/// Each `[[gc.prefix]]` names a repository prefix, once, with a window of a day or more.
 fn check_gc_prefixes(prefixes: &[GcPrefix]) -> Result<()> {
     let mut seen = std::collections::HashSet::new();
     for p in prefixes {
@@ -2000,6 +2037,39 @@ mod tests {
             };
             assert!(format!("{err:#}").contains("s3_host"), "{bad:?}: {err:#}");
         }
+        // With S3 off it would serve nothing, and the registry's own name is not below it.
+        let Err(err) = load("s3 = false\ns3_host = \"s3.example.com\"\n") else {
+            panic!("s3_host was taken with S3 off");
+        };
+        assert!(format!("{err:#}").contains("s3_host"), "{err:#}");
+        let accounts = |s3_host: &str, public_url: &str| {
+            load(&format!(
+                "mode = \"accounts\"\ns3_host = {s3_host:?}\n[oidc]\n\
+                 issuer = \"https://login.example.com\"\nclient_id = \"r\"\n\
+                 client_secret_file = \"/s\"\npublic_url = {public_url:?}\n"
+            ))
+        };
+        for (s3_host, own) in [
+            ("example.com", "https://reg.example.com"),
+            ("example.com", "https://a.b.example.com:8443/"),
+            ("example.com", "https://REG.Example.com/base"),
+            ("s3.example.com", "https://reg.s3.example.com"),
+        ] {
+            let Err(err) = accounts(s3_host, own) else {
+                panic!("{s3_host} was taken over {own}");
+            };
+            assert!(format!("{err:#}").contains("public_url"), "{own}: {err:#}");
+        }
+        for (s3_host, own) in [
+            ("s3.example.com", "https://reg.example.com"),
+            ("reg.example.com", "https://reg.example.com"),
+            ("example.com", "https://example.com:443"),
+            ("example.com", "https://regexample.com"),
+            ("example.com", "https://[::1]:5000"),
+        ] {
+            let cfg = accounts(s3_host, own).unwrap();
+            assert_eq!(cfg.s3_host.as_deref(), Some(s3_host), "{own}");
+        }
         let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), "/s".into());
         assert_eq!(cfg.hub_facts().config_hash, "e3609a2059e9c15e");
         cfg.s3_host = Some("s3.example.com".into());
diff --git a/vk-registry/src/config/help.rs b/vk-registry/src/config/help.rs
index f4f71d46..05a41610 100644
--- a/vk-registry/src/config/help.rs
+++ b/vk-registry/src/config/help.rs
@@ -106,7 +106,9 @@ const KEYS: &[Key] = &[
         name: "s3_host",
         help: "host name whose subdomains are S3 buckets: <bucket>.<s3_host>\n\
                is served as /s3/<bucket>/, for virtual-hosted clients;\n\
-               needs wildcard DNS and certificate [default: unset]",
+               needs wildcard DNS and certificate, and s3 on; the\n\
+               registry's own host name must not be below it\n\
+               [default: unset]",
     },
     Key {
         table: Table::Top,

From effd6a8fe2e44e88ffd1bdd27a36d5af78b989b6 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:25:04 +0100
Subject: [PATCH 25/54] vk-registry/s3: refuse control characters in markers
 and batch keys

The uploads listing now holds its prefix and markers to a bucket
listing's rule (400 InvalidArgument), and a request document holding a
character XML 1.0 does not allow, literal or in CDATA, is 400
MalformedXML. Echoed unchecked into a ListMultipartUploads answer or a
DeleteObjects key, such a character made XML no client can read.
---
 vk-registry/DESIGN.md           |  4 ++--
 vk-registry/src/s3/batch.rs     |  4 ++++
 vk-registry/src/s3/list.rs      |  2 +-
 vk-registry/src/s3/multipart.rs | 17 +++++++++++-----
 vk-registry/src/s3/xml/scan.rs  | 22 +++++++++++++++++++--
 vk-registry/tests/s3_e2e.rs     | 35 +++++++++++++++++++++++++++++++++
 6 files changed, 74 insertions(+), 10 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 3338ee63..c3169605 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -675,7 +675,7 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
-| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through |
@@ -690,7 +690,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-{sha256,sha1,crc32}` is checked against the object (400 `BadDigest`); a composite one (`…-<parts>`) or another algorithm is taken unchecked. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload` |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
-| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; 404 `NoSuchBucket` |
+| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take; an SDK's `x-id` operation hint is ignored |
 
 **XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index dabf2b67..82d36a46 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -229,6 +229,10 @@ mod tests {
             body("<Object><Key>a</Key></Object><Quiet>yes</Quiet>"),
             body("<Object><Key>a</Key></Object><Quiet>true</Quiet><Quiet>true</Quiet>"),
             body("<Object><Key>&ent;</Key></Object>"),
+            // What an answer echoing the key could not write.
+            body("<Object><Key>a&#1;</Key></Object>"),
+            body("<Object><Key>a\u{1}</Key></Object>"),
+            body("<Object><Key><![CDATA[a\u{1}]]></Key></Object>"),
             b"<Other><Object><Key>a</Key></Object></Other>".to_vec(),
             b"".to_vec(),
         ] {
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 0e5c9dbb..91a33b2a 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -114,7 +114,7 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
 
 /// A prefix, delimiter or start key, which a listing echoes in XML: no control character,
 /// which XML 1.0 cannot carry, and no longer than a key.
-fn text(v: String) -> std::result::Result<String, &'static str> {
+pub(super) fn text(v: String) -> std::result::Result<String, &'static str> {
     if v.chars().any(char::is_control) {
         Err("a prefix, delimiter or start key holds no control character")
     } else if v.len() > MAX_KEY {
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index f2bdd7e9..b82dbb52 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -1044,11 +1044,18 @@ pub(super) async fn list_uploads(
     let Some(max) = page_size(param(&params, "max-uploads")) else {
         return refuse(req, invalid(ctx, "max-uploads is a count of uploads"), ctx).await;
     };
-    let prefix = param(&params, "prefix").unwrap_or_default().to_string();
-    let key_marker = param(&params, "key-marker").unwrap_or_default().to_string();
-    let id_marker = param(&params, "upload-id-marker")
-        .unwrap_or_default()
-        .to_string();
+    // Each is echoed in the listing, so held to what a bucket listing's prefix is.
+    let echoed = |name| list::text(param(&params, name).unwrap_or_default().to_string());
+    let (prefix, key_marker, id_marker) = match (
+        echoed("prefix"),
+        echoed("key-marker"),
+        echoed("upload-id-marker"),
+    ) {
+        (Ok(prefix), Ok(key), Ok(id)) => (prefix, key, id),
+        (Err(why), _, _) | (_, Err(why), _) | (_, _, Err(why)) => {
+            return refuse(req, invalid(ctx, why), ctx).await;
+        }
+    };
     if !list::admitted(authz, &bucket, &prefix) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
diff --git a/vk-registry/src/s3/xml/scan.rs b/vk-registry/src/s3/xml/scan.rs
index 4351f1ee..7fb43b86 100644
--- a/vk-registry/src/s3/xml/scan.rs
+++ b/vk-registry/src/s3/xml/scan.rs
@@ -50,6 +50,16 @@ const TRUNCATED: Malformed = Malformed("the document ends inside an element");
 /// The document element of `input`, of at most `max_elements` elements in all.
 pub(crate) fn parse(input: &[u8], max_elements: usize) -> Result<Element, Malformed> {
     let text = std::str::from_utf8(input).map_err(|_| Malformed("the document is not UTF-8"))?;
+    // What XML 1.0 has no character for, a reference excepted ([`character`]), so that no
+    // text taken from a document holds what an answer echoing it could not write.
+    if text
+        .chars()
+        .any(|c| (c < ' ' && !is_space(c)) || matches!(c, '\u{fffe}' | '\u{ffff}'))
+    {
+        return Err(Malformed(
+            "the document holds a character XML does not allow",
+        ));
+    }
     let rest = misc(text.strip_prefix('\u{feff}').unwrap_or(text))?;
     if rest.is_empty() {
         return Err(Malformed("the document has no element"));
@@ -235,7 +245,8 @@ fn character(name: &str) -> Option<char> {
         return None;
     }
     let c = char::from_u32(u32::from_str_radix(digits, radix).ok()?)?;
-    (matches!(c, '\t' | '\n' | '\r') || c >= ' ').then_some(c)
+    (matches!(c, '\t' | '\n' | '\r') || (c >= ' ' && !matches!(c, '\u{fffe}' | '\u{ffff}')))
+        .then_some(c)
 }
 
 #[cfg(test)]
@@ -313,6 +324,9 @@ mod tests {
             "<K>&#0;</K>",
             "<K>&#xD800;</K>",
             "<K>&#x110000;</K>",
+            "<K>&#1;</K>",
+            "<K>&#x1B;</K>",
+            "<K>&#xFFFE;</K>",
             "<K>&#12a;</K>",
             "<K>&averyverylongname;</K>",
             "<K a=\"&nbsp;\"/>",
@@ -344,7 +358,11 @@ mod tests {
             ("<a x=\"1\"y=\"2\"></a>", "white space"),
             ("< a/>", "name"),
             ("<:/>", "name"),
-            ("<a>\u{0}", "ends inside"),
+            ("<a>\u{0}", "does not allow"),
+            ("<a>x\u{1}</a>", "does not allow"),
+            ("<a><![CDATA[\u{1b}]]></a>", "does not allow"),
+            ("<a>\u{ffff}</a>", "does not allow"),
+            ("<a x=\"\u{8}\"/>", "does not allow"),
         ] {
             assert!(malformed(bad).contains(why), "{bad}: {}", malformed(bad));
         }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 01629978..263b25fe 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1970,6 +1970,41 @@ async fn a_key_that_fails_to_delete_is_reported_and_the_batch_goes_on() {
     is_object(&send(&host, Req::new("GET", "/s3/b/d/x")).await, HELLO);
 }
 
+/// What an answer echoes holds no character XML cannot write: an uploads listing's prefix and
+/// markers, and a batch delete's keys.
+#[tokio::test]
+async fn echoed_text_holds_no_control_character() {
+    let dir = tmp("echoed");
+    let host = spawn(open_state(&dir, true));
+    send(&host, Req::new("PUT", "/s3/b/k").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    for bad in [
+        "uploads&prefix=%0A",
+        "uploads&key-marker=a%01",
+        "uploads&upload-id-marker=%1B",
+    ] {
+        send(&host, Req::new("GET", "/s3/b").query(bad))
+            .await
+            .is(400, "InvalidArgument");
+    }
+    send(
+        &host,
+        Req::new("GET", "/s3/b").query("uploads&prefix=a&key-marker=k&upload-id-marker=u"),
+    )
+    .await
+    .ok(200);
+    for key in ["a&#1;", "a\u{1}"] {
+        send(
+            &host,
+            delete_objects("b", delete_doc(&[&key_of(key)], false)),
+        )
+        .await
+        .is(400, "MalformedXML");
+    }
+    is_object(&send(&host, Req::new("GET", "/s3/b/k")).await, HELLO);
+}
+
 /// A query's names are taken decoded, as the signature takes them, wherever they dispatch;
 /// a malformed escape is refused.
 #[tokio::test]

From 115938aacfc7388753d410b87b8a6107460ebe4e Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:25:52 +0100
Subject: [PATCH 26/54] vk-registry/s3: list the buckets a prefix-scoped key
 may read into

ListBuckets now shows what HeadBucket admits: a bucket the caller may
read a directory of. It showed a bucket only to a caller that may read
all of it, so a key scoped to files/team/proj/* found no team bucket to
start from, though HeadBucket and the listings admitted it.
---
 vk-registry/DESIGN.md        | 3 ++-
 vk-registry/src/s3/bucket.rs | 8 +++++---
 vk-registry/tests/s3_e2e.rs  | 4 ++--
 3 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index c3169605..297510ce 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -647,7 +647,8 @@ refused over a clash answers 409 and so reveals that the name exists, as WebDAV'
 bucket authorizes as `files/<bucket>`, except that HeadBucket and GetBucketLocation also
 admit a caller that may read only a directory inside it, which clients probe before listing
 the prefix they were given. Listing the buckets needs a configured credential, as `/dav/`'s
-root listing does, and shows only those the caller may read. Listing a bucket's objects is
+root listing does, and shows only those HeadBucket admits the caller to: a bucket it may read,
+or read a directory inside. Listing a bucket's objects is
 admitted when the caller may read the bucket or the directory the prefix's whole components
 name (`prefix=proj/` for a `read:files/team/proj/*` key over bucket `team`; `prefix=proj`
 names no directory and is refused), and shows only what a read would serve: a directory the
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index 52f47e6b..f12ee59d 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -27,8 +27,10 @@ pub(super) fn owner() -> String {
     )
 }
 
-/// `GET /s3/`: the top-level directories the caller may read. Refused, as `/dav/`'s root
-/// listing is, on a server without a credential, where it would list for anyone.
+/// `GET /s3/`: the top-level directories the caller may read, or read a directory inside, as
+/// HeadBucket admits it: a client given a prefix finds its bucket listed. Refused, as
+/// `/dav/`'s root listing is, on a server without a credential, where it would list for
+/// anyone.
 pub(super) async fn list(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -47,7 +49,7 @@ pub(super) async fn list(
         let mut buckets = String::new();
         for name in store.repo_children(FILES_REPO)? {
             let repo = format!("{FILES_REPO}/{name}");
-            if !authz.may_read(&repo) {
+            if !authz.may_read_below(&repo) {
                 continue;
             }
             let created = store
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 263b25fe..304b88b7 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2149,7 +2149,7 @@ async fn api_keys_reach_what_their_scopes_cover() {
         .await
         .is(404, "NoSuchKey");
 
-    // The buckets listed are those the key may read.
+    // The buckets listed are those the key may read, or read a directory inside.
     let buckets = |k: &str| {
         let k = k.to_string();
         let host = host.clone();
@@ -2172,7 +2172,7 @@ async fn api_keys_reach_what_their_scopes_cover() {
     };
     assert_eq!(buckets(&writer).await, ["b", "c"]);
     assert_eq!(buckets(&bucket_b).await, ["b"]);
-    assert!(buckets(&prefix).await.is_empty());
+    assert_eq!(buckets(&prefix).await, ["b"]);
     let resp = send(&host, as_(&writer, get("/s3/"))).await;
     assert!(resp.body.contains("<CreationDate>"), "{}", resp.body);
 

From 66f4b1896544aca7ea84752ae1a63ba0e0fc9bd3 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:26:43 +0100
Subject: [PATCH 27/54] vk-registry/tests: test the cross-site write refusal

---
 vk-registry/tests/s3_e2e.rs | 47 +++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 304b88b7..46538e44 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1970,6 +1970,53 @@ async fn a_key_that_fails_to_delete_is_reported_and_the_batch_goes_on() {
     is_object(&send(&host, Req::new("GET", "/s3/b/d/x")).await, HELLO);
 }
 
+/// A browser's write from another site's page cannot ride the session cookie it attaches,
+/// path-style or virtual-hosted; a read can, and so can a write from the registry's own pages.
+#[tokio::test]
+async fn a_cross_site_write_is_refused() {
+    let dir = tmp("cross-site");
+    let mut cfg = accounts_config(&dir);
+    cfg.s3_host = Some("s3.example.com".to_string());
+    let state = Arc::new(cfg.into_state().unwrap());
+    let db = accounts_db(&state);
+    let user = db
+        .upsert_user("https://issuer", "ci", EmailUpdate::Keep, None)
+        .unwrap();
+    db.set_admin(&user.id, true).unwrap();
+    let session = db
+        .create_session(&user.id, Duration::from_secs(3600))
+        .unwrap();
+    let addr = spawn(state.clone());
+    let cookie = format!("__Host-vk_session={session}");
+    let send_to = |host: &str, req: Req, site: Option<&str>| {
+        let (addr, host) = (addr.clone(), host.to_string());
+        let mut req = req.header("Cookie", &cookie);
+        if let Some(site) = site {
+            req = req.header("Sec-Fetch-Site", site);
+        }
+        async move { Conn::open_as(&addr, &host).await.send(&req).await }
+    };
+    let vhost = "b.s3.example.com";
+    for (host, path) in [(addr.as_str(), "/s3/b/k"), (vhost, "/v")] {
+        for site in ["cross-site", "same-site"] {
+            let put = Req::new("PUT", path).body(HELLO.to_vec());
+            send_to(host, put, Some(site)).await.is(403, "AccessDenied");
+            let del = Req::new("DELETE", path);
+            send_to(host, del, Some(site)).await.is(403, "AccessDenied");
+        }
+        send_to(host, Req::new("GET", path), Some("cross-site"))
+            .await
+            .is(404, "NoSuchKey");
+        for site in [Some("same-origin"), None] {
+            let put = Req::new("PUT", path).body(HELLO.to_vec());
+            send_to(host, put, site).await.ok(200);
+        }
+        let get = send_to(host, Req::new("GET", path), Some("cross-site")).await;
+        is_object(&get, HELLO);
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// What an answer echoes holds no character XML cannot write: an uploads listing's prefix and
 /// markers, and a batch delete's keys.
 #[tokio::test]

From ecab229a4a7ecf7179cf3beea44842aebfc37622 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:27:05 +0100
Subject: [PATCH 28/54] doc: say an S3 write creates its missing bucket

---
 vk-registry/DESIGN.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 297510ce..ca57a6f6 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -656,6 +656,12 @@ caller may not read is passed over with everything below it, as `PROPFIND` passe
 and neither a foreign tag nor an object whose bytes the caller may not read through it is
 listed.
 
+**A write makes its bucket.** PutObject, CopyObject and CompleteMultipartUpload into a bucket
+that does not exist create it, with every directory above the key, as WebDAV's `PUT` creates
+missing directories, rather than answering S3's `NoSuchBucket`; the write is authorized as
+any other, on the key's parent. This is deliberate: a job behind the guest proxy may not
+create the bucket its area lies in (see below), and can write there all the same.
+
 **Objects are bytes.** Every object is served `application/octet-stream`,
 `Content-Disposition: attachment` and `nosniff`, whatever its writer sent: a `Content-Type`
 is not stored, for the reason manifest media types are restricted (this origin also serves

From a66457243c4dfa10109bed724106b88742ddbb64 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 17:29:08 +0100
Subject: [PATCH 29/54] tests: add a GitLab scenario for the S3 view through an
 area's alias

registry_s3 adds a namespace three components deep with an alias, then
has a job write, read, list and probe an object at /s3/job/<alias>
unsigned through the guest proxy, and be refused another alias and a
bucket its token does not cover. It runs where the registry scenario
does.
---
 tests/gitlab-e2e.sh       |  6 ++---
 tests/gitlab/scenarios.sh | 53 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 3 deletions(-)

diff --git a/tests/gitlab-e2e.sh b/tests/gitlab-e2e.sh
index ac699432..7c0ffac8 100755
--- a/tests/gitlab-e2e.sh
+++ b/tests/gitlab-e2e.sh
@@ -33,7 +33,7 @@
 # Environment: VK_GITLAB_E2E_CACHE (default ~/.cache/vk-gitlab-e2e) holds the GitLab
 # instance; GL_MEM (6G) and GL_CPUS (4) size its VM; GL_BOOT_TIMEOUT (1500 s). E2E_TOKENS=0
 # runs the fleet without hub registry tokens: the registry not enrolled, the node's own
-# credential for caches, and the `registry` and `pipeline_build` scenarios skipped.
+# credential for caches, and the `registry`, `pipeline_build` and `registry_s3` scenarios skipped.
 #
 # Needs: KVM, curl, jq, git, openssl, ss, ip, shuf, network to Docker Hub; about 9 GiB of free RAM
 # (GitLab 6 GiB, job VMs 1 GiB each) and 15 GiB of disk for the GitLab image and its state.
@@ -52,7 +52,7 @@ REPO=$(cd "$E2E/../.." && pwd)
 # shellcheck source=gitlab/scenarios.sh
 . "$E2E/scenarios.sh"
 
-ALL_SCENARIOS=(basic scripts variables exit_codes artifacts cache registry pipeline_build services
+ALL_SCENARIOS=(basic scripts variables exit_codes artifacts cache registry pipeline_build registry_s3 services
   timeout cancel restart)
 
 usage() {
@@ -210,7 +210,7 @@ pids=()
 for s in "${SCENARIOS[@]}"; do
   case $s in
     restart) ;;
-    registry | pipeline_build)
+    registry | pipeline_build | registry_s3)
       if [ -z "$VK_REGISTRY" ] || [ "$E2E_TOKENS" = 0 ]; then
         echo "SKIP|needs a vk-registry taking hub tokens" >"$RUN/results/$s"
       else
diff --git a/tests/gitlab/scenarios.sh b/tests/gitlab/scenarios.sh
index 09bb10e1..f218dedc 100644
--- a/tests/gitlab/scenarios.sh
+++ b/tests/gitlab/scenarios.sh
@@ -391,6 +391,59 @@ EOF
   SC_DETAIL="built in $p1 ($ref), refused in $p2"
 }
 
+# A job reaches the S3 view through the guest proxy by an area's alias, the area three
+# components deep (bucket e2e-s3, keys below e2e/<project>/): it writes, reads, lists and
+# probes an object there unsigned, the proxy lending the job's token, and is refused another
+# alias and a bucket its token does not cover. busybox wget sends neither PUT nor HEAD, so the
+# requests go over nc. The token stays out of the trace.
+sc_registry_s3() {
+  local ci p j
+  hub namespaces add "$REG_ID" e2e-s3 --path 'e2e-s3/{gitlab}/{project_id}' \
+    --alias s3area --grant 'rw:own project' >>"$LOGS/hub-cli.log" 2>&1 || {
+    bad "vk-hub namespaces add e2e-s3 failed"
+    return 1
+  }
+  ci=$({
+    ci_header
+    cat <<'EOF'
+s3:
+  script:
+    - |
+      H=${VK_REGISTRY#http://}
+      HOST=${H%%:*} PORT=80
+      case $H in *:*) PORT=${H##*:} ;; esac
+      req() {
+        printf '%s %s HTTP/1.0\r\nHost: %s\r\nContent-Length: %s\r\nConnection: close\r\n\r\n%s' \
+          "$1" "$2" "$H" "${#3}" "${3:-}" | nc "$HOST" "$PORT" | tr -d '\r'
+      }
+      code() { req "$@" | awk 'NR == 1 { print $2 }'; }
+      BODY=s3-probe-$CI_PIPELINE_ID
+      echo "put=$(code PUT /s3/job/s3area/probe "$BODY")"
+      echo "get=$(code GET /s3/job/s3area/probe)"
+      echo "get-body=$(req GET /s3/job/s3area/probe | sed '1,/^$/d')"
+      LIST=$(req GET '/s3/job/s3area?list-type=2')
+      echo "list=$(printf '%s\n' "$LIST" | awk 'NR == 1 { print $2 }')"
+      echo "list-key=$(printf '%s' "$LIST" | grep -c '<Key>probe</Key>')"
+      echo "list-name=$(printf '%s' "$LIST" | sed -n 's:.*<Name>\([^<]*\)</Name>.*:\1:p')"
+      echo "head=$(code HEAD /s3/job/s3area/probe)"
+      echo "head-length=$(req HEAD /s3/job/s3area/probe | sed -n 's/^[Cc]ontent-[Ll]ength: *//p')"
+      echo "put-nope=$(code PUT /s3/job/nope/x x)"
+      echo "put-images=$(code PUT /s3/images/x x)"
+EOF
+  })
+  p=$(push_scenario registry_s3 <<<"$ci") || return 1
+  wait_pipeline "$p" success || return 1
+  j=$(job "$p" s3)
+  keep_job "$j"
+  local body=s3-probe-$p want
+  for want in put=200 get=200 "get-body=$body" list=200 list-key=1 list-name=s3area head=200 \
+    "head-length=${#body}" put-nope=403 put-images=403; do
+    grep -qE "${LINE}${want}\$" "$RUN/jobs/$j.log" || bad "job $j's trace lacks a line '$want'"
+  done
+  trace_lacks "$j" vkt_
+  SC_DETAIL="pipeline $p: an area's S3 alias written, read, listed and probed; others refused"
+}
+
 sc_services() {
   local p j
   p=$({

From 1b67ef5cbcd9f0b3d56b05901dd8db3c7786458d Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 22:43:18 +0100
Subject: [PATCH 30/54] vk-registry/s3: answer ListObjectVersions as an
 unversioned store

`GET /s3/<bucket>?versions` lists the bucket as S3 lists one that never
had versioning on: the same walk as ListObjects, each object the one
`null` version of its key and the latest, no delete markers, paged by
`key-marker` with the version id marker taken and echoed. That `null`
version names the object itself when sent back: on a DELETE, GET or
HEAD with `?versionId=null`, in a `Delete` document entry and as a copy
source; any other version id stays 501 NotImplemented. Ceph's s3-tests
empty every bucket through the listing and those deletes, so without
them the whole suite errors in setup.
---
 CHANGELOG.md                    |   5 +-
 vk-registry/DESIGN.md           |   9 +-
 vk-registry/s3-compat/README.md |   4 +-
 vk-registry/src/s3/batch.rs     |  14 +--
 vk-registry/src/s3/copy.rs      |  16 +++-
 vk-registry/src/s3/list.rs      | 148 +++++++++++++++++++++++++++++---
 vk-registry/src/s3/mod.rs       |  27 +++++-
 vk-registry/tests/s3_e2e.rs     |  92 +++++++++++++++++---
 8 files changed, 269 insertions(+), 46 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6f8b835..d24bd366 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,8 +12,9 @@ All notable changes to virtkit will be documented in this file.
   `https://<registry>/s3` with any region, and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
-  checksums, given metadata and deleted, and listed page by page, and are the same files WebDAV
-  and `vk registry get` see; a key limited to a directory of a bucket can list that directory.
+  checksums, given metadata and deleted, and listed page by page (as object versions too, for
+  tools that empty a bucket that way), and are the same files WebDAV and `vk registry get`
+  see; a key limited to a directory of a bucket can list that directory.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
   checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
   Buckets can be created and removed, objects copied without their bytes being stored twice
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index ca57a6f6..6bc4b0dc 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -678,16 +678,17 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
-| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
-| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not; `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
-| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through |
 | `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
 | `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
+| `GET /s3/<b>?versions` ListObjectVersions | the same listing as a store that keeps no versions answers it, a `ListVersionsResult` in which each object is a `<Version>` with ListObjects' fields and its `Owner`, `VersionId` `null` and `IsLatest` `true`, with no `<DeleteMarker>`. `key-marker` resumes after a key; `version-id-marker` is taken and echoed as `VersionIdMarker`, a key having one version; `KeyMarker` and, on a truncated page, `NextKeyMarker` with `NextVersionIdMarker` `null` are in the answer, so a paginator sends back what it is given. `list-type` with it, or a `version-id-marker` without a `key-marker`, is 400 `InvalidArgument`. Ceph's s3-tests empty every bucket through it, deleting each key with the `null` version it lists |
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
diff --git a/vk-registry/s3-compat/README.md b/vk-registry/s3-compat/README.md
index 405aa1d5..0bcceea5 100644
--- a/vk-registry/s3-compat/README.md
+++ b/vk-registry/s3-compat/README.md
@@ -113,7 +113,9 @@ Found while bringing the harness up against a build in progress (November 2026):
   teardown empty every test bucket with `list_object_versions`, so a 501 there makes every
   test error before it starts. An unversioned bucket's answer (each key once, `VersionId`
   `null`, `IsLatest` true, no delete markers) is what AWS gives for a bucket that was never
-  versioned.
+  versioned. The teardown then deletes each key with the `VersionId` it was listed with, so
+  `null` has to name the object on DeleteObjects (and DeleteObject) too, or the bucket stays
+  non-empty and every test errors in setup on its `delete_bucket`.
 - **A ranged GET that carries the whole object's `x-amz-checksum-sha256` fails the AWS
   CLI's downloads.** The CLI fetches anything past 8 MiB as parallel ranges, validates each
   206 response's body against the checksum header it carries, and the whole object's does
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index 82d36a46..effa2922 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -9,7 +9,7 @@ use hyper::{Request, Response, StatusCode};
 
 use super::object::{Deleted, admitted, check_body, delete_one, unwritable_message};
 use super::xml::scan::{self, Malformed};
-use super::{Ctx, path, read_small, xml};
+use super::{Ctx, NULL_VERSION, path, read_small, xml};
 use crate::files::{self, Unwritable};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
@@ -27,7 +27,8 @@ const MAX_ELEMENTS: usize = 6 * MAX_KEYS + 16;
 #[derive(Debug, PartialEq, Eq)]
 struct Entry {
     key: String,
-    /// whether it names a version, which this registry does not keep
+    /// whether it names a version other than the object's one, [`NULL_VERSION`], which
+    /// this registry does not keep
     versioned: bool,
 }
 
@@ -57,7 +58,7 @@ fn document(body: &[u8]) -> Result<Asked, Malformed> {
             .ok_or(Malformed("each Object names its Key"))?;
         entries.push(Entry {
             key: key.text.clone(),
-            versioned: o.one("VersionId")?.is_some(),
+            versioned: o.one("VersionId")?.is_some_and(|v| v.text != NULL_VERSION),
         });
     }
     if entries.is_empty() {
@@ -139,7 +140,7 @@ pub(super) async fn delete(
             let outcome = if entry.versioned {
                 Err((
                     "NotImplemented",
-                    "this registry keeps no versions: a key is deleted without a VersionId",
+                    "this registry keeps no versions: a key's one VersionId is null",
                 ))
             } else {
                 // A key the store fails on is that key's error; the batch goes on.
@@ -196,14 +197,15 @@ mod tests {
     fn a_delete_names_its_keys_versions_and_quietness() {
         let asked = document(&body(
             "<Quiet>true</Quiet><Object><Key>a/b</Key></Object>\
-             <Object><VersionId>v</VersionId><Key>c</Key><ETag>\"x\"</ETag></Object>",
+             <Object><VersionId>v</VersionId><Key>c</Key><ETag>\"x\"</ETag></Object>\
+             <Object><Key>d</Key><VersionId>null</VersionId></Object>",
         ))
         .unwrap();
         assert_eq!(
             asked,
             Asked {
                 quiet: true,
-                entries: vec![entry("a/b", false), entry("c", true)],
+                entries: vec![entry("a/b", false), entry("c", true), entry("d", false)],
             }
         );
         let asked = document(&body("<Object><Key>k</Key></Object><Quiet>False</Quiet>")).unwrap();
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index 1a85f951..0f29f7dc 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -12,7 +12,7 @@ use hyper::{Request, Response, StatusCode};
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::object::{admitted, no_such_key, readable, unwritable};
-use super::{Ctx, drain, list, meta, path, refuse, xml};
+use super::{Ctx, NULL_VERSION, drain, list, meta, path, refuse, xml};
 use crate::files::{self, Commit, FILES_REPO, Written, allowed, object_of};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
@@ -24,7 +24,8 @@ pub(super) const COPY_SOURCE: &str = "x-amz-copy-source";
 pub(super) enum Source {
     /// an object: the bucket then the key's components, as [`path::Target::Object`]'s
     Object(Vec<String>),
-    /// one version of an object, which this registry does not keep
+    /// one version of an object other than its [`NULL_VERSION`], which this registry does
+    /// not keep
     Versioned,
     /// nothing this view serves: an S3 error code and the rule
     Invalid(&'static str, &'static str),
@@ -40,7 +41,8 @@ pub(super) fn source(value: &str) -> Source {
         Some((raw, query)) => (raw, Some(query)),
         None => (value, None),
     };
-    if let Some(query) = query {
+    // The null version is the object; the query names nothing else.
+    if let Some(query) = query.filter(|q| q.strip_prefix("versionId=") != Some(NULL_VERSION)) {
         let versioned = query
             .split('&')
             .any(|p| p.split_once('=').map_or(p, |(n, _)| n) == "versionId");
@@ -250,6 +252,7 @@ mod tests {
             "b%2Fa/k",
             "%2Fb/a/k",
             "/b/a/%6B",
+            "/b/a/k?versionId=null",
         ] {
             assert_eq!(source(spelling), object(&["b", "a", "k"]), "{spelling}");
         }
@@ -257,7 +260,12 @@ mod tests {
             source("/b/.sccache_check"),
             object(&["b", ".sccache_check"])
         );
-        for versioned in ["/b/k?versionId=null", "b/k?versionId=3&x=1"] {
+        for versioned in [
+            "/b/k?versionId=1",
+            "b/k?versionId=3&x=1",
+            "b/k?versionId=null&x=1",
+            "b/k?versionId=NULL",
+        ] {
             assert_eq!(source(versioned), Source::Versioned, "{versioned}");
         }
     }
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 91a33b2a..ef698392 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -1,4 +1,6 @@
-//! A bucket's objects: ListObjectsV2 (`?list-type=2`) and ListObjects (v1, `marker`). The
+//! A bucket's objects: ListObjectsV2 (`?list-type=2`), ListObjects (v1, `marker`) and
+//! ListObjectVersions (`?versions`, `key-marker`), the last as a store that keeps no versions
+//! answers it: every object is its one version, `null`, and the latest. The
 //! listing is a depth-first walk of the bucket's directories that yields keys in byte order
 //! of the whole key: a directory's members all start with `<name>/`, so at each level the
 //! directories sort as `<name>/` among the tags, which puts tag `a-b` and `a.b` before
@@ -16,14 +18,14 @@ use hyper::body::Incoming;
 use hyper::{Request, Response, StatusCode};
 
 use super::path::MAX_KEY;
-use super::{Ctx, Params, bucket, conditional, refuse, sigv4, xml};
+use super::{Ctx, NULL_VERSION, Params, bucket, conditional, refuse, sigv4, xml};
 use crate::files::{self, FILES_REPO, Node, Object, allowed, repo_name};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
 /// Most entries a page holds, and what `max-keys` is clamped to: S3's bound.
 const MAX_KEYS: usize = 1000;
 
-/// The query parameters a listing takes, of either version; an SDK's `x-id` hint too.
+/// The query parameters a listing takes, of any of the three; an SDK's `x-id` hint too.
 const PARAMS: &[&str] = &[
     "list-type",
     "prefix",
@@ -32,6 +34,9 @@ const PARAMS: &[&str] = &[
     "continuation-token",
     "start-after",
     "marker",
+    "versions",
+    "key-marker",
+    "version-id-marker",
     "encoding-type",
     "fetch-owner",
     "x-id",
@@ -47,6 +52,11 @@ pub(super) fn is_listing(params: &Params) -> bool {
 struct Query {
     /// `list-type=2`
     v2: bool,
+    /// `?versions`
+    versions: bool,
+    /// `version-id-marker`, as sent, to echo: with one version a key, `key-marker` alone
+    /// says where to resume
+    version_marker: Option<String>,
     prefix: String,
     delimiter: Option<String>,
     max_keys: usize,
@@ -68,7 +78,7 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
         max_keys: MAX_KEYS,
         ..Query::default()
     };
-    let (mut start_after, mut marker) = (None, None);
+    let (mut start_after, mut marker, mut key_marker) = (None, None, None);
     let mut seen: Vec<&str> = Vec::new();
     for (name, value) in params {
         let (name, value) = (name.as_str(), value.clone());
@@ -91,14 +101,27 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
             "continuation-token" => q.token = Some(value),
             "start-after" => start_after = Some(text(value)?),
             "marker" => marker = Some(text(value)?),
+            "versions" if value.is_empty() => q.versions = true,
+            "versions" => return Err("versions takes no value"),
+            "key-marker" => key_marker = Some(text(value)?),
+            "version-id-marker" => q.version_marker = Some(text(value)?),
             "encoding-type" if value == "url" => q.url = true,
             "encoding-type" => return Err("encoding-type is url, or absent"),
             "fetch-owner" => q.owner = value == "true",
             _ => {}
         }
     }
-    // Each version resumes its own way; a first-version listing always names the owner.
-    if q.v2 {
+    // Each listing resumes its own way; the first version and the versions one always name
+    // the owner.
+    if q.versions {
+        if q.v2 {
+            return Err("list-type names ListObjectsV2, which a versions listing is not");
+        }
+        if q.version_marker.is_some() && key_marker.is_none() {
+            return Err("a version-id-marker needs the key-marker it is a version of");
+        }
+        (q.start, q.token, q.owner) = (key_marker, None, true);
+    } else if q.v2 {
         q.start = start_after;
     } else {
         (q.start, q.token, q.owner) = (marker, None, true);
@@ -377,7 +400,7 @@ pub(super) async fn list(
         }
         let (items, truncated) = page(store, authz, &bucket, &q)?;
         Ok(xml::document(
-            "ListBucketResult",
+            q.root(),
             &render(&bucket, &q, &items, truncated),
         ))
     })
@@ -414,18 +437,38 @@ pub(super) fn admitted(authz: &Authz<'_>, bucket: &str, prefix: &str) -> bool {
         })
 }
 
-/// The `ListBucketResult` of a page: its parameters, then the objects, then the common
-/// prefixes, every caller string escaped and, under `encoding-type=url`, encoded.
+impl Query {
+    /// The root element of the document this listing answers with.
+    fn root(&self) -> &'static str {
+        if self.versions {
+            "ListVersionsResult"
+        } else {
+            "ListBucketResult"
+        }
+    }
+}
+
+/// The `ListBucketResult` or `ListVersionsResult` of a page: its parameters, then the
+/// objects (each a `Version` of id `null` in the latter), then the common prefixes, every
+/// caller string escaped and, under `encoding-type=url`, encoded.
 fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
     let enc = |s: &str| if q.url { url_encode(s) } else { s.to_string() };
     let mut out = xml::element("Name", bucket);
     out.push_str(&xml::element("Prefix", &enc(&q.prefix)));
     let next = truncated.then(|| items.last().map(Item::key)).flatten();
-    if !q.v2 {
+    let start = enc(q.start.as_deref().unwrap_or(""));
+    if q.versions {
+        out.push_str(&xml::element("KeyMarker", &start));
         out.push_str(&xml::element(
-            "Marker",
-            &enc(q.start.as_deref().unwrap_or("")),
+            "VersionIdMarker",
+            &enc(q.version_marker.as_deref().unwrap_or("")),
         ));
+        if let Some(next) = next {
+            out.push_str(&xml::element("NextKeyMarker", &enc(next)));
+            out.push_str(&xml::element("NextVersionIdMarker", NULL_VERSION));
+        }
+    } else if !q.v2 {
+        out.push_str(&xml::element("Marker", &start));
         if let Some(next) = next {
             out.push_str(&xml::element("NextMarker", &enc(next)));
         }
@@ -456,10 +499,19 @@ fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
             out.push_str(&xml::element("StartAfter", &enc(start)));
         }
     }
+    let (entry, version) = if q.versions {
+        (
+            "Version",
+            xml::element("VersionId", NULL_VERSION) + &xml::element("IsLatest", "true"),
+        )
+    } else {
+        ("Contents", String::new())
+    };
     for item in items {
         if let Item::Object(key, obj) = item {
-            out.push_str("<Contents>");
+            out.push_str(&format!("<{entry}>"));
             out.push_str(&xml::element("Key", &enc(key)));
+            out.push_str(&version);
             out.push_str(&xml::element("LastModified", &iso8601(obj.modified)));
             out.push_str(&xml::element("ETag", &conditional::etag_of(obj)));
             out.push_str(&xml::element("Size", &obj.size.to_string()));
@@ -467,7 +519,7 @@ fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
                 out.push_str(&bucket::owner());
             }
             out.push_str(&xml::element("StorageClass", "STANDARD"));
-            out.push_str("</Contents>");
+            out.push_str(&format!("</{entry}>"));
         }
     }
     for item in items {
@@ -827,6 +879,10 @@ mod tests {
         assert!(is_listing("list-%74ype=2"));
         assert!(is_listing("list-type=2&prefix=a%2F&delimiter=%2F"));
         assert!(is_listing("marker=a&max-keys=2&x-id=ListObjects"));
+        assert!(is_listing("versions"));
+        assert!(is_listing(
+            "key-marker=a&max-keys=2&version-id-marker=null&versions="
+        ));
         assert!(!is_listing("location"));
         assert!(!is_listing("list-type=2&acl"));
         assert!(!is_listing("uploads"));
@@ -856,6 +912,21 @@ mod tests {
         assert_eq!(parse("").unwrap().max_keys, 1000);
         assert_eq!(parse("max-keys=0").unwrap().max_keys, 0);
         assert!(parse("encoding-type=url").unwrap().url);
+        assert_eq!(parse("").unwrap().root(), "ListBucketResult");
+        // The versions listing: `key-marker` resumes, `version-id-marker` is echoed only.
+        let q = parse("key-marker=a&marker=b&version-id-marker=null&versions").unwrap();
+        assert!(q.versions && q.owner && !q.v2);
+        assert_eq!(
+            (
+                q.start.as_deref(),
+                q.after.as_deref(),
+                q.version_marker.as_deref()
+            ),
+            (Some("a"), Some("a"), Some("null"))
+        );
+        assert_eq!(q.root(), "ListVersionsResult");
+        let q = parse("versions=").unwrap();
+        assert!(q.versions && q.after.is_none() && q.version_marker.is_none());
 
         let bad_token = |t: &[u8]| {
             let token = vk_hub_proto::token::to_base64url(t);
@@ -876,6 +947,10 @@ mod tests {
             "prefix=%0A",
             "prefix=%FF",
             "delimiter=%2",
+            "list-type=2&versions",
+            "version-id-marker=null&versions",
+            "versions=1",
+            "key-marker=%0A&versions",
         ] {
             assert!(parse(bad).is_err(), "{bad}");
         }
@@ -968,5 +1043,50 @@ mod tests {
             iso8601(SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(86_401)),
             "1970-01-02T00:00:01.000Z"
         );
+
+        // The versions listing: each object its `null` version, the latest; the markers
+        // sent back as a paginator sends them, the key's version being `null`.
+        let q = Query {
+            versions: true,
+            version_marker: Some("<v>".to_string()),
+            ..q
+        };
+        let (items, truncated) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+        let xml = render("b", &q, &items, truncated);
+        assert!(
+            xml.starts_with(
+                "<Name>b</Name><Prefix>d/</Prefix><KeyMarker>d/a</KeyMarker>\
+                 <VersionIdMarker>&lt;v&gt;</VersionIdMarker><NextKeyMarker>d/k</NextKeyMarker>\
+                 <NextVersionIdMarker>null</NextVersionIdMarker><MaxKeys>1</MaxKeys>\
+                 <IsTruncated>true</IsTruncated><Version><Key>d/k</Key><VersionId>null</VersionId>\
+                 <IsLatest>true</IsLatest><LastModified>"
+            ),
+            "{xml}"
+        );
+        assert!(
+            xml.contains(&format!(
+                "</Size>{}<StorageClass>STANDARD</StorageClass></Version>",
+                bucket::owner()
+            )),
+            "{xml}"
+        );
+        assert!(!xml.contains("Marker>d/a</Marker") && !xml.contains("Contents"));
+        let q = Query {
+            versions: true,
+            prefix: "d/".to_string(),
+            max_keys: 2,
+            ..Query::default()
+        };
+        let (items, truncated) = page(&t.store, &Authz::NoScopes, "b", &q).unwrap();
+        let xml = render("b", &q, &items, truncated);
+        assert!(
+            xml.starts_with(
+                "<Name>b</Name><Prefix>d/</Prefix><KeyMarker></KeyMarker>\
+                 <VersionIdMarker></VersionIdMarker><MaxKeys>2</MaxKeys>\
+                 <IsTruncated>false</IsTruncated><Version>"
+            ),
+            "{xml}"
+        );
+        assert_eq!(xml.matches("<Version>").count(), 2);
     }
 }
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index fc6475fa..99ca120a 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -248,6 +248,19 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
 /// the method and path do not.
 const OPERATION_HINT: &str = "x-id";
 
+/// The one version every object has, S3's id for an object written while versioning was
+/// off: what ListObjectVersions names each object, and what a request that names it back
+/// (`?versionId=null`, a `VersionId` in a `Delete` document, a copy source's query) asks
+/// for, which is the object itself.
+pub(super) const NULL_VERSION: &str = "null";
+
+/// Whether a query parameter names nothing the path does not: [`OPERATION_HINT`], or the
+/// [`NULL_VERSION`] of the object, which a tool emptying a bucket through
+/// ListObjectVersions sends back with each key.
+fn implicit((name, value): &(String, String)) -> bool {
+    name == OPERATION_HINT || (name == "versionId" && value == NULL_VERSION)
+}
+
 /// A request's query parameters, name and value, in order.
 type Params = [(String, String)];
 
@@ -268,10 +281,10 @@ fn parse_query(raw: &str) -> Option<Vec<(String, String)>> {
 }
 
 /// The subresource a query names (`location`, `attributes`, `uploads`…): `None` for a query
-/// of [`OPERATION_HINT`] at most, `Some("")` when it names more than one parameter or names
-/// one with a value — which nothing served here takes.
+/// of [`implicit`] parameters at most, `Some("")` when it names more than one other
+/// parameter or names one with a value — which nothing served here takes.
 fn subresource(params: &Params) -> Option<&str> {
-    let mut named = params.iter().filter(|(n, _)| n != OPERATION_HINT);
+    let mut named = params.iter().filter(|p| !implicit(p));
     let (name, value) = named.next()?;
     Some(match (value.is_empty(), named.next()) {
         (true, None) => name,
@@ -726,7 +739,13 @@ mod tests {
         assert_eq!(sub("list-type=2"), Some("".to_string()));
         assert_eq!(sub("partNumber=1&uploadId=a"), Some("".to_string()));
         assert_eq!(sub("location&acl"), Some("".to_string()));
-        assert_eq!(sub("versionId=null"), Some("".to_string()));
+        // The null version is the object; any other is nothing served.
+        assert_eq!(sub("versionId=null"), None);
+        assert_eq!(sub("versionId=null&x-id=DeleteObject"), None);
+        assert_eq!(sub("versionId=null&tagging"), Some("tagging".to_string()));
+        assert_eq!(sub("versionId=1"), Some("".to_string()));
+        assert_eq!(sub("versionId="), Some("versionId".to_string()));
+        assert_eq!(sub("versionId=NULL"), Some("".to_string()));
         // Names are decoded as the signature decodes them.
         assert_eq!(sub("upload%73"), Some("uploads".to_string()));
         assert_eq!(sub("x%2Did=GetObject"), None);
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 46538e44..a1956b13 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1919,8 +1919,20 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         .is(404, "NoSuchKey");
 
     // DeleteObject: 204 there or not; a directory has no object to delete; a foreign tag is
-    // not this view's.
-    send(&host, Req::new("DELETE", "/s3/b/k")).await.ok(204);
+    // not this view's. The null version, which ListObjectVersions names, is the object.
+    is_object(
+        &send(&host, Req::new("GET", "/s3/b/k?versionId=null")).await,
+        HELLO,
+    );
+    send(&host, Req::new("GET", "/s3/b/k?versionId=1"))
+        .await
+        .is(501, "NotImplemented");
+    send(&host, Req::new("DELETE", "/s3/b/k?versionId=1"))
+        .await
+        .is(501, "NotImplemented");
+    send(&host, Req::new("DELETE", "/s3/b/k?versionId=null"))
+        .await
+        .ok(204);
     send(&host, Req::new("GET", "/s3/b/k"))
         .await
         .is(404, "NoSuchKey");
@@ -2442,6 +2454,65 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
     }
     assert_eq!(seen, written);
 
+    // The versions: each object the one, `null`, version of its key, paged by key marker
+    // as boto3's paginator pages it, sending back the version id marker it was given.
+    let mut seen = Vec::new();
+    let mut markers: Option<(String, String)> = None;
+    loop {
+        let q = match &markers {
+            Some((key, version)) => format!(
+                "key-marker={}&max-keys=3&version-id-marker={version}&versions=",
+                key.replace('/', "%2F")
+            ),
+            None => "max-keys=3&versions=".to_string(),
+        };
+        let resp = send(host, list(&q)).await;
+        resp.ok(200);
+        assert!(
+            resp.body.starts_with(
+                "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
+                 <ListVersionsResult xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
+                 <Name>sccache</Name><Prefix></Prefix><KeyMarker>"
+            ),
+            "{}",
+            resp.body
+        );
+        let (key, version) = markers.clone().unwrap_or_default();
+        assert_eq!(element(&resp.body, "KeyMarker"), key);
+        assert_eq!(element(&resp.body, "VersionIdMarker"), version);
+        assert!(!resp.body.contains("<Contents>") && !resp.body.contains("DeleteMarker"));
+        let page = keys(&resp.body);
+        assert_eq!(elements(&resp.body, "Version").len(), page.len());
+        assert_eq!(elements(&resp.body, "VersionId"), vec!["null"; page.len()]);
+        assert_eq!(elements(&resp.body, "IsLatest"), vec!["true"; page.len()]);
+        assert_eq!(elements(&resp.body, "Owner").len(), page.len());
+        seen.extend(page);
+        if element(&resp.body, "IsTruncated") == "false" {
+            assert!(!resp.body.contains("NextKeyMarker"));
+            break;
+        }
+        let next = (
+            element(&resp.body, "NextKeyMarker"),
+            element(&resp.body, "NextVersionIdMarker"),
+        );
+        assert_eq!(next, (seen.last().unwrap().clone(), "null".to_string()));
+        markers = Some(next);
+    }
+    assert_eq!(seen, written);
+    let resp = send(host, list("delimiter=%2F&versions=")).await;
+    assert_eq!(keys(&resp.body), [".sccache_check"]);
+    assert_eq!(prefixes(&resp.body), ["ci/"]);
+    for bad in [
+        "list-type=2&versions=",
+        "version-id-marker=null&versions=",
+        "versions=1",
+    ] {
+        send(host, list(bad)).await.is(400, "InvalidArgument");
+    }
+    send(host, sign(Req::new("GET", "/s3/none").query("versions=")))
+        .await
+        .is(404, "NoSuchBucket");
+
     // The other parameters.
     let start = &written[3];
     let resp = send(
@@ -3125,18 +3196,16 @@ async fn objects_are_copied(host: &str, sign: Sign<'_>) -> Vec<u8> {
     assert_eq!(copied(&send(host, sign(req)).await), etag);
     let req = copy("/s3/dst/fresh", "/src/d/k").header("If-None-Match", "*");
     assert_eq!(copied(&send(host, sign(req)).await), etag);
+    // The null version is the source itself.
+    let req = copy("/s3/dst/null", "/src/d/k?versionId=null");
+    assert_eq!(copied(&send(host, sign(req)).await), etag);
 
     // What names no object, or no place for one.
     for (to, from, status, code) in [
         ("/s3/dst/x", "/src/absent", 404, "NoSuchKey"),
         ("/s3/dst/x", "/src/d", 404, "NoSuchKey"),
         ("/s3/dst/x", "/nobucket/k", 404, "NoSuchBucket"),
-        (
-            "/s3/dst/x",
-            "/src/d/k?versionId=null",
-            501,
-            "NotImplemented",
-        ),
+        ("/s3/dst/x", "/src/d/k?versionId=1", 501, "NotImplemented"),
         ("/s3/dst/x", "/src", 400, "InvalidArgument"),
         ("/s3/dst/x", "/src/a%20b", 400, "InvalidArgument"),
         ("/s3/src/d", "/src/d/k", 409, "OperationAborted"),
@@ -3362,14 +3431,15 @@ async fn objects_are_deleted_in_batches(host: &str, sign: Sign<'_>, store: &Stor
             &key_of("a&amp;b"),
             &key_of("d"),
             &key_of("img/v1"),
-            "<Key>c</Key><VersionId>null</VersionId>",
+            "<Key>c</Key><VersionId>1</VersionId>",
             &key_of("d/b"),
             &key_of("x/../y"),
+            "<Key>kept</Key><VersionId>null</VersionId>",
         ],
         false,
     );
     let (deleted, errors) = delete_result(&send(host, sign(delete_objects("batch", doc))).await);
-    assert_eq!(deleted, ["a", "absent", "d", "d/b"]);
+    assert_eq!(deleted, ["a", "absent", "d", "d/b", "kept"]);
     assert_eq!(
         errors,
         [
@@ -3379,7 +3449,7 @@ async fn objects_are_deleted_in_batches(host: &str, sign: Sign<'_>, store: &Stor
             pair("x/../y", "InvalidArgument"),
         ]
     );
-    for gone in ["/s3/batch/a", "/s3/batch/d/b"] {
+    for gone in ["/s3/batch/a", "/s3/batch/d/b", "/s3/batch/kept"] {
         send(host, sign(Req::new("GET", gone)))
             .await
             .is(404, "NoSuchKey");

From e3846dd74d193795c6fca0b1a650aaa6d266ca38 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 22:43:18 +0100
Subject: [PATCH 31/54] vk-registry/s3: carry x-amz-id-2 on every answer

Every /s3/ answer now carries x-amz-id-2, the request id again: S3
sends this second id on every response, and SDK test suites assert it
is there.
---
 vk-registry/DESIGN.md       | 5 +++--
 vk-registry/src/s3/mod.rs   | 8 +++++++-
 vk-registry/tests/s3_e2e.rs | 1 +
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 6bc4b0dc..8b01d105 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -784,8 +784,9 @@ it; they keep the source file's own time in user metadata.
 **Errors** are S3's XML `Error` documents (`Code`, `Message`, `Resource`, `RequestId`, and
 the extra elements AWS sends, such as `ServerTime` or `Condition`), so a client shows a code
 rather than a bare status. Every `/s3/` response carries an `x-amz-request-id` of 16 hex
-digits and `nosniff`; an internal error logs its request id, so a client's report can be
-matched to the server's line. A refusal decided before the caller is authenticated reads at
+digits, the same id again as `x-amz-id-2` (S3's second id, which SDK test suites expect on
+every answer) and `nosniff`; an internal error logs its request id, so a client's report can
+be matched to the server's line. A refusal decided before the caller is authenticated reads at
 most 64 KiB of the body first, enough for `sccache`'s 13-byte probe to see its answer rather
 than a reset; every refusal after it reads the body through, up to the 4 GiB cap, as
 WebDAV's do. A refusal of a request with a body then closes the connection. A registry its
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 99ca120a..3a2b79ef 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -3,7 +3,8 @@
 //! registry already takes (an API key, a hub token, the shared bearer, or the shared Basic
 //! user) and whose signing secret is that same string (the Basic password for the user), so
 //! nothing new is stored; or by the bearer, Basic or session credential the other routes
-//! take. Every answer carries an `x-amz-request-id`, and refusals are S3's XML `Error`.
+//! take. Every answer carries an `x-amz-request-id` (and the same id as `x-amz-id-2`), and
+//! refusals are S3's XML `Error`.
 //! Presigned URLs and temporary credentials are refused.
 //!
 //! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
@@ -80,6 +81,10 @@ const PRE_AUTH_DRAIN: u64 = 64 * 1024;
 /// The header naming each request, for a client's report to be matched to a server line.
 const REQUEST_ID: &str = "x-amz-request-id";
 
+/// S3's second id of a request, carried on every answer as the first one again: SDK test
+/// suites assert it is there, and a client's report may quote either.
+const EXTENDED_ID: &str = "x-amz-id-2";
+
 /// The size from which a written object is stored uncompressed. The AWS CLI and SDK transfer
 /// managers download an object past 8 MiB as parallel 8 MiB ranges, and a range of a
 /// zstd-stored blob is decoded from the blob's start ([`crate::Store::serve_blob_range`]):
@@ -118,6 +123,7 @@ pub(crate) async fn route(
     };
     let headers = resp.headers_mut();
     headers.insert(REQUEST_ID, HeaderValue::from_str(id)?);
+    headers.insert(EXTENDED_ID, HeaderValue::from_str(id)?);
     headers.insert(X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));
     Ok(resp)
 }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index a1956b13..9d130f05 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -483,6 +483,7 @@ impl Resp {
             id.len() == 16 && id.bytes().all(|b| b.is_ascii_hexdigit()),
             "{id}"
         );
+        assert_eq!(self.header("x-amz-id-2"), Some(id));
         assert_eq!(self.header("x-content-type-options"), Some("nosniff"));
         self
     }

From 4b28d1b1cbe890a874cf801365e62af2a449b159 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Thu, 5 Nov 2026 22:47:51 +0100
Subject: [PATCH 32/54] vk-registry/s3: refuse an unknown Authorization scheme
 as malformed

An `Authorization` header of a scheme `/s3/` does not take (SigV2, say),
or with no scheme at all, is 400 `InvalidArgument`, as S3 answers a
signature version it does not support, rather than 403 as a credential
it refused. Basic, Bearer and SigV4 are resolved as before.
---
 vk-registry/DESIGN.md       |  5 +--
 vk-registry/src/s3/mod.rs   | 67 +++++++++++++++++++++++++++++++++----
 vk-registry/tests/s3_e2e.rs | 15 ++++++++-
 3 files changed, 77 insertions(+), 10 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 8b01d105..0e1c9f17 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -616,8 +616,9 @@ and, as S3 requires, every `x-amz-*` header the request carries: one left out is
 it. The request's time must be on the scope's day
 and within 15 minutes of the server's (403 `RequestTimeTooSkewed`, naming the server's
 time). The usual `Authorization: Bearer|Basic` and the session cookie keep working on `/s3/`;
-a request with no credential on a server that requires one is S3's 403 `AccessDenied`, not
-the 401 challenge. On a server with no credential configured, signatures are not checked, as
+an `Authorization` of any other scheme (SigV2, say), or with no scheme at all, is 400
+`InvalidArgument`, as S3 answers a signature version it does not take; a request with no
+credential on a server that requires one is S3's 403 `AccessDenied`, not the 401 challenge. On a server with no credential configured, signatures are not checked, as
 nothing else is. Presigned (query-string) URLs are refused with 400
 `AuthorizationQueryParametersError`, since they put a credential in a URL and so in logs, and
 temporary credentials (`x-amz-security-token`) with 400 `InvalidToken`.
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 3a2b79ef..2ed28369 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -223,13 +223,14 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
         );
         return before_auth(req, resp).await;
     }
-    let signed = headers
-        .get(AUTHORIZATION)
-        .is_some_and(|v| v.as_bytes().starts_with(b"AWS4-HMAC-SHA256 "));
-    let who = if signed {
-        signed_by(state, &req, ctx)
-    } else {
-        presented(state, &req, ctx).map(|who| (who, None))
+    let who = match scheme(headers) {
+        Ok(true) => signed_by(state, &req, ctx),
+        Ok(false) => presented(state, &req, ctx).map(|who| (who, None)),
+        Err(why) => Err(Box::new(ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidArgument",
+            why,
+        ))),
     };
     let (who, seed) = match who {
         Ok(who) => who,
@@ -388,6 +389,32 @@ async fn operate(
     }
 }
 
+/// Whether the `Authorization` header is SigV4's: `false` for none (the session cookie may
+/// stand in) or one of the schemes the other routes take, Basic and Bearer, which
+/// [`presented`] resolves; an error for any other scheme, or a value with no scheme, which
+/// S3 answers 400 as a signature version it does not take rather than 403 as a credential
+/// it refused.
+fn scheme(headers: &HeaderMap) -> std::result::Result<bool, &'static str> {
+    let Some(value) = headers.get(AUTHORIZATION) else {
+        return Ok(false);
+    };
+    let Ok(value) = value.to_str() else {
+        return Err("the Authorization header is not text");
+    };
+    let Some((scheme, _)) = value.split_once(' ') else {
+        return Err("the Authorization header names no scheme: a space follows the scheme");
+    };
+    if scheme == sigv4::ALGORITHM {
+        Ok(true)
+    } else if scheme.eq_ignore_ascii_case("basic") || scheme.eq_ignore_ascii_case("bearer") {
+        Ok(false)
+    } else {
+        Err(
+            "the Authorization scheme is not one this registry takes: AWS4-HMAC-SHA256, Bearer or Basic",
+        )
+    }
+}
+
 /// Answer `resp` once the request body has been read through, as after every refusal of an
 /// authenticated request: a status sent with request bytes unread resets the connection,
 /// which a client sees instead of the answer. A body past the object cap is refused with 413
@@ -681,6 +708,32 @@ fn bearer_of(id: &str) -> Option<HeaderMap> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn an_authorization_scheme_is_sigv4_one_of_ours_or_refused() {
+        let of = |value: Option<&str>| {
+            let mut headers = HeaderMap::new();
+            if let Some(v) = value {
+                headers.insert(AUTHORIZATION, HeaderValue::from_str(v).unwrap());
+            }
+            scheme(&headers)
+        };
+        assert_eq!(of(None), Ok(false));
+        assert_eq!(of(Some("Basic dXNlcjpwYXNz")), Ok(false));
+        assert_eq!(of(Some("bearer vkr_x")), Ok(false));
+        assert_eq!(of(Some("AWS4-HMAC-SHA256 Credential=x")), Ok(true));
+        for bad in [
+            "",
+            "invalid_header",
+            "Basic",
+            "aws4-hmac-sha256 Credential=x",
+            "AWS2-HMAC-SHA1 Credential=x",
+            "AWS AKID:sig",
+            "Digest username=x",
+        ] {
+            assert!(of(Some(bad)).is_err(), "{bad:?}");
+        }
+    }
+
     #[test]
     fn only_s3_paths_are_s3() {
         for p in ["/s3", "/s3/", "/s3/b", "/s3/b/k"] {
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 9d130f05..b41a5188 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -610,6 +610,18 @@ async fn send(host: &str, req: Req) -> Resp {
 /// the key it takes as `good`: each one's answer, over a mode's `host`.
 async fn sigv4_refusals(host: &str, good: (&str, &str)) {
     let get = || Req::new("GET", "/s3/b/k");
+    // A header with no scheme, or of a scheme this registry does not take.
+    for value in [
+        "invalid_header",
+        "AWS2-HMAC-SHA1 Credential=x/20260101/us-east-1/s3/aws4_request, \
+         SignedHeaders=host, Signature=00",
+        "AWS AKIDNOTAKEY:c2ln",
+        "Digest username=x",
+    ] {
+        send(host, get().header("Authorization", value))
+            .await
+            .is(400, "InvalidArgument");
+    }
     // An id it does not know, whose signature is consistent with it.
     send(host, get().signed(host, ("AKIDNOTAKEY", "AKIDNOTAKEY"), 0))
         .await
@@ -754,9 +766,10 @@ async fn a_shared_bearer_is_the_access_key_and_its_secret() {
     send(&host, get().header("Authorization", "Bearer nope"))
         .await
         .is(403, "AccessDenied");
+    // A scheme this registry does not take is malformed, not refused.
     send(&host, get().header("Authorization", "AWS AKID:sig"))
         .await
-        .is(403, "AccessDenied");
+        .is(400, "InvalidArgument");
     // The bearer itself still works, as on `/dav/`.
     send(&host, get().header("Authorization", "Bearer s3cret"))
         .await

From a15078cce9c6a65ea98a373abe83eb1da2832c4f Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 00:16:41 +0100
Subject: [PATCH 33/54] vk-registry/s3: refuse a write that asks for what is
 not kept

A request whose headers ask for server-side encryption (SSE-S3, SSE-KMS
or SSE-C, on a read or a copy's source too), object tags, an ACL other
than the owner's, a grant, a storage class other than STANDARD, a
website redirect or object lock is now 501 NotImplemented, as the PUT
of that configuration already is, rather than taken with the header
dropped. Until now a client that asked for its object to be encrypted
under its own key was answered 200 while the bytes were stored and
served plain. A storage class S3 does not have is 400
InvalidStorageClass; an empty x-amz-tagging, no tags, asks for nothing
and is taken.
---
 CHANGELOG.md                 |   4 +-
 vk-registry/DESIGN.md        |   6 +-
 vk-registry/src/s3/bucket.rs |   3 +-
 vk-registry/src/s3/canned.rs | 154 ++++++++++++++++++++++++++++++++++-
 vk-registry/src/s3/mod.rs    |   9 +-
 vk-registry/tests/s3_e2e.rs  |  83 +++++++++++++++++++
 6 files changed, 251 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d24bd366..a4c17eea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,9 @@ All notable changes to virtkit will be documented in this file.
   checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
   Buckets can be created and removed, objects copied without their bytes being stored twice
   and deleted in batches, and the configuration probes tools send before using a bucket
-  (versioning, ACLs, tagging and the like) are answered as for a bucket with none set. Large
+  (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
+  write asking for one of them — encryption under the client's own key, tags, an ACL, a
+  storage class, a redirect, a retention lock — is refused rather than stored without it. Large
   files can be uploaded in parts, as the AWS CLI uploads them, parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 0e1c9f17..5c038c9e 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -684,16 +684,16 @@ reads; a replaced object keeps only what its own write sent.
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
-| `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB and `x-amz-acl` are taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented` |
+| `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
-| `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through |
+| `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through. So is any request whose headers ask for one of them on the object or bucket it names, rather than the header being taken and dropped: `x-amz-server-side-encryption*` (SSE-S3, SSE-KMS and SSE-C, on a read and a copy's source too: a client that asked for its own key is never told its bytes are stored under it), `x-amz-tagging` naming a tag, `x-amz-acl` other than `private` or `bucket-owner-full-control` (the one ACL there is), `x-amz-grant-*`, `x-amz-storage-class` other than `STANDARD` (400 `InvalidStorageClass` for a class S3 does not have), `x-amz-website-redirect-location` and `x-amz-object-lock-*` |
 | `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
 | `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
 | `GET /s3/<b>?versions` ListObjectVersions | the same listing as a store that keeps no versions answers it, a `ListVersionsResult` in which each object is a `<Version>` with ListObjects' fields and its `Owner`, `VersionId` `null` and `IsLatest` `true`, with no `<DeleteMarker>`. `key-marker` resumes after a key; `version-id-marker` is taken and echoed as `VersionIdMarker`, a key having one version; `KeyMarker` and, on a truncated page, `NextKeyMarker` with `NextVersionIdMarker` `null` are in the answer, so a paginator sends back what it is given. `list-type` with it, or a `version-id-marker` without a `key-marker`, is 400 `InvalidArgument`. Ceph's s3-tests empty every bucket through it, deleting each key with the `null` version it lists |
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed; `x-amz-copy-source` is 400 `InvalidArgument` |
+| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-{sha256,sha1,crc32}` is checked against the object (400 `BadDigest`); a composite one (`…-<parts>`) or another algorithm is taken unchecked. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index f12ee59d..f72196f9 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -157,7 +157,8 @@ const MAX_CONFIGURATION: usize = 1024;
 /// `PUT /s3/<bucket>`: the directory `files/<bucket>`, made as WebDAV's `MKCOL` makes it,
 /// under the namespace lock. 200 with its `Location`; 409 `BucketAlreadyOwnedByYou` when it
 /// is a directory already, which every bucket's owner is. A `CreateBucketConfiguration` body
-/// and `x-amz-acl` are taken and ignored; asking for object lock is `NotImplemented`.
+/// is taken and ignored; asking for object lock is `NotImplemented`, as asking for an ACL
+/// is ([`super::canned::asked`]).
 pub(super) async fn create(
     state: &ServerState,
     authz: &Authz<'_>,
diff --git a/vk-registry/src/s3/canned.rs b/vk-registry/src/s3/canned.rs
index ed4a686a..5ebead4e 100644
--- a/vk-registry/src/s3/canned.rs
+++ b/vk-registry/src/s3/canned.rs
@@ -1,11 +1,14 @@
 //! The configuration a bucket or an object is asked for, answered as S3 answers for one
 //! with nothing configured: tools probe versioning, tagging, ACLs, lifecycle and the rest
 //! before they use a bucket, and go on when they hear there is none. Nothing of it can be
-//! set here; a `PUT` or `DELETE` of any of them is `NotImplemented`.
+//! set here: a `PUT` or `DELETE` of any of them is `NotImplemented`, and so is a request
+//! whose headers ask for one on the object or bucket it writes ([`asked`]).
 
+use hyper::header::HeaderMap;
 use hyper::{Response, StatusCode};
 
 use super::bucket::{OWNER, owner};
+use super::object::Refused;
 use super::xml;
 
 /// What a configuration read answers.
@@ -87,6 +90,86 @@ pub(super) fn object(sub: &str) -> Option<Canned> {
     })
 }
 
+/// The storage classes S3 has: `STANDARD` is the one here, the others are not served, and
+/// anything else is no class at all.
+const STORAGE_CLASSES: [&str; 10] = [
+    "STANDARD",
+    "REDUCED_REDUNDANCY",
+    "STANDARD_IA",
+    "ONEZONE_IA",
+    "INTELLIGENT_TIERING",
+    "GLACIER",
+    "DEEP_ARCHIVE",
+    "OUTPOSTS",
+    "GLACIER_IR",
+    "EXPRESS_ONEZONE",
+];
+
+/// What a request's headers ask for that this registry keeps nothing of, refused as the
+/// `PUT` of that configuration is rather than taken and dropped: a client that asked for its
+/// object to be encrypted under its own key would otherwise be told it was, and the bytes
+/// stored and served plain. Encryption of any kind (SSE-S3, SSE-KMS, SSE-C, on a read or a
+/// copy's source too), object tags, an ACL other than the one every object has, a grant, a
+/// storage class other than `STANDARD`, a website redirect and object lock are
+/// `NotImplemented`; a storage class S3 does not have is `InvalidStorageClass`.
+pub(super) fn asked(headers: &HeaderMap) -> Option<Refused> {
+    let not_implemented = |message| (StatusCode::NOT_IMPLEMENTED, "NotImplemented", message);
+    for name in headers.keys() {
+        let name = name.as_str();
+        if name.contains("server-side-encryption") {
+            return Some(not_implemented(
+                "this registry stores objects unencrypted and takes no encryption key: send \
+                 no x-amz-server-side-encryption header",
+            ));
+        }
+        // No tags at all is what every object has.
+        if name == "x-amz-tagging" && headers.get_all(name).iter().any(|v| !v.is_empty()) {
+            return Some(not_implemented("this registry keeps no object tags"));
+        }
+        if name.starts_with("x-amz-grant-") {
+            return Some(not_implemented(
+                "this registry keeps no ACL but the owner's: send no x-amz-grant header",
+            ));
+        }
+        if name.starts_with("x-amz-object-lock-") {
+            return Some(not_implemented("this registry keeps no object lock"));
+        }
+        if name == "x-amz-website-redirect-location" {
+            return Some(not_implemented(
+                "this registry keeps no website configuration",
+            ));
+        }
+    }
+    // The ACL every object and bucket has, by either of its names, asks for nothing new.
+    if headers
+        .get_all("x-amz-acl")
+        .iter()
+        .any(|v| !matches!(v.as_bytes(), b"private" | b"bucket-owner-full-control"))
+    {
+        return Some(not_implemented(
+            "this registry keeps no ACL but the owner's: x-amz-acl is private, \
+             bucket-owner-full-control or absent",
+        ));
+    }
+    for value in headers.get_all("x-amz-storage-class") {
+        let class = value.to_str().unwrap_or_default();
+        if class == "STANDARD" {
+            continue;
+        }
+        if STORAGE_CLASSES.contains(&class) {
+            return Some(not_implemented(
+                "this registry stores every object as STANDARD",
+            ));
+        }
+        return Some((
+            StatusCode::BAD_REQUEST,
+            "InvalidStorageClass",
+            "the storage class you specified is not valid",
+        ));
+    }
+    None
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -128,6 +211,75 @@ mod tests {
         assert!(object("versioning").is_none() && object("retention").is_none());
     }
 
+    #[test]
+    fn headers_asking_for_what_is_not_kept_are_refused() {
+        let of = |pairs: &[(&str, &str)]| {
+            let mut h = HeaderMap::new();
+            for (n, v) in pairs {
+                h.append(
+                    hyper::header::HeaderName::from_bytes(n.as_bytes()).unwrap(),
+                    hyper::header::HeaderValue::from_str(v).unwrap(),
+                );
+            }
+            asked(&h).map(|(status, code, _)| (status.as_u16(), code))
+        };
+        assert_eq!(of(&[]), None);
+        assert_eq!(
+            of(&[
+                ("x-amz-acl", "private"),
+                ("x-amz-storage-class", "STANDARD"),
+                ("x-amz-meta-x", "1"),
+                ("x-amz-tagging-directive", "COPY"),
+                ("content-type", "text/plain"),
+            ]),
+            None
+        );
+        assert_eq!(of(&[("x-amz-acl", "bucket-owner-full-control")]), None);
+        assert_eq!(of(&[("x-amz-tagging", "")]), None);
+        let refused = Some((501, "NotImplemented"));
+        for (name, value) in [
+            ("x-amz-server-side-encryption", "AES256"),
+            ("x-amz-server-side-encryption", "aws:kms"),
+            ("x-amz-server-side-encryption-aws-kms-key-id", "k"),
+            ("x-amz-server-side-encryption-customer-algorithm", "AES256"),
+            ("x-amz-server-side-encryption-customer-key", "a2V5"),
+            ("x-amz-server-side-encryption-customer-key-md5", "bWQ1"),
+            ("x-amz-server-side-encryption-bucket-key-enabled", "true"),
+            (
+                "x-amz-copy-source-server-side-encryption-customer-algorithm",
+                "AES256",
+            ),
+            ("x-amz-tagging", "a=b"),
+            ("x-amz-acl", "public-read"),
+            ("x-amz-acl", "PRIVATE"),
+            ("x-amz-grant-read", "id=x"),
+            ("x-amz-grant-full-control", "id=x"),
+            ("x-amz-storage-class", "GLACIER"),
+            ("x-amz-storage-class", "REDUCED_REDUNDANCY"),
+            ("x-amz-website-redirect-location", "/x"),
+            ("x-amz-object-lock-mode", "GOVERNANCE"),
+            (
+                "x-amz-object-lock-retain-until-date",
+                "2030-01-01T00:00:00Z",
+            ),
+            ("x-amz-object-lock-legal-hold", "ON"),
+        ] {
+            assert_eq!(of(&[(name, value)]), refused, "{name}: {value}");
+        }
+        for bad in ["INVALID_CLASS", "standard", ""] {
+            assert_eq!(
+                of(&[("x-amz-storage-class", bad)]),
+                Some((400, "InvalidStorageClass")),
+                "{bad:?}"
+            );
+        }
+        // Checked in that order: a refusal names the first thing asked for.
+        assert_eq!(
+            of(&[("x-amz-acl", "public-read"), ("x-amz-storage-class", "x")]),
+            refused
+        );
+    }
+
     #[test]
     fn the_acl_grants_the_owner_everything() {
         let Some(Canned::Document(root, inner)) = bucket("acl") else {
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 2ed28369..97881ef7 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -300,8 +300,10 @@ fn subresource(params: &Params) -> Option<&str> {
 }
 
 /// An authenticated request, to the operation its method, path and query name. What is not
-/// served answers `NotImplemented` once the body is read, as every refusal past the gate does.
-/// `seed` is what a signed `aws-chunked` body's signatures are checked against.
+/// served answers `NotImplemented` once the body is read, as every refusal past the gate does;
+/// so does a request whose headers ask for a configuration this registry keeps nothing of
+/// ([`canned::asked`]), whatever its operation. `seed` is what a signed `aws-chunked` body's
+/// signatures are checked against.
 async fn operate(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -324,6 +326,9 @@ async fn operate(
         );
         return refuse(req, resp, ctx).await;
     };
+    if let Some((status, code, message)) = canned::asked(req.headers()) {
+        return refuse(req, ctx.error(status, code, message), ctx).await;
+    }
     let sub = subresource(&query);
     let method = req.method().clone();
     match (target, &method, sub) {
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index b41a5188..e7c787ae 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1768,6 +1768,89 @@ async fn user_metadata_round_trips_and_no_content_type_is_kept() {
         .is(404, "NoSuchKey");
 }
 
+/// A header asking for a configuration this registry keeps nothing of — encryption, tags,
+/// an ACL, a storage class, a redirect, a lock — refuses the request rather than being
+/// dropped: nothing is written under it, and a read asking for a key gets no bytes.
+#[tokio::test]
+async fn headers_asking_for_what_is_not_kept_refuse_the_request() {
+    let dir = tmp("asked");
+    let host = spawn(open_state(&dir, true));
+    let put = |name: &str, value: &str| {
+        Req::new("PUT", "/s3/b/asked")
+            .header(name, value)
+            .body(HELLO.to_vec())
+    };
+    for (name, value) in [
+        ("x-amz-server-side-encryption", "AES256"),
+        ("x-amz-server-side-encryption-customer-algorithm", "AES256"),
+        ("x-amz-server-side-encryption-customer-key", "a2V5"),
+        ("x-amz-tagging", "a=b"),
+        ("x-amz-acl", "public-read"),
+        (
+            "x-amz-grant-read",
+            "uri=http://acs.amazonaws.com/groups/global/AllUsers",
+        ),
+        ("x-amz-storage-class", "GLACIER"),
+        ("x-amz-website-redirect-location", "/elsewhere"),
+        ("x-amz-object-lock-legal-hold", "ON"),
+    ] {
+        send(&host, put(name, value))
+            .await
+            .is(501, "NotImplemented");
+    }
+    send(&host, put("x-amz-storage-class", "INVALID_CLASS"))
+        .await
+        .is(400, "InvalidStorageClass");
+    send(&host, Req::new("GET", "/s3/b/asked"))
+        .await
+        .is(404, "NoSuchKey");
+    // The one ACL and the one storage class there are ask for nothing.
+    send(
+        &host,
+        put("x-amz-acl", "private").header("x-amz-storage-class", "STANDARD"),
+    )
+    .await
+    .ok(200);
+    is_object(&send(&host, Req::new("GET", "/s3/b/asked")).await, HELLO);
+    // A read asking to decrypt with a key it brings is refused, as is a copy from such a
+    // source, and a bucket asking for an ACL.
+    for req in [
+        Req::new("GET", "/s3/b/asked")
+            .header("x-amz-server-side-encryption-customer-algorithm", "AES256")
+            .header("x-amz-server-side-encryption-customer-key", "a2V5"),
+        Req::new("PUT", "/s3/b/copy")
+            .header("x-amz-copy-source", "/b/asked")
+            .header(
+                "x-amz-copy-source-server-side-encryption-customer-key",
+                "a2V5",
+            ),
+        Req::new("POST", "/s3/b/up")
+            .query("uploads=")
+            .header("x-amz-tagging", "a=b"),
+        Req::new("PUT", "/s3/c").header("x-amz-acl", "public-read-write"),
+    ] {
+        send(&host, req).await.is(501, "NotImplemented");
+    }
+    let head =
+        Req::new("HEAD", "/s3/b/asked").header("x-amz-server-side-encryption-customer-key", "a2V5");
+    send(&host, head).await.ok(501);
+    send(&host, Req::new("GET", "/s3/b/copy"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, Req::new("HEAD", "/s3/c")).await.ok(404);
+    send(
+        &host,
+        Req::new("PUT", "/s3/c").header("x-amz-acl", "private"),
+    )
+    .await
+    .ok(200);
+    let copy = Req::new("PUT", "/s3/b/copy")
+        .header("x-amz-copy-source", "/b/asked")
+        .header("x-amz-tagging-directive", "REPLACE")
+        .header("x-amz-tagging", "");
+    send(&host, copy).await.ok(200);
+}
+
 #[tokio::test]
 async fn conditional_headers_decide_reads_and_writes() {
     let dir = tmp("conditional");

From 3edf177199bee73b2c865b821bf2aac0941ee3c6 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 00:29:47 +0100
Subject: [PATCH 34/54] vk-registry/s3: check, keep and list the checksum a
 write carries

A write's x-amz-checksum header or trailer is now checked in every
algorithm S3 has that this registry computes: CRC32C, CRC64NVME,
SHA-512 and MD5 join CRC32, SHA-1 and SHA-256, with the crc crate
already in the tree. One checksum may be sent, as S3 has it; one in
S3's XXHASH family, or any other algorithm, is 501 NotImplemented
rather than taken unchecked; a checksum that does not hold is refused
in S3's words, naming the algorithm, and an x-amz-sdk-checksum-algorithm
naming another algorithm than the header's or the trailer's is 400
InvalidRequest.

The checksum that held is kept on the object's manifest and is the
object's from then on: sent back on a read asking for it, as
ChecksumAlgorithm and ChecksumType in listings, in its attributes, and
by a copy. A completed multipart upload keeps the whole-object
checksum that held in the same way; one that is neither a full
checksum nor a composite one is 400 InvalidRequest. Clients that
compare a listing's checksum algorithm with what they uploaded
(versitygw's suite crashes without it) now see it.
---
 CHANGELOG.md                    |   4 +-
 Cargo.lock                      |   1 +
 Cargo.toml                      |   3 +
 vk-registry/Cargo.toml          |   3 +-
 vk-registry/DESIGN.md           |  14 +-
 vk-registry/src/s3/checksum.rs  | 364 ++++++++++++++++++++++++++++++++
 vk-registry/src/s3/chunked.rs   |  12 +-
 vk-registry/src/s3/copy.rs      |  14 +-
 vk-registry/src/s3/list.rs      |  10 +-
 vk-registry/src/s3/mod.rs       |   4 +-
 vk-registry/src/s3/multipart.rs | 162 ++++++++------
 vk-registry/src/s3/object.rs    | 364 +++++++++++++++++++++-----------
 vk-registry/tests/s3_e2e.rs     | 248 ++++++++++++++++++++--
 13 files changed, 961 insertions(+), 242 deletions(-)
 create mode 100644 vk-registry/src/s3/checksum.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4c17eea..d59e619b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,7 +12,9 @@ All notable changes to virtkit will be documented in this file.
   `https://<registry>/s3` with any region, and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
-  checksums, given metadata and deleted, and listed page by page (as object versions too, for
+  checksums (in S3's algorithms but the XXHASH family, checked on upload and kept with the
+  object), given
+  metadata and deleted, and listed page by page (as object versions too, for
   tools that empty a bucket that way), and are the same files WebDAV and `vk registry get`
   see; a key limited to a directory of a bucket can list that directory.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
diff --git a/Cargo.lock b/Cargo.lock
index 9cd85fb4..ffa6bdea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4304,6 +4304,7 @@ dependencies = [
  "anyhow",
  "bytes",
  "clap",
+ "crc",
  "crc32fast",
  "futures",
  "hmac",
diff --git a/Cargo.toml b/Cargo.toml
index d1a8bce5..3d0f03f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -136,6 +136,9 @@ sha1 = "0.11"
 md5 = "0.8"
 # vk-registry: the check of an S3 upload's x-amz-checksum-crc32. Already in the tree via flate2.
 crc32fast = "1.5"
+# vk-registry: the check of an S3 upload's x-amz-checksum-crc32c and -crc64nvme, from its
+# catalog. Already in the tree via lzma-rs.
+crc = "3"
 # vk-tpm: the TPM's entropy (TPM2_GetRandom, its seeds) from the OS. Already in the tree via rand.
 getrandom = "0.4"
 # vk-tpm: constant-time comparison of authorization values. Already in the tree via the
diff --git a/vk-registry/Cargo.toml b/vk-registry/Cargo.toml
index 93908a47..302a992c 100644
--- a/vk-registry/Cargo.toml
+++ b/vk-registry/Cargo.toml
@@ -36,10 +36,11 @@ tokio-rustls = { version = "0.26", default-features = false, features = ["ring",
 oci-client.workspace = true
 sha2.workspace = true
 # The digests S3 clients send or expect beside SHA-256: an object's MD5 (its ETag), and the
-# SHA-1 and CRC32 an upload may be checked against.
+# SHA-1, CRC32, CRC32C and CRC64NVME an upload may be checked against.
 md5.workspace = true
 sha1.workspace = true
 crc32fast.workspace = true
+crc.workspace = true
 # SigV4's HMAC chain for /s3/; zeroize wipes the keys it derives.
 hmac.workspace = true
 zeroize.workspace = true
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 5c038c9e..55487edf 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -672,22 +672,22 @@ which a `PutObject` computes in the same pass as the SHA-256 and records on the
 MD5 and its ETag is its SHA-256, quoted — 64 hex digits, which a client checking an ETag as
 an MD5 sees is not one. An object a multipart upload made has S3's multipart ETag,
 `"<MD5 of its parts' MD5s>-<parts>"`, recorded in the same annotation, so GetObject, HeadObject,
-the listings and a copy's source all answer it. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
+the listings and a copy's source all answer it. The `x-amz-checksum-*` a write carried, once it held, is kept as `org.virtkit.s3-checksum` and is the object's checksum from then on, in listings and on reads. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
 of names and values) is kept on the manifest as `org.virtkit.s3-meta.<name>` and sent back on
 reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}`, as headers or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed) and the checksums echoed; `crc32c` and `crc64nvme` are taken unchecked. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; `x-amz-checksum-sha256` (the store's digest, base64) with `x-amz-checksum-mode: ENABLED`. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
-| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
-| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) is kept; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) and the checksum it kept come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through. So is any request whose headers ask for one of them on the object or bucket it names, rather than the header being taken and dropped: `x-amz-server-side-encryption*` (SSE-S3, SSE-KMS and SSE-C, on a read and a copy's source too: a client that asked for its own key is never told its bytes are stored under it), `x-amz-tagging` naming a tag, `x-amz-acl` other than `private` or `bucket-owner-full-control` (the one ACL there is), `x-amz-grant-*`, `x-amz-storage-class` other than `STANDARD` (400 `InvalidStorageClass` for a class S3 does not have), `x-amz-website-redirect-location` and `x-amz-object-lock-*` |
-| `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
+| `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `ChecksumAlgorithm` and `ChecksumType` when its write kept a checksum, `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
 | `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
 | `GET /s3/<b>?versions` ListObjectVersions | the same listing as a store that keeps no versions answers it, a `ListVersionsResult` in which each object is a `<Version>` with ListObjects' fields and its `Owner`, `VersionId` `null` and `IsLatest` `true`, with no `<DeleteMarker>`. `key-marker` resumes after a key; `version-id-marker` is taken and echoed as `VersionIdMarker`, a key having one version; `KeyMarker` and, on a truncated page, `NextKeyMarker` with `NextVersionIdMarker` `null` are in the answer, so a paginator sends back what it is given. `list-type` with it, or a `version-id-marker` without a `key-marker`, is 400 `InvalidArgument`. Ceph's s3-tests empty every bucket through it, deleting each key with the `null` version it lists |
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
@@ -696,7 +696,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-{sha256,sha1,crc32}` is checked against the object (400 `BadDigest`); a composite one (`…-<parts>`) or another algorithm is taken unchecked. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload` |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
new file mode 100644
index 00000000..17b6dcb3
--- /dev/null
+++ b/vk-registry/src/s3/checksum.rs
@@ -0,0 +1,364 @@
+//! The checksum a write may carry of its body, `x-amz-checksum-<algorithm>` as a header or
+//! as an `aws-chunked` body's trailer, in the algorithms S3 has that this registry computes
+//! (CRC32, CRC32C, SHA1, SHA256, CRC64NVME, SHA512, MD5; the XXHASH family is refused rather
+//! than taken unchecked): one at most, checked against what arrived, echoed once it held,
+//! kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`) and from there
+//! sent back on reads asking for it, listed with the object and reported among its
+//! attributes, as the checksum of the whole object (`FULL_OBJECT`).
+
+use std::collections::BTreeMap;
+
+use hyper::header::{HeaderName, HeaderValue};
+use sha2::Digest as _;
+
+use super::xml;
+
+/// The manifest annotation holding an object's checksum: S3's name of the algorithm, a
+/// colon, the checksum in base64.
+pub(crate) const ANNOTATION: &str = "org.virtkit.s3-checksum";
+
+/// S3's name for how a kept checksum was made: of the whole object in one pass.
+pub(super) const FULL_OBJECT: &str = "FULL_OBJECT";
+
+/// The header announcing or answering with that.
+pub(super) const TYPE_HEADER: &str = "x-amz-checksum-type";
+
+/// The algorithms computed here: the header carrying each, S3's name for it, and its length
+/// in bytes.
+pub(super) const ALGORITHMS: [(&str, &str, usize); 7] = [
+    ("x-amz-checksum-crc32", "CRC32", 4),
+    ("x-amz-checksum-crc32c", "CRC32C", 4),
+    ("x-amz-checksum-sha1", "SHA1", 20),
+    ("x-amz-checksum-sha256", "SHA256", 32),
+    ("x-amz-checksum-crc64nvme", "CRC64NVME", 8),
+    ("x-amz-checksum-sha512", "SHA512", 64),
+    ("x-amz-checksum-md5", "MD5", 16),
+];
+
+/// The prefix of every checksum header, S3's and any it may add.
+pub(super) const HEADER_PREFIX: &str = "x-amz-checksum-";
+
+/// The header an SDK names the algorithm of its checksum in, beside the checksum itself.
+pub(super) const SDK_ALGORITHM: &str = "x-amz-sdk-checksum-algorithm";
+
+/// The refusal of a checksum in an algorithm not computed here (S3's XXHASH64, XXHASH3 and
+/// XXHASH128, or anything else), rather than the checksum taken unchecked and the object
+/// then listed without it.
+pub(super) const NOT_COMPUTED: super::object::Refused = (
+    hyper::StatusCode::NOT_IMPLEMENTED,
+    "NotImplemented",
+    "the checksum algorithms this registry computes are CRC32, CRC32C, SHA1, SHA256, \
+     CRC64NVME, SHA512 and MD5",
+);
+
+/// The refusal of a checksum that did not hold, as S3 words it, naming the algorithm.
+pub(super) fn mismatch(header: &str) -> super::object::Refused {
+    let message = match header {
+        "x-amz-checksum-crc32" => "The CRC32 you specified did not match the calculated checksum.",
+        "x-amz-checksum-crc32c" => {
+            "The CRC32C you specified did not match the calculated checksum."
+        }
+        "x-amz-checksum-sha1" => "The SHA1 you specified did not match the calculated checksum.",
+        "x-amz-checksum-sha256" => {
+            "The SHA256 you specified did not match the calculated checksum."
+        }
+        "x-amz-checksum-crc64nvme" => {
+            "The CRC64NVME you specified did not match the calculated checksum."
+        }
+        "x-amz-checksum-sha512" => {
+            "The SHA512 you specified did not match the calculated checksum."
+        }
+        _ => "The MD5 you specified did not match the calculated checksum.",
+    };
+    (hyper::StatusCode::BAD_REQUEST, "BadDigest", message)
+}
+
+/// The refusal of a [`SDK_ALGORITHM`] naming an algorithm other than the checksum header's.
+pub(super) const ALGORITHM_MISMATCH: super::object::Refused = (
+    hyper::StatusCode::BAD_REQUEST,
+    "InvalidRequest",
+    "Value for x-amz-sdk-checksum-algorithm header is invalid.",
+);
+
+/// Whether `headers` name a checksum, by header or by [`SDK_ALGORITHM`], in an algorithm
+/// not computed here.
+pub(super) fn not_computed(headers: &hyper::header::HeaderMap) -> bool {
+    let known = |name: &str| ALGORITHMS.iter().any(|(h, _, _)| *h == name);
+    headers
+        .keys()
+        .any(|k| k.as_str().starts_with(HEADER_PREFIX) && !known(k.as_str()))
+        || headers.get_all(SDK_ALGORITHM).iter().any(|v| {
+            !ALGORITHMS
+                .iter()
+                .any(|(_, name, _)| v.as_bytes().eq_ignore_ascii_case(name.as_bytes()))
+        })
+}
+
+/// CRC-32C (Castagnoli), as S3's `CRC32C`.
+static CRC32C: crc::Crc<u32> = crc::Crc::<u32>::new(&crc::CRC_32_ISCSI);
+
+/// CRC-64/NVME, as S3's `CRC64NVME`.
+static CRC64NVME: crc::Crc<u64> = crc::Crc::<u64>::new(&crc::CRC_64_NVME);
+
+/// How many bytes the checksum `header` carries is, for one of [`ALGORITHMS`].
+pub(super) fn len(header: &str) -> Option<usize> {
+    ALGORITHMS
+        .iter()
+        .find(|(h, _, _)| *h == header)
+        .map(|(_, _, len)| *len)
+}
+
+/// S3's name of the algorithm `header` carries.
+pub(super) fn algorithm(header: &str) -> Option<&'static str> {
+    ALGORITHMS
+        .iter()
+        .find(|(h, _, _)| *h == header)
+        .map(|(_, name, _)| *name)
+}
+
+/// The header carrying `algorithm`'s checksum, by S3's name of it.
+fn header(algorithm: &str) -> Option<&'static str> {
+    ALGORITHMS
+        .iter()
+        .find(|(_, name, _)| *name == algorithm)
+        .map(|(h, _, _)| *h)
+}
+
+/// A digest of a body as it streams, in the algorithm `header` names: SHA-256 is left to
+/// the store, which names every blob by it.
+pub(super) enum Hasher {
+    Crc32(crc32fast::Hasher),
+    Crc32c(crc::Digest<'static, u32>),
+    Sha1(sha1::Sha1),
+    Crc64nvme(crc::Digest<'static, u64>),
+    Sha512(sha2::Sha512),
+    Md5(md5::Context),
+}
+
+impl Hasher {
+    /// The hasher for `header`'s algorithm: `None` for SHA-256, and for no algorithm.
+    pub(super) fn for_(header: &str) -> Option<Self> {
+        Some(match header {
+            "x-amz-checksum-crc32" => Hasher::Crc32(crc32fast::Hasher::new()),
+            "x-amz-checksum-crc32c" => Hasher::Crc32c(CRC32C.digest()),
+            "x-amz-checksum-sha1" => Hasher::Sha1(sha1::Sha1::new()),
+            "x-amz-checksum-crc64nvme" => Hasher::Crc64nvme(CRC64NVME.digest()),
+            "x-amz-checksum-sha512" => Hasher::Sha512(sha2::Sha512::new()),
+            "x-amz-checksum-md5" => Hasher::Md5(md5::Context::new()),
+            _ => return None,
+        })
+    }
+
+    pub(super) fn update(&mut self, data: &[u8]) {
+        match self {
+            Hasher::Crc32(h) => h.update(data),
+            Hasher::Crc32c(h) => h.update(data),
+            Hasher::Sha1(h) => h.update(data),
+            Hasher::Crc64nvme(h) => h.update(data),
+            Hasher::Sha512(h) => h.update(data),
+            Hasher::Md5(h) => h.consume(data),
+        }
+    }
+
+    /// The checksum, as the bytes S3 encodes in base64: big-endian for the CRCs.
+    pub(super) fn finalize(self) -> Vec<u8> {
+        match self {
+            Hasher::Crc32(h) => h.finalize().to_be_bytes().to_vec(),
+            Hasher::Crc32c(h) => h.finalize().to_be_bytes().to_vec(),
+            Hasher::Sha1(h) => h.finalize().to_vec(),
+            Hasher::Crc64nvme(h) => h.finalize().to_be_bytes().to_vec(),
+            Hasher::Sha512(h) => h.finalize().to_vec(),
+            Hasher::Md5(h) => h.finalize().0.to_vec(),
+        }
+    }
+}
+
+/// The checksum of `data` in the algorithm `header` names, SHA-256 included; `None` for a
+/// header that names none.
+pub(super) fn of(header: &str, data: &[u8]) -> Option<Vec<u8>> {
+    if header == "x-amz-checksum-sha256" {
+        return Some(sha2::Sha256::digest(data).to_vec());
+    }
+    let mut hasher = Hasher::for_(header)?;
+    hasher.update(data);
+    Some(hasher.finalize())
+}
+
+/// What an object's annotation keeps: the algorithm, by S3's name, and the checksum in
+/// base64.
+#[derive(Debug, PartialEq, Eq)]
+pub(super) struct Stored {
+    pub(super) algorithm: &'static str,
+    pub(super) value: String,
+}
+
+/// The annotation keeping `value`, the checksum `header` carried once it held.
+pub(super) fn annotation(header: &str, value: &str) -> Option<(String, String)> {
+    let algorithm = algorithm(header)?;
+    Some((ANNOTATION.to_string(), format!("{algorithm}:{value}")))
+}
+
+/// The checksum `annotations` keep, when they keep one this registry wrote: an algorithm it
+/// has, and base64 of that algorithm's length.
+pub(super) fn stored(annotations: &BTreeMap<String, String>) -> Option<Stored> {
+    let (algorithm, value) = annotations.get(ANNOTATION)?.split_once(':')?;
+    let header = header(algorithm)?;
+    let decoded = crate::auth::base64_decode(value)?;
+    (Some(decoded.len()) == len(header)).then(|| Stored {
+        algorithm: algorithm_static(algorithm),
+        value: value.to_string(),
+    })
+}
+
+/// `name` as the static S3 name it is, once [`header`] found it.
+fn algorithm_static(name: &str) -> &'static str {
+    ALGORITHMS
+        .iter()
+        .find(|(_, n, _)| *n == name)
+        .map_or("", |(_, n, _)| *n)
+}
+
+impl Stored {
+    /// The headers a read asked for the checksum answers with: `x-amz-checksum-<algorithm>`
+    /// and the checksum's type.
+    pub(super) fn headers(&self) -> impl Iterator<Item = (HeaderName, HeaderValue)> {
+        let name = header(self.algorithm).and_then(|h| HeaderName::from_bytes(h.as_bytes()).ok());
+        let value = HeaderValue::from_str(&self.value).ok();
+        name.zip(value).into_iter().chain([(
+            HeaderName::from_static(TYPE_HEADER),
+            HeaderValue::from_static(FULL_OBJECT),
+        )])
+    }
+
+    /// The elements a listing adds to an object: its algorithm and the checksum's type.
+    pub(super) fn listed(&self) -> String {
+        xml::element("ChecksumAlgorithm", self.algorithm)
+            + &xml::element("ChecksumType", FULL_OBJECT)
+    }
+
+    /// The elements a `Checksum` attribute or a completed upload's result holds: the
+    /// checksum itself, named by its algorithm, and its type.
+    pub(super) fn elements(&self) -> String {
+        xml::element(&format!("Checksum{}", self.algorithm), &self.value)
+            + &xml::element("ChecksumType", FULL_OBJECT)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The check values of the catalog's algorithms over `123456789`, and SHA-1's.
+    #[test]
+    fn every_algorithm_is_the_one_s3_names() {
+        let b64 = |bytes: &[u8]| vk_hub_proto::to_base64(bytes);
+        let of = |header| b64(&of(header, b"123456789").unwrap());
+        assert_eq!(
+            of("x-amz-checksum-crc32"),
+            b64(&0xCBF4_3926u32.to_be_bytes())
+        );
+        assert_eq!(
+            of("x-amz-checksum-crc32c"),
+            b64(&0xE306_9283u32.to_be_bytes())
+        );
+        assert_eq!(
+            of("x-amz-checksum-crc64nvme"),
+            b64(&0xAE8B_1486_0A79_9888u64.to_be_bytes())
+        );
+        assert_eq!(
+            of("x-amz-checksum-sha1"),
+            b64(&sha1::Sha1::digest(b"123456789"))
+        );
+        assert_eq!(
+            of("x-amz-checksum-sha256"),
+            b64(&sha2::Sha256::digest(b"123456789"))
+        );
+        assert_eq!(
+            of("x-amz-checksum-sha512"),
+            b64(&sha2::Sha512::digest(b"123456789"))
+        );
+        assert_eq!(of("x-amz-checksum-md5"), b64(&md5::compute(b"123456789").0));
+        assert_eq!(super::of("x-amz-checksum-xxhash64", b""), None);
+        // Streamed in pieces, the same.
+        let mut h = Hasher::for_("x-amz-checksum-crc64nvme").unwrap();
+        h.update(b"1234");
+        h.update(b"56789");
+        assert_eq!(h.finalize(), 0xAE8B_1486_0A79_9888u64.to_be_bytes());
+        for (header, name, len) in ALGORITHMS {
+            assert_eq!(super::len(header), Some(len));
+            assert_eq!(algorithm(header), Some(name));
+            assert_eq!(super::header(name), Some(header));
+        }
+        assert_eq!(super::len("x-amz-checksum-xxhash64"), None);
+        let of = |pairs: &[(&str, &str)]| {
+            let mut h = hyper::header::HeaderMap::new();
+            for (n, v) in pairs {
+                h.append(
+                    HeaderName::from_bytes(n.as_bytes()).unwrap(),
+                    HeaderValue::from_str(v).unwrap(),
+                );
+            }
+            not_computed(&h)
+        };
+        assert!(!of(&[]));
+        assert!(!of(&[
+            ("x-amz-checksum-crc32c", "AAAAAA=="),
+            (SDK_ALGORITHM, "crc32c")
+        ]));
+        assert!(of(&[("x-amz-checksum-xxhash64", "AAAAAAAAAAA=")]));
+        assert!(of(&[("x-amz-checksum-xxhash128", "x")]));
+        assert!(of(&[("x-amz-checksum-", "x")]));
+        assert!(of(&[(SDK_ALGORITHM, "XXHASH3")]));
+        assert!(of(&[(SDK_ALGORITHM, "")]));
+        for (header, name, _) in ALGORITHMS {
+            assert!(mismatch(header).2.starts_with(&format!("The {name} you")));
+        }
+    }
+
+    #[test]
+    fn a_kept_checksum_round_trips_through_its_annotation() {
+        let value = vk_hub_proto::to_base64(&[1, 2, 3, 4]);
+        let (name, text) = annotation("x-amz-checksum-crc32c", &value).unwrap();
+        assert_eq!(
+            (name.as_str(), text.as_str()),
+            (ANNOTATION, "CRC32C:AQIDBA==")
+        );
+        let annotations = BTreeMap::from([(name, text)]);
+        let kept = stored(&annotations).unwrap();
+        assert_eq!(kept.algorithm, "CRC32C");
+        assert_eq!(kept.value, value);
+        let headers: Vec<(String, String)> = kept
+            .headers()
+            .map(|(n, v)| (n.to_string(), v.to_str().unwrap().to_string()))
+            .collect();
+        assert_eq!(
+            headers,
+            [
+                ("x-amz-checksum-crc32c".to_string(), value.clone()),
+                ("x-amz-checksum-type".to_string(), "FULL_OBJECT".to_string()),
+            ]
+        );
+        assert_eq!(
+            kept.listed(),
+            "<ChecksumAlgorithm>CRC32C</ChecksumAlgorithm><ChecksumType>FULL_OBJECT</ChecksumType>"
+        );
+        assert_eq!(
+            kept.elements(),
+            "<ChecksumCRC32C>AQIDBA==</ChecksumCRC32C><ChecksumType>FULL_OBJECT</ChecksumType>"
+        );
+        assert_eq!(annotation("x-amz-checksum-xxhash64", &value), None);
+        // Nothing kept, or something this registry did not write.
+        let of = |text: &str| {
+            stored(&BTreeMap::from([(
+                ANNOTATION.to_string(),
+                text.to_string(),
+            )]))
+        };
+        assert_eq!(of("CRC32C:AQID"), None);
+        assert_eq!(of("XXHASH64:AQIDBA=="), None);
+        assert_eq!(of("MD5:AQIDBA=="), None);
+        assert_eq!(of("AQIDBA=="), None);
+        assert_eq!(of("CRC32C:!!"), None);
+        assert_eq!(stored(&BTreeMap::new()), None);
+    }
+}
diff --git a/vk-registry/src/s3/chunked.rs b/vk-registry/src/s3/chunked.rs
index e33f7f33..98f1f9ed 100644
--- a/vk-registry/src/s3/chunked.rs
+++ b/vk-registry/src/s3/chunked.rs
@@ -40,15 +40,6 @@ const TRAILER_SIGNATURE: &str = "x-amz-trailer-signature";
 /// The SHA-256 of nothing, which a chunk's string to sign carries where a header hash would be.
 const EMPTY_SHA256: &str = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
 
-/// The checksums a trailer may carry, as `x-amz-trailer` names them.
-pub(crate) const CHECKSUMS: [&str; 5] = [
-    "x-amz-checksum-crc32",
-    "x-amz-checksum-crc32c",
-    "x-amz-checksum-sha1",
-    "x-amz-checksum-sha256",
-    "x-amz-checksum-crc64nvme",
-];
-
 /// How a chunked body is framed and signed, from its `x-amz-content-sha256`.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum Mode {
@@ -90,7 +81,8 @@ pub(crate) struct Framing {
     pub(crate) mode: Mode,
     /// `x-amz-decoded-content-length`: exactly how many bytes the chunks hold
     pub(crate) declared: u64,
-    /// the checksum `x-amz-trailer` announced, one of [`CHECKSUMS`]
+    /// the checksum `x-amz-trailer` announced, the header of one of
+    /// [`super::checksum::ALGORITHMS`]
     pub(crate) trailer: Option<&'static str>,
 }
 
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index 0f29f7dc..66838109 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -3,8 +3,9 @@
 //! manifest whatever the size and the pool still holds the bytes once. The source is read
 //! as GetObject reads it and its conditions are its `x-amz-copy-source-if-*` headers; the
 //! destination is written as PutObject writes, its `If-None-Match: *`/`If-Match` checked
-//! where the tag is written. The source's MD5, and so its ETag, comes along; its user
-//! metadata too, unless `x-amz-metadata-directive: REPLACE` gives the request's instead.
+//! where the tag is written. The source's MD5, and so its ETag, comes along, and the checksum
+//! its write kept; its user metadata too, unless `x-amz-metadata-directive: REPLACE` gives
+//! the request's instead.
 
 use anyhow::Result;
 use hyper::body::Incoming;
@@ -12,7 +13,7 @@ use hyper::{Request, Response, StatusCode};
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::object::{admitted, no_such_key, readable, unwritable};
-use super::{Ctx, NULL_VERSION, drain, list, meta, path, refuse, xml};
+use super::{Ctx, NULL_VERSION, checksum, drain, list, meta, path, refuse, xml};
 use crate::files::{self, Commit, FILES_REPO, Written, allowed, object_of};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
@@ -206,8 +207,11 @@ pub(super) async fn copy(
             return Ok(no_such_key(&ctx));
         }
         let mut annotations = replaced.unwrap_or_else(|| meta::carried(&obj.annotations));
-        if let Some(md5) = obj.annotations.get(MD5_ANNOTATION) {
-            annotations.insert(MD5_ANNOTATION.to_string(), md5.clone());
+        // Of the bytes, which are the same: the ETag and the checksum.
+        for name in [MD5_ANNOTATION, checksum::ANNOTATION] {
+            if let Some(value) = obj.annotations.get(name) {
+                annotations.insert(name.to_string(), value.clone());
+            }
         }
         let etag = conditional::etag(&obj.layer, &annotations);
         let how = Commit {
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index ef698392..5cde6f48 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -18,7 +18,7 @@ use hyper::body::Incoming;
 use hyper::{Request, Response, StatusCode};
 
 use super::path::MAX_KEY;
-use super::{Ctx, NULL_VERSION, Params, bucket, conditional, refuse, sigv4, xml};
+use super::{Ctx, NULL_VERSION, Params, bucket, checksum, conditional, refuse, sigv4, xml};
 use crate::files::{self, FILES_REPO, Node, Object, allowed, repo_name};
 use crate::{Authz, Body, ServerState, Store, accounts};
 
@@ -449,8 +449,9 @@ impl Query {
 }
 
 /// The `ListBucketResult` or `ListVersionsResult` of a page: its parameters, then the
-/// objects (each a `Version` of id `null` in the latter), then the common prefixes, every
-/// caller string escaped and, under `encoding-type=url`, encoded.
+/// objects (each a `Version` of id `null` in the latter, each with the algorithm of the
+/// checksum its write kept, when one did), then the common prefixes, every caller string
+/// escaped and, under `encoding-type=url`, encoded.
 fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
     let enc = |s: &str| if q.url { url_encode(s) } else { s.to_string() };
     let mut out = xml::element("Name", bucket);
@@ -514,6 +515,9 @@ fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
             out.push_str(&version);
             out.push_str(&xml::element("LastModified", &iso8601(obj.modified)));
             out.push_str(&xml::element("ETag", &conditional::etag_of(obj)));
+            if let Some(kept) = checksum::stored(&obj.annotations) {
+                out.push_str(&kept.listed());
+            }
             out.push_str(&xml::element("Size", &obj.size.to_string()));
             if q.owner {
                 out.push_str(&bucket::owner());
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 97881ef7..5726e816 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -12,7 +12,8 @@
 //! answers the service and its buckets, [`list`] a bucket's listings, [`object`] the
 //! objects, with [`chunked`] decoding the `aws-chunked` bodies SDKs upload them in, [`copy`]
 //! their copies, [`multipart`] their uploads in parts and [`batch`] their deletion in
-//! batches; [`canned`] answers the configurations a bucket or an object has none of.
+//! batches, with [`checksum`] checking and keeping the checksum a write carries; [`canned`]
+//! answers the configurations a bucket or an object has none of.
 //! Operations not served answer `NotImplemented`.
 //!
 //! With `s3_host` set, a request sent to `<bucket>.<s3_host>` names its bucket by its host,
@@ -23,6 +24,7 @@
 mod batch;
 mod bucket;
 mod canned;
+mod checksum;
 mod chunked;
 mod conditional;
 mod copy;
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index b82dbb52..cc17eba3 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -34,8 +34,8 @@ use super::copy::{self, COPY_SOURCE, Source};
 use super::object::{self, Refused, admitted, no_such_key, readable, unwritable};
 use super::xml::scan::{self, Malformed};
 use super::{
-    Ctx, OPERATION_HINT, Params, UNCOMPRESSED_FROM, bucket, chunked, drain, list, meta, read_small,
-    refuse, xml,
+    Ctx, OPERATION_HINT, Params, UNCOMPRESSED_FROM, bucket, checksum, chunked, drain, list, meta,
+    read_small, refuse, xml,
 };
 use crate::files::{self, Commit, FILES_REPO, MAX_OBJECT, Staged, Written, allowed, object_of};
 use crate::{Authz, Body, STREAM_CHUNK, ServerState, Store, accounts, body_of};
@@ -248,9 +248,8 @@ pub(super) async fn create(
     };
     let algorithm = match checksum_algorithm(headers) {
         Ok(a) => a,
-        Err(message) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidRequest", message);
-            return refuse(req, resp, ctx).await;
+        Err((status, code, message)) => {
+            return refuse(req, ctx.error(status, code, message), ctx).await;
         }
     };
     if let Some(resp) = drain(req, ctx).await? {
@@ -296,18 +295,25 @@ pub(super) async fn create(
 }
 
 /// The `x-amz-checksum-algorithm` a creation names, as S3 spells it: the algorithm the
-/// parts' checksums will be in, which each part's request then carries and is checked by.
-fn checksum_algorithm(
-    headers: &HeaderMap,
-) -> std::result::Result<Option<&'static str>, &'static str> {
+/// parts' checksums will be in, which each part's request then carries and is checked by;
+/// one not computed here is refused as a part carrying it would be.
+fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'static str>, Refused> {
     let Some(v) = headers.get("x-amz-checksum-algorithm") else {
         return Ok(None);
     };
-    ["CRC32", "CRC32C", "CRC64NVME", "SHA1", "SHA256"]
+    let known = checksum::ALGORITHMS
         .into_iter()
-        .find(|a| v.as_bytes().eq_ignore_ascii_case(a.as_bytes()))
-        .map(Some)
-        .ok_or("x-amz-checksum-algorithm is CRC32, CRC32C, CRC64NVME, SHA1 or SHA256")
+        .map(|(_, name, _)| name)
+        .find(|a| v.as_bytes().eq_ignore_ascii_case(a.as_bytes()));
+    match known {
+        Some(name) => Ok(Some(name)),
+        None if v.as_bytes().is_empty() || v.to_str().is_err() => Err((
+            StatusCode::BAD_REQUEST,
+            "InvalidRequest",
+            "x-amz-checksum-algorithm names one of S3's checksum algorithms",
+        )),
+        None => Err(checksum::NOT_COMPUTED),
+    }
 }
 
 /// A request naming `uploadId` on an object, to the operation its method names.
@@ -621,48 +627,69 @@ fn multipart_etag(md5s: &[[u8; 16]]) -> String {
     format!("{}-{}", crate::hex_of(&all.finalize().0), md5s.len())
 }
 
-/// The whole-object checksums a completion's headers name, as bytes: those of the
-/// algorithms this registry computes, sent as a full object's. A composite checksum (a
-/// checksum of the parts' checksums, `<base64>-<parts>`) or one of another algorithm is
-/// passed over, since the parts were checked as they came.
-#[derive(Default)]
-struct WholeChecksums {
-    sha256: Option<Vec<u8>>,
-    sha1: Option<Vec<u8>>,
-    crc32: Option<Vec<u8>>,
+/// The whole-object checksum a completion's headers name: the first `x-amz-checksum-*` of
+/// the algorithms computed here sent as a full object's (base64 of the algorithm's length),
+/// its header, text and bytes. A composite checksum (a checksum of the parts' checksums,
+/// `<base64>-<parts>`) is passed over, since the parts were checked as they came; anything
+/// else is refused, as is an algorithm not computed here.
+struct Whole {
+    header: &'static str,
+    text: String,
+    bytes: Vec<u8>,
 }
 
-impl WholeChecksums {
-    fn of(headers: &HeaderMap) -> Self {
-        let full = |name, len| {
-            object::base64_header(headers, name, len)
-                .ok()
-                .flatten()
-                .map(|(_, bytes)| bytes)
-        };
-        WholeChecksums {
-            sha256: full("x-amz-checksum-sha256", 32),
-            sha1: full("x-amz-checksum-sha1", 20),
-            crc32: full("x-amz-checksum-crc32", 4),
+impl Whole {
+    fn of(headers: &HeaderMap) -> std::result::Result<Option<Self>, Refused> {
+        if checksum::not_computed(headers) {
+            return Err(checksum::NOT_COMPUTED);
+        }
+        for (header, _, len) in checksum::ALGORITHMS {
+            let Some(value) = headers.get(header) else {
+                continue;
+            };
+            if let Some((text, bytes)) = object::base64_header(headers, header, len).ok().flatten()
+            {
+                return Ok(Some(Whole {
+                    header,
+                    text,
+                    bytes,
+                }));
+            }
+            let text = value.to_str().unwrap_or_default().trim();
+            let composite = text.rsplit_once('-').is_some_and(|(sum, parts)| {
+                crate::auth::base64_decode(sum).is_some_and(|b| b.len() == len)
+                    && part_number(parts).is_some()
+            });
+            if !composite {
+                return Err((
+                    StatusCode::BAD_REQUEST,
+                    "InvalidRequest",
+                    "an x-amz-checksum header is the checksum of the object in base64, or a \
+                     composite one, <base64>-<parts>",
+                ));
+            }
         }
+        Ok(None)
     }
 }
 
-/// What [`assemble`] made: the object staged, and its ETag, unquoted.
+/// What [`assemble`] made: the object staged, its ETag, unquoted, and the whole-object
+/// checksum that held, its header and text, to keep.
 struct Assembled {
     staged: Staged,
     etag: String,
+    checksum: Option<(&'static str, String)>,
 }
 
 /// Concatenate the `parts` of `up`, in order, into a staging file, in one pass, hashing on
 /// the way: each part's MD5, checked against both the ETag asked and the part's record, so a
 /// part replaced while this reads it is noticed rather than built in; the whole object's
-/// SHA-256, and its SHA-1 and CRC32 when `whole` asks to be checked against them.
+/// SHA-256, and the checksum `whole` asks to be checked against, in its algorithm.
 fn assemble(
     store: &Store,
     up: &Upload,
     parts: &[(u32, String)],
-    whole: &WholeChecksums,
+    whole: Option<&Whole>,
 ) -> Result<std::result::Result<Assembled, Refused>> {
     let invalid_part: Refused = (
         StatusCode::BAD_REQUEST,
@@ -697,8 +724,7 @@ fn assemble(
     let (path, mut out) = store.stage_file()?;
     let mut staged = Staged::written(path, 0, String::new());
     let mut sha256 = sha2::Sha256::new();
-    let mut sha1 = whole.sha1.as_ref().map(|_| sha1::Sha1::new());
-    let mut crc32 = whole.crc32.as_ref().map(|_| crc32fast::Hasher::new());
+    let mut hasher = whole.and_then(|w| checksum::Hasher::for_(w.header));
     let mut md5s = Vec::with_capacity(parts.len());
     let mut buf = vec![0u8; STREAM_CHUNK];
     for (n, etag) in parts {
@@ -722,10 +748,7 @@ fn assemble(
             let data = buf.get(..got).unwrap_or_default();
             md5.consume(data);
             sha256.update(data);
-            if let Some(h) = &mut sha1 {
-                h.update(data);
-            }
-            if let Some(h) = &mut crc32 {
+            if let Some(h) = &mut hasher {
                 h.update(data);
             }
             out.write_all(data).context("writing an object")?;
@@ -737,36 +760,30 @@ fn assemble(
         md5s.push(md5);
     }
     drop(out);
-    let mismatch = |expected: &Option<Vec<u8>>, got: Option<Vec<u8>>| {
-        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
-    };
     let sha256 = sha256.finalize().to_vec();
-    if mismatch(&whole.sha256, Some(sha256.clone()))
-        || mismatch(&whole.sha1, sha1.map(|h| h.finalize().to_vec()))
-        || mismatch(
-            &whole.crc32,
-            crc32.map(|h| h.finalize().to_be_bytes().to_vec()),
-        )
-    {
-        return Ok(Err((
-            StatusCode::BAD_REQUEST,
-            "BadDigest",
-            "the x-amz-checksum you specified did not match the checksum of the object the \
-             parts make",
-        )));
+    if let Some(whole) = whole {
+        let got = match hasher {
+            Some(h) => h.finalize(),
+            None => sha256.clone(),
+        };
+        if got != whole.bytes {
+            return Ok(Err(checksum::mismatch(whole.header)));
+        }
     }
     staged.hex = crate::hex_of(&sha256);
     Ok(Ok(Assembled {
         staged,
         etag: multipart_etag(&md5s),
+        checksum: whole.map(|w| (w.header, w.text.clone())),
     }))
 }
 
 /// `POST /s3/<bucket>/<key>?uploadId=<id>`: the object the `CompleteMultipartUpload`
 /// document's parts make, in the order given, tagged at the key as a PutObject's body is
 /// (the key checked again, `If-None-Match: *`/`If-Match` checked where the tag is written),
-/// with the user metadata recorded at the upload's creation and the multipart ETag; the
-/// upload then goes. A refusal leaves the upload as it was, to be completed again.
+/// with the user metadata recorded at the upload's creation, the multipart ETag and the
+/// whole-object checksum that held; the upload then goes. A refusal leaves the upload as it
+/// was, to be completed again.
 async fn complete(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -786,7 +803,12 @@ async fn complete(
         );
         return refuse(req, resp, ctx).await;
     };
-    let whole = WholeChecksums::of(req.headers());
+    let whole = match Whole::of(req.headers()) {
+        Ok(whole) => whole,
+        Err((status, code, message)) => {
+            return refuse(req, ctx.error(status, code, message), ctx).await;
+        }
+    };
     let (head, body) = req.into_parts();
     let too_long = ctx.error(
         StatusCode::BAD_REQUEST,
@@ -819,7 +841,7 @@ async fn complete(
             let Some(up) = open(&store, &id, &segs) else {
                 return Ok(None);
             };
-            let assembled = assemble(&store, &up, &parts, &whole)?;
+            let assembled = assemble(&store, &up, &parts, whole.as_ref())?;
             Ok(Some((up, assembled)))
         })
         .await
@@ -830,9 +852,19 @@ async fn complete(
         Some((_, Err((status, code, message)))) => return Ok(ctx.error(status, code, message)),
         Some((up, Ok(assembled))) => (up, assembled),
     };
-    let Assembled { staged, etag } = assembled;
+    let Assembled {
+        staged,
+        etag,
+        checksum,
+    } = assembled;
     let mut annotations = up.meta.annotations;
     annotations.insert(MD5_ANNOTATION.to_string(), etag.clone());
+    if let Some((name, value)) =
+        checksum.and_then(|(header, text)| checksum::annotation(header, &text))
+    {
+        annotations.insert(name, value);
+    }
+    let kept = checksum::stored(&annotations).map_or(String::new(), |kept| kept.elements());
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
@@ -847,7 +879,7 @@ async fn complete(
     Ok(xml::document(
         "CompleteMultipartUploadResult",
         &format!(
-            "{}{}{}{}",
+            "{}{}{}{}{kept}",
             xml::element("Location", &ctx.url),
             xml::element("Bucket", &up.meta.bucket),
             xml::element("Key", &up.meta.key),
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index dbd84bb1..bd259a00 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -18,11 +18,11 @@ use hyper::header::{
     CONTENT_TYPE, ETAG, HeaderMap, HeaderValue, LAST_MODIFIED,
 };
 use hyper::{Request, Response, StatusCode};
-use sha1::Digest as _;
+use sha2::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::range::{self, Range};
-use super::{Ctx, UNCOMPRESSED_FROM, chunked, drain, meta, refuse, xml};
+use super::{Ctx, UNCOMPRESSED_FROM, checksum, chunked, drain, meta, refuse, xml};
 use crate::dav::http_date;
 use crate::files::{
     self, Commit, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, object_of,
@@ -33,7 +33,8 @@ use crate::{Authz, Body, ServerState, Store, accounts, body_of};
 /// The header asking a read for the object's checksum.
 const CHECKSUM_MODE: &str = "x-amz-checksum-mode";
 
-/// The checksum a read answers with, when asked: the SHA-256 the store names the bytes by.
+/// The checksum a read answers with, when asked, for an object whose write kept none: the
+/// SHA-256 the store names the bytes by.
 const CHECKSUM_SHA256: &str = "x-amz-checksum-sha256";
 
 /// Whether this caller may `action` on the key at `segs` or on its parent: what admits a
@@ -207,11 +208,14 @@ pub(super) async fn get(
         // The whole object's checksum, on the whole object only: S3 sends none with a part,
         // and the AWS CLI checks what it is sent against the bytes of each part it fetches.
         if checksum && !partial {
-            insert(
-                headers,
-                hyper::header::HeaderName::from_static(CHECKSUM_SHA256),
-                &sha256_base64(&obj.layer),
-            );
+            match checksum::stored(&obj.annotations) {
+                Some(kept) => headers.extend(kept.headers()),
+                None => insert(
+                    headers,
+                    hyper::header::HeaderName::from_static(CHECKSUM_SHA256),
+                    &sha256_base64(&obj.layer),
+                ),
+            }
         }
         for (name, value) in meta::headers(&obj.annotations) {
             headers.append(name, value);
@@ -273,10 +277,11 @@ pub(super) async fn attributes(
             ));
         }
         if has("Checksum") {
-            inner.push_str(&format!(
-                "<Checksum>{}</Checksum>",
-                xml::element("ChecksumSHA256", &sha256_base64(&obj.layer))
-            ));
+            let kept = match checksum::stored(&obj.annotations) {
+                Some(kept) => kept.elements(),
+                None => xml::element("ChecksumSHA256", &sha256_base64(&obj.layer)),
+            };
+            inner.push_str(&format!("<Checksum>{kept}</Checksum>"));
         }
         if has("StorageClass") {
             inner.push_str(&xml::element("StorageClass", "STANDARD"));
@@ -331,13 +336,25 @@ const DECODED_LENGTH: &str = "x-amz-decoded-content-length";
 #[derive(Default)]
 struct Expected {
     md5: Option<Vec<u8>>,
-    sha256: Option<Vec<u8>>,
-    sha1: Option<Vec<u8>>,
-    crc32: Option<Vec<u8>>,
-    /// the `x-amz-checksum-*` headers to echo once they held
-    echo: Vec<(&'static str, String)>,
+    /// the one `x-amz-checksum-*` it carries, as a header or in the trailer
+    checksum: Option<Claim>,
+}
+
+/// An `x-amz-checksum-*` a request carries: its header, its text (to echo and keep once it
+/// held) and the bytes the text decodes to.
+struct Claim {
+    header: &'static str,
+    text: String,
+    bytes: Vec<u8>,
 }
 
+/// The refusal of a second `x-amz-checksum-*`, as S3 words it.
+const ONE_CHECKSUM: Refused = (
+    StatusCode::BAD_REQUEST,
+    "InvalidRequest",
+    "Expecting a single x-amz-checksum- header. Multiple checksum Types are not allowed.",
+);
+
 /// What a PutObject's headers ask that cannot be served, or are malformed: a status, a code
 /// and a message.
 pub(super) type Refused = (StatusCode, &'static str, &'static str);
@@ -422,10 +439,21 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
         }
         Some(v) => {
             let name = v.to_str().unwrap_or_default().trim();
-            let known = chunked::CHECKSUMS
+            let known = checksum::ALGORITHMS
                 .into_iter()
+                .map(|(header, _, _)| header)
                 .find(|c| c.eq_ignore_ascii_case(name));
-            Some(known.ok_or(invalid("x-amz-trailer names one x-amz-checksum header"))?)
+            match known {
+                Some(header) => Some(header),
+                None if !name.contains(',')
+                    && name
+                        .to_ascii_lowercase()
+                        .starts_with(checksum::HEADER_PREFIX) =>
+                {
+                    return Err(checksum::NOT_COMPUTED);
+                }
+                None => return Err(invalid("x-amz-trailer names one x-amz-checksum header")),
+            }
         }
     };
     Ok(Payload {
@@ -438,16 +466,6 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
     })
 }
 
-/// How many bytes the checksum a header or trailer `name`s is.
-fn checksum_len(name: &str) -> usize {
-    match name {
-        "x-amz-checksum-sha256" => 32,
-        "x-amz-checksum-sha1" => 20,
-        "x-amz-checksum-crc64nvme" => 8,
-        _ => 4,
-    }
-}
-
 /// Header `name`'s text and the bytes it decodes to from base64, `len` of them: `Ok(None)`
 /// when it is not sent, `Err` when it is not that.
 pub(super) fn base64_header(
@@ -477,16 +495,18 @@ fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refu
     Ok(md5.map(|(_, b)| b))
 }
 
+/// What a request's headers ask to be checked: its `Content-MD5` and the one
+/// `x-amz-checksum-*` it carries, in an algorithm computed here; a second one is refused as
+/// S3 refuses it, and one in another algorithm as not implemented.
 fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
+    if checksum::not_computed(headers) {
+        return Err(checksum::NOT_COMPUTED);
+    }
     let mut out = Expected {
         md5: content_md5(headers)?,
         ..Expected::default()
     };
-    for (name, len) in [
-        ("x-amz-checksum-sha256", 32),
-        ("x-amz-checksum-sha1", 20),
-        ("x-amz-checksum-crc32", 4),
-    ] {
+    for (name, _, len) in checksum::ALGORITHMS {
         let value = base64_header(headers, name, len).map_err(|()| {
             (
                 StatusCode::BAD_REQUEST,
@@ -494,80 +514,80 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
                 "an x-amz-checksum header is the checksum of the body in base64",
             )
         })?;
-        if let Some((text, value)) = value {
-            out.expect(name, text, value);
+        if let Some((text, bytes)) = value {
+            if out.checksum.is_some() {
+                return Err(ONE_CHECKSUM);
+            }
+            out.checksum = Some(Claim {
+                header: name,
+                text,
+                bytes,
+            });
         }
     }
+    // An SDK names the algorithm of the checksum it sends: one naming another is refused as
+    // S3 refuses it, so the checksum is checked in the algorithm the client meant.
+    if let (Some(named), Some(claim)) = (headers.get(checksum::SDK_ALGORITHM), &out.checksum)
+        && !checksum::algorithm(claim.header)
+            .is_some_and(|a| named.as_bytes().eq_ignore_ascii_case(a.as_bytes()))
+    {
+        return Err(checksum::ALGORITHM_MISMATCH);
+    }
     Ok(out)
 }
 
 impl Expected {
-    /// Check the body against `value`, the checksum `name`s, and echo its `text` once it
-    /// held: for the checksums this registry computes; any other is taken unchecked.
-    fn expect(&mut self, name: &'static str, text: String, value: Vec<u8>) {
-        let slot = match name {
-            "x-amz-checksum-sha256" => &mut self.sha256,
-            "x-amz-checksum-sha1" => &mut self.sha1,
-            "x-amz-checksum-crc32" => &mut self.crc32,
-            _ => return,
-        };
-        *slot = Some(value);
-        self.echo.push((name, text));
-    }
-
     /// The trailer's checksum `name`d, as sent: base64 of the checksum's length.
     fn trailer(&mut self, name: &'static str, text: &str) -> std::result::Result<(), Refused> {
-        let value = crate::auth::base64_decode(text)
-            .filter(|b| b.len() == checksum_len(name))
+        let bytes = crate::auth::base64_decode(text)
+            .filter(|b| Some(b.len()) == checksum::len(name))
             .ok_or((
                 StatusCode::BAD_REQUEST,
                 "InvalidRequest",
                 "the trailer's x-amz-checksum is the checksum of the body in base64",
             ))?;
-        self.expect(name, text.to_string(), value);
+        self.checksum = Some(Claim {
+            header: name,
+            text: text.to_string(),
+            bytes,
+        });
         Ok(())
     }
 }
 
-/// The digests computed while a body streams: MD5 always (the ETag), SHA-1 and CRC32 only
-/// when the request asks to be checked against them.
+/// The digests computed while a body streams: MD5 always (the ETag), and the checksum the
+/// request asks to be checked against, in its algorithm, when that is not the SHA-256 the
+/// store computes anyway.
 struct Digests {
     md5: md5::Context,
-    sha1: Option<sha1::Sha1>,
-    crc32: Option<crc32fast::Hasher>,
+    checksum: Option<checksum::Hasher>,
 }
 
 impl Digests {
-    /// The digests `expected` asks for, and the one a trailer announced as `trailer`.
+    /// The digests `expected` asks for, or the one a trailer announced as `trailer`.
     fn for_(expected: &Expected, trailer: Option<&str>) -> Self {
-        let wanted = |set: bool, name| set || trailer == Some(name);
+        let header = expected.checksum.as_ref().map(|c| c.header).or(trailer);
         Digests {
             md5: md5::Context::new(),
-            sha1: wanted(expected.sha1.is_some(), "x-amz-checksum-sha1").then(sha1::Sha1::new),
-            crc32: wanted(expected.crc32.is_some(), "x-amz-checksum-crc32")
-                .then(crc32fast::Hasher::new),
+            checksum: header.and_then(checksum::Hasher::for_),
         }
     }
 
     fn update(&mut self, data: &[u8]) {
         self.md5.consume(data);
-        if let Some(h) = &mut self.sha1 {
-            h.update(data);
-        }
-        if let Some(h) = &mut self.crc32 {
+        if let Some(h) = &mut self.checksum {
             h.update(data);
         }
     }
 }
 
-/// Check what arrived against what the request said of it: its `md5`, and its `sha256`,
-/// `sha1` and `crc32` where they were computed.
+/// Check what arrived against what the request said of it: its `md5`, and its checksum,
+/// which is `sha256` for that algorithm and `computed` for any other.
 fn verify(
     expected: &Expected,
     md5: &[u8],
-    sha256: &Option<Vec<u8>>,
-    sha1: &Option<Vec<u8>>,
-    crc32: &Option<Vec<u8>>,
+    sha256: Option<&[u8]>,
+    computed: Option<Vec<u8>>,
 ) -> std::result::Result<(), Refused> {
     if expected.md5.as_deref().is_some_and(|m| m != md5) {
         return Err((
@@ -576,37 +596,34 @@ fn verify(
             "the Content-MD5 you specified did not match what was received",
         ));
     }
-    let mismatch = |expected: &Option<Vec<u8>>, got: &Option<Vec<u8>>| {
-        expected.as_ref().is_some_and(|e| Some(e) != got.as_ref())
-    };
-    if mismatch(&expected.sha256, sha256)
-        || mismatch(&expected.sha1, sha1)
-        || mismatch(&expected.crc32, crc32)
-    {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            "BadDigest",
-            "the x-amz-checksum you specified did not match the checksum of what was received",
-        ));
+    if let Some(claim) = &expected.checksum {
+        let got = if claim.header == CHECKSUM_SHA256 {
+            sha256
+        } else {
+            computed.as_deref()
+        };
+        if got != Some(claim.bytes.as_slice()) {
+            return Err(checksum::mismatch(claim.header));
+        }
     }
     Ok(())
 }
 
 /// Check a request document read whole (a `Delete`) against what its headers say of it, as a
 /// PutObject's body is checked: the signed `x-amz-content-sha256`, `Content-MD5` and the
-/// `x-amz-checksum-*` headers. A document is sent whole, not `aws-chunked`.
+/// `x-amz-checksum-*` header. A document is sent whole, not `aws-chunked`.
 pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
     check_document(headers, body)?;
     let expected = expected(headers)?;
-    let sha256 = sha2::Sha256::digest(body).to_vec();
-    let sha1 = sha1::Sha1::digest(body).to_vec();
-    let crc32 = crc32fast::hash(body).to_be_bytes().to_vec();
+    let computed = expected
+        .checksum
+        .as_ref()
+        .and_then(|c| checksum::of(c.header, body));
     verify(
         &expected,
         &md5::compute(body).0,
-        &Some(sha256),
-        &Some(sha1),
-        &Some(crc32),
+        Some(&sha2::Sha256::digest(body)),
+        computed,
     )
 }
 
@@ -636,7 +653,7 @@ pub(super) fn check_document(headers: &HeaderMap, body: &[u8]) -> std::result::R
         md5: content_md5(headers)?,
         ..Expected::default()
     };
-    verify(&expected, &md5::compute(body).0, &None, &None, &None)
+    verify(&expected, &md5::compute(body).0, None, None)
 }
 
 /// Why a write at a path that takes no object is refused: what is in the way.
@@ -681,18 +698,24 @@ pub(super) struct Plan {
 /// The [`Plan`] of a write's body, or why its headers are refused.
 pub(super) fn plan(headers: &HeaderMap) -> std::result::Result<Plan, Refused> {
     let payload = payload(headers)?;
-    let trailer = payload.framing.and_then(|f| f.trailer);
-    if trailer.is_some_and(|name| headers.contains_key(name)) {
+    let expected = expected(headers)?;
+    if payload.framing.is_some_and(|f| f.trailer.is_some()) && expected.checksum.is_some() {
         return Err((
             StatusCode::BAD_REQUEST,
             "InvalidRequest",
             "a checksum is sent as a header or in the trailer, not both",
         ));
     }
-    Ok(Plan {
-        payload,
-        expected: expected(headers)?,
-    })
+    // As beside a checksum header: the trailer's checksum is in the algorithm the SDK names.
+    if let (Some(named), Some(trailer)) = (
+        headers.get(checksum::SDK_ALGORITHM),
+        payload.framing.and_then(|f| f.trailer),
+    ) && !checksum::algorithm(trailer)
+        .is_some_and(|a| named.as_bytes().eq_ignore_ascii_case(a.as_bytes()))
+    {
+        return Err(checksum::ALGORITHM_MISMATCH);
+    }
+    Ok(Plan { payload, expected })
 }
 
 /// A write's body, received whole and checked against what its request said of it.
@@ -700,8 +723,8 @@ pub(super) struct Received {
     /// the bytes, staged
     pub(super) staged: files::Staged,
     pub(super) md5: [u8; 16],
-    /// the `x-amz-checksum-*` that held, to echo
-    pub(super) echo: Vec<(&'static str, String)>,
+    /// the `x-amz-checksum-*` that held, its header and text: to echo, and to keep
+    pub(super) echo: Option<(&'static str, String)>,
 }
 
 /// Stream `body` into `staging` (a private file just created, and its path) while hashing it,
@@ -760,28 +783,27 @@ pub(super) async fn receive(
         )));
     }
     let md5 = digests.md5.finalize().0;
-    let sha1 = digests.sha1.map(|h| h.finalize().to_vec());
-    let crc32 = digests.crc32.map(|h| h.finalize().to_be_bytes().to_vec());
+    let computed = digests.checksum.map(checksum::Hasher::finalize);
     let sha256 = hex_bytes(&staged.hex);
-    if let Err((status, code, message)) = verify(&expected, &md5, &sha256, &sha1, &crc32) {
+    if let Err((status, code, message)) = verify(&expected, &md5, sha256.as_deref(), computed) {
         return Ok(Err(ctx.error(status, code, message)));
     }
     Ok(Ok(Received {
         staged,
         md5,
-        echo: expected.echo,
+        echo: expected.checksum.map(|c| (c.header, c.text)),
     }))
 }
 
-/// The 200 a write answers: its `etag` (quoted) and the checksums that held.
-pub(super) fn written(etag: &str, echo: Vec<(&'static str, String)>) -> Result<Response<Body>> {
+/// The 200 a write answers: its `etag` (quoted) and the checksum that held.
+pub(super) fn written(etag: &str, echo: Option<(&'static str, String)>) -> Result<Response<Body>> {
     let mut resp = Response::builder()
         .status(StatusCode::OK)
         .header(CONTENT_LENGTH, "0")
         .body(body_of(bytes::Bytes::new()))?;
     let headers = resp.headers_mut();
     insert(headers, ETAG, etag);
-    for (name, value) in echo {
+    if let Some((name, value)) = echo {
         insert(
             headers,
             hyper::header::HeaderName::from_static(name),
@@ -793,8 +815,9 @@ pub(super) fn written(etag: &str, echo: Vec<(&'static str, String)>) -> Result<R
 
 /// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
 /// what the request said of it ([`receive`]), then tag it under the namespace lock, with its
-/// MD5 and user metadata on the manifest and the request's `If-None-Match: *`/`If-Match`
-/// checked there. Its `Content-Type` is not kept: every object is served as bytes.
+/// MD5, the checksum that held and its user metadata on the manifest and the request's
+/// `If-None-Match: *`/`If-Match` checked there. Its `Content-Type` is not kept: every object
+/// is served as bytes.
 pub(super) async fn put(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -851,6 +874,13 @@ pub(super) async fn put(
     };
     let md5_hex = crate::hex_of(&received.md5);
     annotations.insert(MD5_ANNOTATION.to_string(), md5_hex.clone());
+    let kept = received
+        .echo
+        .as_ref()
+        .and_then(|(header, text)| checksum::annotation(header, text));
+    if let Some((name, value)) = kept.clone() {
+        annotations.insert(name, value);
+    }
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
@@ -868,7 +898,14 @@ pub(super) async fn put(
             ));
         }
     }
-    self::written(&format!("\"{md5_hex}\""), received.echo)
+    let mut resp = self::written(&format!("\"{md5_hex}\""), received.echo)?;
+    if kept.is_some() {
+        resp.headers_mut().insert(
+            checksum::TYPE_HEADER,
+            HeaderValue::from_static(checksum::FULL_OBJECT),
+        );
+    }
+    Ok(resp)
 }
 
 /// `DELETE /s3/<bucket>/<key>`: 204 whether or not the key held an object, as S3 answers;
@@ -1046,17 +1083,17 @@ mod tests {
         let trailer = ("x-amz-content-sha256", "STREAMING-UNSIGNED-PAYLOAD-TRAILER");
         let (_, f) = framing(&[trailer, length, ("x-amz-trailer", "X-Amz-Checksum-CRC32")]);
         assert_eq!(f.trailer, Some("x-amz-checksum-crc32"));
-        for bad in [
-            "x-amz-checksum-md5",
-            "x-amz-checksum-crc32,x-amz-checksum-sha1",
-            "",
-        ] {
+        for bad in ["x-amz-checksum-crc32,x-amz-checksum-sha1", ""] {
             assert_eq!(
                 code(&[trailer, length, ("x-amz-trailer", bad)]),
                 Some("InvalidRequest"),
                 "{bad}"
             );
         }
+        assert_eq!(
+            code(&[trailer, length, ("x-amz-trailer", "x-amz-checksum-xxhash3")]),
+            Some("NotImplemented")
+        );
         let signed = ("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD");
         let crc = ("x-amz-trailer", "x-amz-checksum-crc32");
         assert_eq!(code(&[signed, length, crc]), Some("InvalidRequest"));
@@ -1068,34 +1105,51 @@ mod tests {
         let mut e = Expected::default();
         let crc = vk_hub_proto::to_base64(&[1, 2, 3, 4]);
         e.trailer("x-amz-checksum-crc32", &crc).ok().unwrap();
-        assert_eq!(e.crc32, Some(vec![1, 2, 3, 4]));
-        assert_eq!(e.echo, [("x-amz-checksum-crc32", crc.clone())]);
-        // Taken unchecked, and not echoed.
-        e.trailer(
-            "x-amz-checksum-crc64nvme",
-            &vk_hub_proto::to_base64(&[0; 8]),
-        )
-        .ok()
-        .unwrap();
-        assert_eq!(e.echo.len(), 1);
+        let claim = e.checksum.as_ref().unwrap();
+        assert_eq!(claim.bytes, [1, 2, 3, 4]);
+        assert_eq!(
+            (claim.header, claim.text.as_str()),
+            ("x-amz-checksum-crc32", crc.as_str())
+        );
+        let nvme = vk_hub_proto::to_base64(&[0; 8]);
+        e.trailer("x-amz-checksum-crc64nvme", &nvme).ok().unwrap();
+        let claim = e.checksum.as_ref().unwrap();
+        assert_eq!(
+            (claim.header, claim.bytes.len()),
+            ("x-amz-checksum-crc64nvme", 8)
+        );
         assert!(e.trailer("x-amz-checksum-sha256", &crc).is_err());
         assert!(e.trailer("x-amz-checksum-crc32c", "!!").is_err());
+        assert!(e.trailer("x-amz-checksum-md5", &crc).is_err());
     }
 
     #[test]
-    fn checksums_are_base64_of_their_length() {
+    fn checksums_are_base64_of_their_length_and_one_at_most() {
         let md5 = vk_hub_proto::to_base64(&[0u8; 16]);
         let sha = vk_hub_proto::to_base64(&[1u8; 32]);
         let e = expected(&headers(&[
             ("content-md5", &md5),
             ("x-amz-checksum-sha256", &sha),
-            ("x-amz-checksum-crc32c", "AAAAAA=="),
         ]))
         .ok()
         .unwrap();
         assert_eq!(e.md5, Some(vec![0u8; 16]));
-        assert_eq!(e.sha256, Some(vec![1u8; 32]));
-        assert_eq!(e.echo, [("x-amz-checksum-sha256", sha.clone())]);
+        let claim = e.checksum.unwrap();
+        assert_eq!(
+            (claim.header, claim.text.as_str()),
+            ("x-amz-checksum-sha256", sha.as_str())
+        );
+        assert_eq!(claim.bytes, vec![1u8; 32]);
+        for (name, len) in [
+            ("x-amz-checksum-crc32", 4),
+            ("x-amz-checksum-crc32c", 4),
+            ("x-amz-checksum-sha1", 20),
+            ("x-amz-checksum-crc64nvme", 8),
+        ] {
+            let value = vk_hub_proto::to_base64(&vec![2u8; len]);
+            let e = expected(&headers(&[(name, &value)])).ok().unwrap();
+            assert_eq!(e.checksum.unwrap().header, name);
+        }
         let code = |pairs: &[(&str, &str)]| expected(&headers(pairs)).err().map(|e| e.1);
         assert_eq!(code(&[("content-md5", "AAAA")]), Some("InvalidDigest"));
         assert_eq!(code(&[("content-md5", "!!")]), Some("InvalidDigest"));
@@ -1107,6 +1161,62 @@ mod tests {
             code(&[("x-amz-checksum-crc32", &md5)]),
             Some("InvalidRequest")
         );
+        assert_eq!(
+            code(&[("x-amz-checksum-crc64nvme", "AAAAAA==")]),
+            Some("InvalidRequest")
+        );
+        assert_eq!(
+            code(&[("x-amz-checksum-xxhash64", "AAAAAAAAAAA=")]),
+            Some("NotImplemented")
+        );
+        assert_eq!(
+            code(&[("x-amz-sdk-checksum-algorithm", "XXHASH128")]),
+            Some("NotImplemented")
+        );
+        assert_eq!(
+            code(&[
+                ("x-amz-sdk-checksum-algorithm", "CRC32"),
+                ("x-amz-checksum-sha256", &sha)
+            ]),
+            Some("InvalidRequest")
+        );
+        assert!(
+            expected(&headers(&[
+                ("x-amz-sdk-checksum-algorithm", "sha256"),
+                ("x-amz-checksum-sha256", &sha)
+            ]))
+            .is_ok()
+        );
+        assert_eq!(
+            code(&[
+                ("x-amz-checksum-sha256", &sha),
+                ("x-amz-checksum-crc32", "AAAAAA==")
+            ]),
+            Some("InvalidRequest")
+        );
+        // A header beside a trailer, of any algorithm.
+        let crc = ("x-amz-trailer", "x-amz-checksum-crc32");
+        let streaming = ("x-amz-content-sha256", "STREAMING-UNSIGNED-PAYLOAD-TRAILER");
+        let length = ("x-amz-decoded-content-length", "13");
+        assert_eq!(
+            plan(&headers(&[
+                streaming,
+                length,
+                crc,
+                ("x-amz-checksum-sha256", &sha)
+            ]))
+            .err()
+            .map(|e| e.1),
+            Some("InvalidRequest")
+        );
+        assert!(plan(&headers(&[streaming, length, crc])).is_ok());
+        // The trailer is in the algorithm the SDK names, in any case.
+        let sdk = |name| ("x-amz-sdk-checksum-algorithm", name);
+        assert!(plan(&headers(&[streaming, length, crc, sdk("crc32")])).is_ok());
+        assert_eq!(
+            plan(&headers(&[streaming, length, crc, sdk("SHA1")])).err(),
+            Some(checksum::ALGORITHM_MISMATCH)
+        );
     }
 
     #[test]
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index e7c787ae..35328b8b 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1354,12 +1354,20 @@ async fn a_put_checks_the_digests_it_is_sent() {
         ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(HELLO))),
         ("x-amz-checksum-sha1", b64(&sha1(HELLO))),
         ("x-amz-checksum-crc32", b64(&crc(HELLO))),
+        ("x-amz-checksum-crc32c", crc32c_b64(HELLO)),
+        ("x-amz-checksum-crc64nvme", crc64nvme_b64(HELLO)),
+        ("x-amz-checksum-sha512", b64(&sha2::Sha512::digest(HELLO))),
+        ("x-amz-checksum-md5", b64(&md5::compute(HELLO).0)),
     ];
     let bad: Vec<(&str, String)> = vec![
         ("Content-MD5", b64(&md5::compute(other).0)),
         ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(other))),
         ("x-amz-checksum-sha1", b64(&sha1(other))),
         ("x-amz-checksum-crc32", b64(&crc(other))),
+        ("x-amz-checksum-crc32c", crc32c_b64(other)),
+        ("x-amz-checksum-crc64nvme", crc64nvme_b64(other)),
+        ("x-amz-checksum-sha512", b64(&sha2::Sha512::digest(other))),
+        ("x-amz-checksum-md5", b64(&md5::compute(other).0)),
     ];
     for (i, (name, value)) in good.iter().enumerate() {
         let path = format!("/s3/b/good{i}");
@@ -1367,29 +1375,66 @@ async fn a_put_checks_the_digests_it_is_sent() {
         resp.ok(200);
         if name.starts_with("x-amz-checksum") {
             assert_eq!(resp.header(name), Some(value.as_str()), "{name}");
+            assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
+        } else {
+            assert_eq!(resp.header("x-amz-checksum-type"), None);
         }
         is_object(&send(&host, get(&path)).await, HELLO);
     }
     for (i, (name, value)) in bad.iter().enumerate() {
         let path = format!("/s3/b/bad{i}");
-        send(&host, put(&path, (name, value)))
-            .await
-            .is(400, "BadDigest");
+        let resp = send(&host, put(&path, (name, value))).await;
+        resp.is(400, "BadDigest");
+        if let Some(algorithm) = name.strip_prefix("x-amz-checksum-") {
+            let wording = format!(
+                "<Message>The {} you specified did not match the calculated checksum.</Message>",
+                algorithm.to_ascii_uppercase()
+            );
+            assert!(resp.body.contains(&wording), "{}", resp.body);
+        }
         send(&host, get(&path)).await.is(404, "NoSuchKey");
     }
+    // An SDK naming the algorithm of its checksum must name the one it sent.
+    let named = put("/s3/b/x", ("x-amz-checksum-sha1", &b64(&sha1(HELLO))))
+        .header("x-amz-sdk-checksum-algorithm", "CRC32");
+    send(&host, named).await.is(400, "InvalidRequest");
+    let named = put("/s3/b/named", ("x-amz-checksum-sha1", &b64(&sha1(HELLO))))
+        .header("x-amz-sdk-checksum-algorithm", "sha1");
+    send(&host, named).await.ok(200);
     send(&host, put("/s3/b/x", ("Content-MD5", "AAAA")))
         .await
         .is(400, "InvalidDigest");
     send(&host, put("/s3/b/x", ("x-amz-checksum-sha256", "AAAA")))
         .await
         .is(400, "InvalidRequest");
-    // Not checked, so taken.
-    send(&host, put("/s3/b/c", ("x-amz-checksum-crc32c", "AAAAAA==")))
-        .await
-        .ok(200);
+    send(
+        &host,
+        put("/s3/b/x", ("x-amz-checksum-crc64nvme", "AAAAAA==")),
+    )
+    .await
+    .is(400, "InvalidRequest");
+    // One checksum, of one algorithm, and one computed here: never taken unchecked.
+    let two = put("/s3/b/x", ("x-amz-checksum-crc32c", &crc32c_b64(HELLO)))
+        .header("x-amz-checksum-crc32", &crc32_b64(HELLO));
+    send(&host, two).await.is(400, "InvalidRequest");
+    for (name, value) in [
+        ("x-amz-checksum-xxhash64", "AAAAAAAAAAA="),
+        ("x-amz-checksum-xxhash128", "AAAAAAAAAAAAAAAAAAAAAA=="),
+        ("x-amz-sdk-checksum-algorithm", "XXHASH3"),
+    ] {
+        send(&host, put("/s3/b/x", (name, value)))
+            .await
+            .is(501, "NotImplemented");
+    }
+    let req = Req::new("POST", "/s3/b/x")
+        .query("uploads=")
+        .header("x-amz-checksum-algorithm", "XXHASH64");
+    send(&host, req).await.is(501, "NotImplemented");
+    send(&host, get("/s3/b/x")).await.is(404, "NoSuchKey");
     assert_eq!(staging_left(&dir), 0);
 
-    // On a read, the SHA-256 the store has, when asked.
+    // On a read, the SHA-256 the store has, when asked, for an object whose write kept no
+    // checksum.
     let resp = send(&host, get("/s3/b/good0")).await;
     assert_eq!(resp.header("x-amz-checksum-sha256"), None);
     let asked = get("/s3/b/good0").header("x-amz-checksum-mode", "ENABLED");
@@ -1406,6 +1451,129 @@ async fn a_put_checks_the_digests_it_is_sent() {
         resp.header("x-amz-checksum-sha256"),
         Some(&*b64(&sha2::Sha256::digest(HELLO)))
     );
+    assert_eq!(resp.header("x-amz-checksum-type"), None);
+}
+
+/// The checksum a write carried, once it held, is the object's: sent back on a read asking
+/// for it, listed with the object, reported among its attributes, carried by a copy, and
+/// the one a completed upload's whole-object checksum becomes.
+#[tokio::test]
+async fn the_checksum_a_write_carried_is_kept_with_the_object() {
+    let dir = tmp("kept");
+    let host = spawn(open_state(&dir, true));
+    let crc = crc32c_b64(HELLO);
+    let put = Req::new("PUT", "/s3/b/k")
+        .header("x-amz-checksum-crc32c", &crc)
+        .body(HELLO.to_vec());
+    send(&host, put).await.ok(200);
+    for method in ["GET", "HEAD"] {
+        let asked = Req::new(method, "/s3/b/k").header("x-amz-checksum-mode", "ENABLED");
+        let resp = send(&host, asked).await;
+        resp.ok(200);
+        assert_eq!(resp.header("x-amz-checksum-crc32c"), Some(crc.as_str()));
+        assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
+        assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+        let resp = send(&host, Req::new(method, "/s3/b/k")).await;
+        assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
+        // Not with a part: the whole object's checksum says nothing of it.
+        let part = Req::new(method, "/s3/b/k")
+            .header("x-amz-checksum-mode", "ENABLED")
+            .header("Range", "bytes=0-1");
+        let resp = send(&host, part).await;
+        resp.ok(206);
+        assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
+    }
+    let attrs = Req::new("GET", "/s3/b/k")
+        .query("attributes")
+        .header("x-amz-object-attributes", "Checksum");
+    let resp = send(&host, attrs).await;
+    resp.ok(200);
+    assert_eq!(
+        element(&resp.body, "Checksum"),
+        format!("<ChecksumCRC32C>{crc}</ChecksumCRC32C><ChecksumType>FULL_OBJECT</ChecksumType>")
+    );
+    let copy = Req::new("PUT", "/s3/b/copy").header("x-amz-copy-source", "/b/k");
+    send(&host, copy).await.ok(200);
+    send(&host, Req::new("PUT", "/s3/b/plain").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    for query in ["list-type=2", "", "versions"] {
+        let resp = send(&host, Req::new("GET", "/s3/b").query(query)).await;
+        resp.ok(200);
+        assert_eq!(keys(&resp.body), ["copy", "k", "plain"]);
+        assert_eq!(
+            elements(&resp.body, "ChecksumAlgorithm"),
+            ["CRC32C", "CRC32C"]
+        );
+        assert_eq!(
+            elements(&resp.body, "ChecksumType"),
+            ["FULL_OBJECT", "FULL_OBJECT"]
+        );
+        assert!(
+            resp.body.contains(
+                "<ChecksumAlgorithm>CRC32C</ChecksumAlgorithm><ChecksumType>FULL_OBJECT\
+                 </ChecksumType><Size>13</Size>"
+            ),
+            "{}",
+            resp.body
+        );
+    }
+    // Replaced by a write carrying none, the object has none.
+    send(&host, Req::new("PUT", "/s3/b/k").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    let asked = Req::new("GET", "/s3/b/k").header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, asked).await;
+    assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
+    assert_eq!(resp.header("x-amz-checksum-type"), None);
+
+    // An upload completed with the whole object's checksum keeps it; a composite one is
+    // passed over, and a wrong one refused.
+    let sign = |r: Req| r;
+    let path = "/s3/b/parts";
+    let id = create_upload(&host, &sign, path).await;
+    let (one, two) = (bytes_of_len(70_000), bytes_of_len(500));
+    let e1 = upload_part(&host, &sign, path, &id, 1, &one).await;
+    let e2 = upload_part(&host, &sign, path, &id, 2, &two).await;
+    let whole = [one.as_slice(), &two].concat();
+    let nvme = crc64nvme_b64(&whole);
+    let parts = [(1, e1.as_str()), (2, e2.as_str())];
+    let wrong =
+        complete(path, &id, &parts).header("x-amz-checksum-crc64nvme", &crc64nvme_b64(&one));
+    send(&host, wrong).await.is(400, "BadDigest");
+    let resp = send(
+        &host,
+        complete(path, &id, &parts).header("x-amz-checksum-crc64nvme", &nvme),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "ChecksumCRC64NVME"), nvme);
+    assert_eq!(element(&resp.body, "ChecksumType"), "FULL_OBJECT");
+    let asked = Req::new("HEAD", path).header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, asked).await;
+    resp.ok(200);
+    assert_eq!(resp.header("x-amz-checksum-crc64nvme"), Some(nvme.as_str()));
+    let id = create_upload(&host, &sign, path).await;
+    let e1 = upload_part(&host, &sign, path, &id, 1, &one).await;
+    for (name, value, status, code) in [
+        ("x-amz-checksum-crc32", "bad", 400, "InvalidRequest"),
+        ("x-amz-checksum-crc32", "AAAAAA==-0", 400, "InvalidRequest"),
+        ("x-amz-checksum-crc32", "AAAAAA==-x", 400, "InvalidRequest"),
+        (
+            "x-amz-checksum-xxhash64",
+            "AAAAAAAAAAA=",
+            501,
+            "NotImplemented",
+        ),
+    ] {
+        let req = complete(path, &id, &[(1, e1.as_str())]).header(name, value);
+        send(&host, req).await.is(status, code);
+    }
+    let composite =
+        complete(path, &id, &[(1, e1.as_str())]).header("x-amz-checksum-crc32", "AAAAAA==-1");
+    let resp = send(&host, composite).await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "ChecksumType"), Vec::<String>::new());
 }
 
 /// The shared bearer of [`bearer_server`], which is also its access key and secret.
@@ -1434,6 +1602,18 @@ fn crc32_b64(b: &[u8]) -> String {
     b64(&crc32fast::hash(b).to_be_bytes())
 }
 
+fn crc32c_b64(b: &[u8]) -> String {
+    b64(&crc::Crc::<u32>::new(&crc::CRC_32_ISCSI)
+        .checksum(b)
+        .to_be_bytes())
+}
+
+fn crc64nvme_b64(b: &[u8]) -> String {
+    b64(&crc::Crc::<u64>::new(&crc::CRC_64_NVME)
+        .checksum(b)
+        .to_be_bytes())
+}
+
 /// One request whose body the server may stop reading, refusing it: the body is written
 /// beside the wait for the answer, and a write failing once the server closes is expected.
 async fn send_refused(host: &str, req: Req) -> Resp {
@@ -1495,19 +1675,39 @@ async fn aws_chunked_uploads_are_decoded_in_every_mode() {
             is_object(&send(&host, get(&path)).await, &data);
         }
     }
-    // A checksum not computed here is taken unchecked, and not echoed.
-    let crc32c = Some(("x-amz-checksum-crc32c", "AAAAAA=="));
-    let req = Req::new("PUT", "/s3/b/crc32c").chunked(
-        &host,
-        BEARER,
-        Chunked::UnsignedTrailer,
-        HELLO,
-        crc32c,
-    );
-    let resp = send(&host, req).await;
-    resp.ok(200);
-    assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
-    is_object(&send(&host, get("/s3/b/crc32c")).await, HELLO);
+    // The CRCs S3 added later are checked and echoed as the others are.
+    for (name, value, wrong) in [
+        (
+            "x-amz-checksum-crc32c",
+            crc32c_b64(HELLO),
+            crc32c_b64(b"other"),
+        ),
+        (
+            "x-amz-checksum-crc64nvme",
+            crc64nvme_b64(HELLO),
+            crc64nvme_b64(b"other"),
+        ),
+    ] {
+        let req = Req::new("PUT", "/s3/b/crc").chunked(
+            &host,
+            BEARER,
+            Chunked::UnsignedTrailer,
+            HELLO,
+            Some((name, value.as_str())),
+        );
+        let resp = send(&host, req).await;
+        resp.ok(200);
+        assert_eq!(resp.header(name), Some(value.as_str()));
+        is_object(&send(&host, get("/s3/b/crc")).await, HELLO);
+        let req = Req::new("PUT", "/s3/b/crc-bad").chunked(
+            &host,
+            BEARER,
+            Chunked::UnsignedTrailer,
+            HELLO,
+            Some((name, wrong.as_str())),
+        );
+        send(&host, req).await.is(400, "BadDigest");
+    }
 
     // An aws-chunked body under its own SHA-256: the decoded bytes must have it.
     let framed = b"d\r\nHello, World!\r\n0\r\n\r\n".to_vec();
@@ -1668,7 +1868,11 @@ async fn a_trailer_checksum_must_be_the_body_s() {
         resp.ok(200);
         assert_eq!(resp.header("x-amz-checksum-sha1"), Some(sha1.as_str()));
 
-        // Not base64 of its length; announced and not sent; sent as a header too.
+        // Not computed here; not base64 of its length; announced and not sent; sent as a
+        // header too.
+        let xx = ("x-amz-checksum-xxhash64", "AAAAAAAAAAA=");
+        let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(xx));
+        send(&host, req).await.is(501, "NotImplemented");
         let crc = ("x-amz-checksum-crc32", "!!");
         let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(crc));
         send(&host, req).await.is(400, "InvalidRequest");

From 9062730a73230d8bf905792e3d95fd1aa6bb5302 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 00:37:23 +0100
Subject: [PATCH 35/54] vk-registry/s3: read an object made of parts a part at
 a time

GET and HEAD take ?partNumber=<n>, as the AWS CLI and SDKs download a
large object: the bytes of that part as it was uploaded, 206 with its
Content-Range and x-amz-mp-parts-count. A completed multipart upload
keeps its parts' sizes on the object's manifest for that, a copy
carries them, and GetObjectAttributes answers ObjectParts from them. An
object written whole is its one part; a part there is not is 416
InvalidPartNumber, as S3 answers.
---
 CHANGELOG.md                    |   3 +-
 vk-registry/DESIGN.md           |   8 +-
 vk-registry/src/s3/copy.rs      |  14 ++-
 vk-registry/src/s3/mod.rs       |  39 +++++-
 vk-registry/src/s3/multipart.rs | 206 ++++++++++++++++++++++++++++++--
 vk-registry/src/s3/object.rs    |  92 +++++++++++++-
 vk-registry/tests/s3_e2e.rs     | 161 ++++++++++++++++++++++++-
 7 files changed, 497 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d59e619b..9a024491 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,7 +24,8 @@ All notable changes to virtkit will be documented in this file.
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
   storage class, a redirect, a retention lock — is refused rather than stored without it. Large
-  files can be uploaded in parts, as the AWS CLI uploads them, parts copied from other objects,
+  files can be uploaded in parts, as the AWS CLI uploads them, read back a part at a time,
+  parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
   shown as the S3 key pair, ready to paste. With wildcard DNS, setting `s3_host` also serves
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 55487edf..f6cf40c0 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -679,10 +679,10 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
-| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
-| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag) and the checksum it kept come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
@@ -696,7 +696,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload` |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index 66838109..0ca7e839 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -3,9 +3,9 @@
 //! manifest whatever the size and the pool still holds the bytes once. The source is read
 //! as GetObject reads it and its conditions are its `x-amz-copy-source-if-*` headers; the
 //! destination is written as PutObject writes, its `If-None-Match: *`/`If-Match` checked
-//! where the tag is written. The source's MD5, and so its ETag, comes along, and the checksum
-//! its write kept; its user metadata too, unless `x-amz-metadata-directive: REPLACE` gives
-//! the request's instead.
+//! where the tag is written. The source's MD5, and so its ETag, comes along, with the
+//! checksum its write kept and its parts; its user metadata too, unless
+//! `x-amz-metadata-directive: REPLACE` gives the request's instead.
 
 use anyhow::Result;
 use hyper::body::Incoming;
@@ -207,8 +207,12 @@ pub(super) async fn copy(
             return Ok(no_such_key(&ctx));
         }
         let mut annotations = replaced.unwrap_or_else(|| meta::carried(&obj.annotations));
-        // Of the bytes, which are the same: the ETag and the checksum.
-        for name in [MD5_ANNOTATION, checksum::ANNOTATION] {
+        // Of the bytes, which are the same: the ETag, the checksum and the parts.
+        for name in [
+            MD5_ANNOTATION,
+            checksum::ANNOTATION,
+            super::multipart::PARTS_ANNOTATION,
+        ] {
             if let Some(value) = obj.annotations.get(name) {
                 annotations.insert(name.to_string(), value.clone());
             }
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 5726e816..6481ce9a 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -289,6 +289,16 @@ fn parse_query(raw: &str) -> Option<Vec<(String, String)>> {
         .collect()
 }
 
+/// The part a query asks of an object (`?partNumber=<n>`), as sent, when it names nothing
+/// else but [`implicit`] parameters.
+fn part_asked(params: &Params) -> Option<&str> {
+    let mut named = params.iter().filter(|p| !implicit(p));
+    match (named.next(), named.next()) {
+        (Some((name, value)), None) if name == "partNumber" => Some(value),
+        _ => None,
+    }
+}
+
 /// The subresource a query names (`location`, `attributes`, `uploads`…): `None` for a query
 /// of [`implicit`] parameters at most, `Some("")` when it names more than one other
 /// parameter or names one with a value — which nothing served here takes.
@@ -331,6 +341,20 @@ async fn operate(
     if let Some((status, code, message)) = canned::asked(req.headers()) {
         return refuse(req, ctx.error(status, code, message), ctx).await;
     }
+    let part = match part_asked(&query) {
+        None => None,
+        Some(value) => match multipart::part_number(value) {
+            Some(n) => Some(n),
+            None => {
+                let resp = ctx.error(
+                    StatusCode::BAD_REQUEST,
+                    "InvalidArgument",
+                    "Part number must be an integer between 1 and 10000, inclusive.",
+                );
+                return refuse(req, resp, ctx).await;
+            }
+        },
+    };
     let sub = subresource(&query);
     let method = req.method().clone();
     match (target, &method, sub) {
@@ -370,8 +394,10 @@ async fn operate(
         (path::Target::Bucket(b), &Method::POST, Some("delete")) => {
             batch::delete(state, authz, b, req, ctx).await
         }
-        (path::Target::Object { segs, .. }, &Method::GET | &Method::HEAD, None) => {
-            object::get(state, authz, segs, method == Method::HEAD, req, ctx).await
+        (path::Target::Object { segs, .. }, &Method::GET | &Method::HEAD, _)
+            if part.is_some() || sub.is_none() =>
+        {
+            object::get(state, authz, segs, method == Method::HEAD, part, req, ctx).await
         }
         (path::Target::Object { segs, .. }, &Method::GET, Some("attributes")) => {
             object::attributes(state, authz, segs, req, ctx).await
@@ -804,6 +830,15 @@ mod tests {
         assert_eq!(sub("x-id=PutObject&tagging"), Some("tagging".to_string()));
         assert_eq!(sub("list-type=2"), Some("".to_string()));
         assert_eq!(sub("partNumber=1&uploadId=a"), Some("".to_string()));
+        // A part of an object, and nothing else with it.
+        let part = |q: &str| part_asked(&parse_query(q).unwrap()).map(str::to_string);
+        assert_eq!(part("partNumber=3"), Some("3".to_string()));
+        assert_eq!(part("partNumber=x&x-id=GetObject"), Some("x".to_string()));
+        assert_eq!(part("partNumber=1&versionId=null"), Some("1".to_string()));
+        assert_eq!(part("partNumber=1&uploadId=a"), None);
+        assert_eq!(part("partNumber=1&versionId=2"), None);
+        assert_eq!(part("x-id=GetObject"), None);
+        assert_eq!(part(""), None);
         assert_eq!(sub("location&acl"), Some("".to_string()));
         // The null version is the object; any other is nothing served.
         assert_eq!(sub("versionId=null"), None);
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index cc17eba3..2f606f3e 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -8,8 +8,10 @@
 //! again replaces the earlier one whole. Completing an upload concatenates the parts it names
 //! into one staging file in a single pass off the runtime, hashing on the way, then promotes
 //! and tags it as a PutObject's body is, its ETag `"<MD5 of the parts' MD5s>-<parts>"`; the
-//! directory then goes. The gc sweeps an upload nothing has been written into for its grace
-//! window, as it sweeps an idle OCI upload.
+//! directory then goes, and the parts' sizes stay on the manifest ([`PARTS_ANNOTATION`]),
+//! so a read may ask for one part of the object as it was uploaded (`?partNumber=<n>`) and
+//! GetObjectAttributes may list them. The gc sweeps an upload nothing has been written into
+//! for its grace window, as it sweeps an idle OCI upload.
 //!
 //! Authorized as a PutObject is: `Write` on the key's parent repository, `Read` there for
 //! ListParts, and ListMultipartUploads as a listing of the bucket. The upload id must name an
@@ -56,6 +58,109 @@ const MAX_LISTED: usize = 1000;
 /// What an upload records of itself, in its directory.
 const META: &str = "meta.json";
 
+/// The manifest annotation holding the sizes of the parts an object was completed from, in
+/// order: each in decimal, a run of equal sizes as `<size>x<count>`, joined by commas, so an
+/// upload in equal parts is one run whatever their number.
+pub(crate) const PARTS_ANNOTATION: &str = "org.virtkit.s3-parts";
+
+/// The [`PARTS_ANNOTATION`] for parts of `sizes`.
+fn parts_annotation(sizes: &[u64]) -> String {
+    let mut runs: Vec<(u64, usize)> = Vec::new();
+    for size in sizes {
+        match runs.last_mut() {
+            Some((s, n)) if s == size => *n = n.saturating_add(1),
+            _ => runs.push((*size, 1)),
+        }
+    }
+    runs.iter()
+        .map(|(size, n)| {
+            if *n == 1 {
+                size.to_string()
+            } else {
+                format!("{size}x{n}")
+            }
+        })
+        .collect::<Vec<_>>()
+        .join(",")
+}
+
+/// The sizes of the parts `annotations` say an object was completed from, in order: 1 to
+/// [`MAX_PARTS`] of them, summing to at most the object cap. `None` for an object not made
+/// of parts, or an annotation this registry did not write.
+pub(super) fn part_sizes(annotations: &BTreeMap<String, String>) -> Option<Vec<u64>> {
+    let text = annotations.get(PARTS_ANNOTATION)?;
+    let mut sizes = Vec::new();
+    let mut total: u64 = 0;
+    let number = |s: &str| {
+        (!s.is_empty() && s.bytes().all(|b| b.is_ascii_digit()) && s.len() <= 20)
+            .then(|| s.parse::<u64>().ok())
+            .flatten()
+    };
+    for run in text.split(',') {
+        let (size, count) = match run.split_once('x') {
+            Some((size, count)) => (number(size)?, number(count)?),
+            None => (number(run)?, 1),
+        };
+        let count = usize::try_from(count).ok()?;
+        if count == 0 || sizes.len().saturating_add(count) > MAX_PARTS as usize {
+            return None;
+        }
+        total = total.checked_add(size.checked_mul(count as u64)?)?;
+        if total > MAX_OBJECT {
+            return None;
+        }
+        sizes.extend(std::iter::repeat_n(size, count));
+    }
+    (!sizes.is_empty()).then_some(sizes)
+}
+
+/// Where part `n` (from 1) of an object of parts `sizes` lies: its first byte and its
+/// length; `None` past the last part.
+pub(super) fn part_range(sizes: &[u64], n: u32) -> Option<(u64, u64)> {
+    let at = usize::try_from(n).ok()?.checked_sub(1)?;
+    let len = *sizes.get(at)?;
+    let start = sizes
+        .get(..at)?
+        .iter()
+        .try_fold(0u64, |a, s| a.checked_add(*s))?;
+    Some((start, len))
+}
+
+/// The `ObjectParts` of GetObjectAttributes for an object of parts `sizes`: `max` of them
+/// from after part `marker`, each with its number and size (no checksum: none is kept per
+/// part), with the paging S3 writes around them and the count of them all.
+pub(super) fn object_parts(sizes: &[u64], max: usize, marker: u32) -> String {
+    let after: Vec<(usize, &u64)> = sizes
+        .iter()
+        .enumerate()
+        .filter(|(i, _)| i.saturating_add(1) > marker as usize)
+        .collect();
+    let truncated = after.len() > max;
+    let page = after.get(..max).unwrap_or(&after);
+    let mut out = format!(
+        "<ObjectParts>{}{}",
+        xml::element("IsTruncated", if truncated { "true" } else { "false" }),
+        xml::element("MaxParts", &max.to_string())
+    );
+    if let (true, Some((last, _))) = (truncated, page.last()) {
+        out.push_str(&xml::element(
+            "NextPartNumberMarker",
+            &last.saturating_add(1).to_string(),
+        ));
+    }
+    out.push_str(&xml::element("PartNumberMarker", &marker.to_string()));
+    for (i, size) in page {
+        out.push_str(&format!(
+            "<Part>{}{}</Part>",
+            xml::element("PartNumber", &i.saturating_add(1).to_string()),
+            xml::element("Size", &size.to_string())
+        ));
+    }
+    out.push_str(&xml::element("PartsCount", &sizes.len().to_string()));
+    out.push_str("</ObjectParts>");
+    out
+}
+
 /// Longest `meta.json` or part record read: far above what one can hold (a key, and at most
 /// 2 KiB of user metadata).
 const MAX_RECORD: u64 = 64 * 1024;
@@ -123,7 +228,7 @@ fn only(params: &[(&str, &str)], taken: &[&str]) -> bool {
 }
 
 /// A part number as a query or a document gives it: 1 to [`MAX_PARTS`], in decimal.
-fn part_number(s: &str) -> Option<u32> {
+pub(super) fn part_number(s: &str) -> Option<u32> {
     if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) || s.len() > 5 {
         return None;
     }
@@ -673,12 +778,13 @@ impl Whole {
     }
 }
 
-/// What [`assemble`] made: the object staged, its ETag, unquoted, and the whole-object
-/// checksum that held, its header and text, to keep.
+/// What [`assemble`] made: the object staged, its ETag, unquoted, the whole-object checksum
+/// that held, its header and text, to keep, and the sizes of its parts in order.
 struct Assembled {
     staged: Staged,
     etag: String,
     checksum: Option<(&'static str, String)>,
+    sizes: Vec<u64>,
 }
 
 /// Concatenate the `parts` of `up`, in order, into a staging file, in one pass, hashing on
@@ -726,6 +832,7 @@ fn assemble(
     let mut sha256 = sha2::Sha256::new();
     let mut hasher = whole.and_then(|w| checksum::Hasher::for_(w.header));
     let mut md5s = Vec::with_capacity(parts.len());
+    let mut sizes = Vec::with_capacity(parts.len());
     let mut buf = vec![0u8; STREAM_CHUNK];
     for (n, etag) in parts {
         let mut file = match std::fs::File::open(part_path(&up.dir, *n)) {
@@ -734,6 +841,7 @@ fn assemble(
             Err(e) => return Err(anyhow::Error::from(e).context("opening a part")),
         };
         let mut md5 = md5::Context::new();
+        let before = staged.size;
         loop {
             let got = match file.read(&mut buf) {
                 Ok(0) => break,
@@ -758,6 +866,7 @@ fn assemble(
             return Ok(Err(invalid_part));
         }
         md5s.push(md5);
+        sizes.push(staged.size.saturating_sub(before));
     }
     drop(out);
     let sha256 = sha256.finalize().to_vec();
@@ -775,15 +884,16 @@ fn assemble(
         staged,
         etag: multipart_etag(&md5s),
         checksum: whole.map(|w| (w.header, w.text.clone())),
+        sizes,
     }))
 }
 
 /// `POST /s3/<bucket>/<key>?uploadId=<id>`: the object the `CompleteMultipartUpload`
 /// document's parts make, in the order given, tagged at the key as a PutObject's body is
 /// (the key checked again, `If-None-Match: *`/`If-Match` checked where the tag is written),
-/// with the user metadata recorded at the upload's creation, the multipart ETag and the
-/// whole-object checksum that held; the upload then goes. A refusal leaves the upload as it
-/// was, to be completed again.
+/// with the user metadata recorded at the upload's creation, the multipart ETag, the
+/// whole-object checksum that held and the parts' sizes; the upload then goes. A refusal
+/// leaves the upload as it was, to be completed again.
 async fn complete(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -856,9 +966,11 @@ async fn complete(
         staged,
         etag,
         checksum,
+        sizes,
     } = assembled;
     let mut annotations = up.meta.annotations;
     annotations.insert(MD5_ANNOTATION.to_string(), etag.clone());
+    annotations.insert(PARTS_ANNOTATION.to_string(), parts_annotation(&sizes));
     if let Some((name, value)) =
         checksum.and_then(|(header, text)| checksum::annotation(header, &text))
     {
@@ -1282,6 +1394,84 @@ mod tests {
         }
     }
 
+    #[test]
+    fn part_sizes_round_trip_through_their_annotation() {
+        let of = |text: &str| {
+            part_sizes(&BTreeMap::from([(
+                PARTS_ANNOTATION.to_string(),
+                text.to_string(),
+            )]))
+        };
+        for sizes in [
+            vec![5],
+            vec![8 << 20, 8 << 20, 8 << 20, 1024],
+            vec![1, 2, 2, 3, 3, 3, 1],
+            vec![0, 0],
+            vec![7; 10_000],
+        ] {
+            let text = parts_annotation(&sizes);
+            assert_eq!(of(&text), Some(sizes.clone()), "{text}");
+        }
+        assert_eq!(
+            parts_annotation(&[8 << 20, 8 << 20, 8 << 20, 1024]),
+            "8388608x3,1024"
+        );
+        assert_eq!(parts_annotation(&[1, 2, 2, 3, 3, 3, 1]), "1,2x2,3x3,1");
+        assert_eq!(of("3x2"), Some(vec![3, 3]));
+        for bad in [
+            "",
+            "x",
+            "3x",
+            "x3",
+            "3x0",
+            "-1",
+            "1,,2",
+            "1x10001",
+            "4294967296x1024",
+            "99999999999999999999999",
+        ] {
+            assert_eq!(of(bad), None, "{bad:?}");
+        }
+        assert_eq!(part_sizes(&BTreeMap::new()), None);
+
+        let sizes = [5, 7, 0, 3];
+        assert_eq!(part_range(&sizes, 1), Some((0, 5)));
+        assert_eq!(part_range(&sizes, 2), Some((5, 7)));
+        assert_eq!(part_range(&sizes, 3), Some((12, 0)));
+        assert_eq!(part_range(&sizes, 4), Some((12, 3)));
+        assert_eq!(part_range(&sizes, 5), None);
+        assert_eq!(part_range(&sizes, 0), None);
+    }
+
+    #[test]
+    fn object_parts_are_paged_as_s3_pages_them() {
+        let sizes = [5, 7, 3];
+        assert_eq!(
+            object_parts(&sizes, 1000, 0),
+            "<ObjectParts><IsTruncated>false</IsTruncated><MaxParts>1000</MaxParts>\
+             <PartNumberMarker>0</PartNumberMarker><Part><PartNumber>1</PartNumber><Size>5</Size>\
+             </Part><Part><PartNumber>2</PartNumber><Size>7</Size></Part><Part><PartNumber>3\
+             </PartNumber><Size>3</Size></Part><PartsCount>3</PartsCount></ObjectParts>"
+        );
+        assert_eq!(
+            object_parts(&sizes, 2, 0),
+            "<ObjectParts><IsTruncated>true</IsTruncated><MaxParts>2</MaxParts>\
+             <NextPartNumberMarker>2</NextPartNumberMarker><PartNumberMarker>0</PartNumberMarker>\
+             <Part><PartNumber>1</PartNumber><Size>5</Size></Part><Part><PartNumber>2</PartNumber>\
+             <Size>7</Size></Part><PartsCount>3</PartsCount></ObjectParts>"
+        );
+        assert_eq!(
+            object_parts(&sizes, 2, 2),
+            "<ObjectParts><IsTruncated>false</IsTruncated><MaxParts>2</MaxParts>\
+             <PartNumberMarker>2</PartNumberMarker><Part><PartNumber>3</PartNumber><Size>3</Size>\
+             </Part><PartsCount>3</PartsCount></ObjectParts>"
+        );
+        let none = object_parts(&sizes, 0, 0);
+        assert!(none.contains("<IsTruncated>true</IsTruncated><MaxParts>0</MaxParts>"));
+        assert!(!none.contains("<Part>") && !none.contains("NextPartNumberMarker"));
+        assert!(!object_parts(&sizes, 5, 3).contains("<Part>"));
+    }
+
     #[test]
     fn a_copy_range_names_both_ends_in_order() {
         assert_eq!(copy_range("bytes=0-0"), Some((0, 0)));
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index bd259a00..e55fa2f4 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -22,7 +22,7 @@ use sha2::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::range::{self, Range};
-use super::{Ctx, UNCOMPRESSED_FROM, checksum, chunked, drain, meta, refuse, xml};
+use super::{Ctx, UNCOMPRESSED_FROM, checksum, chunked, drain, meta, multipart, refuse, xml};
 use crate::dav::http_date;
 use crate::files::{
     self, Commit, MAX_OBJECT, Node, Object, PutError, Unwritable, Written, allowed, object_of,
@@ -33,6 +33,9 @@ use crate::{Authz, Body, ServerState, Store, accounts, body_of};
 /// The header asking a read for the object's checksum.
 const CHECKSUM_MODE: &str = "x-amz-checksum-mode";
 
+/// The header a read of one part carries: how many parts the object was uploaded in.
+const PARTS_COUNT: &str = "x-amz-mp-parts-count";
+
 /// The checksum a read answers with, when asked, for an object whose write kept none: the
 /// SHA-256 the store names the bytes by.
 const CHECKSUM_SHA256: &str = "x-amz-checksum-sha256";
@@ -103,7 +106,10 @@ fn content_range(start: u64, len: u64, total: u64) -> String {
 }
 
 /// `GET`/`HEAD /s3/<bucket>/<key>`: the object's bytes, after its conditional headers, or
-/// the one byte range `Range` asks for (206) when `If-Range`, if sent, still holds; a HEAD
+/// the one byte range `Range` asks for (206) when `If-Range`, if sent, still holds, or
+/// `?partNumber=<part>`: the bytes of that part of the object as it was uploaded (206 with
+/// its `Content-Range`, and `x-amz-mp-parts-count` for an object made of parts; an object
+/// written whole is its one part, and a part of no bytes is the whole object, 200); a HEAD
 /// answers what the GET would. A GET served, whole or in part, refreshes an idle object's tag
 /// as a WebDAV GET does; a HEAD touches nothing.
 pub(super) async fn get(
@@ -111,6 +117,7 @@ pub(super) async fn get(
     authz: &Authz<'_>,
     segs: Vec<String>,
     head: bool,
+    part: Option<u32>,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
@@ -119,6 +126,14 @@ pub(super) async fn get(
     }
     let conditions = Conditions::of(req.headers());
     let asked = range::Asked::of(req.headers());
+    if part.is_some() && req.headers().contains_key(hyper::header::RANGE) {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidRequest",
+            "Cannot specify both Range header and partNumber query parameter",
+        );
+        return refuse(req, resp, ctx).await;
+    }
     let checksum = req
         .headers()
         .get(CHECKSUM_MODE)
@@ -151,7 +166,36 @@ pub(super) async fn get(
                 ));
             }
         }
-        let mut resp = match asked.resolve(&etag, obj.modified, obj.size) {
+        let sizes = multipart::part_sizes(&obj.annotations);
+        let range = match part {
+            None => asked.resolve(&etag, obj.modified, obj.size),
+            Some(n) => {
+                let lies = match &sizes {
+                    Some(sizes) => multipart::part_range(sizes, n),
+                    None => (n == 1).then_some((0, obj.size)),
+                };
+                let Some((start, len)) = lies else {
+                    let count = sizes.as_ref().map_or(1, Vec::len).to_string();
+                    return Ok(xml::error(
+                        StatusCode::RANGE_NOT_SATISFIABLE,
+                        "InvalidPartNumber",
+                        "The requested partnumber is not satisfiable.",
+                        &[
+                            ("ActualPartCount", &count),
+                            ("PartNumberRequested", &n.to_string()),
+                        ],
+                        &ctx.path,
+                        &ctx.id,
+                    ));
+                };
+                if len == 0 {
+                    Range::Whole
+                } else {
+                    Range::Part { start, len }
+                }
+            }
+        };
+        let mut resp = match range {
             Range::Whole => {
                 let digest = format!("sha256:{}", obj.layer);
                 let mut resp = crate::serve_blob(store, &digest, head, false, false)?;
@@ -205,6 +249,13 @@ pub(super) async fn get(
         headers.insert(CONTENT_DISPOSITION, HeaderValue::from_static("attachment"));
         insert(headers, ETAG, &etag);
         insert(headers, LAST_MODIFIED, &modified);
+        if let (Some(_), Some(sizes)) = (part, &sizes) {
+            insert(
+                headers,
+                hyper::header::HeaderName::from_static(PARTS_COUNT),
+                &sizes.len().to_string(),
+            );
+        }
         // The whole object's checksum, on the whole object only: S3 sends none with a part,
         // and the AWS CLI checks what it is sent against the bytes of each part it fetches.
         if checksum && !partial {
@@ -226,8 +277,10 @@ pub(super) async fn get(
 }
 
 /// `GET /s3/<bucket>/<key>?attributes`: what `x-amz-object-attributes` asks of `ETag`,
-/// `Checksum`, `ObjectSize` and `StorageClass` (`ObjectParts` has nothing to say of an object
-/// written whole), with `Last-Modified`. A metadata read, so it touches nothing.
+/// `Checksum`, `ObjectParts` (the parts an object was uploaded in, `x-amz-max-parts` of
+/// them from after `x-amz-part-number-marker`; an object written whole has none),
+/// `ObjectSize` and `StorageClass`, with `Last-Modified`. A metadata read, so it touches
+/// nothing.
 pub(super) async fn attributes(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -238,6 +291,28 @@ pub(super) async fn attributes(
     if !admitted(authz, accounts::Action::Read, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
+    let count = |name: &str, default: u64, most: u64| -> Option<u64> {
+        match req.headers().get(name) {
+            None => Some(default),
+            Some(v) => v
+                .to_str()
+                .ok()
+                .filter(|v| !v.is_empty() && v.bytes().all(|b| b.is_ascii_digit()))
+                .and_then(|v| v.parse::<u64>().ok())
+                .map(|n| n.min(most)),
+        }
+    };
+    let (Some(max_parts), Some(marker)) = (
+        count("x-amz-max-parts", 1000, 1000),
+        count("x-amz-part-number-marker", 0, u64::from(u32::MAX)),
+    ) else {
+        let resp = ctx.error(
+            StatusCode::BAD_REQUEST,
+            "InvalidArgument",
+            "x-amz-max-parts and x-amz-part-number-marker are whole numbers",
+        );
+        return refuse(req, resp, ctx).await;
+    };
     let mut asked = Vec::new();
     for value in req.headers().get_all("x-amz-object-attributes") {
         let Ok(value) = value.to_str() else {
@@ -283,6 +358,13 @@ pub(super) async fn attributes(
             };
             inner.push_str(&format!("<Checksum>{kept}</Checksum>"));
         }
+        if has("ObjectParts")
+            && let Some(sizes) = multipart::part_sizes(&obj.annotations)
+        {
+            let max = usize::try_from(max_parts).unwrap_or(1000);
+            let marker = u32::try_from(marker).unwrap_or(u32::MAX);
+            inner.push_str(&multipart::object_parts(&sizes, max, marker));
+        }
         if has("StorageClass") {
             inner.push_str(&xml::element("StorageClass", "STANDARD"));
         }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 35328b8b..fdd9a492 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1454,6 +1454,165 @@ async fn a_put_checks_the_digests_it_is_sent() {
     assert_eq!(resp.header("x-amz-checksum-type"), None);
 }
 
+/// An object uploaded in parts is read back a part at a time, as the AWS CLI and SDKs
+/// download it: each part as it was sent, with the count of them; an object written whole
+/// is its one part; a part there is not is refused as a range past the end is.
+#[tokio::test]
+async fn an_object_made_of_parts_is_read_a_part_at_a_time() {
+    let dir = tmp("parts");
+    let host = spawn(open_state(&dir, true));
+    let sign = |r: Req| r;
+    let path = "/s3/b/parts";
+    let id = create_upload(&host, &sign, path).await;
+    let parts: Vec<Vec<u8>> = vec![bytes_of_len(70_000), bytes_of_len(500), b"end".to_vec()];
+    let mut etags = Vec::new();
+    for (i, data) in parts.iter().enumerate() {
+        etags.push(upload_part(&host, &sign, path, &id, i as u32 + 1, data).await);
+    }
+    let named: Vec<(u32, &str)> = etags
+        .iter()
+        .enumerate()
+        .map(|(i, e)| (i as u32 + 1, e.as_str()))
+        .collect();
+    send(&host, complete(path, &id, &named)).await.ok(200);
+    let whole = parts.concat();
+    let etag = multipart_etag(&[&parts[0], &parts[1], &parts[2]]);
+    let mut start = 0;
+    for (i, data) in parts.iter().enumerate() {
+        let query = format!("partNumber={}", i + 1);
+        for method in ["GET", "HEAD"] {
+            let resp = send(&host, Req::new(method, path).query(&query)).await;
+            resp.ok(206);
+            assert_eq!(resp.header("x-amz-mp-parts-count"), Some("3"));
+            assert_eq!(resp.header("etag"), Some(&*etag));
+            assert_eq!(
+                resp.header("content-range"),
+                Some(&*format!(
+                    "bytes {start}-{}/{}",
+                    start + data.len() - 1,
+                    whole.len()
+                ))
+            );
+            assert_eq!(
+                resp.header("content-length"),
+                Some(&*data.len().to_string())
+            );
+            assert_eq!(resp.header("accept-ranges"), Some("bytes"));
+            if method == "GET" {
+                assert_eq!(resp.bytes, *data);
+            }
+        }
+        start += data.len();
+    }
+    let resp = send(&host, Req::new("GET", path).query("partNumber=4")).await;
+    resp.is(416, "InvalidPartNumber");
+    assert_eq!(element(&resp.body, "ActualPartCount"), "3");
+    assert_eq!(element(&resp.body, "PartNumberRequested"), "4");
+    for bad in [
+        "partNumber=0",
+        "partNumber=-3",
+        "partNumber=10001",
+        "partNumber=x",
+    ] {
+        send(&host, Req::new("GET", path).query(bad))
+            .await
+            .is(400, "InvalidArgument");
+    }
+    let both = Req::new("GET", path)
+        .query("partNumber=1")
+        .header("Range", "bytes=0-9");
+    send(&host, both).await.is(400, "InvalidRequest");
+    // The SDK's hint and the null version name nothing more.
+    let resp = send(
+        &host,
+        Req::new("GET", path).query("partNumber=3&versionId=null&x-id=GetObject"),
+    )
+    .await;
+    resp.ok(206);
+    assert_eq!(resp.bytes, b"end");
+    // The whole object, and a range of it, as before.
+    is_object(&send(&host, Req::new("GET", path)).await, &whole);
+    let resp = send(
+        &host,
+        Req::new("GET", path).header("Range", "bytes=70000-70499"),
+    )
+    .await;
+    resp.ok(206);
+    assert_eq!(resp.bytes, parts[1]);
+    assert_eq!(resp.header("x-amz-mp-parts-count"), None);
+
+    // Its parts among its attributes, paged.
+    let attrs = |which: &str| {
+        Req::new("GET", path)
+            .query("attributes")
+            .header("x-amz-object-attributes", which)
+    };
+    let resp = send(&host, attrs("ObjectParts,ObjectSize")).await;
+    resp.ok(200);
+    assert_eq!(
+        element(&resp.body, "ObjectParts"),
+        "<IsTruncated>false</IsTruncated><MaxParts>1000</MaxParts><PartNumberMarker>0\
+         </PartNumberMarker><Part><PartNumber>1</PartNumber><Size>70000</Size></Part><Part>\
+         <PartNumber>2</PartNumber><Size>500</Size></Part><Part><PartNumber>3</PartNumber>\
+         <Size>3</Size></Part><PartsCount>3</PartsCount>"
+    );
+    assert_eq!(element(&resp.body, "ObjectSize"), "70503");
+    let resp = send(
+        &host,
+        attrs("ObjectParts")
+            .header("x-amz-max-parts", "1")
+            .header("x-amz-part-number-marker", "1"),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(elements(&resp.body, "PartNumber"), ["2"]);
+    assert_eq!(element(&resp.body, "IsTruncated"), "true");
+    assert_eq!(element(&resp.body, "NextPartNumberMarker"), "2");
+    send(&host, attrs("ObjectParts").header("x-amz-max-parts", "-1"))
+        .await
+        .is(400, "InvalidArgument");
+
+    // A copy is made of the same parts.
+    let copy = Req::new("PUT", "/s3/b/copy").header("x-amz-copy-source", "/b/parts");
+    send(&host, copy).await.ok(200);
+    let resp = send(&host, Req::new("GET", "/s3/b/copy").query("partNumber=2")).await;
+    resp.ok(206);
+    assert_eq!(resp.bytes, parts[1]);
+    assert_eq!(resp.header("x-amz-mp-parts-count"), Some("3"));
+
+    // An object written whole is its one part, with no count; one of no bytes is whole.
+    send(&host, Req::new("PUT", "/s3/b/one").body(HELLO.to_vec()))
+        .await
+        .ok(200);
+    for method in ["GET", "HEAD"] {
+        let resp = send(&host, Req::new(method, "/s3/b/one").query("partNumber=1")).await;
+        resp.ok(206);
+        assert_eq!(resp.header("content-range"), Some("bytes 0-12/13"));
+        assert_eq!(resp.header("content-length"), Some("13"));
+        assert_eq!(resp.header("x-amz-mp-parts-count"), None);
+    }
+    let resp = send(&host, Req::new("GET", "/s3/b/one").query("partNumber=2")).await;
+    resp.is(416, "InvalidPartNumber");
+    assert_eq!(element(&resp.body, "ActualPartCount"), "1");
+    let resp = send(&host, attrs("ObjectParts,ETag").path_of("/s3/b/one")).await;
+    resp.ok(200);
+    assert!(!resp.body.contains("ObjectParts"), "{}", resp.body);
+    let sha = b64(&sha2::Sha256::digest(b""));
+    let empty = Req::new("PUT", "/s3/b/empty").header("x-amz-checksum-sha256", &sha);
+    send(&host, empty).await.ok(200);
+    let resp = send(
+        &host,
+        Req::new("HEAD", "/s3/b/empty")
+            .query("partNumber=1")
+            .header("x-amz-checksum-mode", "ENABLED"),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(resp.header("content-range"), None);
+    assert_eq!(resp.header("content-length"), Some("0"));
+    assert_eq!(resp.header("x-amz-checksum-sha256"), Some(sha.as_str()));
+}
+
 /// The checksum a write carried, once it held, is the object's: sent back on a read asking
 /// for it, listed with the object, reported among its attributes, carried by a copy, and
 /// the one a completed upload's whole-object checksum becomes.
@@ -2167,7 +2326,7 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
 
     // Not served: other subresources and verbs, and parameters an operation does not take.
     for req in [
-        Req::new("GET", "/s3/b/k").query("partNumber=1"),
+        Req::new("GET", "/s3/b/k").query("partNumber=1&retention"),
         Req::new("GET", "/s3/b/k").query("retention"),
         Req::new("POST", "/s3/b/k").query("uploads&acl"),
         put("/s3/b/k").query("tagging"),

From 3287d9765381268888bb71aa1b346b39adbaa270 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 08:50:09 +0100
Subject: [PATCH 36/54] vk-registry/s3: let a refused write see its refusal

A refusal decided before the caller is known now reads up to 8 MiB of
the body before answering, the AWS CLI's part size, where 64 KiB left
any larger refused upload with a reset instead of the answer. A client
holding its body back on Expect: 100-continue is refused before the
100 would go out, so it sends no body and reads the refusal first, as
it would from S3.
---
 CHANGELOG.md                |  3 +-
 vk-registry/DESIGN.md       | 10 +++--
 vk-registry/src/s3/mod.rs   | 31 +++++++++++----
 vk-registry/tests/s3_e2e.rs | 77 ++++++++++++++++++++++++++++++++++---
 4 files changed, 104 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a024491..cb7d69b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,7 +23,8 @@ All notable changes to virtkit will be documented in this file.
   and deleted in batches, and the configuration probes tools send before using a bucket
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
-  storage class, a redirect, a retention lock — is refused rather than stored without it. Large
+  storage class, a redirect, a retention lock — is refused rather than stored without it, and
+  a refused upload sees its refusal rather than a dropped connection. Large
   files can be uploaded in parts, as the AWS CLI uploads them, read back a part at a time,
   parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index f6cf40c0..e41ab066 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -788,10 +788,12 @@ rather than a bare status. Every `/s3/` response carries an `x-amz-request-id` o
 digits, the same id again as `x-amz-id-2` (S3's second id, which SDK test suites expect on
 every answer) and `nosniff`; an internal error logs its request id, so a client's report can
 be matched to the server's line. A refusal decided before the caller is authenticated reads at
-most 64 KiB of the body first, enough for `sccache`'s 13-byte probe to see its answer rather
-than a reset; every refusal after it reads the body through, up to the 4 GiB cap, as
-WebDAV's do. A refusal of a request with a body then closes the connection. A registry its
-hub made read-only answers writes 503 `ServiceUnavailable` with `Retry-After`.
+most 8 MiB of the body first, enough for a write of the AWS CLI's part size (and `sccache`'s
+13-byte probe) to see its answer rather than a reset; every refusal after it reads the body
+through, up to the 4 GiB cap, as WebDAV's do. A refusal of a request with a body then closes
+the connection. A request holding its body back on `Expect: 100-continue` is refused before
+the `100` goes out, so the client sends no body and sees the refusal, as it would from S3.
+A registry its hub made read-only answers writes 503 `ServiceUnavailable` with `Retry-After`.
 
 S3 writes into `files/` take the WebDAV view's namespace lock, run their store work on the
 blocking pool and stream their bodies on the runtime. Objects expire under the gc's tag
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 6481ce9a..959aa727 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -40,7 +40,7 @@ mod xml;
 use anyhow::Result;
 use hyper::body::Incoming;
 use hyper::header::{
-    AUTHORIZATION, DATE, HeaderMap, HeaderValue, RETRY_AFTER, X_CONTENT_TYPE_OPTIONS,
+    AUTHORIZATION, DATE, EXPECT, HeaderMap, HeaderValue, RETRY_AFTER, X_CONTENT_TYPE_OPTIONS,
 };
 use hyper::{Method, Request, Response, StatusCode};
 use vk_hub_proto::token::Claims;
@@ -76,9 +76,10 @@ pub(crate) fn host_of(req: &Request<Incoming>) -> Option<&str> {
 }
 
 /// How much of a request body is read before answering a refusal decided before the caller
-/// is known: enough for a small write to see its answer rather than a reset, not so much
-/// that anyone who can reach the port can make the server read a large upload for nothing.
-const PRE_AUTH_DRAIN: u64 = 64 * 1024;
+/// is known: enough for a write of a part's size (the AWS CLI's 8 MiB) to see its answer
+/// rather than a reset, not so much that anyone who can reach the port can make the server
+/// read a large upload for nothing.
+const PRE_AUTH_DRAIN: u64 = 8 << 20;
 
 /// The header naming each request, for a client's report to be matched to a server line.
 const REQUEST_ID: &str = "x-amz-request-id";
@@ -451,11 +452,24 @@ fn scheme(headers: &HeaderMap) -> std::result::Result<bool, &'static str> {
 /// Answer `resp` once the request body has been read through, as after every refusal of an
 /// authenticated request: a status sent with request bytes unread resets the connection,
 /// which a client sees instead of the answer. A body past the object cap is refused with 413
-/// instead.
+/// instead. A client waiting on `Expect: 100-continue` has sent no body yet: it is answered
+/// at once, and the `100` it would have sent the body on never goes out.
 async fn refuse(req: Request<Incoming>, resp: Response<Body>, ctx: &Ctx) -> Result<Response<Body>> {
+    if expects_continue(req.headers()) {
+        return Ok(resp);
+    }
     Ok(drain(req, ctx).await?.unwrap_or(resp))
 }
 
+/// Whether the client holds its body back until a `100 Continue`, which hyper sends only once
+/// the body is first read: an answer given before that is the final one, and the body never
+/// comes.
+fn expects_continue(headers: &HeaderMap) -> bool {
+    headers
+        .get(EXPECT)
+        .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"100-continue"))
+}
+
 /// Read a request's body through and discard it: `Some(413)` if it crosses the object cap.
 async fn drain(req: Request<Incoming>, ctx: &Ctx) -> Result<Option<Response<Body>>> {
     let sink = &mut tokio::io::sink();
@@ -495,9 +509,12 @@ async fn read_small(
 }
 
 /// Answer `resp` to a request refused before it was authenticated, having read at most
-/// [`PRE_AUTH_DRAIN`] of its body (and the frame that crossed it).
+/// [`PRE_AUTH_DRAIN`] of its body (and the frame that crossed it); none of a body held back
+/// for a `100 Continue`, as [`refuse`] reads none.
 async fn before_auth(req: Request<Incoming>, resp: Response<Body>) -> Result<Response<Body>> {
-    crate::files::drain_up_to(req.into_body(), PRE_AUTH_DRAIN).await;
+    if !expects_continue(req.headers()) {
+        crate::files::drain_up_to(req.into_body(), PRE_AUTH_DRAIN).await;
+    }
     Ok(resp)
 }
 
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index fdd9a492..f7b9df38 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -901,12 +901,12 @@ async fn an_api_key_is_the_access_key_and_its_secret_until_revoked_or_expired()
     }
 }
 
-/// A refusal before authentication reads up to 64 KiB of the body, so a write sees its answer
+/// A refusal before authentication reads up to 8 MiB of the body, so a write sees its answer
 /// rather than a reset, a large one while it is still sending; the connection then closes,
 /// as after any refusal of a request with a body, rather than the server reading the rest.
 /// Without a body, the connection goes on.
 #[tokio::test]
-async fn a_refused_body_is_read_up_to_64_kib() {
+async fn a_refused_body_is_read_up_to_8_mib() {
     let dir = tmp("drain");
     let (state, _) = shared(
         &dir,
@@ -967,12 +967,12 @@ async fn a_refused_body_is_read_up_to_64_kib() {
         assert_eq!(resp.header("connection"), Some("close"), "{code}");
         assert!(conn.closed().await, "{code}");
 
-        // A MiB of a body declared 64 MiB long, the rest never sent: the answer comes all
+        // 9 MiB of a body declared 64 MiB long, the rest never sent: the answer comes all
         // the same, so the server did not wait for the body's end.
-        let req = req(vec![b'x'; 1 << 20]);
+        let req = req(vec![b'x'; 9 << 20]);
         let mut conn = Conn::open(&host).await;
         let head = req.head(&host).replace(
-            &format!("Content-Length: {}", 1 << 20),
+            &format!("Content-Length: {}", 9 << 20),
             &format!("Content-Length: {}", 64 << 20),
         );
         let mut write = conn.write.take().unwrap();
@@ -993,6 +993,73 @@ async fn a_refused_body_is_read_up_to_64_kib() {
     }
 }
 
+/// A client holding its body back on `Expect: 100-continue` gets a refusal as its first
+/// answer, before any `100`, and never sends the body; one admitted gets the `100`, sends
+/// the body and is answered as usual.
+#[tokio::test]
+async fn a_refusal_comes_before_any_100_continue() {
+    let dir = tmp("expect");
+    let (state, _) = shared(
+        &dir,
+        Auth::Bearer {
+            token: "s3cret".into(),
+        },
+        true,
+    );
+    let host = spawn(state);
+    /// The head of `req` with a 123-byte body announced and held back.
+    fn held(req: &Req, host: &str) -> String {
+        req.head(host).replace(
+            "Content-Length: 0",
+            "Content-Length: 123\r\nExpect: 100-continue",
+        )
+    }
+    let put = || Req::new("PUT", "/s3/b/k");
+    // Before authentication, and after it.
+    for (req, status) in [
+        (put(), 403),
+        (put().header("Authorization", "Bearer nope"), 403),
+        (
+            put()
+                .header("x-amz-tagging", "a=b")
+                .signed(&host, ("s3cret", "s3cret"), 0),
+            501,
+        ),
+    ] {
+        let mut conn = Conn::open(&host).await;
+        let write = conn.write.as_mut().unwrap();
+        write.write_all(held(&req, &host).as_bytes()).await.unwrap();
+        let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
+            .await
+            .expect("answered without the body");
+        assert_eq!(resp.status, status, "{resp:?}");
+        assert_eq!(resp.header("connection"), Some("close"));
+        assert!(conn.closed().await);
+    }
+    // Admitted: the 100, then the body, then the answer.
+    let body = vec![b'x'; 123];
+    let req = put().signed(&host, ("s3cret", "s3cret"), 0);
+    let mut conn = Conn::open(&host).await;
+    let write = conn.write.as_mut().unwrap();
+    write.write_all(held(&req, &host).as_bytes()).await.unwrap();
+    let mut line = String::new();
+    conn.read.read_line(&mut line).await.unwrap();
+    assert_eq!(line, "HTTP/1.1 100 Continue\r\n");
+    line.clear();
+    conn.read.read_line(&mut line).await.unwrap();
+    assert_eq!(line, "\r\n");
+    conn.write.as_mut().unwrap().write_all(&body).await.unwrap();
+    conn.response().await.ok(200);
+    is_object(
+        &send(
+            &host,
+            Req::new("GET", "/s3/b/k").signed(&host, ("s3cret", "s3cret"), 0),
+        )
+        .await,
+        &body,
+    );
+}
+
 /// `s3 = false`: `/s3/` is the 404 any unknown path is, after the usual gate.
 #[tokio::test]
 async fn s3_off_is_the_catch_all_404_after_authentication() {

From c7c42182261f865dfe1bd7ad2b48c399cda3932a Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 09:34:59 +0100
Subject: [PATCH 37/54] vk-registry/s3: name the object's size on a PutObject's
 answer

PutObject answers with x-amz-object-size, as S3 does: the Go SDK reads
it back without checking, and versitygw's conditional-delete test
crashed on its absence.
---
 vk-registry/DESIGN.md        |  2 +-
 vk-registry/src/s3/object.rs | 25 +++++++++++++++++++++++--
 vk-registry/tests/s3_e2e.rs  |  1 +
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index e41ab066..2a20ae8a 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -678,7 +678,7 @@ reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index e55fa2f4..26522d04 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -879,6 +879,16 @@ pub(super) async fn receive(
 
 /// The 200 a write answers: its `etag` (quoted) and the checksum that held.
 pub(super) fn written(etag: &str, echo: Option<(&'static str, String)>) -> Result<Response<Body>> {
+    written_of(etag, echo, None)
+}
+
+/// [`written`] for an object of `size` bytes, which the answer names (`x-amz-object-size`),
+/// as S3's PutObject does; a part's answer names none.
+fn written_of(
+    etag: &str,
+    echo: Option<(&'static str, String)>,
+    size: Option<u64>,
+) -> Result<Response<Body>> {
     let mut resp = Response::builder()
         .status(StatusCode::OK)
         .header(CONTENT_LENGTH, "0")
@@ -892,9 +902,19 @@ pub(super) fn written(etag: &str, echo: Option<(&'static str, String)>) -> Resul
             &value,
         );
     }
+    if let Some(size) = size {
+        insert(
+            headers,
+            hyper::header::HeaderName::from_static(OBJECT_SIZE),
+            &size.to_string(),
+        );
+    }
     Ok(resp)
 }
 
+/// The header a PutObject's answer names the object's size in, which SDKs read back.
+const OBJECT_SIZE: &str = "x-amz-object-size";
+
 /// `PUT /s3/<bucket>/<key>`: stream the body into staging while hashing it, check it against
 /// what the request said of it ([`receive`]), then tag it under the namespace lock, with its
 /// MD5, the checksum that held and its user metadata on the manifest and the request's
@@ -963,10 +983,11 @@ pub(super) async fn put(
     if let Some((name, value)) = kept.clone() {
         annotations.insert(name, value);
     }
+    let size = received.staged.size;
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
-        uncompressed: received.staged.size >= UNCOMPRESSED_FROM,
+        uncompressed: size >= UNCOMPRESSED_FROM,
     };
     let written = files::commit(Arc::clone(&state.store), segs, received.staged, how).await?;
     match written {
@@ -980,7 +1001,7 @@ pub(super) async fn put(
             ));
         }
     }
-    let mut resp = self::written(&format!("\"{md5_hex}\""), received.echo)?;
+    let mut resp = written_of(&format!("\"{md5_hex}\""), received.echo, Some(size))?;
     if kept.is_some() {
         resp.headers_mut().insert(
             checksum::TYPE_HEADER,
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index f7b9df38..1ad06137 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1440,6 +1440,7 @@ async fn a_put_checks_the_digests_it_is_sent() {
         let path = format!("/s3/b/good{i}");
         let resp = send(&host, put(&path, (name, value))).await;
         resp.ok(200);
+        assert_eq!(resp.header("x-amz-object-size"), Some("13"));
         if name.starts_with("x-amz-checksum") {
             assert_eq!(resp.header(name), Some(value.as_str()), "{name}");
             assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));

From 5117718fb87711cf124f233956814c9355c61a8f Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:26:23 +0100
Subject: [PATCH 38/54] vk-registry/s3: delete only what a conditional delete
 names

DeleteObject takes If-Match, x-amz-if-match-last-modified-time and
x-amz-if-match-size, and each <Object> of a DeleteObjects document its
ETag, LastModifiedTime and Size: the object is deleted only when every
condition given holds, checked under the namespace lock against the
object the delete removes. A condition that does not hold is 412
PreconditionFailed (that key's error in a batch), one on a key with no
object NoSuchKey, as S3's conditional deletes answer, and a value that
does not parse 400. A condition beside a version id is 501, S3 applying
them to the current object only.

AbortMultipartUpload takes x-amz-if-match-initiated-time: an upload
initiated in another second is kept and the abort answers 412; a time
still to come is no condition, as S3 takes it.
---
 CHANGELOG.md                      |   3 +-
 vk-registry/DESIGN.md             |   6 +-
 vk-registry/src/s3/batch.rs       | 244 +++++++++++++++++++++++++-----
 vk-registry/src/s3/conditional.rs | 169 ++++++++++++++++++++-
 vk-registry/src/s3/mod.rs         |   3 +-
 vk-registry/src/s3/multipart.rs   |  25 ++-
 vk-registry/src/s3/object.rs      |  69 +++++++--
 vk-registry/tests/s3_e2e.rs       | 210 +++++++++++++++++++++++++
 8 files changed, 668 insertions(+), 61 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb7d69b0..547c5877 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,7 +20,8 @@ All notable changes to virtkit will be documented in this file.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
   checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
   Buckets can be created and removed, objects copied without their bytes being stored twice
-  and deleted in batches, and the configuration probes tools send before using a bucket
+  and deleted in batches — only while still the ETag, modification time or size a delete
+  names, when it names one, as S3's conditional deletes — and the configuration probes tools send before using a bucket
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 2a20ae8a..7dec2ae7 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -681,9 +681,9 @@ reads; a replaced object keeps only what its own write sent.
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
-| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too |
+| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
-| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through. So is any request whose headers ask for one of them on the object or bucket it names, rather than the header being taken and dropped: `x-amz-server-side-encryption*` (SSE-S3, SSE-KMS and SSE-C, on a read and a copy's source too: a client that asked for its own key is never told its bytes are stored under it), `x-amz-tagging` naming a tag, `x-amz-acl` other than `private` or `bucket-owner-full-control` (the one ACL there is), `x-amz-grant-*`, `x-amz-storage-class` other than `STANDARD` (400 `InvalidStorageClass` for a class S3 does not have), `x-amz-website-redirect-location` and `x-amz-object-lock-*` |
@@ -697,7 +697,7 @@ reads; a replaced object keeps only what its own write sent.
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
-| `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload` |
+| `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take; an SDK's `x-id` operation hint is ignored |
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index effa2922..57da64b1 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -2,11 +2,17 @@
 //! each deleted as DeleteObject deletes it and answered on its own in the `DeleteResult`. The
 //! namespace lock is taken once for the whole batch. The document is bounded (1 MiB, 1000
 //! keys) and checked against the digests its request names before a key is touched.
+//!
+//! An `<Object>` may carry conditions on the object it names, as DeleteObject's headers do:
+//! its `ETag`, `LastModifiedTime` and `Size`, checked under that lock against the object the
+//! key holds, which is deleted only when they all hold (else `PreconditionFailed`, or
+//! `NoSuchKey` when there is no object), the batch going on.
 
 use anyhow::Result;
 use hyper::body::Incoming;
 use hyper::{Request, Response, StatusCode};
 
+use super::conditional::{self, DeleteConditions};
 use super::object::{Deleted, admitted, check_body, delete_one, unwritable_message};
 use super::xml::scan::{self, Malformed};
 use super::{Ctx, NULL_VERSION, path, read_small, xml};
@@ -24,12 +30,14 @@ const MAX_KEYS: usize = 1000;
 const MAX_ELEMENTS: usize = 6 * MAX_KEYS + 16;
 
 /// One key a `Delete` document names.
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, Default, PartialEq, Eq)]
 struct Entry {
     key: String,
-    /// whether it names a version other than the object's one, [`NULL_VERSION`], which
-    /// this registry does not keep
-    versioned: bool,
+    /// the `VersionId` it names, echoed in its answer; one other than the object's one,
+    /// [`NULL_VERSION`], is one this registry does not keep
+    version: Option<String>,
+    /// what must hold of the object for it to be deleted
+    conditions: DeleteConditions,
 }
 
 /// What a `Delete` document asks.
@@ -39,33 +47,78 @@ struct Asked {
     entries: Vec<Entry>,
 }
 
-/// The `Delete` document `body` holds.
-fn document(body: &[u8]) -> Result<Asked, Malformed> {
+/// Why a `Delete` document is refused whole.
+#[derive(Debug, PartialEq, Eq)]
+enum Refused {
+    /// 400 `MalformedXML`
+    Malformed(&'static str),
+    /// 400 `InvalidRequest`: the first `LastModifiedTime` in the document that is not a
+    /// date, as it was sent
+    Date(String),
+}
+
+impl From<Malformed> for Refused {
+    fn from(Malformed(why): Malformed) -> Self {
+        Refused::Malformed(why)
+    }
+}
+
+/// The `Delete` document `body` holds. An empty `LastModifiedTime` makes it malformed, which
+/// S3 reports ahead of one that is not a date.
+fn document(body: &[u8]) -> Result<Asked, Refused> {
     let root = scan::parse(body, MAX_ELEMENTS)?;
     if root.name != "Delete" {
-        return Err(Malformed("the document is not a Delete"));
+        return Err(Malformed("the document is not a Delete").into());
     }
     let quiet = match root.one("Quiet")?.map(|q| q.text.trim()) {
         None => false,
         Some(q) if q.eq_ignore_ascii_case("true") => true,
         Some(q) if q.eq_ignore_ascii_case("false") => false,
-        Some(_) => return Err(Malformed("Quiet is true or false")),
+        Some(_) => return Err(Malformed("Quiet is true or false").into()),
     };
     let mut entries = Vec::new();
+    let mut bad_date = None;
     for o in root.all("Object") {
         let key = o
             .one("Key")?
             .ok_or(Malformed("each Object names its Key"))?;
+        let modified = match o.one("LastModifiedTime")? {
+            None => None,
+            Some(t) if t.text.trim().is_empty() => {
+                return Err(Malformed("a LastModifiedTime is a date").into());
+            }
+            Some(t) => match conditional::parse_time(&t.text) {
+                Some(time) => Some(conditional::whole_seconds(time)),
+                None => {
+                    bad_date.get_or_insert_with(|| t.text.clone());
+                    None
+                }
+            },
+        };
+        let size = match o.one("Size")? {
+            None => None,
+            Some(s) => Some(
+                conditional::parse_size(&s.text).ok_or(Malformed("a Size is a count of bytes"))?,
+            ),
+        };
         entries.push(Entry {
             key: key.text.clone(),
-            versioned: o.one("VersionId")?.is_some_and(|v| v.text != NULL_VERSION),
+            version: o.one("VersionId")?.map(|v| v.text.clone()),
+            conditions: DeleteConditions {
+                etag: o.one("ETag")?.map(|e| e.text.clone()),
+                modified,
+                size,
+            },
         });
     }
+    if let Some(date) = bad_date {
+        return Err(Refused::Date(date));
+    }
     if entries.is_empty() {
-        return Err(Malformed("a Delete names at least one Object"));
+        return Err(Malformed("a Delete names at least one Object").into());
     }
     if entries.len() > MAX_KEYS {
-        return Err(Malformed("a Delete names at most 1000 objects"));
+        return Err(Malformed("a Delete names at most 1000 objects").into());
     }
     Ok(Asked { quiet, entries })
 }
@@ -73,14 +126,16 @@ fn document(body: &[u8]) -> Result<Asked, Malformed> {
 /// Why one key was not deleted: an S3 error code and a message.
 type KeyError = (&'static str, &'static str);
 
-/// Delete `key` of `bucket` for this caller, the namespace held: as DeleteObject would, a
-/// key with no object counting as deleted.
+/// Delete `key` of `bucket` for this caller when `conditions` hold of its object, the
+/// namespace held: as DeleteObject would, a key with no object counting as deleted when no
+/// condition is asked.
 fn delete_key(
     store: &Store,
     namespace: &files::Namespace,
     authz: &Authz<'_>,
     bucket: &str,
     key: &str,
+    conditions: &DeleteConditions,
 ) -> Result<std::result::Result<(), KeyError>> {
     // A key here is text, not a URL: no escape is decoded, and no key holds a `%`.
     if key.contains('%') {
@@ -98,11 +153,43 @@ fn delete_key(
     if !admitted(authz, accounts::Action::Write, &segs) {
         return Ok(Err(denied));
     }
-    Ok(match delete_one(store, namespace, authz, &segs)? {
-        Deleted::Gone => Ok(()),
-        Deleted::Denied => Err(denied),
-        Deleted::Foreign => Err(("OperationAborted", unwritable_message(Unwritable::Foreign))),
-    })
+    Ok(
+        match delete_one(store, namespace, authz, &segs, conditions)? {
+            Deleted::Gone => Ok(()),
+            Deleted::Denied => Err(denied),
+            Deleted::Foreign => Err(("OperationAborted", unwritable_message(Unwritable::Foreign))),
+            Deleted::Absent => Err(("NoSuchKey", "The specified key does not exist.")),
+            Deleted::Failed => Err(("PreconditionFailed", conditional::PRECONDITION_FAILED)),
+        },
+    )
+}
+
+/// Why `entry` is refused before its key is looked at: a version this registry does not
+/// keep, an empty `ETag`, or a condition on a version, which S3 applies to the current
+/// object only.
+fn refused(entry: &Entry) -> Option<KeyError> {
+    let conditions = &entry.conditions;
+    if conditions
+        .etag
+        .as_deref()
+        .is_some_and(|e| e.trim().is_empty())
+    {
+        return Some((
+            "InvalidArgument",
+            "The value provided for the ETag field cannot be empty for this API.",
+        ));
+    }
+    match entry.version.as_deref() {
+        Some(_) if !conditions.is_empty() => Some((
+            "NotImplemented",
+            "A form field you provided implies functionality that is not implemented",
+        )),
+        Some(v) if v != NULL_VERSION => Some((
+            "NotImplemented",
+            "this registry keeps no versions: a key's one VersionId is null",
+        )),
+        _ => None,
+    }
 }
 
 /// `POST /s3/<bucket>?delete`: each key of the document deleted, or the reason it was not,
@@ -130,39 +217,49 @@ pub(super) async fn delete(
     }
     let asked = match document(&body) {
         Ok(asked) => asked,
-        Err(Malformed(why)) => return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why)),
+        Err(Refused::Malformed(why)) => {
+            return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why));
+        }
+        Err(Refused::Date(date)) => {
+            let message = format!("Invalid value for date attribute: {date}");
+            return Ok(ctx.error(StatusCode::BAD_REQUEST, "InvalidRequest", &message));
+        }
     };
     let id = ctx.id.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let namespace = files::namespace(store)?;
         let mut out = String::new();
         for entry in &asked.entries {
-            let outcome = if entry.versioned {
-                Err((
-                    "NotImplemented",
-                    "this registry keeps no versions: a key's one VersionId is null",
-                ))
+            let outcome = if let Some(why) = refused(entry) {
+                Err(why)
             } else {
                 // A key the store fails on is that key's error; the batch goes on.
-                delete_key(store, &namespace, authz, &bucket, &entry.key).unwrap_or_else(|e| {
-                    eprintln!(
-                        "vk-registry: S3 request {id} could not delete {:?}: {e:#}",
-                        entry.key
-                    );
-                    Err((
-                        "InternalError",
-                        "the server could not delete this key; its log names this request id",
-                    ))
-                })
+                let conditions = &entry.conditions;
+                delete_key(store, &namespace, authz, &bucket, &entry.key, conditions)
+                    .unwrap_or_else(|e| {
+                        eprintln!(
+                            "vk-registry: S3 request {id} could not delete {:?}: {e:#}",
+                            entry.key
+                        );
+                        Err((
+                            "InternalError",
+                            "the server could not delete this key; its log names this request id",
+                        ))
+                    })
             };
+            let version = entry
+                .version
+                .as_deref()
+                .map(|v| xml::element("VersionId", v))
+                .unwrap_or_default();
             match outcome {
                 Ok(()) if asked.quiet => {}
                 Ok(()) => out.push_str(&format!(
-                    "<Deleted>{}</Deleted>",
+                    "<Deleted>{}{version}</Deleted>",
                     xml::element("Key", &entry.key)
                 )),
                 Err((code, message)) => out.push_str(&format!(
-                    "<Error>{}{}{}</Error>",
+                    "<Error>{}{version}{}{}</Error>",
                     xml::element("Key", &entry.key),
                     xml::element("Code", code),
                     xml::element("Message", message)
@@ -186,10 +283,11 @@ mod tests {
         .into_bytes()
     }
 
-    fn entry(key: &str, versioned: bool) -> Entry {
+    fn entry(key: &str, version: Option<&str>) -> Entry {
         Entry {
             key: key.into(),
-            versioned,
+            version: version.map(str::to_string),
+            ..Entry::default()
         }
     }
 
@@ -197,7 +295,7 @@ mod tests {
     fn a_delete_names_its_keys_versions_and_quietness() {
         let asked = document(&body(
             "<Quiet>true</Quiet><Object><Key>a/b</Key></Object>\
-             <Object><VersionId>v</VersionId><Key>c</Key><ETag>\"x\"</ETag></Object>\
+             <Object><VersionId>v</VersionId><Key>c</Key></Object>\
              <Object><Key>d</Key><VersionId>null</VersionId></Object>",
         ))
         .unwrap();
@@ -205,14 +303,78 @@ mod tests {
             asked,
             Asked {
                 quiet: true,
-                entries: vec![entry("a/b", false), entry("c", true), entry("d", false)],
+                entries: vec![
+                    entry("a/b", None),
+                    entry("c", Some("v")),
+                    entry("d", Some("null"))
+                ],
             }
         );
         let asked = document(&body("<Object><Key>k</Key></Object><Quiet>False</Quiet>")).unwrap();
         assert!(!asked.quiet);
         // Text is taken as it is, to be judged as a key.
         let asked = document(&body("<Object><Key> a&amp;b </Key></Object>")).unwrap();
-        assert_eq!(asked.entries, [entry(" a&b ", false)]);
+        assert_eq!(asked.entries, [entry(" a&b ", None)]);
+    }
+
+    #[test]
+    fn an_object_carries_its_conditions() {
+        let asked = document(&body(
+            "<Object><Key>a</Key><ETag>\"x\"</ETag><Size>13</Size>\
+             <LastModifiedTime>Sun, 06 Nov 1994 08:49:37 GMT</LastModifiedTime></Object>\
+             <Object><Key>b</Key><LastModifiedTime> Sun, 06 Nov 1994 10:49:37 +0200 \
+             </LastModifiedTime><ETag></ETag></Object>",
+        ))
+        .unwrap();
+        let conditions = |etag: &str, size| DeleteConditions {
+            etag: Some(etag.into()),
+            modified: Some(784_111_777),
+            size,
+        };
+        assert_eq!(asked.entries[0].conditions, conditions("\"x\"", Some(13)));
+        assert_eq!(asked.entries[1].conditions, conditions("", None));
+        // An empty ETag is that key's error; a condition on a version is not served.
+        assert_eq!(refused(&asked.entries[1]).unwrap().0, "InvalidArgument");
+        assert!(refused(&asked.entries[0]).is_none());
+        let versioned = Entry {
+            version: Some("null".into()),
+            ..asked.entries.into_iter().next().unwrap()
+        };
+        assert_eq!(refused(&versioned).unwrap().0, "NotImplemented");
+        assert!(refused(&entry("k", Some("null"))).is_none());
+        assert_eq!(refused(&entry("k", Some("v"))).unwrap().0, "NotImplemented");
+    }
+
+    #[test]
+    fn a_condition_that_is_not_one_refuses_the_document() {
+        let one = |inner: &str| document(&body(&format!("<Object><Key>k</Key>{inner}</Object>")));
+        assert_eq!(
+            one("<LastModifiedTime>2024-01-01T00:00:00Z</LastModifiedTime>"),
+            Err(Refused::Date("2024-01-01T00:00:00Z".into()))
+        );
+        assert_eq!(
+            one("<LastModifiedTime>  not a date  </LastModifiedTime>"),
+            Err(Refused::Date("  not a date  ".into()))
+        );
+        for bad in [
+            "<LastModifiedTime></LastModifiedTime>",
+            "<LastModifiedTime>   </LastModifiedTime>",
+            "<Size>-1</Size>",
+            "<Size>1.0</Size>",
+            "<Size></Size>",
+            "<ETag>a</ETag><ETag>b</ETag>",
+        ] {
+            assert!(matches!(one(bad), Err(Refused::Malformed(_))), "{bad}");
+        }
+        // The first date that is not one is named; an empty one outranks it.
+        let two = |a: &str, b: &str| {
+            document(&body(&format!(
+                "<Object><Key>k</Key><LastModifiedTime>{a}</LastModifiedTime></Object>\
+                 <Object><Key>k</Key><LastModifiedTime>{b}</LastModifiedTime></Object>"
+            )))
+        };
+        assert_eq!(two("first", "second"), Err(Refused::Date("first".into())));
+        assert!(matches!(two("not a date", ""), Err(Refused::Malformed(_))));
     }
 
     #[test]
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index 1fd4d057..1d1dc882 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -1,7 +1,8 @@
 //! ETags and the conditional headers S3 takes on them: on a read, `If-Match`,
 //! `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since`, in RFC 9110's order (S3's
 //! too); on a write, `If-None-Match: *` (create only) and `If-Match` (replace only that
-//! object), checked where the tag is written.
+//! object), checked where the tag is written; on a delete, the object's ETag, modification
+//! time and size, checked where the tag is deleted.
 
 use std::collections::BTreeMap;
 use std::time::{Duration, SystemTime};
@@ -211,6 +212,113 @@ impl WriteConditions {
     }
 }
 
+/// What S3 says when a precondition does not hold.
+pub(crate) const PRECONDITION_FAILED: &str =
+    "At least one of the pre-conditions you specified did not hold";
+
+/// The header a DeleteObject names the object's modification time in.
+pub(crate) const IF_MATCH_LAST_MODIFIED: &str = "x-amz-if-match-last-modified-time";
+
+/// The header a DeleteObject names the object's size in.
+pub(crate) const IF_MATCH_SIZE: &str = "x-amz-if-match-size";
+
+/// The header an AbortMultipartUpload names its upload's initiation time in.
+pub(crate) const IF_MATCH_INITIATED: &str = "x-amz-if-match-initiated-time";
+
+/// A delete's conditions: DeleteObject's `If-Match`, `x-amz-if-match-last-modified-time` and
+/// `x-amz-if-match-size`, or the `ETag`, `LastModifiedTime` and `Size` of an `<Object>` of a
+/// `Delete` document. Each one given must hold of the object for it to be deleted.
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+pub(crate) struct DeleteConditions {
+    /// an ETag, quoted or not, or `*` (also quoted) for any object
+    pub(crate) etag: Option<String>,
+    /// seconds since the epoch
+    pub(crate) modified: Option<u64>,
+    pub(crate) size: Option<u64>,
+}
+
+impl DeleteConditions {
+    /// The conditions DeleteObject's headers carry; the reason for a 400 when one is not a
+    /// value its header takes.
+    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, &'static str> {
+        let text = |name: &str| match headers.get(name) {
+            None => Ok(None),
+            Some(v) => v
+                .to_str()
+                .map(|v| Some(v.to_string()))
+                .map_err(|_| "a conditional header is not text"),
+        };
+        let modified = match text(IF_MATCH_LAST_MODIFIED)? {
+            None => None,
+            Some(v) => Some(
+                parse_time(&v)
+                    .map(whole_seconds)
+                    .ok_or("x-amz-if-match-last-modified-time is an HTTP date")?,
+            ),
+        };
+        let size = match text(IF_MATCH_SIZE)? {
+            None => None,
+            Some(v) => Some(parse_size(&v).ok_or("x-amz-if-match-size is a count of bytes")?),
+        };
+        Ok(DeleteConditions {
+            etag: text(IF_MATCH.as_str())?,
+            modified,
+            size,
+        })
+    }
+
+    pub(crate) fn is_empty(&self) -> bool {
+        self.etag.is_none() && self.modified.is_none() && self.size.is_none()
+    }
+
+    /// Whether every condition holds of `obj`: its ETag named (`*` naming any), its
+    /// modification time to the second, its size.
+    pub(crate) fn hold(&self, obj: &Object) -> bool {
+        self.etag.as_deref().is_none_or(|list| {
+            let list = if list.trim() == "\"*\"" { "*" } else { list };
+            names(list, &etag_of(obj))
+        }) && self
+            .modified
+            .is_none_or(|t| t == whole_seconds(obj.modified))
+            && self.size.is_none_or(|s| s == obj.size)
+    }
+}
+
+/// A count of bytes as a condition gives it: decimal digits only.
+pub(crate) fn parse_size(text: &str) -> Option<u64> {
+    let text = text.trim();
+    (!text.is_empty() && text.bytes().all(|b| b.is_ascii_digit()))
+        .then(|| text.parse().ok())
+        .flatten()
+}
+
+/// A time as a delete's condition gives it: an HTTP date in any of RFC 9110's three forms,
+/// or, as S3 takes it, the IMF form with a numeric zone (`+0200`) in place of `GMT`;
+/// surrounding blanks are passed over.
+pub(crate) fn parse_time(text: &str) -> Option<SystemTime> {
+    let text = text.trim();
+    if let Ok(t) = httpdate::parse_http_date(text) {
+        return Some(t);
+    }
+    let (local, zone) = text.rsplit_once(' ')?;
+    let (sign, digits) = match zone.as_bytes().first()? {
+        b'+' => (1i64, &zone[1..]),
+        b'-' => (-1i64, &zone[1..]),
+        _ => return None,
+    };
+    if digits.len() != 4 || !digits.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    let (hours, minutes): (i64, i64) = (digits[..2].parse().ok()?, digits[2..].parse().ok()?);
+    if minutes > 59 {
+        return None;
+    }
+    let as_gmt = httpdate::parse_http_date(&format!("{local} GMT")).ok()?;
+    let offset = sign * (hours * 3600 + minutes * 60);
+    let secs = i64::try_from(whole_seconds(as_gmt)).ok()? - offset;
+    Some(SystemTime::UNIX_EPOCH + Duration::from_secs(u64::try_from(secs).ok()?))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -389,6 +497,65 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_delete_s_time_is_an_http_date_or_one_with_a_numeric_zone() {
+        let t = Some(at(784_111_777));
+        assert_eq!(parse_time("Sun, 06 Nov 1994 08:49:37 GMT"), t);
+        assert_eq!(parse_time("Sunday, 06-Nov-94 08:49:37 GMT"), t);
+        assert_eq!(parse_time("Sun Nov  6 08:49:37 1994"), t);
+        assert_eq!(parse_time("Sun, 06 Nov 1994 10:49:37 +0200"), t);
+        assert_eq!(parse_time("Sun, 06 Nov 1994 07:19:37 -0130"), t);
+        assert_eq!(parse_time("  Sun, 06 Nov 1994 08:49:37 GMT  "), t);
+        for bad in [
+            "",
+            "1994-11-06T08:49:37Z",
+            "Sun, 06 Nov 1994 08:49:37 +02",
+            "Sun, 06 Nov 1994 08:49:37 +0260",
+            "Sun, 06 Nov 1994 08:49:37 UTC",
+            "not a date",
+        ] {
+            assert_eq!(parse_time(bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn a_delete_s_conditions_all_hold_or_it_keeps_the_object() {
+        let obj = object(&[(MD5_ANNOTATION, MD5)]);
+        let e = format!("\"{MD5}\"");
+        let date = httpdate::fmt_http_date(at(1_000_000));
+        let named = |n: &'static str| hyper::header::HeaderName::from_static(n);
+        let check = |pairs: &[(hyper::header::HeaderName, &str)]| {
+            DeleteConditions::of(&headers(pairs)).map(|c| (c.is_empty(), c.hold(&obj)))
+        };
+        let size = named(IF_MATCH_SIZE);
+        let time = named(IF_MATCH_LAST_MODIFIED);
+        assert_eq!(check(&[]), Ok((true, true)));
+        for etag in [e.as_str(), MD5, "*", "\"*\""] {
+            assert_eq!(check(&[(IF_MATCH, etag)]), Ok((false, true)), "{etag}");
+        }
+        assert_eq!(check(&[(IF_MATCH, "\"x\"")]), Ok((false, false)));
+        assert_eq!(check(&[(IF_MATCH, "")]), Ok((false, false)));
+        assert_eq!(check(&[(size.clone(), "13")]), Ok((false, true)));
+        assert_eq!(check(&[(size.clone(), "14")]), Ok((false, false)));
+        assert_eq!(check(&[(time.clone(), &date)]), Ok((false, true)));
+        let before = httpdate::fmt_http_date(at(999_999));
+        assert_eq!(check(&[(time.clone(), &before)]), Ok((false, false)));
+        // every one must hold
+        assert_eq!(
+            check(&[
+                (IF_MATCH, &e),
+                (size.clone(), "13"),
+                (time.clone(), &before)
+            ]),
+            Ok((false, false))
+        );
+        // a value its header does not take is refused, not passed over
+        for bad in ["-1", "13 bytes", ""] {
+            assert!(check(&[(size.clone(), bad)]).is_err(), "{bad}");
+        }
+        assert!(check(&[(time, "yesterday")]).is_err());
+    }
+
     #[test]
     fn writes_create_only_or_replace_only_what_they_name() {
         let md5 = object(&[(MD5_ANNOTATION, MD5)]);
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 959aa727..b6b52fdd 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -417,7 +417,8 @@ async fn operate(
             object::put(state, authz, segs, seed, req, ctx).await
         }
         (path::Target::Object { segs, .. }, &Method::DELETE, None) => {
-            object::delete(state, authz, segs, req, ctx).await
+            let versioned = query.iter().any(|(name, _)| name == "versionId");
+            object::delete(state, authz, segs, versioned, req, ctx).await
         }
         _ => refuse(req, ctx.not_implemented(), ctx).await,
     }
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 2f606f3e..7b3720de 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -1011,7 +1011,10 @@ async fn remove(dir: PathBuf) -> Result<()> {
     .context("removing an upload panicked")?
 }
 
-/// `DELETE /s3/<bucket>/<key>?uploadId=<id>`: the upload and its parts removed; 204.
+/// `DELETE /s3/<bucket>/<key>?uploadId=<id>`: the upload and its parts removed; 204. With
+/// `x-amz-if-match-initiated-time`, only an upload initiated in that second is: 412 for
+/// another, 400 for a value that is not a date. A time still to come is no condition, as S3
+/// takes it.
 async fn abort(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -1023,12 +1026,32 @@ async fn abort(
     if !on_parent(authz, accounts::Action::Write, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
+    let initiated = match req.headers().get(conditional::IF_MATCH_INITIATED) {
+        None => None,
+        Some(v) => match v.to_str().ok().and_then(conditional::parse_time) {
+            Some(t) if t > SystemTime::now() => None,
+            Some(t) => Some(conditional::whole_seconds(t)),
+            None => {
+                let why = "x-amz-if-match-initiated-time is an HTTP date";
+                return refuse(req, invalid(ctx, why), ctx).await;
+            }
+        },
+    };
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
     }
     let Some(up) = open_async(state, &id, &segs).await? else {
         return Ok(no_such_upload(ctx));
     };
+    // An upload's creation time never changes, so a concurrent abort or completion leaves
+    // nothing for the check to be wrong about.
+    if initiated.is_some_and(|t| t != up.meta.created) {
+        return Ok(ctx.error(
+            StatusCode::PRECONDITION_FAILED,
+            "PreconditionFailed",
+            conditional::PRECONDITION_FAILED,
+        ));
+    }
     remove(up.dir).await?;
     Ok(Response::builder()
         .status(StatusCode::NO_CONTENT)
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 26522d04..cfc3d914 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -1015,27 +1015,57 @@ pub(super) async fn put(
 /// a key that is a directory has no object to delete, and is 204 too. A foreign tag is not
 /// this view's to delete (409), and a caller that may read the object but not write it is
 /// refused (403). Under the namespace lock, as every change of `files/` is.
+///
+/// `If-Match`, `x-amz-if-match-last-modified-time` and `x-amz-if-match-size` are checked
+/// under that lock, against the object the delete would remove: 412 when one does not hold,
+/// 404 `NoSuchKey` when no object is there, and 400 for a value its header does not take.
+/// They apply to the object's one version, so `versioned` (a `?versionId=null` in the query)
+/// with any of them is 501.
 pub(super) async fn delete(
     state: &ServerState,
     authz: &Authz<'_>,
     segs: Vec<String>,
+    versioned: bool,
     req: Request<Incoming>,
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
     if !admitted(authz, accounts::Action::Write, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
+    let conditions = match conditional::DeleteConditions::of(req.headers()) {
+        Ok(c) => c,
+        Err(why) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", why);
+            return refuse(req, resp, ctx).await;
+        }
+    };
+    if versioned && !conditions.is_empty() {
+        let resp = ctx.error(
+            StatusCode::NOT_IMPLEMENTED,
+            "NotImplemented",
+            "A header you provided implies functionality that is not implemented",
+        );
+        return refuse(req, resp, ctx).await;
+    }
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
     }
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let namespace = files::namespace(store)?;
-        Ok(match delete_one(store, &namespace, authz, &segs)? {
-            Deleted::Gone => no_content(),
-            Deleted::Denied => ctx.access_denied(),
-            Deleted::Foreign => unwritable(Unwritable::Foreign, &ctx),
-        })
+        Ok(
+            match delete_one(store, &namespace, authz, &segs, &conditions)? {
+                Deleted::Gone => no_content(),
+                Deleted::Denied => ctx.access_denied(),
+                Deleted::Foreign => unwritable(Unwritable::Foreign, &ctx),
+                Deleted::Absent => no_such_key(&ctx),
+                Deleted::Failed => ctx.error(
+                    StatusCode::PRECONDITION_FAILED,
+                    "PreconditionFailed",
+                    conditional::PRECONDITION_FAILED,
+                ),
+            },
+        )
     })
     .await
 }
@@ -1048,34 +1078,47 @@ pub(super) enum Deleted {
     Denied,
     /// a foreign tag is there, which is not this view's to delete
     Foreign,
+    /// conditions were asked of an object, and none is there as far as the caller can tell;
+    /// nothing was deleted
+    Absent,
+    /// a condition did not hold of the object, which is kept
+    Failed,
 }
 
-/// Delete the object at `segs` for this caller, the namespace held (`_namespace`): a key
-/// that is a directory holds no object to delete. Writing the repository it is in is what
-/// deletes it, reading it or not; one the caller may neither read nor write is absent.
+/// Delete the object at `segs` for this caller, the namespace held (`_namespace`), when
+/// `conditions` hold of it: a key that is a directory holds no object to delete. Writing the
+/// repository it is in is what deletes it, reading it or not; one the caller may neither read
+/// nor write is absent. Holding the namespace, the object the conditions are checked against
+/// is the one deleted.
 pub(super) fn delete_one(
     store: &Store,
     _namespace: &files::Namespace,
     authz: &Authz<'_>,
     segs: &[String],
+    conditions: &conditional::DeleteConditions,
 ) -> Result<Deleted> {
+    let absent = match conditions.is_empty() {
+        true => Deleted::Gone,
+        false => Deleted::Absent,
+    };
     let Some(node) = files::resolve(store, segs)? else {
-        return Ok(Deleted::Gone);
+        return Ok(absent);
     };
     if !allowed(authz, accounts::Action::Write, node.repo()) {
         return Ok(match allowed(authz, accounts::Action::Read, node.repo()) {
             true => Deleted::Denied,
-            false => Deleted::Gone,
+            false => absent,
         });
     }
     match node {
+        Node::Object(obj) if !conditions.hold(&obj) => Ok(Deleted::Failed),
         Node::Object(obj) => {
             store.delete_tag(&obj.repo, &obj.tag)?;
+            Ok(Deleted::Gone)
         }
-        Node::Foreign(_) => return Ok(Deleted::Foreign),
-        Node::Dir(_) => {}
+        Node::Foreign(_) => Ok(Deleted::Foreign),
+        Node::Dir(_) => Ok(absent),
     }
-    Ok(Deleted::Gone)
 }
 
 fn no_content() -> Response<Body> {
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 1ad06137..89da7b49 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2352,6 +2352,175 @@ async fn conditional_headers_decide_reads_and_writes() {
     }
 }
 
+/// DeleteObject's and DeleteObjects' conditions: an object is deleted only when each one
+/// given holds of it.
+#[tokio::test]
+async fn conditional_deletes_keep_what_they_do_not_name() {
+    let dir = tmp("conditional-delete");
+    let host = spawn(open_state(&dir, true));
+    let put = |path: &str| Req::new("PUT", path).body(HELLO.to_vec());
+    let exists = |path: &str| send(&host, Req::new("HEAD", path));
+    let etag = format!("\"{}\"", md5_hex(HELLO));
+    send(&host, put("/s3/b/k")).await.ok(200);
+    let modified = |path: &'static str| {
+        let head = exists(path);
+        async move { head.await.header("last-modified").unwrap().to_string() }
+    };
+    let past = "Mon, 01 Jan 2001 00:00:00 GMT";
+    let del = |name: &str, value: &str| Req::new("DELETE", "/s3/b/k").header(name, value);
+
+    // Each condition that does not hold keeps the object.
+    for (name, value) in [
+        ("If-Match", "\"incorrect_etag\""),
+        ("If-Match", "incorrect_etag"),
+        ("x-amz-if-match-size", "23234"),
+        ("x-amz-if-match-last-modified-time", past),
+    ] {
+        send(&host, del(name, value))
+            .await
+            .is(412, "PreconditionFailed");
+        exists("/s3/b/k").await.ok(200);
+    }
+    let all = del("If-Match", &etag)
+        .header("x-amz-if-match-size", "13")
+        .header("x-amz-if-match-last-modified-time", past);
+    send(&host, all).await.is(412, "PreconditionFailed");
+    // A value its header does not take is refused.
+    send(&host, del("x-amz-if-match-size", "-1"))
+        .await
+        .is(400, "InvalidArgument");
+    send(&host, del("x-amz-if-match-last-modified-time", "yesterday"))
+        .await
+        .is(400, "InvalidArgument");
+    // A condition applies to the object, not to a version of it.
+    let versioned = del("If-Match", &etag).query("versionId=null");
+    send(&host, versioned).await.is(501, "NotImplemented");
+    exists("/s3/b/k").await.ok(200);
+
+    // Each one that holds deletes it: the ETag quoted or not, `*`, the size, the time.
+    for (name, value) in [
+        ("If-Match", etag.as_str()),
+        ("If-Match", etag.trim_matches('"')),
+        ("If-Match", "*"),
+        ("If-Match", "\"*\""),
+        ("x-amz-if-match-size", "13"),
+        ("x-amz-if-match-last-modified-time", ""),
+    ] {
+        send(&host, put("/s3/b/k")).await.ok(200);
+        // An empty time stands for this write's own, read back: the clock may have ticked since the last.
+        let time = modified("/s3/b/k").await;
+        let value = if value.is_empty() {
+            time.as_str()
+        } else {
+            value
+        };
+        let resp = send(&host, del(name, value)).await;
+        assert_eq!(resp.status, 204, "{name}: {value}: {}", resp.body);
+        exists("/s3/b/k").await.ok(404);
+    }
+    // With nothing there, a condition is NoSuchKey; without one, 204 as before.
+    send(&host, del("If-Match", "*")).await.is(404, "NoSuchKey");
+    send(&host, del("x-amz-if-match-size", "13"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, Req::new("DELETE", "/s3/b/k")).await.ok(204);
+
+    // DeleteObjects: the same conditions as an Object's children, each key on its own.
+    let keys = [
+        "quoted",
+        "unquoted",
+        "wildcard",
+        "size",
+        "time",
+        "stale",
+        "big",
+        "old",
+        "empty",
+        "versioned",
+    ];
+    for k in keys {
+        send(&host, put(&format!("/s3/b/{k}"))).await.ok(200);
+    }
+    let modified = modified("/s3/b/time").await;
+    let lmt = |t: &str| format!("<LastModifiedTime>{t}</LastModifiedTime>");
+    let doc = delete_doc(
+        &[
+            &format!("{}<ETag>{etag}</ETag>", key_of("quoted")),
+            &format!(
+                "{}<ETag>{}</ETag>",
+                key_of("unquoted"),
+                etag.trim_matches('"')
+            ),
+            &format!("{}<ETag>\"*\"</ETag>", key_of("wildcard")),
+            &format!("{}<Size>13</Size>", key_of("size")),
+            &format!("{}{}", key_of("time"), lmt(&modified)),
+            &format!(
+                "{}<ETag>00000000000000000000000000000000</ETag>",
+                key_of("stale")
+            ),
+            &format!("{}<ETag>{etag}</ETag><Size>14</Size>", key_of("big")),
+            &format!("{}{}", key_of("old"), lmt(past)),
+            &format!("{}<ETag></ETag>", key_of("empty")),
+            &format!(
+                "{}<VersionId>null</VersionId><ETag>{etag}</ETag>",
+                key_of("versioned")
+            ),
+            &format!("{}<ETag>*</ETag>", key_of("missing")),
+            &format!("{}<Size>13</Size>", key_of("missing-size")),
+        ],
+        false,
+    );
+    let resp = send(&host, delete_objects("b", doc)).await;
+    let (deleted, errors) = delete_result(&resp);
+    assert_eq!(deleted, ["quoted", "unquoted", "wildcard", "size", "time"]);
+    let errors: Vec<(&str, &str)> = errors
+        .iter()
+        .map(|(k, c)| (k.as_str(), c.as_str()))
+        .collect();
+    assert_eq!(
+        errors,
+        [
+            ("stale", "PreconditionFailed"),
+            ("big", "PreconditionFailed"),
+            ("old", "PreconditionFailed"),
+            ("empty", "InvalidArgument"),
+            ("versioned", "NotImplemented"),
+            ("missing", "NoSuchKey"),
+            ("missing-size", "NoSuchKey"),
+        ]
+    );
+    let versioned = &elements(&resp.body, "Error")[4];
+    assert_eq!(element(versioned, "VersionId"), "null");
+    for k in keys {
+        let kept = !deleted.iter().any(|d| d == k);
+        exists(&format!("/s3/b/{k}"))
+            .await
+            .ok(if kept { 200 } else { 404 });
+    }
+
+    // A LastModifiedTime that is not a date refuses the whole document, an empty one first.
+    let refused = |times: &[&str]| {
+        let objects: Vec<String> = times
+            .iter()
+            .map(|t| format!("{}{}", key_of("stale"), lmt(t)))
+            .collect();
+        let objects: Vec<&str> = objects.iter().map(String::as_str).collect();
+        delete_objects("b", delete_doc(&objects, false))
+    };
+    let resp = send(&host, refused(&["2001-01-01T00:00:00Z"])).await;
+    resp.is(400, "InvalidRequest");
+    assert!(
+        resp.body
+            .contains("Invalid value for date attribute: 2001-01-01T00:00:00Z"),
+        "{}",
+        resp.body
+    );
+    send(&host, refused(&["not a date", ""]))
+        .await
+        .is(400, "MalformedXML");
+    exists("/s3/b/stale").await.ok(200);
+}
+
 #[tokio::test]
 async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     let dir = tmp("objects");
@@ -4494,6 +4663,47 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
     send(&host, sign(list)).await.is(404, "NoSuchUpload");
     send(&host, abort()).await.is(404, "NoSuchUpload");
 
+    // Aborted only if initiated when it says; a time still to come is no condition.
+    let now = || std::time::SystemTime::now();
+    let before = now();
+    let id = create_upload(&host, &sign, path).await;
+    let after = now();
+    let abort_if = |date: &str| {
+        let req = Req::new("DELETE", path)
+            .query(&format!("uploadId={id}"))
+            .header("x-amz-if-match-initiated-time", date);
+        sign(req)
+    };
+    let past = "Mon, 01 Jan 2001 00:00:00 GMT";
+    send(&host, abort_if(past))
+        .await
+        .is(412, "PreconditionFailed");
+    send(&host, abort_if("yesterday"))
+        .await
+        .is(400, "InvalidArgument");
+    let list = || sign(Req::new("GET", path).query(&format!("uploadId={id}")));
+    send(&host, list()).await.ok(200);
+    // The upload was initiated in the second before or after it was asked for.
+    let mut status = 0;
+    for t in [before, after] {
+        status = send(&host, abort_if(&httpdate::fmt_http_date(t)))
+            .await
+            .status;
+        if status == 204 {
+            break;
+        }
+    }
+    assert_eq!(status, 204);
+    send(&host, list()).await.is(404, "NoSuchUpload");
+    let id = create_upload(&host, &sign, path).await;
+    let req = Req::new("DELETE", path)
+        .query(&format!("uploadId={id}"))
+        .header(
+            "x-amz-if-match-initiated-time",
+            "Fri, 01 Jan 2100 00:00:00 GMT",
+        );
+    send(&host, sign(req)).await.ok(204);
+
     // An id names its own key's upload only, and an id this server cannot mint nothing.
     let id = create_upload(&host, &sign, path).await;
     for other in ["/s3/b/other", "/s3/c/k"] {

From 5618d0c245d945d97ee8de5e032e1b43a92a28fc Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:33:51 +0100
Subject: [PATCH 39/54] vk-registry/s3: complete or abort an upload one request
 at a time

A completion or an abort now holds the upload's directory locked
(flock) from looking the upload up until it is gone. Completions of
the same upload sent at once, as SDKs and versitygw's racey test send
them, used to read parts another completion was removing and answer
400 InvalidPart; the one that waits now finds the upload completed.
---
 CHANGELOG.md                    |  3 +-
 vk-registry/DESIGN.md           |  7 +++--
 vk-registry/src/s3/multipart.rs | 55 +++++++++++++++++++++++++++------
 vk-registry/tests/s3_e2e.rs     | 47 ++++++++++++++++++++++++++++
 4 files changed, 100 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 547c5877..d59ad51f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,7 +26,8 @@ All notable changes to virtkit will be documented in this file.
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
   a refused upload sees its refusal rather than a dropped connection. Large
-  files can be uploaded in parts, as the AWS CLI uploads them, read back a part at a time,
+  files can be uploaded in parts, as the AWS CLI uploads them, completed once however many
+  completions of the upload are sent at once, read back a part at a time,
   parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 7dec2ae7..460ebb51 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -696,7 +696,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it: another completion of an upload just completed is 404 `NoSuchUpload`, never 400 `InvalidPart` for parts going from under it |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
@@ -769,7 +769,10 @@ repositories across its pages (see "Operational constraints and deferred work").
 for each part `part-<n>` (its bytes) and `part-<n>.json` (their size and MD5). Each file is
 written under a private temporary name and renamed over its own, so a part sent again replaces
 the earlier one whole; since a part's bytes and its record are two renames, completing an
-upload checks each part's MD5 again as it reads it. An upload id is minted as an OCI upload id
+upload checks each part's MD5 again as it reads it. A completion or an abort holds the upload's
+directory locked (`flock`, so across processes on the store too) from looking the upload up
+until it is gone, so of two at once the second runs after the first and sees what it left;
+parts are written without the lock. An upload id is minted as an OCI upload id
 is, `<pid>-<n>-<random hex>`, and held to hex digits and dashes, so it never names a path, and
 every call checks that the id's recorded bucket and key are the request's. A part's bytes
 stay out of the pool until the upload completes, so parts of the same content are stored once
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 7b3720de..26623702 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -11,7 +11,9 @@
 //! directory then goes, and the parts' sizes stay on the manifest ([`PARTS_ANNOTATION`]),
 //! so a read may ask for one part of the object as it was uploaded (`?partNumber=<n>`) and
 //! GetObjectAttributes may list them. The gc sweeps an upload nothing has been written into
-//! for its grace window, as it sweeps an idle OCI upload.
+//! for its grace window, as it sweeps an idle OCI upload. A completion or an abort holds
+//! the upload's directory locked until it is done ([`open_held`]), so two of them at once run
+//! one after the other.
 //!
 //! Authorized as a PutObject is: `Write` on the key's parent repository, `Read` there for
 //! ListParts, and ListMultipartUploads as a listing of the bucket. The upload id must name an
@@ -273,6 +275,40 @@ fn open(store: &Store, id: &str, segs: &[String]) -> Option<Upload> {
     })
 }
 
+/// An upload held for its end: [`open`]'s, once the lock on its directory is had.
+struct Held {
+    /// the directory, open and locked exclusive (`flock`) until dropped
+    _lock: std::fs::File,
+    up: Upload,
+}
+
+/// The upload `id` names for the object at `segs`, held so no other completion or abort of
+/// it, in this process or another on the store, runs until the hold is dropped: blocks
+/// while one does, then looks the upload up afresh, so the one that waited finds it as
+/// that one left it. Only completions and aborts take the hold; a part written meanwhile is
+/// caught by the MD5 a completion checks as it reads it.
+fn open_held(store: &Store, id: &str, segs: &[String]) -> Result<Option<Held>> {
+    let Some(dir) = store.multipart_dir(id) else {
+        return Ok(None);
+    };
+    let lock = match std::fs::File::open(&dir) {
+        Ok(lock) => lock,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(e) => return Err(anyhow::Error::from(e).context(format!("opening {}", dir.display()))),
+    };
+    lock.lock()
+        .with_context(|| format!("locking {}", dir.display()))?;
+    Ok(open(store, id, segs).map(|up| Held { _lock: lock, up }))
+}
+
+/// [`open_held`], off the runtime.
+async fn open_held_async(state: &ServerState, id: &str, segs: &[String]) -> Result<Option<Held>> {
+    let (store, id, segs) = (Arc::clone(&state.store), id.to_string(), segs.to_vec());
+    tokio::task::spawn_blocking(move || open_held(&store, &id, &segs))
+        .await
+        .context("holding an upload panicked")?
+}
+
 fn no_such_upload(ctx: &Ctx) -> Response<Body> {
     ctx.error(
         StatusCode::NOT_FOUND,
@@ -948,19 +984,21 @@ async fn complete(
     let assembled = {
         let (store, segs) = (Arc::clone(&state.store), segs.clone());
         tokio::task::spawn_blocking(move || -> Result<_> {
-            let Some(up) = open(&store, &id, &segs) else {
+            let Some(held) = open_held(&store, &id, &segs)? else {
                 return Ok(None);
             };
-            let assembled = assemble(&store, &up, &parts, whole.as_ref())?;
-            Ok(Some((up, assembled)))
+            let assembled = assemble(&store, &held.up, &parts, whole.as_ref())?;
+            Ok(Some((held, assembled)))
         })
         .await
         .context("assembling an upload panicked")??
     };
-    let (up, assembled) = match assembled {
+    // Held until the upload is gone, so a completion racing this one waits, then finds it
+    // completed rather than its parts going from under it.
+    let (Held { _lock, up }, assembled) = match assembled {
         None => return Ok(no_such_upload(ctx)),
         Some((_, Err((status, code, message)))) => return Ok(ctx.error(status, code, message)),
-        Some((up, Ok(assembled))) => (up, assembled),
+        Some((held, Ok(assembled))) => (held, assembled),
     };
     let Assembled {
         staged,
@@ -1040,11 +1078,10 @@ async fn abort(
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
     }
-    let Some(up) = open_async(state, &id, &segs).await? else {
+    // Held until the upload is gone: an abort racing a completion waits for it to end.
+    let Some(Held { _lock, up }) = open_held_async(state, &id, &segs).await? else {
         return Ok(no_such_upload(ctx));
     };
-    // An upload's creation time never changes, so a concurrent abort or completion leaves
-    // nothing for the check to be wrong about.
     if initiated.is_some_and(|t| t != up.meta.created) {
         return Ok(ctx.error(
             StatusCode::PRECONDITION_FAILED,
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 89da7b49..5d8eab51 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -4818,6 +4818,53 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
     assert_eq!(staging_left(&dir), 0);
 }
 
+/// The same upload completed by several requests at once, as an SDK retrying a completion
+/// that timed out does: one makes the object and the others find the upload completed,
+/// never a part of it missing; the object is the parts', whole.
+#[tokio::test]
+async fn concurrent_completions_of_one_upload_make_one_object() {
+    let (dir, host) = bearer_server("multipart-racey");
+    let sign = |r: Req| r.signed(&host, BEARER, 0);
+    let path = "/s3/b/racey";
+    let parts: Vec<Vec<u8>> = (0..3u8)
+        .map(|p| {
+            (0..5usize << 20)
+                .map(|i| (i * 7 + p as usize) as u8)
+                .collect()
+        })
+        .collect();
+    for round in 0..4 {
+        let id = create_upload(&host, &sign, path).await;
+        let mut etags = Vec::new();
+        for (n, data) in (1..).zip(&parts) {
+            etags.push(upload_part(&host, &sign, path, &id, n, data).await);
+        }
+        let named: Vec<(u32, &str)> = (1..).zip(etags.iter().map(String::as_str)).collect();
+        let mut racing = tokio::task::JoinSet::new();
+        for _ in 0..5 {
+            let (host, req) = (host.clone(), sign(complete(path, &id, &named)));
+            racing.spawn(async move { send(&host, req).await });
+        }
+        let mut made = 0;
+        while let Some(resp) = racing.join_next().await {
+            let resp = resp.unwrap();
+            if resp.status == 200 {
+                made += 1;
+            } else {
+                resp.is(404, "NoSuchUpload");
+            }
+        }
+        assert_eq!(made, 1, "round {round}");
+        let whole = parts.concat();
+        let resp = send(&host, sign(Req::new("GET", path))).await;
+        is_object(&resp, &whole);
+        let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
+        assert_eq!(resp.header("etag"), Some(&*multipart_etag(&refs)));
+    }
+    assert!(multipart_left(&dir).is_empty());
+    assert_eq!(staging_left(&dir), 0);
+}
+
 /// A key that may only read a directory can list its uploads and parts, and can neither
 /// start an upload there nor send a part to one.
 #[tokio::test]

From 98d5191a76c929b3ae4b130d1483a7d75965aa1f Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:40:33 +0100
Subject: [PATCH 40/54] vk-registry/s3: answer a repeated completion as the
 first was

A completed upload now leaves its directory holding completed.json
(the parts it named, the object's ETag, the SHA-256 of its bytes and
the checksum it answered with) instead of going at once. The same
completion sent again, as an SDK retries one whose answer it lost, is
200 with the same result while the key still holds that object; other
parts, or an object written over or deleted since, stay 404
NoSuchUpload. The record goes with the idle uploads once past the gc's
grace window, and status no longer counts it as an upload in progress.
---
 CHANGELOG.md                    |   3 +-
 vk-registry/DESIGN.md           |  12 +-
 vk-registry/src/lib.rs          |  17 ++-
 vk-registry/src/s3/multipart.rs | 187 +++++++++++++++++++++++++++-----
 vk-registry/tests/s3_e2e.rs     |  80 +++++++++++---
 5 files changed, 252 insertions(+), 47 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d59ad51f..6311b0f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,8 @@ All notable changes to virtkit will be documented in this file.
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
   a refused upload sees its refusal rather than a dropped connection. Large
   files can be uploaded in parts, as the AWS CLI uploads them, completed once however many
-  completions of the upload are sent at once, read back a part at a time,
+  completions of the upload are sent, at once or as retries (each answered as the first while
+  the object is still the one it made), read back a part at a time,
   parts copied from other objects,
   and unfinished uploads listed, aborted, or cleaned up by `gc` once idle; `status` counts
   them. Set `s3 = false` in the server config to turn it off. A newly created API key is also
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 460ebb51..cee833c6 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -560,7 +560,8 @@ left in `uploads/` goes with the idle uploads, and so does an S3 multipart uploa
 been written into for the grace window: its directory under `uploads/s3/` is idle by the
 newest mtime among its files (the directory's own does not move when a part is replaced),
 and goes whole, parts and all. Completing an upload marks it used, so the sweep does not
-take it while its parts are read.
+take it while its parts are read, and leaves its directory holding only the record of what
+it made, swept in turn once idle, so a completion sent again until then is answered again.
 
 ## S3 view (`/s3/`)
 
@@ -696,7 +697,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes. The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it: another completion of an upload just completed is 404 `NoSuchUpload`, never 400 `InvalidPart` for parts going from under it |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
@@ -772,7 +773,12 @@ the earlier one whole; since a part's bytes and its record are two renames, comp
 upload checks each part's MD5 again as it reads it. A completion or an abort holds the upload's
 directory locked (`flock`, so across processes on the store too) from looking the upload up
 until it is gone, so of two at once the second runs after the first and sees what it left;
-parts are written without the lock. An upload id is minted as an OCI upload id
+parts are written without the lock. A completion that made its object removes `meta.json`,
+then writes `completed.json` (the bucket, the key, the parts it named, the object's ETag, the
+SHA-256 of its bytes and the checksum it answered with), then removes the parts: the
+directory is no upload in progress from the first step on, and is swept as an idle upload is.
+A repeated completion compares the object at the key against that record; a crash between
+the first two steps forgets the completion, and a repeat then finds no upload. An upload id is minted as an OCI upload id
 is, `<pid>-<n>-<random hex>`, and held to hex digits and dashes, so it never names a path, and
 every call checks that the id's recorded bucket and key are the request's. A part's bytes
 stay out of the pool until the upload completes, so parts of the same content are stored once
diff --git a/vk-registry/src/lib.rs b/vk-registry/src/lib.rs
index d4b135cc..6f71fdc3 100644
--- a/vk-registry/src/lib.rs
+++ b/vk-registry/src/lib.rs
@@ -3885,9 +3885,17 @@ fn newest_mtime(dir: &Path) -> Option<SystemTime> {
     Some(newest)
 }
 
-/// What the S3 multipart uploads in `dir` hold: how many there are, and their files' bytes.
+/// The record an S3 multipart upload in progress keeps in its directory: a completed upload's
+/// directory, kept for a while to answer its completion again, has none.
+pub(crate) const MULTIPART_RECORD: &str = "meta.json";
+
+/// What the S3 multipart uploads in progress in `dir` hold: how many there are, and their
+/// files' bytes.
 fn multipart_usage(dir: &Path) -> (usize, u64) {
-    let uploads = multipart_dirs(dir);
+    let uploads: Vec<PathBuf> = multipart_dirs(dir)
+        .into_iter()
+        .filter(|d| d.join(MULTIPART_RECORD).is_file())
+        .collect();
     let bytes = uploads
         .iter()
         .flat_map(|d| dir_files(d))
@@ -8306,6 +8314,9 @@ mod tests {
             std::fs::write(up.join("part-1.json"), b"{}").unwrap();
         }
         std::fs::write(fresh.join("meta.json"), b"{}").unwrap();
+        // Completed lately: kept, and not counted as in progress.
+        let (_, done) = store.create_multipart().unwrap();
+        std::fs::write(done.join("completed.json"), b"{}").unwrap();
         // Not an upload's name: never taken for one.
         std::fs::create_dir_all(dir.join("uploads/s3/not-an-upload")).unwrap();
 
@@ -8316,6 +8327,7 @@ mod tests {
         }
         touch(&busy.join("part-1"));
         touch(&fresh.join("meta.json"));
+        touch(&done.join("completed.json"));
         let s = store.stats().unwrap();
         assert_eq!((s.multipart_uploads, s.multipart_bytes), (3, 8 + 8 + 2));
         let mut out = Vec::new();
@@ -8334,6 +8346,7 @@ mod tests {
         assert!(!idle.exists());
         assert!(busy.join("part-1").is_file());
         assert!(fresh.join("meta.json").is_file());
+        assert!(done.join("completed.json").is_file());
         assert!(dir.join("uploads/s3/not-an-upload").is_dir());
         assert_eq!(store.stats().unwrap().multipart_uploads, 2);
         let _ = std::fs::remove_dir_all(&dir);
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 26623702..8881361e 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -13,7 +13,9 @@
 //! GetObjectAttributes may list them. The gc sweeps an upload nothing has been written into
 //! for its grace window, as it sweeps an idle OCI upload. A completion or an abort holds
 //! the upload's directory locked until it is done ([`open_held`]), so two of them at once run
-//! one after the other.
+//! one after the other. A completed upload's directory keeps only `completed.json`, what the
+//! completion made ([`Completed`]), until the gc sweeps it as an idle upload: the same
+//! completion sent again is answered as it was while the key holds that object.
 //!
 //! Authorized as a PutObject is: `Write` on the key's parent repository, `Read` there for
 //! ListParts, and ListMultipartUploads as a listing of the bucket. The upload id must name an
@@ -58,7 +60,7 @@ const MAX_ELEMENTS: usize = 6 * MAX_PARTS as usize + 16;
 const MAX_LISTED: usize = 1000;
 
 /// What an upload records of itself, in its directory.
-const META: &str = "meta.json";
+const META: &str = crate::MULTIPART_RECORD;
 
 /// The manifest annotation holding the sizes of the parts an object was completed from, in
 /// order: each in decimal, a run of equal sizes as `<size>x<count>`, joined by commas, so an
@@ -288,6 +290,15 @@ struct Held {
 /// that one left it. Only completions and aborts take the hold; a part written meanwhile is
 /// caught by the MD5 a completion checks as it reads it.
 fn open_held(store: &Store, id: &str, segs: &[String]) -> Result<Option<Held>> {
+    let Some((lock, _)) = hold(store, id)? else {
+        return Ok(None);
+    };
+    Ok(open(store, id, segs).map(|up| Held { _lock: lock, up }))
+}
+
+/// The directory of upload `id`, open and locked exclusive, with its path: [`open_held`]'s
+/// hold, before anything in the directory is read.
+fn hold(store: &Store, id: &str) -> Result<Option<(std::fs::File, PathBuf)>> {
     let Some(dir) = store.multipart_dir(id) else {
         return Ok(None);
     };
@@ -298,7 +309,7 @@ fn open_held(store: &Store, id: &str, segs: &[String]) -> Result<Option<Held>> {
     };
     lock.lock()
         .with_context(|| format!("locking {}", dir.display()))?;
-    Ok(open(store, id, segs).map(|up| Held { _lock: lock, up }))
+    Ok(Some((lock, dir)))
 }
 
 /// [`open_held`], off the runtime.
@@ -928,8 +939,10 @@ fn assemble(
 /// document's parts make, in the order given, tagged at the key as a PutObject's body is
 /// (the key checked again, `If-None-Match: *`/`If-Match` checked where the tag is written),
 /// with the user metadata recorded at the upload's creation, the multipart ETag, the
-/// whole-object checksum that held and the parts' sizes; the upload then goes. A refusal
-/// leaves the upload as it was, to be completed again.
+/// whole-object checksum that held and the parts' sizes; the upload then goes, leaving what
+/// it made ([`settle`]). A refusal leaves the upload as it was, to be completed again. A
+/// completed upload is answered as it was when the same parts are named again and the key
+/// still holds the object it made ([`completed`]), and is `NoSuchUpload` otherwise.
 async fn complete(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -981,24 +994,33 @@ async fn complete(
             ));
         }
     };
-    let assembled = {
+    let found = {
         let (store, segs) = (Arc::clone(&state.store), segs.clone());
         tokio::task::spawn_blocking(move || -> Result<_> {
-            let Some(held) = open_held(&store, &id, &segs)? else {
-                return Ok(None);
+            let Some((lock, dir)) = hold(&store, &id)? else {
+                return Ok(Found::Gone);
             };
-            let assembled = assemble(&store, &held.up, &parts, whole.as_ref())?;
-            Ok(Some((held, assembled)))
+            let Some(up) = open(&store, &id, &segs) else {
+                return Ok(match completed(&store, &dir, &segs, &parts)? {
+                    Some(done) => Found::Completed(done),
+                    None => Found::Gone,
+                });
+            };
+            let assembled = assemble(&store, &up, &parts, whole.as_ref())?;
+            Ok(Found::Assembled(Held { _lock: lock, up }, parts, assembled))
         })
         .await
         .context("assembling an upload panicked")??
     };
-    // Held until the upload is gone, so a completion racing this one waits, then finds it
-    // completed rather than its parts going from under it.
-    let (Held { _lock, up }, assembled) = match assembled {
-        None => return Ok(no_such_upload(ctx)),
-        Some((_, Err((status, code, message)))) => return Ok(ctx.error(status, code, message)),
-        Some((held, Ok(assembled))) => (held, assembled),
+    // Held until the upload is completed, so a completion racing this one waits, then finds
+    // it completed rather than its parts going from under it.
+    let (Held { _lock, up }, parts, assembled) = match found {
+        Found::Gone => return Ok(no_such_upload(ctx)),
+        Found::Completed(done) => return Ok(done.result(ctx)),
+        Found::Assembled(_, _, Err((status, code, message))) => {
+            return Ok(ctx.error(status, code, message));
+        }
+        Found::Assembled(held, parts, Ok(assembled)) => (held, parts, assembled),
     };
     let Assembled {
         staged,
@@ -1015,6 +1037,14 @@ async fn complete(
         annotations.insert(name, value);
     }
     let kept = checksum::stored(&annotations).map_or(String::new(), |kept| kept.elements());
+    let done = Completed {
+        bucket: up.meta.bucket,
+        key: up.meta.key,
+        parts,
+        etag,
+        layer: staged.hex.clone(),
+        kept,
+    };
     let how = Commit {
         annotations,
         precondition: conditions.precondition(),
@@ -1025,17 +1055,120 @@ async fn complete(
         Written::Refused(why) => return Ok(unwritable(why, ctx)),
         Written::PreconditionFailed => return Ok(copy::failed(ctx)),
     }
-    remove(up.dir).await?;
-    Ok(xml::document(
-        "CompleteMultipartUploadResult",
-        &format!(
-            "{}{}{}{}{kept}",
-            xml::element("Location", &ctx.url),
-            xml::element("Bucket", &up.meta.bucket),
-            xml::element("Key", &up.meta.key),
-            xml::element("ETag", &format!("\"{etag}\""))
-        ),
-    ))
+    let resp = done.result(ctx);
+    let dir = up.dir;
+    let settled = {
+        let dir = dir.clone();
+        tokio::task::spawn_blocking(move || settle(&dir, &done))
+            .await
+            .context("recording a completion panicked")?
+    };
+    if settled.is_err() {
+        // The object is made; an upload that could not be remembered as completed only
+        // answers a retry of its completion 404, as one completed before this did.
+        remove(dir).await?;
+    }
+    Ok(resp)
+}
+
+/// What [`complete`] found of an upload, held.
+enum Found {
+    /// no upload of the key by that id, or one completed otherwise than asked
+    Gone,
+    /// completed as asked, into the object still at the key
+    Completed(Completed),
+    /// in progress: its parts assembled as asked, or why not
+    Assembled(
+        Held,
+        Vec<(u32, String)>,
+        std::result::Result<Assembled, Refused>,
+    ),
+}
+
+/// What a completed upload leaves in its directory, in place of its record and parts.
+const COMPLETED: &str = "completed.json";
+
+/// What an upload's completion made, remembered so that the same completion sent again (an
+/// SDK retrying one whose answer it lost) is answered as it was.
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+struct Completed {
+    bucket: String,
+    key: String,
+    /// the parts the completion named, as [`document`] reads them
+    parts: Vec<(u32, String)>,
+    /// the object's ETag, unquoted
+    etag: String,
+    /// the object's bytes, by the hex of their SHA-256
+    layer: String,
+    /// the checksum elements of the answer
+    kept: String,
+}
+
+impl Completed {
+    /// The `CompleteMultipartUploadResult` of this completion.
+    fn result(&self, ctx: &Ctx) -> Response<Body> {
+        xml::document(
+            "CompleteMultipartUploadResult",
+            &format!(
+                "{}{}{}{}{}",
+                xml::element("Location", &ctx.url),
+                xml::element("Bucket", &self.bucket),
+                xml::element("Key", &self.key),
+                xml::element("ETag", &format!("\"{}\"", self.etag)),
+                self.kept
+            ),
+        )
+    }
+}
+
+/// The completion `dir` remembers, when it named `parts` for the object at `segs` and that
+/// object is still the one it made: the same bytes under the same multipart ETag. An object
+/// written over or deleted since, or another list of parts, finds none.
+fn completed(
+    store: &Store,
+    dir: &Path,
+    segs: &[String],
+    parts: &[(u32, String)],
+) -> Result<Option<Completed>> {
+    let Some(done) = read_record::<Completed>(&dir.join(COMPLETED)) else {
+        return Ok(None);
+    };
+    if done.bucket != bucket_of(segs) || done.key != key_of(segs) || done.parts != parts {
+        return Ok(None);
+    }
+    let same = match files::resolve(store, segs)? {
+        Some(files::Node::Object(obj)) => {
+            obj.layer == done.layer && obj.annotations.get(MD5_ANNOTATION) == Some(&done.etag)
+        }
+        _ => false,
+    };
+    Ok(same.then_some(done))
+}
+
+/// Leave the completed upload in `dir` as `done` only: its record removed first, so it is no
+/// upload in progress from then on, then `done` written, then its parts and whatever else is
+/// there removed. The directory then goes as an idle upload's does, once the gc's grace
+/// window has passed.
+fn settle(dir: &Path, done: &Completed) -> Result<()> {
+    std::fs::remove_file(dir.join(META))
+        .with_context(|| format!("removing {}", dir.join(META).display()))?;
+    vk_fs::write_atomic_unsynced(&dir.join(COMPLETED), &serde_json::to_vec(done)?, 0o600)?;
+    for entry in std::fs::read_dir(dir).with_context(|| format!("listing {}", dir.display()))? {
+        let entry = entry?;
+        if entry.file_name() != COMPLETED {
+            let path = entry.path();
+            match std::fs::remove_file(&path) {
+                Ok(()) => {}
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+                Err(e) => {
+                    return Err(
+                        anyhow::Error::from(e).context(format!("removing {}", path.display()))
+                    );
+                }
+            }
+        }
+    }
+    Ok(())
 }
 
 /// Remove an upload's directory, off the runtime; one already gone is gone.
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 5d8eab51..4dba4432 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -4456,11 +4456,13 @@ fn complete(path: &str, id: &str, parts: &[(u32, &str)]) -> Req {
         .body(complete_doc(parts))
 }
 
-/// The S3 multipart uploads left in the store, by id.
+/// The S3 multipart uploads in progress in the store, by id: not the completed ones kept to
+/// answer their completion again.
 fn multipart_left(dir: &std::path::Path) -> Vec<String> {
     let mut ids: Vec<String> = std::fs::read_dir(dir.join("store/uploads/s3"))
         .map(|d| {
             d.filter_map(|e| e.ok())
+                .filter(|e| e.path().join("meta.json").is_file())
                 .map(|e| e.file_name().to_string_lossy().into_owned())
                 .collect()
         })
@@ -4587,6 +4589,7 @@ async fn a_multipart_upload_is_assembled_from_its_parts() {
     )
     .await;
     resp.ok(200);
+    let first = resp.body.clone();
     let etag = multipart_etag(&[&one, &two, &three]);
     assert!(etag.ends_with("-3\""), "{etag}");
     assert_eq!(element(&resp.body, "ETag"), etag.replace('"', "&quot;"));
@@ -4618,7 +4621,27 @@ async fn a_multipart_upload_is_assembled_from_its_parts() {
 
     // The upload is gone with its parts, and nothing is left staged.
     assert!(multipart_left(&dir).is_empty());
+    let up = dir.join(format!("store/uploads/s3/{id}"));
+    let kept: Vec<_> = std::fs::read_dir(&up)
+        .unwrap()
+        .map(|e| e.unwrap().file_name())
+        .collect();
+    assert_eq!(kept, ["completed.json"]);
     assert_eq!(staging_left(&dir), 0);
+    // The same completion sent again is answered as it was, as long as the object is the
+    // one it made; another list of parts finds no upload.
+    let again = || sign(complete(path, &id, &[(1, e1), (2, e2), (3, e3)]));
+    let resp2 = send(&host, again()).await;
+    resp2.ok(200);
+    assert_eq!(resp2.body, first);
+    send(&host, sign(complete(path, &id, &[(1, e1), (2, e2)])))
+        .await
+        .is(404, "NoSuchUpload");
+    let abort = Req::new("DELETE", path).query(&format!("uploadId={id}"));
+    send(&host, sign(abort)).await.is(404, "NoSuchUpload");
+    let resp2 = send(&host, again()).await;
+    resp2.ok(200);
+    assert_eq!(resp2.body, first);
     let listed = send(&host, sign(Req::new("GET", "/s3/b").query("uploads="))).await;
     listed.ok(200);
     assert!(
@@ -4633,6 +4656,36 @@ async fn a_multipart_upload_is_assembled_from_its_parts() {
     send(&host, sign(complete(path, &id, &[(1, e1)])))
         .await
         .is(404, "NoSuchUpload");
+    // Once the object is written over, the completion is no longer its answer; nor once
+    // it is deleted.
+    send(&host, sign(Req::new("PUT", path).body(whole.clone())))
+        .await
+        .ok(200);
+    send(&host, again()).await.is(404, "NoSuchUpload");
+    let id = create_upload(&host, &sign, path).await;
+    let etag = upload_part(&host, &sign, path, &id, 1, &three).await;
+    let once = || sign(complete(path, &id, &[(1, &etag)]));
+    send(&host, once()).await.ok(200);
+    send(&host, once()).await.ok(200);
+    send(&host, sign(Req::new("DELETE", path))).await.ok(204);
+    send(&host, once()).await.is(404, "NoSuchUpload");
+    // Nor once the gc has swept it, with the uploads left idle.
+    let id = create_upload(&host, &sign, path).await;
+    let etag = upload_part(&host, &sign, path, &id, 1, &three).await;
+    let once = || sign(complete(path, &id, &[(1, &etag)]));
+    send(&host, once()).await.ok(200);
+    let up = dir.join(format!("store/uploads/s3/{id}"));
+    let old = SystemTime::now() - Duration::from_secs(3 * 86_400);
+    std::fs::File::open(up.join("completed.json"))
+        .unwrap()
+        .set_modified(old)
+        .unwrap();
+    std::fs::File::open(&up).unwrap().set_modified(old).unwrap();
+    let store = Store::new(dir.join("store")).unwrap();
+    let day = Duration::from_secs(86_400);
+    store.gc(day * 30, day, false).unwrap();
+    assert!(!up.exists());
+    send(&host, once()).await.is(404, "NoSuchUpload");
 }
 
 /// A one-part upload, an aborted one, part copies, an upload's id used for another key, a
@@ -4819,8 +4872,8 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
 }
 
 /// The same upload completed by several requests at once, as an SDK retrying a completion
-/// that timed out does: one makes the object and the others find the upload completed,
-/// never a part of it missing; the object is the parts', whole.
+/// that timed out does: one makes the object and the others, finding it made, are answered
+/// as it was, never with a part of it missing; the object is the parts', whole.
 #[tokio::test]
 async fn concurrent_completions_of_one_upload_make_one_object() {
     let (dir, host) = bearer_server("multipart-racey");
@@ -4845,21 +4898,20 @@ async fn concurrent_completions_of_one_upload_make_one_object() {
             let (host, req) = (host.clone(), sign(complete(path, &id, &named)));
             racing.spawn(async move { send(&host, req).await });
         }
-        let mut made = 0;
+        let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
+        let etag = multipart_etag(&refs);
         while let Some(resp) = racing.join_next().await {
             let resp = resp.unwrap();
-            if resp.status == 200 {
-                made += 1;
-            } else {
-                resp.is(404, "NoSuchUpload");
-            }
+            resp.ok(200);
+            assert_eq!(
+                element(&resp.body, "ETag"),
+                etag.replace('"', "&quot;"),
+                "round {round}"
+            );
         }
-        assert_eq!(made, 1, "round {round}");
-        let whole = parts.concat();
         let resp = send(&host, sign(Req::new("GET", path))).await;
-        is_object(&resp, &whole);
-        let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
-        assert_eq!(resp.header("etag"), Some(&*multipart_etag(&refs)));
+        is_object(&resp, &parts.concat());
+        assert_eq!(resp.header("etag"), Some(&*etag));
     }
     assert!(multipart_left(&dir).is_empty());
     assert_eq!(staging_left(&dir), 0);

From 35de93092a1f1e107f4839f80a5c2420b11856df Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:51:31 +0100
Subject: [PATCH 41/54] vk-registry/s3: page bucket listings with the markers
 S3 sends

ListObjects names a NextMarker only beside a delimiter, as S3 does:
without one, the page's last key is the next marker, as SDK paginators
take it. ListObjectsV2's start-after and continuation-token sent to it
are 400 InvalidArgument.

ListObjectsV2 sent both a token and start-after starts after the later
of the two, so a paginator keeping its start-after beside the token
sees no key twice; an empty token is none, echoed empty. A listing
echoes Prefix only when one was sent.
---
 vk-registry/DESIGN.md       |   4 +-
 vk-registry/src/s3/list.rs  | 102 ++++++++++++++++++++++++++++--------
 vk-registry/tests/s3_e2e.rs |  42 +++++++++++++--
 3 files changed, 119 insertions(+), 29 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index cee833c6..786e7ce5 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -688,8 +688,8 @@ reads; a replaced object keeps only what its own write sent.
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through. So is any request whose headers ask for one of them on the object or bucket it names, rather than the header being taken and dropped: `x-amz-server-side-encryption*` (SSE-S3, SSE-KMS and SSE-C, on a read and a copy's source too: a client that asked for its own key is never told its bytes are stored under it), `x-amz-tagging` naming a tag, `x-amz-acl` other than `private` or `bucket-owner-full-control` (the one ACL there is), `x-amz-grant-*`, `x-amz-storage-class` other than `STANDARD` (400 `InvalidStorageClass` for a class S3 does not have), `x-amz-website-redirect-location` and `x-amz-object-lock-*` |
-| `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `ChecksumAlgorithm` and `ChecksumType` when its write kept a checksum, `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it). `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
-| `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` and, on a truncated page, `NextMarker` in the answer, no `KeyCount`, and every object's `Owner` |
+| `GET /s3/<b>?list-type=2` ListObjectsV2 | `ListBucketResult` with `KeyCount`, the keys starting with `prefix` (any text, which may end inside a component), each with `Key`, `LastModified`, `ETag` (as HeadObject's), `ChecksumAlgorithm` and `ChecksumType` when its write kept a checksum, `Size` and `StorageClass` `STANDARD`, and `Owner` `vk-registry` with `fetch-owner=true`. Keys come in byte order of the whole key, the order S3 lists in: a directory's keys all start with `<name>/`, so tag `a-b` and `a.b` come before the keys below directory `a`, and those before tag `a_b`. `delimiter` (any text) folds every key past the prefix holding it into a `CommonPrefixes` entry ending at its first occurrence; a directory folded so is not walked, and an empty one is listed as a prefix, as WebDAV shows it. `max-keys` defaults to 1000 and is clamped to it; `0` is an empty, complete page. `NextContinuationToken` names the page's last entry; a `continuation-token` or `start-after` resumes after it, a common prefix included (a start key inside a folded prefix passes over it); sent both, the page starts after the later of the two, so a paginator that keeps its `start-after` beside the token sees no key twice, and both are echoed. An empty `continuation-token` is none, echoed empty. `Prefix` is in the answer only when `prefix` was sent, as S3 echoes it, here and in the two listings below. `encoding-type=url` percent-encodes keys, prefixes, the delimiter and `StartAfter`. 400 `InvalidArgument` for a token this registry did not give or a malformed parameter; 404 `NoSuchBucket`; 403 `AccessDenied` past the admission rule above. Touches nothing |
+| `GET /s3/<b>` ListObjects | the first version of the same listing: `marker` for `start-after`, `Marker` (empty when none was sent) and, on a truncated page with a `delimiter`, `NextMarker` in the answer, as S3 sends it only then (without one, the page's last key is the next marker, as SDK paginators take it), no `KeyCount`, and every object's `Owner`. `start-after` or `continuation-token`, ListObjectsV2's, is 400 `InvalidArgument` |
 | `GET /s3/<b>?versions` ListObjectVersions | the same listing as a store that keeps no versions answers it, a `ListVersionsResult` in which each object is a `<Version>` with ListObjects' fields and its `Owner`, `VersionId` `null` and `IsLatest` `true`, with no `<DeleteMarker>`. `key-marker` resumes after a key; `version-id-marker` is taken and echoed as `VersionIdMarker`, a key having one version; `KeyMarker` and, on a truncated page, `NextKeyMarker` with `NextVersionIdMarker` `null` are in the answer, so a paginator sends back what it is given. `list-type` with it, or a `version-id-marker` without a `key-marker`, is 400 `InvalidArgument`. Ceph's s3-tests empty every bucket through it, deleting each key with the `null` version it lists |
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 5cde6f48..669d8d4e 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -57,14 +57,15 @@ struct Query {
     /// `version-id-marker`, as sent, to echo: with one version a key, `key-marker` alone
     /// says where to resume
     version_marker: Option<String>,
-    prefix: String,
+    /// `prefix`, as sent: echoed only when it was, as S3 echoes it
+    prefix: Option<String>,
     delimiter: Option<String>,
     max_keys: usize,
-    /// the continuation token as sent, to echo
+    /// the continuation token as sent, to echo (v2 only)
     token: Option<String>,
     /// `start-after` (v2) or `marker` (v1), as sent
     start: Option<String>,
-    /// the key the page starts after: the token's, else `start`
+    /// the key the page starts after: the later of the token's and `start`
     after: Option<String>,
     /// `encoding-type=url`
     url: bool,
@@ -90,7 +91,7 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
         match name {
             "list-type" if value == "2" => q.v2 = true,
             "list-type" => return Err("list-type is 2, or absent for the first version"),
-            "prefix" => q.prefix = text(value)?,
+            "prefix" => q.prefix = Some(text(value)?),
             "delimiter" => q.delimiter = Some(text(value)?).filter(|d| !d.is_empty()),
             "max-keys" => {
                 let n: usize = value
@@ -123,15 +124,23 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
         (q.start, q.token, q.owner) = (key_marker, None, true);
     } else if q.v2 {
         q.start = start_after;
+    } else if start_after.is_some() {
+        return Err("start-after is ListObjectsV2's: send list-type=2, or marker");
+    } else if q.token.is_some() {
+        return Err("continuation-token is ListObjectsV2's: send list-type=2, or marker");
     } else {
-        (q.start, q.token, q.owner) = (marker, None, true);
+        (q.start, q.owner) = (marker, true);
     }
-    q.after = match &q.token {
+    // Sent both, a page starts after the later: a paginator that keeps its first
+    // `start-after` beside the token it was given sees no key twice. An empty token is
+    // none, echoed as sent.
+    let resumed = match q.token.as_deref() {
+        Some("") | None => None,
         Some(token) => Some(
             resume_point(token).ok_or("the continuation token is not one this registry gave")?,
         ),
-        None => q.start.clone(),
     };
+    q.after = resumed.max(q.start.clone());
     Ok(q)
 }
 
@@ -386,7 +395,7 @@ pub(super) async fn list(
             return refuse(req, resp, ctx).await;
         }
     };
-    if !admitted(authz, &bucket, &q.prefix) {
+    if !admitted(authz, &bucket, q.prefix()) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
     let ctx = ctx.clone();
@@ -414,7 +423,7 @@ fn page(store: &Store, authz: &Authz<'_>, bucket: &str, q: &Query) -> Result<(Ve
         return Ok((Vec::new(), false));
     }
     let how = Walk {
-        prefix: &q.prefix,
+        prefix: q.prefix(),
         delimiter: q.delimiter.as_deref(),
         after: q.after.as_deref(),
         limit: q.max_keys.saturating_add(1),
@@ -438,6 +447,11 @@ pub(super) fn admitted(authz: &Authz<'_>, bucket: &str, prefix: &str) -> bool {
 }
 
 impl Query {
+    /// The keys listed start with this: `prefix`, or anything.
+    fn prefix(&self) -> &str {
+        self.prefix.as_deref().unwrap_or("")
+    }
+
     /// The root element of the document this listing answers with.
     fn root(&self) -> &'static str {
         if self.versions {
@@ -455,7 +469,9 @@ impl Query {
 fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
     let enc = |s: &str| if q.url { url_encode(s) } else { s.to_string() };
     let mut out = xml::element("Name", bucket);
-    out.push_str(&xml::element("Prefix", &enc(&q.prefix)));
+    if let Some(prefix) = &q.prefix {
+        out.push_str(&xml::element("Prefix", &enc(prefix)));
+    }
     let next = truncated.then(|| items.last().map(Item::key)).flatten();
     let start = enc(q.start.as_deref().unwrap_or(""));
     if q.versions {
@@ -470,7 +486,9 @@ fn render(bucket: &str, q: &Query, items: &[Item], truncated: bool) -> String {
         }
     } else if !q.v2 {
         out.push_str(&xml::element("Marker", &start));
-        if let Some(next) = next {
+        // S3 names the next marker only beside a delimiter; without one, the page's last
+        // key is where the next page starts.
+        if let Some(next) = next.filter(|_| q.delimiter.is_some()) {
             out.push_str(&xml::element("NextMarker", &enc(next)));
         }
     }
@@ -744,7 +762,7 @@ mod tests {
                 let mut after: Option<String> = None;
                 loop {
                     let q = Query {
-                        prefix: prefix.to_string(),
+                        prefix: Some(prefix.to_string()),
                         delimiter: delimiter.map(str::to_string),
                         max_keys: size,
                         after: after.clone(),
@@ -895,7 +913,7 @@ mod tests {
             parse("list-type=2&prefix=a%2F&delimiter=%2F&max-keys=5000&fetch-owner=true").unwrap();
         assert!(q.v2 && q.owner);
         assert_eq!(
-            (q.prefix.as_str(), q.delimiter.as_deref(), q.max_keys),
+            (q.prefix(), q.delimiter.as_deref(), q.max_keys),
             ("a/", Some("/"), 1000)
         );
         let q = parse("list-type=2&start-after=a&marker=b").unwrap();
@@ -910,9 +928,22 @@ mod tests {
         .unwrap();
         assert_eq!(q.after.as_deref(), Some("s/1/"));
         assert_eq!(q.token.as_deref(), Some(token.as_str()));
-        let q = parse("marker=b&start-after=a&delimiter=").unwrap();
-        assert!(!q.v2 && q.owner);
+        // Sent both, the later of the token and `start-after` is where the page starts.
+        let q = parse(&format!(
+            "list-type=2&start-after=t&continuation-token={token}"
+        ))
+        .unwrap();
+        assert_eq!(q.after.as_deref(), Some("t"));
+        // An empty token is none, and is echoed.
+        let q = parse("list-type=2&continuation-token=&start-after=a").unwrap();
+        assert_eq!(
+            (q.token.as_deref(), q.after.as_deref()),
+            (Some(""), Some("a"))
+        );
+        let q = parse("marker=b&delimiter=").unwrap();
+        assert!(!q.v2 && q.owner && q.prefix.is_none());
         assert_eq!((q.after.as_deref(), q.delimiter), (Some("b"), None));
+        assert_eq!(parse("prefix=").unwrap().prefix.as_deref(), Some(""));
         assert_eq!(parse("").unwrap().max_keys, 1000);
         assert_eq!(parse("max-keys=0").unwrap().max_keys, 0);
         assert!(parse("encoding-type=url").unwrap().url);
@@ -937,13 +968,17 @@ mod tests {
             parse(&format!("list-type=2&continuation-token={token}")).is_err()
         };
         assert!(bad_token(b"a b"));
-        assert!(bad_token(b""));
+        assert!(!bad_token(b""));
         assert!(bad_token(&[0xff]));
         assert!(bad_token(&[b'a'; 1025]));
         assert!(!bad_token(&[b'a'; 1024]));
         for bad in [
             "list-type=2&continuation-token=!!",
             "list-type=2&continuation-token=YQ==",
+            // ListObjectsV2's own parameters, sent to the first version.
+            "start-after=a",
+            "start-after",
+            "marker=a&continuation-token=",
             "list-type=1",
             "max-keys=-1",
             "max-keys=x",
@@ -965,7 +1000,7 @@ mod tests {
         let t = tree("render", &["d/k"]);
         let q = Query {
             v2: true,
-            prefix: "d/".to_string(),
+            prefix: Some("d/".to_string()),
             max_keys: 1000,
             ..Query::default()
         };
@@ -990,10 +1025,14 @@ mod tests {
             "{xml}"
         );
         assert!(!xml.contains("<Owner>"));
+        // A prefix is echoed only when one was sent.
+        let q = Query { prefix: None, ..q };
+        let xml = render("b", &q, &items, false);
+        assert!(xml.starts_with("<Name>b</Name><MaxKeys>"), "{xml}");
 
         let q = Query {
             v2: true,
-            prefix: "<a b>/".to_string(),
+            prefix: Some("<a b>/".to_string()),
             delimiter: Some("&".to_string()),
             start: Some("\"x".to_string()),
             max_keys: 2,
@@ -1019,10 +1058,11 @@ mod tests {
         assert!(xml.contains("<StartAfter>%22x</StartAfter>"), "{xml}");
         assert!(xml.contains("<Prefix>%3Ca%20b%3E/c%26</Prefix></CommonPrefixes>"));
 
-        // The first version: a marker, the next one, and every object's owner.
+        // The first version: a marker, the next one beside a delimiter only, and every
+        // object's owner.
         put(&t.store, "b/d/m");
         let q = Query {
-            prefix: "d/".to_string(),
+            prefix: Some("d/".to_string()),
             start: Some("d/a".to_string()),
             after: Some("d/a".to_string()),
             max_keys: 1,
@@ -1034,7 +1074,25 @@ mod tests {
         assert!(
             xml.starts_with(
                 "<Name>b</Name><Prefix>d/</Prefix><Marker>d/a</Marker>\
-                 <NextMarker>d/k</NextMarker><MaxKeys>1</MaxKeys><IsTruncated>true</IsTruncated>"
+                 <MaxKeys>1</MaxKeys><IsTruncated>true</IsTruncated>"
+            ),
+            "{xml}"
+        );
+        let delimited = Query {
+            prefix: Some("d/".to_string()),
+            delimiter: Some("/".to_string()),
+            start: Some("d/a".to_string()),
+            after: Some("d/a".to_string()),
+            max_keys: 1,
+            owner: true,
+            ..Query::default()
+        };
+        let xml = render("b", &delimited, &items, truncated);
+        assert!(
+            xml.starts_with(
+                "<Name>b</Name><Prefix>d/</Prefix><Marker>d/a</Marker>\
+                 <NextMarker>d/k</NextMarker><MaxKeys>1</MaxKeys><Delimiter>/</Delimiter>\
+                 <IsTruncated>true</IsTruncated>"
             ),
             "{xml}"
         );
@@ -1077,7 +1135,7 @@ mod tests {
         assert!(!xml.contains("Marker>d/a</Marker") && !xml.contains("Contents"));
         let q = Query {
             versions: true,
-            prefix: "d/".to_string(),
+            prefix: Some("d/".to_string()),
             max_keys: 2,
             ..Query::default()
         };
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 4dba4432..37870620 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -3053,7 +3053,7 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
         resp.body.starts_with(
             "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
              <ListBucketResult xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
-             <Name>sccache</Name><Prefix></Prefix><MaxKeys>1000</MaxKeys><KeyCount>7</KeyCount>\
+             <Name>sccache</Name><MaxKeys>1000</MaxKeys><KeyCount>7</KeyCount>\
              <IsTruncated>false</IsTruncated><Contents>"
         ),
         "{}",
@@ -3127,7 +3127,8 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
     }
     assert_eq!((pages, seen.as_slice()), (4, written.as_slice()));
 
-    // The first version: markers, and every object's owner.
+    // The first version: markers, and every object's owner. With no delimiter there is no
+    // next marker: the page's last key is where the next one starts, as SDKs page it.
     let mut seen = Vec::new();
     let mut marker = String::new();
     loop {
@@ -3146,10 +3147,12 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
         if element(&resp.body, "IsTruncated") == "false" {
             break;
         }
-        marker = element(&resp.body, "NextMarker");
-        assert_eq!(&marker, seen.last().unwrap());
+        assert!(!resp.body.contains("NextMarker"));
+        marker = seen.last().unwrap().clone();
     }
     assert_eq!(seen, written);
+    let resp = send(host, list("delimiter=%2F&max-keys=1")).await;
+    assert_eq!(element(&resp.body, "NextMarker"), ".sccache_check");
 
     // The versions: each object the one, `null`, version of its key, paged by key marker
     // as boto3's paginator pages it, sending back the version id marker it was given.
@@ -3169,7 +3172,7 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
             resp.body.starts_with(
                 "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
                  <ListVersionsResult xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\">\
-                 <Name>sccache</Name><Prefix></Prefix><KeyMarker>"
+                 <Name>sccache</Name><KeyMarker>"
             ),
             "{}",
             resp.body
@@ -3222,6 +3225,33 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
     .await;
     assert_eq!(keys(&resp.body), &written[4..]);
     assert_eq!(&element(&resp.body, "StartAfter"), start);
+    // A token and `start-after` both: the page starts after the later of the two, and
+    // both are echoed; an empty token is none.
+    let first = send(host, list("list-type=2&max-keys=1")).await;
+    let token = element(&first.body, "NextContinuationToken");
+    for (start, from) in [(&written[0], 1), (&written[3], 4)] {
+        let resp = send(
+            host,
+            list(&format!(
+                "continuation-token={token}&list-type=2&start-after={}",
+                start.replace('/', "%2F")
+            )),
+        )
+        .await;
+        assert_eq!(keys(&resp.body), &written[from..], "{start}");
+        assert_eq!(element(&resp.body, "ContinuationToken"), token);
+        assert_eq!(&element(&resp.body, "StartAfter"), start);
+    }
+    let resp = send(host, list("continuation-token=&list-type=2")).await;
+    resp.ok(200);
+    assert_eq!(keys(&resp.body), written);
+    assert!(
+        resp.body
+            .contains("<ContinuationToken></ContinuationToken>")
+    );
+    assert!(!resp.body.contains("<Prefix>"));
+    let resp = send(host, list("list-type=2&prefix=")).await;
+    assert!(resp.body.contains("<Prefix></Prefix>"), "{}", resp.body);
     let resp = send(host, list("fetch-owner=true&list-type=2&max-keys=1")).await;
     assert!(
         resp.body.contains(
@@ -3255,6 +3285,8 @@ async fn sharded_listing(host: &str, sign: Sign<'_>) {
         "list-type=2&max-keys=-1",
         "encoding-type=base64&list-type=2",
         "list-type=3",
+        "start-after=a",
+        "continuation-token=",
     ] {
         send(host, list(bad)).await.is(400, "InvalidArgument");
     }

From 2e15aee85b82fdf7dd3c82c76af9f9c363bf2e6a Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:55:35 +0100
Subject: [PATCH 42/54] vk-registry/s3: page ListMultipartUploads by key and
 upload id as S3 does

A key's uploads are listed in the order they were initiated rather
than by id as text. An upload-id-marker is taken as S3 takes it: the
page starts after that upload, which has to be one of the first key
from key-marker on (else 400 InvalidArgument), and without a key-marker
it is ignored. NextKeyMarker and NextUploadIdMarker name the page's
last upload whether or not more follow, and Prefix is echoed only when
one was sent.
---
 vk-registry/DESIGN.md           |  2 +-
 vk-registry/src/s3/multipart.rs | 58 ++++++++++++++++----
 vk-registry/tests/s3_e2e.rs     | 94 ++++++++++++++++++++++++++++++---
 3 files changed, 137 insertions(+), 17 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 786e7ce5..f0ba8e35 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -700,7 +700,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
-| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then upload id, after `key-marker` (and `upload-id-marker` for that key), `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
+| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take; an SDK's `x-id` operation hint is ignored |
 
 **XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 8881361e..244b9dda 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -1348,11 +1348,27 @@ struct Listed {
     created: u64,
 }
 
+impl Listed {
+    /// Where the upload is listed: by key, then as S3 lists a key's uploads, by when each was
+    /// initiated, which the counter in its id (`<pid>-<n>-<random>`) orders within the second
+    /// for the uploads one server made.
+    fn order(&self) -> (&str, u64, u64, u64, &str) {
+        let mut n = self
+            .id
+            .splitn(3, '-')
+            .map(|n| n.parse().unwrap_or(u64::MAX));
+        let (pid, count) = (n.next().unwrap_or(u64::MAX), n.next().unwrap_or(u64::MAX));
+        (&self.key, self.created, pid, count, &self.id)
+    }
+}
+
 /// `GET /s3/<bucket>?uploads`: the uploads in progress into the bucket whose key starts with
-/// `prefix`, by key then id, after `key-marker` (and, for that key, `upload-id-marker`),
-/// `max-uploads` of them (at most and by default 1000). Admitted as a listing of the bucket
-/// with that prefix is, and shows only the uploads whose key the caller may read. Every
-/// upload's record is read: the cost is the store's uploads in progress, not the bucket's.
+/// `prefix`, in [`Listed::order`], after `key-marker`, `max-uploads` of them (at most and by
+/// default 1000). With `upload-id-marker` too, after that upload, which has to be one of the
+/// first key from `key-marker` on, as S3 takes it; without `key-marker` it is ignored.
+/// Admitted as a listing of the bucket with that prefix is, and shows only the uploads whose
+/// key the caller may read. Every upload's record is read: the cost is the store's uploads
+/// in progress, not the bucket's.
 pub(super) async fn list_uploads(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -1383,7 +1399,7 @@ pub(super) async fn list_uploads(
     };
     // Each is echoed in the listing, so held to what a bucket listing's prefix is.
     let echoed = |name| list::text(param(&params, name).unwrap_or_default().to_string());
-    let (prefix, key_marker, id_marker) = match (
+    let (prefix, key_marker, mut id_marker) = match (
         echoed("prefix"),
         echoed("key-marker"),
         echoed("upload-id-marker"),
@@ -1393,6 +1409,10 @@ pub(super) async fn list_uploads(
             return refuse(req, invalid(ctx, why), ctx).await;
         }
     };
+    if key_marker.is_empty() {
+        id_marker.clear();
+    }
+    let prefix_sent = param(&params, "prefix").is_some();
     if !list::admitted(authz, &bucket, &prefix) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
@@ -1410,8 +1430,8 @@ pub(super) async fn list_uploads(
             let Some(meta) = read_record::<Meta>(&dir.join(META)) else {
                 continue;
             };
-            let after = meta.key > key_marker
-                || (meta.key == key_marker && !id_marker.is_empty() && id > id_marker);
+            // Past the key marker; at it too when an upload of the first key is to be found.
+            let after = meta.key > key_marker || (meta.key == key_marker && !id_marker.is_empty());
             let segs: Vec<String> = std::iter::once(bucket.clone())
                 .chain(meta.key.split('/').map(str::to_string))
                 .collect();
@@ -1427,7 +1447,22 @@ pub(super) async fn list_uploads(
                 });
             }
         }
-        uploads.sort_by(|a, b| (&a.key, &a.id).cmp(&(&b.key, &b.id)));
+        uploads.sort_by(|a, b| a.order().cmp(&b.order()));
+        if !id_marker.is_empty() {
+            let first = uploads.first().map(|u| u.key.clone());
+            let Some(at) = uploads
+                .iter()
+                .take_while(|u| Some(&u.key) == first.as_ref())
+                .position(|u| u.id == id_marker)
+            else {
+                return Ok(ctx.error(
+                    StatusCode::BAD_REQUEST,
+                    "InvalidArgument",
+                    "upload-id-marker names none of the uploads of the first key from key-marker",
+                ));
+            };
+            uploads.drain(..=at);
+        }
         let truncated = uploads.len() > max;
         uploads.truncate(max);
         let enc = |s: &str| {
@@ -1443,11 +1478,14 @@ pub(super) async fn list_uploads(
             xml::element("KeyMarker", &enc(&key_marker)),
             xml::element("UploadIdMarker", &id_marker),
         );
-        if let (true, Some(last)) = (truncated, uploads.last()) {
+        // S3 names the page's last upload whether or not more follow.
+        if let Some(last) = uploads.last() {
             out.push_str(&xml::element("NextKeyMarker", &enc(&last.key)));
             out.push_str(&xml::element("NextUploadIdMarker", &last.id));
         }
-        out.push_str(&xml::element("Prefix", &enc(&prefix)));
+        if prefix_sent {
+            out.push_str(&xml::element("Prefix", &enc(&prefix)));
+        }
         if url {
             out.push_str(&xml::element("EncodingType", "url"));
         }
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 37870620..28d7a09b 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2744,12 +2744,14 @@ async fn echoed_text_holds_no_control_character() {
             .await
             .is(400, "InvalidArgument");
     }
-    send(
-        &host,
-        Req::new("GET", "/s3/b").query("uploads&prefix=a&key-marker=k&upload-id-marker=u"),
-    )
-    .await
-    .ok(200);
+    for good in [
+        "uploads&prefix=a&key-marker=k",
+        "uploads&upload-id-marker=u",
+    ] {
+        send(&host, Req::new("GET", "/s3/b").query(good))
+            .await
+            .ok(200);
+    }
     for key in ["a&#1;", "a\u{1}"] {
         send(
             &host,
@@ -2761,6 +2763,86 @@ async fn echoed_text_holds_no_control_character() {
     is_object(&send(&host, Req::new("GET", "/s3/b/k")).await, HELLO);
 }
 
+/// Uploads are listed by key, then a key's in the order they were initiated, and paged by
+/// the key and upload id markers as S3 pages them.
+#[tokio::test]
+async fn uploads_are_paged_by_key_and_upload_id() {
+    let dir = tmp("upload-pages");
+    let host = spawn(open_state(&dir, true));
+    let list = |q: &str| Req::new("GET", "/s3/b").query(&format!("uploads&{q}"));
+    send(&host, Req::new("PUT", "/s3/b")).await.ok(200);
+    let mut made = Vec::new();
+    // Twelve uploads of a key, so their ids' counters reach two digits and order as numbers.
+    for (key, count) in [("bar", 12), ("baz", 3), ("foo", 1)] {
+        for _ in 0..count {
+            let resp = send(
+                &host,
+                Req::new("POST", &format!("/s3/b/{key}")).query("uploads="),
+            )
+            .await;
+            resp.ok(200);
+            made.push((key.to_string(), element(&resp.body, "UploadId")));
+        }
+    }
+    let ids = |body: &str| elements(body, "UploadId");
+    let all: Vec<String> = made.iter().map(|(_, id)| id.clone()).collect();
+
+    let resp = send(&host, list("")).await;
+    resp.ok(200);
+    assert_eq!(ids(&resp.body), all);
+    assert!(!resp.body.contains("<Prefix>"), "{}", resp.body);
+    // The last upload is named whether or not more follow.
+    assert_eq!(element(&resp.body, "IsTruncated"), "false");
+    assert_eq!(element(&resp.body, "NextKeyMarker"), "foo");
+    assert_eq!(element(&resp.body, "NextUploadIdMarker"), all[15]);
+    let resp = send(&host, list("prefix=")).await;
+    assert!(resp.body.contains("<Prefix></Prefix>"), "{}", resp.body);
+
+    // Paged by both markers, every upload once.
+    let mut seen = Vec::new();
+    let mut q = "max-uploads=5".to_string();
+    loop {
+        let resp = send(&host, list(&q)).await;
+        resp.ok(200);
+        seen.extend(ids(&resp.body));
+        if element(&resp.body, "IsTruncated") == "false" {
+            break;
+        }
+        q = format!(
+            "key-marker={}&max-uploads=5&upload-id-marker={}",
+            element(&resp.body, "NextKeyMarker"),
+            element(&resp.body, "NextUploadIdMarker")
+        );
+    }
+    assert_eq!(seen, all);
+
+    // A key marker alone: past that key's uploads.
+    let resp = send(&host, list("key-marker=bar")).await;
+    assert_eq!(ids(&resp.body), &all[12..]);
+    // An upload id marker alone is ignored.
+    let resp = send(&host, list(&format!("upload-id-marker={}", all[3]))).await;
+    resp.ok(200);
+    assert_eq!(ids(&resp.body), all);
+    assert_eq!(element(&resp.body, "UploadIdMarker"), "");
+    // A key marker that is no upload's key: the upload id is one of the next key's.
+    let resp = send(
+        &host,
+        list(&format!("key-marker=bat&upload-id-marker={}", all[13])),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(ids(&resp.body), &all[14..]);
+    assert_eq!(element(&resp.body, "UploadIdMarker"), all[13]);
+    // Else the upload id marker names nothing to start after.
+    for q in [
+        format!("key-marker=bar&upload-id-marker={}", all[13]),
+        "key-marker=bar&upload-id-marker=1-2-3".to_string(),
+        format!("key-marker=zzz&upload-id-marker={}", all[15]),
+    ] {
+        send(&host, list(&q)).await.is(400, "InvalidArgument");
+    }
+}
+
 /// A query's names are taken decoded, as the signature takes them, wherever they dispatch;
 /// a malformed escape is refused.
 #[tokio::test]

From 29f46ab88cbeb54d128fda266364b13be407a0f4 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 10:59:29 +0100
Subject: [PATCH 43/54] vk-registry/s3: answer InvalidURI for a path S3 cannot
 parse

A path with a malformed percent escape, a component that is not UTF-8
or holds a control character once decoded, or `..` components climbing
above the root (`\` separating them too) is 400 InvalidURI, answered
before the credential is looked at, as S3 parses the URI first. It was
InvalidArgument or InvalidBucketName once authenticated, and 403 before.
A `..` that stays below the root is still refused as a key component.
---
 vk-registry/DESIGN.md       | 10 ++++--
 vk-registry/src/s3/mod.rs   | 14 +++++++-
 vk-registry/src/s3/path.rs  | 64 +++++++++++++++++++++++++++++++++++++
 vk-registry/tests/s3_e2e.rs | 57 +++++++++++++++++++++++++++++++++
 4 files changed, 141 insertions(+), 4 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index f0ba8e35..4f0363f0 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -635,9 +635,13 @@ one component; a key is 1 to 14 components (16 counting `files` and the bucket),
 `[A-Za-z0-9._-]` of at most 255 bytes, not `.`, `..`, `tags`, `manifests` or `blobs`, the whole
 key at most 1024 bytes, no empty component and no trailing slash, so there are no "directory
 marker" objects. Paths are split before they are percent-decoded, as WebDAV's are, so `%2F`
-cannot smuggle a separator. Anything else is 400 `InvalidArgument`, `KeyTooLongError` or
-`InvalidBucketName`, with a message naming the rule. `sccache`'s keys (`a/b/c/<hex>`,
-`.sccache_check`) pass. A query's parameters, names and values alike, are percent-decoded
+cannot smuggle a separator. A path S3 could not parse at all is 400 `InvalidURI`, answered
+before the credential is looked at, as S3 parses the URI first: a malformed percent escape, a
+component that is not UTF-8 once decoded or holds a control character (`\u{8a}`), or `..` components climbing above the root (the
+one below `/s3` path-style, the host's virtual-hosted), `\` separating them as `/` does. A
+`..` that stays below the root is a key component. Anything else is 400 `InvalidArgument`,
+`KeyTooLongError` or `InvalidBucketName`, with a message naming the rule. `sccache`'s keys
+(`a/b/c/<hex>`, `.sccache_check`) pass. A query's parameters, names and values alike, are percent-decoded
 once, as the signature decodes them, before the request is dispatched on them; a malformed
 escape is 400 `InvalidArgument`.
 
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index b6b52fdd..05dbedc4 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -105,6 +105,10 @@ pub(crate) async fn route(
     req: Request<Incoming>,
 ) -> Result<Response<Body>> {
     let path = req.uri().path();
+    let unparsable = path::unparsable(match bucket {
+        Some(_) => path,
+        None => path.strip_prefix("/s3").unwrap_or(path),
+    });
     let ctx = Ctx {
         id: accounts::random_token(8),
         path: match bucket {
@@ -117,7 +121,15 @@ pub(crate) async fn route(
         },
     };
     let id = &ctx.id;
-    let mut resp = match serve(state, req, &ctx).await {
+    // S3 parses the URI before it looks at the credential.
+    let served = match unparsable {
+        Some(why) => {
+            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidURI", why);
+            before_auth(req, resp).await
+        }
+        None => serve(state, req, &ctx).await,
+    };
+    let mut resp = match served {
         Ok(resp) => resp,
         Err(e) => {
             eprintln!("vk-registry: S3 request {id} failed: {e:#}");
diff --git a/vk-registry/src/s3/path.rs b/vk-registry/src/s3/path.rs
index fc5fe05c..93c2bbc0 100644
--- a/vk-registry/src/s3/path.rs
+++ b/vk-registry/src/s3/path.rs
@@ -65,6 +65,35 @@ const COMPONENT_TOO_LONG: Refusal =
     refusal("KeyTooLongError", "a key component is at most 255 bytes");
 const KEY_TOO_LONG: Refusal = refusal("KeyTooLongError", "a key is at most 1024 bytes");
 
+/// Why S3 could not parse a request's path at all, which it answers 400 `InvalidURI` before
+/// looking at the credential: a component with a malformed percent escape, not UTF-8 once
+/// decoded or holding a control character (as ceph's suite has S3 refuse `\u{8a}`), or `..`
+/// components that climb above the root, `\` separating them as `/` does.
+/// `rel` is the path below the S3 root: what follows `/s3` path-style, the whole path of a
+/// request whose host names the bucket. A `.` or `..` that stays below the root is a key's
+/// component, which [`parse`] refuses as such.
+pub(crate) fn unparsable(rel: &str) -> Option<&'static str> {
+    let mut depth = 0usize;
+    for raw in rel.split('/') {
+        let Some(seg) = decode_segment(raw).filter(|s| !s.chars().any(char::is_control)) else {
+            return Some(
+                "the request's path has a malformed percent escape, is not UTF-8 or holds a control character",
+            );
+        };
+        for part in seg.split('\\') {
+            match part {
+                "" | "." => {}
+                ".." => match depth.checked_sub(1) {
+                    Some(up) => depth = up,
+                    None => return Some("the request's path climbs above its root"),
+                },
+                _ => depth += 1,
+            }
+        }
+    }
+    None
+}
+
 /// What the path of a request under `/s3` names; the caller dispatches only `/s3` paths here.
 pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
     let rest = path.strip_prefix("/s3").unwrap_or(path);
@@ -149,6 +178,41 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_path_is_unparsable_with_a_bad_escape_or_climbing_above_its_root() {
+        for bad in [
+            "/b/(*&^%&())",
+            "/b/a%zz",
+            "/b/a%",
+            "/b/%FF",
+            "/b/%C2%AE%C2%8A-",
+            "/b/a%0Ab",
+            "/b%2",
+            "/b/../../x",
+            "/b/a/a/../../../../x",
+            "/b//a/../../b/../../c",
+            "/b/x//../../../y",
+            "/b/x%5C..%5C..%5C..%5Cy",
+            "/../x",
+            "/..",
+        ] {
+            assert!(unparsable(bad).is_some(), "{bad}");
+        }
+        for good in [
+            "",
+            "/",
+            "/b",
+            "/b/k",
+            "/b/..",
+            "/b/a/../b",
+            "/b/x/y/../..",
+            "/b/./k",
+            "/b/a%2F..%2F..%2F..",
+        ] {
+            assert_eq!(unparsable(good), None, "{good}");
+        }
+    }
+
     #[test]
     fn the_service_and_buckets_are_named_by_one_component() {
         assert_eq!(parse("/s3"), Ok(Target::Service));
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 28d7a09b..ad7f45f1 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -2646,6 +2646,63 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     assert_eq!(staging_left(&dir), 0);
 }
 
+/// A path S3 cannot parse — a malformed escape, or `..` climbing above the root — is 400
+/// `InvalidURI` before the credential is looked at, path-style or virtual-hosted; a `..`
+/// that stays below the root is a key's component, refused as one. Other routes keep their
+/// own answers.
+#[tokio::test]
+async fn a_path_that_cannot_be_parsed_is_an_invalid_uri() {
+    let (_dir, host) = bearer_server("invalid-uri");
+    let sign = |r: Req| r.signed(&host, BEARER, 0);
+    for path in [
+        "/s3/bucket/(*&^%&())",
+        "/s3/b/a%zz",
+        "/s3/b/a%",
+        "/s3/b%2/k",
+        "/s3/b/%FF",
+        "/s3/b/%C2%AE%C2%8A-",
+        "/s3/b/../../x",
+        "/s3/b/x//../../../y",
+        "/s3/b/x%5C..%5C..%5C..%5Cy",
+        "/s3/..",
+    ] {
+        send(&host, Req::new("GET", path))
+            .await
+            .is(400, "InvalidURI");
+        send(&host, sign(Req::new("PUT", path).body(HELLO.to_vec())))
+            .await
+            .is(400, "InvalidURI");
+    }
+    send(
+        &host,
+        sign(Req::new("PUT", "/s3/b/a/../x").body(HELLO.to_vec())),
+    )
+    .await
+    .is(400, "InvalidArgument");
+    send(&host, Req::new("GET", "/s3/b/a/../x"))
+        .await
+        .is(403, "AccessDenied");
+    let dav = send(&host, Req::new("GET", "/dav/a%zz")).await;
+    assert_eq!(dav.status, 401);
+    assert_eq!(dav.header("x-amz-request-id"), None);
+
+    let dir = tmp("invalid-uri-vhost");
+    let mut cfg = ServerConfig::local("127.0.0.1:5000".parse().unwrap(), dir.join("store"));
+    cfg.s3_host = Some("s3.example.com".to_string());
+    let addr = spawn(Arc::new(cfg.into_state().unwrap()));
+    let mut conn = Conn::open_as(&addr, "b.s3.example.com").await;
+    // The root is the host's: one `..` climbs above it.
+    conn.send(&Req::new("GET", "/../x"))
+        .await
+        .is(400, "InvalidURI");
+    conn.send(&Req::new("GET", "/a%zz"))
+        .await
+        .is(400, "InvalidURI");
+    conn.send(&Req::new("GET", "/a/../x"))
+        .await
+        .is(400, "InvalidArgument");
+}
+
 /// A key the store fails to delete is reported on its own, and the batch goes on past it.
 #[tokio::test]
 async fn a_key_that_fails_to_delete_is_reported_and_the_batch_goes_on() {

From d47c8f039d760fe2ff70b3e9a855f6679774452d Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 11:27:09 +0100
Subject: [PATCH 44/54] vk-registry/s3: answer S3's own error codes, statuses
 and messages

One table (s3/error.rs) maps each code to its status and AWS's message,
as versitygw 1.10.0's s3err mirrors them; handlers name a code, and add
the elements AWS sends with it (BucketName, Key, UploadId, ArgumentName
and ArgumentValue, Condition, Header, Size and MaxSizeAllowed) where the
detail of the old messages now goes. InvalidArgument and InvalidRequest
keep the specific sentence AWS has for the case (copy sources, metadata
directives, counts, checksum values, listing markers), malformed
Authorization headers say AWS's reason in AWS's order, and an unsigned
header refusal names all of them. EntityTooLarge is 400, as in S3.
Refusals S3 never makes (key charset, store clashes, presigned URLs,
read-only store) keep a message saying why.

This reverses the earlier choice not to match versitygw's wording.
---
 CHANGELOG.md                      |   3 +-
 vk-registry/DESIGN.md             |  26 +-
 vk-registry/src/s3/batch.rs       |  91 +++----
 vk-registry/src/s3/bucket.rs      |  72 +++--
 vk-registry/src/s3/canned.rs      |  96 +++----
 vk-registry/src/s3/checksum.rs    |  39 ++-
 vk-registry/src/s3/chunked.rs     |  95 ++++---
 vk-registry/src/s3/conditional.rs |  84 ++++--
 vk-registry/src/s3/copy.rs        | 127 ++++-----
 vk-registry/src/s3/error.rs       | 428 ++++++++++++++++++++++++++++++
 vk-registry/src/s3/list.rs        | 152 ++++++++---
 vk-registry/src/s3/meta.rs        |  49 ++--
 vk-registry/src/s3/mod.rs         | 252 ++++++++----------
 vk-registry/src/s3/multipart.rs   | 322 +++++++++++-----------
 vk-registry/src/s3/object.rs      | 267 ++++++-------------
 vk-registry/src/s3/path.rs        | 130 +++++----
 vk-registry/src/s3/sigv4.rs       | 220 ++++++++++-----
 vk-registry/tests/s3_e2e.rs       |  49 +++-
 18 files changed, 1510 insertions(+), 992 deletions(-)
 create mode 100644 vk-registry/src/s3/error.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6311b0f5..8936742d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,7 +25,8 @@ All notable changes to virtkit will be documented in this file.
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
-  a refused upload sees its refusal rather than a dropped connection. Large
+  a refused upload sees its refusal rather than a dropped connection; every refusal carries
+  the error code, status and message S3 answers with. Large
   files can be uploaded in parts, as the AWS CLI uploads them, completed once however many
   completions of the upload are sent, at once or as retries (each answered as the first while
   the object is still the one it made), read back a part at a time,
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 4f0363f0..8c4b84f6 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -613,7 +613,7 @@ apply unchanged, and only then is its secret used to check the signature; an unk
 403 `InvalidAccessKeyId`, a wrong signature 403 `SignatureDoesNotMatch` (with the string to
 sign and canonical request, as AWS answers). The signature must cover `host`, `x-amz-content-sha256`
 and, as S3 requires, every `x-amz-*` header the request carries: one left out is 403
-`AccessDenied` naming it in `HeadersNotSigned`, since anything on the way could have added
+`AccessDenied` naming each in `HeadersNotSigned`, since anything on the way could have added
 it. The request's time must be on the scope's day
 and within 15 minutes of the server's (403 `RequestTimeTooSkewed`, naming the server's
 time). The usual `Authorization: Bearer|Basic` and the session cookie keep working on `/s3/`;
@@ -640,7 +640,8 @@ before the credential is looked at, as S3 parses the URI first: a malformed perc
 component that is not UTF-8 once decoded or holds a control character (`\u{8a}`), or `..` components climbing above the root (the
 one below `/s3` path-style, the host's virtual-hosted), `\` separating them as `/` does. A
 `..` that stays below the root is a key component. Anything else is 400 `InvalidArgument`,
-`KeyTooLongError` or `InvalidBucketName`, with a message naming the rule. `sccache`'s keys
+`KeyTooLongError` (with the `Size` and the `MaxSizeAllowed`, 1024 for the key, 255 for a
+component) or `InvalidBucketName`, an `InvalidArgument` with a message naming the rule. `sccache`'s keys
 (`a/b/c/<hex>`, `.sccache_check`) pass. A query's parameters, names and values alike, are percent-decoded
 once, as the signature decodes them, before the request is dispatched on them; a malformed
 escape is 400 `InvalidArgument`.
@@ -662,6 +663,19 @@ caller may not read is passed over with everything below it, as `PROPFIND` passe
 and neither a foreign tag nor an object whose bytes the caller may not read through it is
 listed.
 
+**Refusals are S3's.** Every refusal is S3's XML `Error`, with the code, status and message
+AWS answers that case with (`The specified bucket does not exist.`, `The specified multipart
+upload does not exist. The upload ID may be invalid, or the upload may have been aborted or
+completed.`, `At least one of the pre-conditions you specified did not hold`…), from one
+table (`src/s3/error.rs`): a handler names a code, and the message is the code's unless AWS has
+one of its own for the case, as `InvalidArgument` and `InvalidRequest` always do. The detail
+goes in the elements AWS adds for it: `BucketName`, `Key`, `UploadId`, `ArgumentName` and
+`ArgumentValue`, `Condition`, `Header` (the header a `NotImplemented` is about), `Size` and
+`MaxSizeAllowed`, `PartNumber` and `ETag`. A refusal of this registry's own, one AWS never
+makes (a key outside the store's names, a write over a directory, a presigned URL, a
+cross-site write, a read-only store), keeps a message that says why. versitygw 1.10.0's
+`s3err` table, which mirrors AWS's messages, and AWS's error-code list are the references.
+
 **A write makes its bucket.** PutObject, CopyObject and CompleteMultipartUpload into a bucket
 that does not exist create it, with every directory above the key, as WebDAV's `PUT` creates
 missing directories, rather than answering S3's `NoSuchBucket`; the write is authorized as
@@ -683,7 +697,7 @@ reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 413 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
@@ -699,9 +713,9 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
-| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 413 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
+| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (413 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
@@ -732,7 +746,7 @@ streams and wiped after. **A request authenticated by a bearer, Basic or session
 rather than SigV4** — the way a proxy that authenticates a guest's requests itself forwards
 them — and any request to a server with no credential has no secret to check them with: its
 framing is decoded and its signatures are read, not checked. `x-amz-decoded-content-length`
-is required (400 `InvalidRequest`), past 4 GiB is 413 before the body is read, and the chunks
+is required (400 `InvalidRequest`), past 4 GiB is 400 `EntityTooLarge` before the body is read, and the chunks
 must hold exactly that many bytes. The trailer's `x-amz-checksum-{crc32,sha1,sha256}` is
 checked against the decoded bytes and echoed, as a header's is; `crc32c` and `crc64nvme` are
 taken unchecked; a checksum sent both as a header and in the trailer is 400. Reading is
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index 57da64b1..d558001c 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -10,9 +10,10 @@
 
 use anyhow::Result;
 use hyper::body::Incoming;
-use hyper::{Request, Response, StatusCode};
+use hyper::{Request, Response};
 
 use super::conditional::{self, DeleteConditions};
+use super::error::{Code, Refusal};
 use super::object::{Deleted, admitted, check_body, delete_one, unwritable_message};
 use super::xml::scan::{self, Malformed};
 use super::{Ctx, NULL_VERSION, path, read_small, xml};
@@ -123,9 +124,6 @@ fn document(body: &[u8]) -> Result<Asked, Refused> {
     Ok(Asked { quiet, entries })
 }
 
-/// Why one key was not deleted: an S3 error code and a message.
-type KeyError = (&'static str, &'static str);
-
 /// Delete `key` of `bucket` for this caller when `conditions` hold of its object, the
 /// namespace held: as DeleteObject would, a key with no object counting as deleted when no
 /// condition is asked.
@@ -136,30 +134,38 @@ fn delete_key(
     bucket: &str,
     key: &str,
     conditions: &DeleteConditions,
-) -> Result<std::result::Result<(), KeyError>> {
+) -> Result<std::result::Result<(), Refusal>> {
     // A key here is text, not a URL: no escape is decoded, and no key holds a `%`.
     if key.contains('%') {
-        return Ok(Err((
-            "InvalidArgument",
+        return Ok(Err(Refusal::said(
+            Code::InvalidArgument,
             "a key's components are runs of A-Z a-z 0-9 . _ - only",
         )));
     }
     let segs = match path::parse(&format!("/s3/{bucket}/{key}")) {
         Ok(path::Target::Object { segs, .. }) => segs,
-        Ok(_) => return Ok(Err(("InvalidArgument", "the key is empty"))),
-        Err(why) => return Ok(Err((why.code, why.message))),
+        Ok(_) => {
+            return Ok(Err(Refusal::said(
+                Code::InvalidArgument,
+                "the key is empty",
+            )));
+        }
+        Err(why) => return Ok(Err(why)),
     };
-    let denied = ("AccessDenied", "the credential may not delete this key");
+    let denied = || Refusal::new(Code::AccessDenied);
     if !admitted(authz, accounts::Action::Write, &segs) {
-        return Ok(Err(denied));
+        return Ok(Err(denied()));
     }
     Ok(
         match delete_one(store, namespace, authz, &segs, conditions)? {
             Deleted::Gone => Ok(()),
-            Deleted::Denied => Err(denied),
-            Deleted::Foreign => Err(("OperationAborted", unwritable_message(Unwritable::Foreign))),
-            Deleted::Absent => Err(("NoSuchKey", "The specified key does not exist.")),
-            Deleted::Failed => Err(("PreconditionFailed", conditional::PRECONDITION_FAILED)),
+            Deleted::Denied => Err(denied()),
+            Deleted::Foreign => Err(Refusal::said(
+                Code::OperationAborted,
+                unwritable_message(Unwritable::Foreign),
+            )),
+            Deleted::Absent => Err(Refusal::new(Code::NoSuchKey)),
+            Deleted::Failed => Err(Refusal::new(Code::PreconditionFailed)),
         },
     )
 }
@@ -167,27 +173,24 @@ fn delete_key(
 /// Why `entry` is refused before its key is looked at: a version this registry does not
 /// keep, an empty `ETag`, or a condition on a version, which S3 applies to the current
 /// object only.
-fn refused(entry: &Entry) -> Option<KeyError> {
+fn refused(entry: &Entry) -> Option<Refusal> {
     let conditions = &entry.conditions;
     if conditions
         .etag
         .as_deref()
         .is_some_and(|e| e.trim().is_empty())
     {
-        return Some((
-            "InvalidArgument",
+        return Some(Refusal::said(
+            Code::InvalidArgument,
             "The value provided for the ETag field cannot be empty for this API.",
         ));
     }
     match entry.version.as_deref() {
-        Some(_) if !conditions.is_empty() => Some((
-            "NotImplemented",
+        Some(_) if !conditions.is_empty() => Some(Refusal::said(
+            Code::NotImplemented,
             "A form field you provided implies functionality that is not implemented",
         )),
-        Some(v) if v != NULL_VERSION => Some((
-            "NotImplemented",
-            "this registry keeps no versions: a key's one VersionId is null",
-        )),
+        Some(v) if v != NULL_VERSION => Some(Refusal::new(Code::NotImplemented)),
         _ => None,
     }
 }
@@ -203,26 +206,21 @@ pub(super) async fn delete(
     ctx: &Ctx,
 ) -> Result<Response<Body>> {
     let (parts, body) = req.into_parts();
-    let too_long = ctx.error(
-        StatusCode::BAD_REQUEST,
-        "MalformedXML",
-        "a Delete document is at most 1 MiB",
-    );
+    let too_long = ctx.error(Code::MalformedXML);
     let body = match read_small(body, MAX_DOCUMENT, too_long, ctx).await? {
         Ok(body) => body,
         Err(resp) => return Ok(resp),
     };
-    if let Err((status, code, message)) = check_body(&parts.headers, &body) {
-        return Ok(ctx.error(status, code, message));
+    if let Err(why) = check_body(&parts.headers, &body) {
+        return Ok(ctx.error(why));
     }
     let asked = match document(&body) {
         Ok(asked) => asked,
-        Err(Refused::Malformed(why)) => {
-            return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why));
-        }
+        // What is wrong with it is S3's to say in its own words.
+        Err(Refused::Malformed(_)) => return Ok(ctx.error(Code::MalformedXML)),
         Err(Refused::Date(date)) => {
             let message = format!("Invalid value for date attribute: {date}");
-            return Ok(ctx.error(StatusCode::BAD_REQUEST, "InvalidRequest", &message));
+            return Ok(ctx.error(Refusal::saying(Code::InvalidRequest, message)));
         }
     };
     let id = ctx.id.clone();
@@ -241,10 +239,7 @@ pub(super) async fn delete(
                             "vk-registry: S3 request {id} could not delete {:?}: {e:#}",
                             entry.key
                         );
-                        Err((
-                            "InternalError",
-                            "the server could not delete this key; its log names this request id",
-                        ))
+                        Err(Refusal::new(Code::InternalError))
                     })
             };
             let version = entry
@@ -258,11 +253,11 @@ pub(super) async fn delete(
                     "<Deleted>{}{version}</Deleted>",
                     xml::element("Key", &entry.key)
                 )),
-                Err((code, message)) => out.push_str(&format!(
+                Err(why) => out.push_str(&format!(
                     "<Error>{}{version}{}{}</Error>",
                     xml::element("Key", &entry.key),
-                    xml::element("Code", code),
-                    xml::element("Message", message)
+                    xml::element("Code", why.code.name()),
+                    xml::element("Message", why.message())
                 )),
             }
         }
@@ -334,15 +329,21 @@ mod tests {
         assert_eq!(asked.entries[0].conditions, conditions("\"x\"", Some(13)));
         assert_eq!(asked.entries[1].conditions, conditions("", None));
         // An empty ETag is that key's error; a condition on a version is not served.
-        assert_eq!(refused(&asked.entries[1]).unwrap().0, "InvalidArgument");
+        assert_eq!(
+            refused(&asked.entries[1]).unwrap().code,
+            Code::InvalidArgument
+        );
         assert!(refused(&asked.entries[0]).is_none());
         let versioned = Entry {
             version: Some("null".into()),
             ..asked.entries.into_iter().next().unwrap()
         };
-        assert_eq!(refused(&versioned).unwrap().0, "NotImplemented");
+        assert_eq!(refused(&versioned).unwrap().code, Code::NotImplemented);
         assert!(refused(&entry("k", Some("null"))).is_none());
-        assert_eq!(refused(&entry("k", Some("v"))).unwrap().0, "NotImplemented");
+        assert_eq!(
+            refused(&entry("k", Some("v"))).unwrap().code,
+            Code::NotImplemented
+        );
     }
 
     #[test]
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index f72196f9..dc3b8d01 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -10,6 +10,7 @@ use hyper::header::{AUTHORIZATION, CONTENT_LENGTH, HeaderValue, LOCATION, RETRY_
 use hyper::{Request, Response, StatusCode};
 
 use super::canned::Canned;
+use super::error::{Code, Refusal};
 use super::xml::scan;
 use super::{Ctx, drain, read_small, refuse, sigv4, xml};
 use crate::files::{self, DELETE_LOCK_WAIT, FILES_REPO, allowed};
@@ -38,11 +39,10 @@ pub(super) async fn list(
     ctx: &Ctx,
 ) -> anyhow::Result<Response<Body>> {
     if !crate::dav::may_enumerate(state) {
-        let resp = ctx.error(
-            StatusCode::FORBIDDEN,
-            "AccessDenied",
+        let resp = ctx.error(Refusal::said(
+            Code::AccessDenied,
             "listing the buckets needs a configured credential",
-        );
+        ));
         return refuse(req, resp, ctx).await;
     }
     crate::dav::blocking(state, authz, move |store, authz| {
@@ -70,6 +70,11 @@ pub(super) async fn list(
     .await
 }
 
+/// `NoSuchBucket`, naming `bucket`.
+pub(super) fn no_such_bucket(bucket: &str) -> Refusal {
+    Refusal::new(Code::NoSuchBucket).with("BucketName", bucket)
+}
+
 /// Whether `bucket` is there for this caller: `Err` with the answer when it is not — 403 when
 /// the caller may read nothing in the bucket, 404 `NoSuchBucket` when it may but no such
 /// directory exists. A caller that may read only a directory inside the bucket passes, since
@@ -86,13 +91,7 @@ async fn check(
     }
     let store = std::sync::Arc::clone(&state.store);
     let exists = tokio::task::spawn_blocking(move || store.repo_dir_exists(&repo)).await?;
-    Ok((!exists).then(|| {
-        ctx.error(
-            StatusCode::NOT_FOUND,
-            "NoSuchBucket",
-            "the specified bucket does not exist",
-        )
-    }))
+    Ok((!exists).then(|| ctx.error(no_such_bucket(bucket))))
 }
 
 /// `HEAD /s3/<bucket>`.
@@ -130,7 +129,7 @@ pub(super) async fn location(
         .headers()
         .get(AUTHORIZATION)
         .and_then(|v| v.to_str().ok())
-        .and_then(|v| sigv4::parse_authorization(v).ok())
+        .and_then(|v| sigv4::parse_authorization(v, "s3").ok())
         .map_or(String::new(), |c| xml::escape(c.region));
     Ok(xml::document("LocationConstraint", &region))
 }
@@ -148,7 +147,7 @@ pub(super) async fn configuration(
     if let Some(resp) = check(state, authz, &bucket, ctx).await? {
         return refuse(req, resp, ctx).await;
     }
-    refuse(req, canned.answer(ctx), ctx).await
+    refuse(req, canned.answer(&bucket, ctx), ctx).await
 }
 
 /// Longest `CreateBucketConfiguration` body taken: it names a region, which is ignored.
@@ -176,14 +175,12 @@ pub(super) async fn create(
         .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"true"))
     {
         let resp = ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "this registry keeps no object lock",
+            Refusal::new(Code::NotImplemented).with("Header", "x-amz-bucket-object-lock-enabled"),
         );
         return refuse(req, resp, ctx).await;
     }
-    let malformed = |message| ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", message);
-    let too_long = malformed("a CreateBucketConfiguration is at most 1 KiB");
+    let malformed = || ctx.error(Code::MalformedXML);
+    let too_long = malformed();
     let body = match read_small(req.into_body(), MAX_CONFIGURATION, too_long, ctx).await? {
         Ok(body) => body,
         Err(resp) => return Ok(resp),
@@ -191,24 +188,21 @@ pub(super) async fn create(
     if !body.iter().all(u8::is_ascii_whitespace)
         && !scan::parse(&body, 16).is_ok_and(|el| el.name == "CreateBucketConfiguration")
     {
-        return Ok(malformed("the body is not a CreateBucketConfiguration"));
+        return Ok(malformed());
     }
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, _| {
         let _namespace = files::namespace(store)?;
         if store.repo_dir_exists(&repo) {
-            return Ok(ctx.error(
-                StatusCode::CONFLICT,
-                "BucketAlreadyOwnedByYou",
-                "the bucket you tried to create exists, and is yours",
-            ));
+            return Ok(
+                ctx.error(Refusal::new(Code::BucketAlreadyOwnedByYou).with("BucketName", bucket))
+            );
         }
         if store.repo_path_taken(&repo) {
-            return Ok(ctx.error(
-                StatusCode::CONFLICT,
-                "OperationAborted",
+            return Ok(ctx.error(Refusal::said(
+                Code::OperationAborted,
                 "something that is not a directory has the bucket's name in the store",
-            ));
+            )));
         }
         store.create_repo(&repo)?;
         Ok(Response::builder()
@@ -260,28 +254,24 @@ pub(super) async fn delete(
         loop {
             let namespace = files::namespace(store)?;
             if !store.repo_dir_exists(&repo) {
-                return Ok(ctx.error(
-                    StatusCode::NOT_FOUND,
-                    "NoSuchBucket",
-                    "the specified bucket does not exist",
-                ));
+                return Ok(ctx.error(no_such_bucket(&bucket)));
             }
-            let not_empty = |message| ctx.error(StatusCode::CONFLICT, "BucketNotEmpty", message);
+            let not_empty = |r: Refusal| ctx.error(r.with("BucketName", bucket.as_str()));
             return Ok(match remove_tree(store, &repo)? {
                 RepoRemoval::Removed => Response::builder()
                     .status(StatusCode::NO_CONTENT)
                     .body(body_of(bytes::Bytes::new()))?,
-                RepoRemoval::HasMembers => not_empty("the bucket you tried to delete is not empty"),
-                RepoRemoval::HasRecords => not_empty(
+                RepoRemoval::HasMembers => not_empty(Refusal::new(Code::BucketNotEmpty)),
+                RepoRemoval::HasRecords => not_empty(Refusal::said(
+                    Code::BucketNotEmpty,
                     "the bucket holds content written lately that is not a deleted object's, \
                      such as an image pushed over /v2/; it can go once the gc's grace has passed",
-                ),
+                )),
                 RepoRemoval::Busy if Instant::now() >= deadline => {
-                    let mut resp = ctx.error(
-                        StatusCode::SERVICE_UNAVAILABLE,
-                        "ServiceUnavailable",
+                    let mut resp = ctx.error(Refusal::said(
+                        Code::ServiceUnavailable,
                         "the store stayed locked; retry the DeleteBucket",
-                    );
+                    ));
                     resp.headers_mut()
                         .insert(RETRY_AFTER, HeaderValue::from_static("5"));
                     resp
diff --git a/vk-registry/src/s3/canned.rs b/vk-registry/src/s3/canned.rs
index 5ebead4e..b220c6e9 100644
--- a/vk-registry/src/s3/canned.rs
+++ b/vk-registry/src/s3/canned.rs
@@ -4,11 +4,11 @@
 //! set here: a `PUT` or `DELETE` of any of them is `NotImplemented`, and so is a request
 //! whose headers ask for one on the object or bucket it writes ([`asked`]).
 
+use hyper::Response;
 use hyper::header::HeaderMap;
-use hyper::{Response, StatusCode};
 
 use super::bucket::{OWNER, owner};
-use super::object::Refused;
+use super::error::{Code, Refusal};
 use super::xml;
 
 /// What a configuration read answers.
@@ -16,19 +16,15 @@ pub(super) enum Canned {
     /// a 200 document: its root element and what it holds
     Document(&'static str, String),
     /// a 404: S3's code for "none configured"
-    Missing(&'static str),
+    Missing(Code),
 }
 
 impl Canned {
-    /// The answer, at `ctx`'s path.
-    pub(super) fn answer(self, ctx: &super::Ctx) -> Response<crate::Body> {
+    /// The answer, at `ctx`'s path, for `bucket`.
+    pub(super) fn answer(self, bucket: &str, ctx: &super::Ctx) -> Response<crate::Body> {
         match self {
             Canned::Document(root, inner) => xml::document(root, &inner),
-            Canned::Missing(code) => ctx.error(
-                StatusCode::NOT_FOUND,
-                code,
-                "this registry keeps no such configuration",
-            ),
+            Canned::Missing(code) => ctx.error(Refusal::new(code).with("BucketName", bucket)),
         }
     }
 }
@@ -68,15 +64,15 @@ pub(super) fn bucket(sub: &str) -> Option<Canned> {
             xml::element("Payer", "BucketOwner"),
         ),
         "accelerate" => empty("AccelerateConfiguration"),
-        "lifecycle" => Canned::Missing("NoSuchLifecycleConfiguration"),
-        "policy" | "policyStatus" => Canned::Missing("NoSuchBucketPolicy"),
-        "cors" => Canned::Missing("NoSuchCORSConfiguration"),
-        "encryption" => Canned::Missing("ServerSideEncryptionConfigurationNotFoundError"),
-        "object-lock" => Canned::Missing("ObjectLockConfigurationNotFoundError"),
-        "replication" => Canned::Missing("ReplicationConfigurationNotFoundError"),
-        "website" => Canned::Missing("NoSuchWebsiteConfiguration"),
-        "publicAccessBlock" => Canned::Missing("NoSuchPublicAccessBlockConfiguration"),
-        "ownershipControls" => Canned::Missing("OwnershipControlsNotFoundError"),
+        "lifecycle" => Canned::Missing(Code::NoSuchLifecycleConfiguration),
+        "policy" | "policyStatus" => Canned::Missing(Code::NoSuchBucketPolicy),
+        "cors" => Canned::Missing(Code::NoSuchCORSConfiguration),
+        "encryption" => Canned::Missing(Code::ServerSideEncryptionConfigurationNotFoundError),
+        "object-lock" => Canned::Missing(Code::ObjectLockConfigurationNotFoundError),
+        "replication" => Canned::Missing(Code::ReplicationConfigurationNotFoundError),
+        "website" => Canned::Missing(Code::NoSuchWebsiteConfiguration),
+        "publicAccessBlock" => Canned::Missing(Code::NoSuchPublicAccessBlockConfiguration),
+        "ownershipControls" => Canned::Missing(Code::OwnershipControlsNotFoundError),
         _ => return None,
     })
 }
@@ -112,32 +108,19 @@ const STORAGE_CLASSES: [&str; 10] = [
 /// copy's source too), object tags, an ACL other than the one every object has, a grant, a
 /// storage class other than `STANDARD`, a website redirect and object lock are
 /// `NotImplemented`; a storage class S3 does not have is `InvalidStorageClass`.
-pub(super) fn asked(headers: &HeaderMap) -> Option<Refused> {
-    let not_implemented = |message| (StatusCode::NOT_IMPLEMENTED, "NotImplemented", message);
+pub(super) fn asked(headers: &HeaderMap) -> Option<Refusal> {
+    // AWS names the header a NotImplemented is about.
+    let not_implemented = |header: &str| Refusal::new(Code::NotImplemented).with("Header", header);
     for name in headers.keys() {
         let name = name.as_str();
-        if name.contains("server-side-encryption") {
-            return Some(not_implemented(
-                "this registry stores objects unencrypted and takes no encryption key: send \
-                 no x-amz-server-side-encryption header",
-            ));
-        }
         // No tags at all is what every object has.
-        if name == "x-amz-tagging" && headers.get_all(name).iter().any(|v| !v.is_empty()) {
-            return Some(not_implemented("this registry keeps no object tags"));
-        }
-        if name.starts_with("x-amz-grant-") {
-            return Some(not_implemented(
-                "this registry keeps no ACL but the owner's: send no x-amz-grant header",
-            ));
-        }
-        if name.starts_with("x-amz-object-lock-") {
-            return Some(not_implemented("this registry keeps no object lock"));
-        }
-        if name == "x-amz-website-redirect-location" {
-            return Some(not_implemented(
-                "this registry keeps no website configuration",
-            ));
+        if name.contains("server-side-encryption")
+            || (name == "x-amz-tagging" && headers.get_all(name).iter().any(|v| !v.is_empty()))
+            || name.starts_with("x-amz-grant-")
+            || name.starts_with("x-amz-object-lock-")
+            || name == "x-amz-website-redirect-location"
+        {
+            return Some(not_implemented(name));
         }
     }
     // The ACL every object and bucket has, by either of its names, asks for nothing new.
@@ -146,10 +129,7 @@ pub(super) fn asked(headers: &HeaderMap) -> Option<Refused> {
         .iter()
         .any(|v| !matches!(v.as_bytes(), b"private" | b"bucket-owner-full-control"))
     {
-        return Some(not_implemented(
-            "this registry keeps no ACL but the owner's: x-amz-acl is private, \
-             bucket-owner-full-control or absent",
-        ));
+        return Some(not_implemented("x-amz-acl"));
     }
     for value in headers.get_all("x-amz-storage-class") {
         let class = value.to_str().unwrap_or_default();
@@ -157,15 +137,9 @@ pub(super) fn asked(headers: &HeaderMap) -> Option<Refused> {
             continue;
         }
         if STORAGE_CLASSES.contains(&class) {
-            return Some(not_implemented(
-                "this registry stores every object as STANDARD",
-            ));
+            return Some(not_implemented("x-amz-storage-class"));
         }
-        return Some((
-            StatusCode::BAD_REQUEST,
-            "InvalidStorageClass",
-            "the storage class you specified is not valid",
-        ));
+        return Some(Refusal::new(Code::InvalidStorageClass).with("StorageClassRequested", class));
     }
     None
 }
@@ -221,7 +195,7 @@ mod tests {
                     hyper::header::HeaderValue::from_str(v).unwrap(),
                 );
             }
-            asked(&h).map(|(status, code, _)| (status.as_u16(), code))
+            asked(&h).map(|r| (r.code.status().as_u16(), r.code.name()))
         };
         assert_eq!(of(&[]), None);
         assert_eq!(
@@ -273,6 +247,18 @@ mod tests {
                 "{bad:?}"
             );
         }
+        // A refusal names the header, and says what AWS says.
+        let mut h = HeaderMap::new();
+        h.insert(
+            "x-amz-grant-read",
+            hyper::header::HeaderValue::from_static("id=x"),
+        );
+        let r = asked(&h).unwrap();
+        assert_eq!(r.element("Header"), Some("x-amz-grant-read"));
+        assert_eq!(
+            r.message(),
+            "A header you provided implies functionality that is not implemented"
+        );
         // Checked in that order: a refusal names the first thing asked for.
         assert_eq!(
             of(&[("x-amz-acl", "public-read"), ("x-amz-storage-class", "x")]),
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index 17b6dcb3..a1f2676f 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -11,6 +11,7 @@ use std::collections::BTreeMap;
 use hyper::header::{HeaderName, HeaderValue};
 use sha2::Digest as _;
 
+use super::error::{Code, Refusal};
 use super::xml;
 
 /// The manifest annotation holding an object's checksum: S3's name of the algorithm, a
@@ -44,15 +45,10 @@ pub(super) const SDK_ALGORITHM: &str = "x-amz-sdk-checksum-algorithm";
 /// The refusal of a checksum in an algorithm not computed here (S3's XXHASH64, XXHASH3 and
 /// XXHASH128, or anything else), rather than the checksum taken unchecked and the object
 /// then listed without it.
-pub(super) const NOT_COMPUTED: super::object::Refused = (
-    hyper::StatusCode::NOT_IMPLEMENTED,
-    "NotImplemented",
-    "the checksum algorithms this registry computes are CRC32, CRC32C, SHA1, SHA256, \
-     CRC64NVME, SHA512 and MD5",
-);
+pub(super) const NOT_COMPUTED: Refusal = Refusal::new(Code::NotImplemented);
 
 /// The refusal of a checksum that did not hold, as S3 words it, naming the algorithm.
-pub(super) fn mismatch(header: &str) -> super::object::Refused {
+pub(super) fn mismatch(header: &str) -> Refusal {
     let message = match header {
         "x-amz-checksum-crc32" => "The CRC32 you specified did not match the calculated checksum.",
         "x-amz-checksum-crc32c" => {
@@ -70,16 +66,31 @@ pub(super) fn mismatch(header: &str) -> super::object::Refused {
         }
         _ => "The MD5 you specified did not match the calculated checksum.",
     };
-    (hyper::StatusCode::BAD_REQUEST, "BadDigest", message)
+    Refusal::said(Code::BadDigest, message)
 }
 
 /// The refusal of a [`SDK_ALGORITHM`] naming an algorithm other than the checksum header's.
-pub(super) const ALGORITHM_MISMATCH: super::object::Refused = (
-    hyper::StatusCode::BAD_REQUEST,
-    "InvalidRequest",
+pub(super) const ALGORITHM_MISMATCH: Refusal = Refusal::said(
+    Code::InvalidRequest,
     "Value for x-amz-sdk-checksum-algorithm header is invalid.",
 );
 
+/// The refusal of checksum header `name` when it is not a checksum in base64, as S3 words it.
+pub(super) fn invalid(name: &str) -> Refusal {
+    Refusal::saying(
+        Code::InvalidRequest,
+        format!("Value for {name} header is invalid."),
+    )
+}
+
+/// [`invalid`] for the checksum `name` a trailer carries.
+pub(super) fn invalid_trailing(name: &str) -> Refusal {
+    Refusal::saying(
+        Code::InvalidRequest,
+        format!("Value for {name} trailing header is invalid."),
+    )
+}
+
 /// Whether `headers` name a checksum, by header or by [`SDK_ALGORITHM`], in an algorithm
 /// not computed here.
 pub(super) fn not_computed(headers: &hyper::header::HeaderMap) -> bool {
@@ -311,7 +322,11 @@ mod tests {
         assert!(of(&[(SDK_ALGORITHM, "XXHASH3")]));
         assert!(of(&[(SDK_ALGORITHM, "")]));
         for (header, name, _) in ALGORITHMS {
-            assert!(mismatch(header).2.starts_with(&format!("The {name} you")));
+            assert!(
+                mismatch(header)
+                    .message()
+                    .starts_with(&format!("The {name} you"))
+            );
         }
     }
 
diff --git a/vk-registry/src/s3/chunked.rs b/vk-registry/src/s3/chunked.rs
index 98f1f9ed..18482a06 100644
--- a/vk-registry/src/s3/chunked.rs
+++ b/vk-registry/src/s3/chunked.rs
@@ -22,10 +22,10 @@ use std::pin::Pin;
 use std::task::{Context, Poll, ready};
 
 use bytes::{Buf as _, Bytes};
-use hyper::StatusCode;
 use hyper::body::{Body, Frame};
 use sha2::{Digest as _, Sha256};
 
+use super::error::Code;
 use super::sigv4::{self, SigningKey};
 
 /// The longest chunk header taken, its CRLF included: a size and a signature need 91.
@@ -142,11 +142,11 @@ fn trailer_string_to_sign(stamp: &str, scope: &str, previous: &str, lines_sha256
     )
 }
 
-/// Why a chunked body was refused: the S3 answer to it.
+/// Why a chunked body was refused: the S3 code it is answered with, and what was wrong with
+/// it, which the answer leaves to the code's own message.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) struct Refusal {
-    pub(crate) status: StatusCode,
-    pub(crate) code: &'static str,
+    pub(crate) code: Code,
     pub(crate) message: &'static str,
 }
 
@@ -154,8 +154,7 @@ impl Refusal {
     /// A chunk header that is malformed, too long, or sizes a chunk past the declared length.
     fn size(message: &'static str) -> Self {
         Refusal {
-            status: StatusCode::BAD_REQUEST,
-            code: "InvalidChunkSizeError",
+            code: Code::InvalidChunkSizeError,
             message,
         }
     }
@@ -163,8 +162,7 @@ impl Refusal {
     /// A body that ends early, or holds other than the declared length.
     fn incomplete(message: &'static str) -> Self {
         Refusal {
-            status: StatusCode::BAD_REQUEST,
-            code: "IncompleteBody",
+            code: Code::IncompleteBody,
             message,
         }
     }
@@ -172,8 +170,7 @@ impl Refusal {
     /// A trailer section that is malformed, too long, or followed by anything.
     fn trailer(message: &'static str) -> Self {
         Refusal {
-            status: StatusCode::BAD_REQUEST,
-            code: "MalformedTrailerError",
+            code: Code::MalformedTrailerError,
             message,
         }
     }
@@ -181,13 +178,18 @@ impl Refusal {
     /// A chunk or trailer signature that is not the seed's key's.
     fn signature(message: &'static str) -> Self {
         Refusal {
-            status: StatusCode::FORBIDDEN,
-            code: "SignatureDoesNotMatch",
+            code: Code::SignatureDoesNotMatch,
             message,
         }
     }
 }
 
+impl From<Refusal> for super::error::Refusal {
+    fn from(r: Refusal) -> Self {
+        super::error::Refusal::new(r.code)
+    }
+}
+
 /// Why a [`Decoder`] stopped: its framing was refused, or the body under it failed.
 #[derive(Debug)]
 pub(crate) enum Error {
@@ -769,13 +771,13 @@ mod tests {
             decode(other.as_bytes(), 64, framing, Some(seed(chunk2)))
                 .unwrap_err()
                 .code,
-            "SignatureDoesNotMatch"
+            Code::SignatureDoesNotMatch
         );
         assert_eq!(
             decode(tail.as_bytes(), 64, framing, Some(seed(SEED)))
                 .unwrap_err()
                 .code,
-            "SignatureDoesNotMatch"
+            Code::SignatureDoesNotMatch
         );
         // Without a seed the trailer is read, its signature not checked.
         let (_, trailer) = decode(other.as_bytes(), 64, framing, None).unwrap();
@@ -812,15 +814,15 @@ mod tests {
         let t = unsigned_trailer(1);
         assert_eq!(
             code("1\r\na\r\n0\r\nx-amz-checksum-sha1:x\r\n\r\n", t),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
-        assert_eq!(code("1\r\na\r\n0\r\n\r\n", t), "MalformedTrailerError");
+        assert_eq!(code("1\r\na\r\n0\r\n\r\n", t), Code::MalformedTrailerError);
         assert_eq!(
             code(
                 "1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\nx-amz-checksum-crc32:a\r\n\r\n",
                 t
             ),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
         let sig = format!("x-amz-trailer-signature:{FINAL}");
         assert_eq!(
@@ -828,11 +830,11 @@ mod tests {
                 &format!("1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\n{sig}\r\n\r\n"),
                 t
             ),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
         assert_eq!(
             code(&format!("1;chunk-signature={FINAL}\r\na\r\n0\r\n\r\n"), t),
-            "InvalidChunkSizeError"
+            Code::InvalidChunkSizeError
         );
         // A plain aws-chunked body has no trailer.
         let plain = Framing {
@@ -846,7 +848,7 @@ mod tests {
         );
         assert_eq!(
             code("1\r\na\r\n0\r\nx-amz-checksum-crc32:a\r\n\r\n", plain),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
     }
 
@@ -859,19 +861,19 @@ mod tests {
         };
         let code = |body: String| decode(body.as_bytes(), 8, framing, None).unwrap_err().code;
         let zero = format!("0;chunk-signature={FINAL}\r\n");
-        assert_eq!(code(format!("{zero}\r\n")), "MalformedTrailerError");
+        assert_eq!(code(format!("{zero}\r\n")), Code::MalformedTrailerError);
         let sig = format!("x-amz-trailer-signature:{FINAL}\r\n");
         assert!(decode(format!("{zero}{sig}\r\n").as_bytes(), 8, framing, None).is_ok());
         assert_eq!(
             code(format!("{zero}{sig}{sig}\r\n")),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
         assert_eq!(
             code(format!(
                 "{zero}x-amz-trailer-signature:{}\r\n\r\n",
                 FINAL.to_uppercase()
             )),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
     }
 
@@ -883,12 +885,12 @@ mod tests {
             flipped.replace_range(..1, if wrong.starts_with('0') { "1" } else { "0" });
             let mutated = body.replace(wrong, &flipped);
             let r = decode(mutated.as_bytes(), 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
-            assert_eq!(r.code, "SignatureDoesNotMatch", "{wrong}");
-            assert_eq!(r.status, StatusCode::FORBIDDEN);
+            assert_eq!(r.code, Code::SignatureDoesNotMatch, "{wrong}");
+            assert_eq!(r.code.status(), hyper::StatusCode::FORBIDDEN);
         }
         // Another seed: another chain.
         let r = decode(body.as_bytes(), 4096, signed(66_560), Some(seed(CHUNK1))).unwrap_err();
-        assert_eq!(r.code, "SignatureDoesNotMatch");
+        assert_eq!(r.code, Code::SignatureDoesNotMatch);
     }
 
     #[test]
@@ -902,14 +904,20 @@ mod tests {
             decode(body, 3, framing, None).unwrap_err().code
         };
         // Past the declared length, short of it, or not the length a size says.
-        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 4), "InvalidChunkSizeError");
-        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 6), "IncompleteBody");
-        assert_eq!(code(b"4\r\nhello\r\n0\r\n\r\n", 5), "IncompleteBody");
+        assert_eq!(
+            code(b"5\r\nhello\r\n0\r\n\r\n", 4),
+            Code::InvalidChunkSizeError
+        );
+        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 6), Code::IncompleteBody);
+        assert_eq!(code(b"4\r\nhello\r\n0\r\n\r\n", 5), Code::IncompleteBody);
         assert_eq!(
             code(b"ffffffffffffffff\r\nhello\r\n0\r\n\r\n", 5),
-            "InvalidChunkSizeError"
+            Code::InvalidChunkSizeError
+        );
+        assert_eq!(
+            code(b"10000000000000000\r\n", 5),
+            Code::InvalidChunkSizeError
         );
-        assert_eq!(code(b"10000000000000000\r\n", 5), "InvalidChunkSizeError");
         // Sizes in hex only.
         for bad in [
             &b"x\r\n"[..],
@@ -918,7 +926,7 @@ mod tests {
             b" 5\r\nhello\r\n",
             b"+5\r\nhello\r\n",
         ] {
-            assert_eq!(code(bad, 5), "InvalidChunkSizeError", "{bad:?}");
+            assert_eq!(code(bad, 5), Code::InvalidChunkSizeError, "{bad:?}");
         }
         let plain = Framing {
             mode: Mode::Unsigned,
@@ -942,28 +950,31 @@ mod tests {
             message(&pad(256))
         );
         assert!(message(&pad(257)).contains("256"));
-        assert_eq!(code(&pad(300), 1), "InvalidChunkSizeError");
+        assert_eq!(code(&pad(300), 1), Code::InvalidChunkSizeError);
         // A header whose LF never comes is refused at the bound, not read further.
         let mut endless = vec![b'0'; 10_000];
         endless.insert(0, b'1');
-        assert_eq!(code(&endless, 1), "InvalidChunkSizeError");
+        assert_eq!(code(&endless, 1), Code::InvalidChunkSizeError);
         // LF without CR, or data not followed by CRLF.
-        assert_eq!(code(b"5\nhello\r\n0\r\n\r\n", 5), "InvalidChunkSizeError");
-        assert_eq!(code(b"5\r\nhello\n0\r\n\r\n", 5), "IncompleteBody");
-        assert_eq!(code(b"5\r\nhelloXY0\r\n\r\n", 5), "IncompleteBody");
+        assert_eq!(
+            code(b"5\nhello\r\n0\r\n\r\n", 5),
+            Code::InvalidChunkSizeError
+        );
+        assert_eq!(code(b"5\r\nhello\n0\r\n\r\n", 5), Code::IncompleteBody);
+        assert_eq!(code(b"5\r\nhelloXY0\r\n\r\n", 5), Code::IncompleteBody);
         // Anything after the end.
         assert_eq!(
             code(b"5\r\nhello\r\n0\r\n\r\n\r\n", 5),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
         assert_eq!(
             code(b"5\r\nhello\r\n0\r\n\r\nx", 5),
-            "MalformedTrailerError"
+            Code::MalformedTrailerError
         );
         let mut garbage = example();
         garbage.push(b'x');
         let r = decode(&garbage, 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
-        assert_eq!(r.code, "MalformedTrailerError");
+        assert_eq!(r.code, Code::MalformedTrailerError);
     }
 
     #[test]
@@ -975,7 +986,7 @@ mod tests {
         ]);
         for cut in cuts {
             let r = decode(&body[..cut], 4096, signed(66_560), Some(seed(SEED))).unwrap_err();
-            assert_eq!(r.code, "IncompleteBody", "{cut}");
+            assert_eq!(r.code, Code::IncompleteBody, "{cut}");
         }
     }
 
@@ -994,7 +1005,7 @@ mod tests {
         assert_eq!(ok.1.map(|v| v.len()), Some(MAX_TRAILER - 2 - 23));
         for len in [MAX_TRAILER - 1, MAX_TRAILER, 100_000] {
             let r = decode(body(len).as_bytes(), 512, unsigned_trailer(1), None).unwrap_err();
-            assert_eq!(r.code, "MalformedTrailerError", "{len}");
+            assert_eq!(r.code, Code::MalformedTrailerError, "{len}");
         }
     }
 
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index 1d1dc882..6d0463fa 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -7,8 +7,11 @@
 use std::collections::BTreeMap;
 use std::time::{Duration, SystemTime};
 
-use hyper::header::{HeaderMap, IF_MATCH, IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_UNMODIFIED_SINCE};
+use hyper::header::{
+    HeaderMap, HeaderName, IF_MATCH, IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_UNMODIFIED_SINCE,
+};
 
+use super::error::{Code, Refusal};
 use crate::files::{Object, Precondition};
 
 /// The manifest annotation holding an S3-written object's MD5, as lowercase hex; for an
@@ -173,23 +176,36 @@ pub(crate) struct WriteConditions {
     pub(crate) if_match: Option<String>,
 }
 
-/// Why a write's conditional headers are not served: an `If-None-Match` other than `*`.
-pub(crate) struct Unsupported;
+/// Why a write's `header` is not served, as S3 says it: an `If-None-Match` other than `*`,
+/// or a value that is not text.
+pub(crate) fn unsupported(header: &HeaderName) -> Refusal {
+    let name = if *header == IF_NONE_MATCH {
+        "If-None-Match"
+    } else {
+        "If-Match"
+    };
+    Refusal::new(Code::NotImplemented)
+        .with("Header", name)
+        .with(
+            "additionalMessage",
+            format!("We don't accept the provided value of {name} header for this API"),
+        )
+}
 
 impl WriteConditions {
-    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, Unsupported> {
-        let text = |name| {
+    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, Refusal> {
+        let text = |name: HeaderName| {
             let values: Vec<&str> = headers
-                .get_all(name)
+                .get_all(&name)
                 .iter()
-                .map(|v| v.to_str().map_err(|_| Unsupported))
+                .map(|v| v.to_str().map_err(|_| unsupported(&name)))
                 .collect::<Result<_, _>>()?;
-            Ok((!values.is_empty()).then(|| values.join(",")))
+            Ok::<_, Refusal>((!values.is_empty()).then(|| values.join(",")))
         };
         let absent = match text(IF_NONE_MATCH)? {
             None => false,
             Some(v) if v.trim() == "*" => true,
-            Some(_) => return Err(Unsupported),
+            Some(_) => return Err(unsupported(&IF_NONE_MATCH)),
         };
         Ok(WriteConditions {
             absent,
@@ -212,10 +228,6 @@ impl WriteConditions {
     }
 }
 
-/// What S3 says when a precondition does not hold.
-pub(crate) const PRECONDITION_FAILED: &str =
-    "At least one of the pre-conditions you specified did not hold";
-
 /// The header a DeleteObject names the object's modification time in.
 pub(crate) const IF_MATCH_LAST_MODIFIED: &str = "x-amz-if-match-last-modified-time";
 
@@ -238,30 +250,38 @@ pub(crate) struct DeleteConditions {
 }
 
 impl DeleteConditions {
-    /// The conditions DeleteObject's headers carry; the reason for a 400 when one is not a
+    /// The conditions DeleteObject's headers carry; 400 `InvalidArgument` when one is not a
     /// value its header takes.
-    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, &'static str> {
-        let text = |name: &str| match headers.get(name) {
+    pub(crate) fn of(headers: &HeaderMap) -> Result<Self, Refusal> {
+        let text = |name: &'static str| match headers.get(name) {
             None => Ok(None),
-            Some(v) => v
-                .to_str()
-                .map(|v| Some(v.to_string()))
-                .map_err(|_| "a conditional header is not text"),
+            Some(v) => v.to_str().map(|v| Some(v.to_string())).map_err(|_| {
+                Refusal::said(Code::InvalidArgument, "a conditional header is not text")
+                    .with("ArgumentName", name)
+            }),
         };
         let modified = match text(IF_MATCH_LAST_MODIFIED)? {
             None => None,
-            Some(v) => Some(
-                parse_time(&v)
-                    .map(whole_seconds)
-                    .ok_or("x-amz-if-match-last-modified-time is an HTTP date")?,
-            ),
+            Some(v) => Some(parse_time(&v).map(whole_seconds).ok_or_else(|| {
+                Refusal::argument(
+                    "x-amz-if-match-last-modified-time is an HTTP date",
+                    IF_MATCH_LAST_MODIFIED,
+                    v.as_str(),
+                )
+            })?),
         };
         let size = match text(IF_MATCH_SIZE)? {
             None => None,
-            Some(v) => Some(parse_size(&v).ok_or("x-amz-if-match-size is a count of bytes")?),
+            Some(v) => Some(parse_size(&v).ok_or_else(|| {
+                Refusal::argument(
+                    "x-amz-if-match-size is a count of bytes",
+                    IF_MATCH_SIZE,
+                    v.as_str(),
+                )
+            })?),
         };
         Ok(DeleteConditions {
-            etag: text(IF_MATCH.as_str())?,
+            etag: text("if-match")?,
             modified,
             size,
         })
@@ -271,6 +291,16 @@ impl DeleteConditions {
         self.etag.is_none() && self.modified.is_none() && self.size.is_none()
     }
 
+    /// The refusal of these conditions on a version, which S3 applies to the current object
+    /// only.
+    pub(crate) fn versioned(&self) -> Refusal {
+        Refusal::new(Code::NotImplemented).with(
+            "additionalMessage",
+            "Conditional delete operations are not allowed when a version ID is included in \
+             the request parameters.",
+        )
+    }
+
     /// Whether every condition holds of `obj`: its ETag named (`*` naming any), its
     /// modification time to the second, its size.
     pub(crate) fn hold(&self, obj: &Object) -> bool {
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index 0ca7e839..f4846e53 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -9,9 +9,11 @@
 
 use anyhow::Result;
 use hyper::body::Incoming;
-use hyper::{Request, Response, StatusCode};
+use hyper::{Request, Response};
 
+use super::bucket::no_such_bucket;
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::error::{Code, Refusal};
 use super::object::{admitted, no_such_key, readable, unwritable};
 use super::{Ctx, NULL_VERSION, checksum, drain, list, meta, path, refuse, xml};
 use crate::files::{self, Commit, FILES_REPO, Written, allowed, object_of};
@@ -28,8 +30,8 @@ pub(super) enum Source {
     /// one version of an object other than its [`NULL_VERSION`], which this registry does
     /// not keep
     Versioned,
-    /// nothing this view serves: an S3 error code and the rule
-    Invalid(&'static str, &'static str),
+    /// nothing this view serves, and why
+    Invalid(Refusal),
 }
 
 /// What a copy source `value` names: `<bucket>/<key>`, with or without a leading slash, its
@@ -50,41 +52,39 @@ pub(super) fn source(value: &str) -> Source {
         return if versioned {
             Source::Versioned
         } else {
-            Source::Invalid(
-                "InvalidArgument",
+            invalid(
                 "x-amz-copy-source is <bucket>/<key>, with no query but a versionId",
+                value,
             )
         };
     }
     let Some(decoded) = crate::dav::decode_segment(raw) else {
-        return Source::Invalid(
-            "InvalidArgument",
-            "x-amz-copy-source has a malformed percent escape or is not UTF-8",
-        );
+        return invalid("Invalid copy source encoding", value);
     };
     if decoded.contains('%') {
-        return Source::Invalid(
-            "InvalidArgument",
+        return invalid(
             "a key's components are runs of A-Z a-z 0-9 . _ - only",
+            value,
         );
     }
     let decoded = decoded.strip_prefix('/').unwrap_or(&decoded);
     match path::parse(&format!("/s3/{decoded}")) {
         Ok(path::Target::Object { segs, .. }) => Source::Object(segs),
-        Ok(_) => Source::Invalid(
-            "InvalidArgument",
-            "x-amz-copy-source names a bucket and a key",
-        ),
-        Err(why) => Source::Invalid(why.code, why.message),
+        Ok(_) => invalid("Invalid copy source object key", value),
+        Err(why) if why.code == Code::InvalidBucketName => {
+            invalid("Invalid copy source bucket name", value)
+        }
+        Err(why) => Source::Invalid(why),
     }
 }
 
+/// A copy source refused as S3 refuses one: `InvalidArgument` on `x-amz-copy-source`.
+fn invalid(message: &'static str, value: &str) -> Source {
+    Source::Invalid(Refusal::argument(message, COPY_SOURCE, value))
+}
+
 pub(super) fn failed(ctx: &Ctx) -> Response<Body> {
-    ctx.error(
-        StatusCode::PRECONDITION_FAILED,
-        "PreconditionFailed",
-        "at least one of the preconditions you specified did not hold",
-    )
+    ctx.error(Code::PreconditionFailed)
 }
 
 /// The answer for a source the caller cannot read: `NoSuchBucket` when its bucket is no
@@ -97,13 +97,9 @@ pub(super) fn absent(
 ) -> Response<Body> {
     let bucket = format!("{FILES_REPO}/{}", src.first().map_or("", String::as_str));
     if authz.may_read_below(&bucket) && !store.repo_dir_exists(&bucket) {
-        return ctx.error(
-            StatusCode::NOT_FOUND,
-            "NoSuchBucket",
-            "the specified bucket does not exist",
-        );
+        return ctx.error(no_such_bucket(src.first().map_or("", String::as_str)));
     }
-    no_such_key(ctx)
+    no_such_key(ctx, src)
 }
 
 /// `PUT /s3/<bucket>/<key>` with `x-amz-copy-source`: the source object tagged again at the
@@ -128,17 +124,10 @@ pub(super) async fn copy(
     let src = match source(value) {
         Source::Object(src) => src,
         Source::Versioned => {
-            let resp = ctx.error(
-                StatusCode::NOT_IMPLEMENTED,
-                "NotImplemented",
-                "this registry keeps no versions to copy from",
-            );
-            return refuse(req, resp, ctx).await;
-        }
-        Source::Invalid(code, message) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, code, message);
+            let resp = ctx.error(Refusal::new(Code::NotImplemented).with("Header", COPY_SOURCE));
             return refuse(req, resp, ctx).await;
         }
+        Source::Invalid(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if !admitted(authz, accounts::Action::Read, &src) {
         return refuse(req, ctx.access_denied(), ctx).await;
@@ -149,43 +138,36 @@ pub(super) async fn copy(
     {
         None | Some(b"COPY") => false,
         Some(b"REPLACE") => true,
-        Some(_) => {
-            let resp = ctx.error(
-                StatusCode::BAD_REQUEST,
-                "InvalidArgument",
-                "x-amz-metadata-directive is COPY or REPLACE",
-            );
+        Some(v) => {
+            let resp = ctx.error(Refusal::argument(
+                "Unknown metadata directive.",
+                "x-amz-metadata-directive",
+                String::from_utf8_lossy(v),
+            ));
             return refuse(req, resp, ctx).await;
         }
     };
     if src == segs && !replace {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidRequest",
-            "this copy request is illegal because it is trying to copy an object to itself \
-             without changing the object's metadata",
-        );
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidRequest,
+            "This copy request is illegal because it is trying to copy an object to itself \
+             without changing the object's metadata, storage class, website redirect location \
+             or encryption attributes.",
+        ));
         return refuse(req, resp, ctx).await;
     }
     let replaced = if replace {
         match meta::annotations(headers) {
             Ok(a) => Some(a),
-            Err(why) => {
-                let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
-                return refuse(req, resp, ctx).await;
-            }
+            Err(why) => return refuse(req, ctx.error(why), ctx).await,
         }
     } else {
         None
     };
     let conditions = Conditions::of_copy_source(headers);
-    let Ok(written) = WriteConditions::of(headers) else {
-        let resp = ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "a write's If-None-Match is * or nothing",
-        );
-        return refuse(req, resp, ctx).await;
+    let written = match WriteConditions::of(headers) {
+        Ok(written) => written,
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let precondition = written.precondition();
     // A copy has no body of its own; whatever came is read through first.
@@ -204,7 +186,7 @@ pub(super) async fn copy(
         // The layer gone under the tag (pruned by hand) is no object either; present, it is
         // now referenced again, which keeps it from the gc's grace window.
         if !store.has_blob(&obj.layer) {
-            return Ok(no_such_key(&ctx));
+            return Ok(no_such_key(&ctx, &src));
         }
         let mut annotations = replaced.unwrap_or_else(|| meta::carried(&obj.annotations));
         // Of the bytes, which are the same: the ETag, the checksum and the parts.
@@ -280,8 +262,8 @@ mod tests {
 
     #[test]
     fn a_copy_source_that_names_no_object_is_refused_with_the_rule() {
-        let code = |value: &str| match source(value) {
-            Source::Invalid(code, _) => code,
+        let refusal = |value: &str| match source(value) {
+            Source::Invalid(why) => why,
             other => panic!("{value}: {other:?}"),
         };
         for bad in [
@@ -300,12 +282,21 @@ mod tests {
             "/b/tags/k",
             "//b/k",
         ] {
-            assert!(
-                ["InvalidArgument", "InvalidBucketName"].contains(&code(bad)),
-                "{bad}: {}",
-                code(bad)
-            );
+            assert_eq!(refusal(bad).code, Code::InvalidArgument, "{bad}");
         }
-        assert_eq!(code(&format!("/b/{}", "x".repeat(256))), "KeyTooLongError");
+        // In S3's words, naming the header and its value.
+        let r = refusal("/b/a%2");
+        assert_eq!(r.message(), "Invalid copy source encoding");
+        assert_eq!(r.element("ArgumentName"), Some(COPY_SOURCE));
+        assert_eq!(r.element("ArgumentValue"), Some("/b/a%2"));
+        assert_eq!(refusal("/b").message(), "Invalid copy source object key");
+        assert_eq!(
+            refusal("//b/k").message(),
+            "Invalid copy source bucket name"
+        );
+        assert_eq!(
+            refusal(&format!("/b/{}", "x".repeat(256))).code,
+            Code::KeyTooLongError
+        );
     }
 }
diff --git a/vk-registry/src/s3/error.rs b/vk-registry/src/s3/error.rs
new file mode 100644
index 00000000..f80bc03a
--- /dev/null
+++ b/vk-registry/src/s3/error.rs
@@ -0,0 +1,428 @@
+//! S3's errors as AWS answers them: each code this view refuses with, the status that goes
+//! with it and AWS's own message for it, in one table ([`Code`]), so a handler names a code
+//! and the words are S3's. A refusal ([`Refusal`]) carries the code's message unless AWS has
+//! a more specific one for the case (`InvalidArgument` and `InvalidRequest` always do), and
+//! the elements AWS adds to its `Error` document for it — `BucketName`, `Key`, `UploadId`,
+//! `ArgumentName` and `ArgumentValue`, `Condition`, `Header` and the like — which is where
+//! the detail of a refusal goes.
+
+use std::borrow::Cow;
+
+use hyper::{Response, StatusCode};
+
+use super::xml;
+use crate::Body;
+
+/// An S3 error code.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Code {
+    AccessDenied,
+    AuthorizationHeaderMalformed,
+    AuthorizationQueryParametersError,
+    BadDigest,
+    BucketAlreadyOwnedByYou,
+    BucketNotEmpty,
+    EntityTooLarge,
+    IncompleteBody,
+    InternalError,
+    InvalidAccessKeyId,
+    InvalidArgument,
+    InvalidBucketName,
+    InvalidChunkSizeError,
+    InvalidDigest,
+    InvalidPart,
+    InvalidPartNumber,
+    InvalidPartOrder,
+    InvalidRange,
+    InvalidRequest,
+    InvalidStorageClass,
+    InvalidToken,
+    InvalidURI,
+    KeyTooLongError,
+    MalformedTrailerError,
+    MalformedXML,
+    MetadataTooLarge,
+    NoSuchBucket,
+    NoSuchBucketPolicy,
+    NoSuchCORSConfiguration,
+    NoSuchKey,
+    NoSuchLifecycleConfiguration,
+    NoSuchPublicAccessBlockConfiguration,
+    NoSuchUpload,
+    NoSuchWebsiteConfiguration,
+    NotImplemented,
+    ObjectLockConfigurationNotFoundError,
+    OperationAborted,
+    OwnershipControlsNotFoundError,
+    PreconditionFailed,
+    ReplicationConfigurationNotFoundError,
+    RequestTimeTooSkewed,
+    ServerSideEncryptionConfigurationNotFoundError,
+    ServiceUnavailable,
+    SignatureDoesNotMatch,
+    XAmzContentSHA256Mismatch,
+}
+
+impl Code {
+    /// The code's name, its status and AWS's message for it.
+    const fn spec(self) -> (&'static str, StatusCode, &'static str) {
+        use Code::*;
+        const BAD: StatusCode = StatusCode::BAD_REQUEST;
+        const GONE: StatusCode = StatusCode::NOT_FOUND;
+        match self {
+            AccessDenied => ("AccessDenied", StatusCode::FORBIDDEN, "Access Denied"),
+            AuthorizationHeaderMalformed => (
+                "AuthorizationHeaderMalformed",
+                BAD,
+                "The authorization header is malformed.",
+            ),
+            AuthorizationQueryParametersError => (
+                "AuthorizationQueryParametersError",
+                BAD,
+                "Query-string authentication version 4 requires the X-Amz-Algorithm, \
+                 X-Amz-Credential, X-Amz-Signature, X-Amz-Date, X-Amz-SignedHeaders, and \
+                 X-Amz-Expires parameters.",
+            ),
+            BadDigest => (
+                "BadDigest",
+                BAD,
+                "The Content-MD5 you specified did not match what we received.",
+            ),
+            BucketAlreadyOwnedByYou => (
+                "BucketAlreadyOwnedByYou",
+                StatusCode::CONFLICT,
+                "Your previous request to create the named bucket succeeded and you already \
+                 own it.",
+            ),
+            BucketNotEmpty => (
+                "BucketNotEmpty",
+                StatusCode::CONFLICT,
+                "The bucket you tried to delete is not empty.",
+            ),
+            EntityTooLarge => (
+                "EntityTooLarge",
+                BAD,
+                "Your proposed upload exceeds the maximum allowed object size.",
+            ),
+            IncompleteBody => (
+                "IncompleteBody",
+                BAD,
+                "You did not provide the number of bytes specified by the Content-Length HTTP \
+                 header",
+            ),
+            InternalError => (
+                "InternalError",
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "We encountered an internal error. Please try again.",
+            ),
+            InvalidAccessKeyId => (
+                "InvalidAccessKeyId",
+                StatusCode::FORBIDDEN,
+                "The AWS Access Key Id you provided does not exist in our records.",
+            ),
+            InvalidArgument => ("InvalidArgument", BAD, "Invalid Argument"),
+            InvalidBucketName => (
+                "InvalidBucketName",
+                BAD,
+                "The specified bucket is not valid.",
+            ),
+            InvalidChunkSizeError => (
+                "InvalidChunkSizeError",
+                BAD,
+                "Only the last chunk is allowed to have a size less than 8192 bytes",
+            ),
+            InvalidDigest => (
+                "InvalidDigest",
+                BAD,
+                "The Content-Md5 you specified is not valid.",
+            ),
+            InvalidPart => (
+                "InvalidPart",
+                BAD,
+                "One or more of the specified parts could not be found.  The part may not have \
+                 been uploaded, or the specified entity tag may not match the part's entity \
+                 tag.",
+            ),
+            InvalidPartNumber => (
+                "InvalidPartNumber",
+                StatusCode::RANGE_NOT_SATISFIABLE,
+                "The requested partnumber is not satisfiable.",
+            ),
+            InvalidPartOrder => (
+                "InvalidPartOrder",
+                BAD,
+                "The list of parts was not in ascending order. Parts must be ordered by part \
+                 number.",
+            ),
+            InvalidRange => (
+                "InvalidRange",
+                StatusCode::RANGE_NOT_SATISFIABLE,
+                "The requested range is not satisfiable",
+            ),
+            InvalidRequest => ("InvalidRequest", BAD, "Invalid Request"),
+            InvalidStorageClass => (
+                "InvalidStorageClass",
+                BAD,
+                "The storage class you specified is not valid",
+            ),
+            InvalidToken => (
+                "InvalidToken",
+                BAD,
+                "The provided token is malformed or otherwise invalid.",
+            ),
+            InvalidURI => ("InvalidURI", BAD, "Couldn't parse the specified URI."),
+            KeyTooLongError => ("KeyTooLongError", BAD, "Your key is too long."),
+            MalformedTrailerError => (
+                "MalformedTrailerError",
+                BAD,
+                "The request contained trailing data that was not well-formed or did not \
+                 conform to our published schema.",
+            ),
+            MalformedXML => (
+                "MalformedXML",
+                BAD,
+                "The XML you provided was not well-formed or did not validate against our \
+                 published schema.",
+            ),
+            MetadataTooLarge => (
+                "MetadataTooLarge",
+                BAD,
+                "Your metadata headers exceed the maximum allowed metadata size",
+            ),
+            NoSuchBucket => ("NoSuchBucket", GONE, "The specified bucket does not exist."),
+            NoSuchBucketPolicy => (
+                "NoSuchBucketPolicy",
+                GONE,
+                "The bucket policy does not exist.",
+            ),
+            NoSuchCORSConfiguration => (
+                "NoSuchCORSConfiguration",
+                GONE,
+                "The CORS configuration does not exist",
+            ),
+            NoSuchKey => ("NoSuchKey", GONE, "The specified key does not exist."),
+            NoSuchLifecycleConfiguration => (
+                "NoSuchLifecycleConfiguration",
+                GONE,
+                "The lifecycle configuration does not exist",
+            ),
+            NoSuchPublicAccessBlockConfiguration => (
+                "NoSuchPublicAccessBlockConfiguration",
+                GONE,
+                "The public access block configuration was not found",
+            ),
+            NoSuchUpload => (
+                "NoSuchUpload",
+                GONE,
+                "The specified multipart upload does not exist. The upload ID may be invalid, \
+                 or the upload may have been aborted or completed.",
+            ),
+            NoSuchWebsiteConfiguration => (
+                "NoSuchWebsiteConfiguration",
+                GONE,
+                "The specified bucket does not have a website configuration",
+            ),
+            NotImplemented => (
+                "NotImplemented",
+                StatusCode::NOT_IMPLEMENTED,
+                "A header you provided implies functionality that is not implemented",
+            ),
+            ObjectLockConfigurationNotFoundError => (
+                "ObjectLockConfigurationNotFoundError",
+                GONE,
+                "Object Lock configuration does not exist for this bucket.",
+            ),
+            OperationAborted => (
+                "OperationAborted",
+                StatusCode::CONFLICT,
+                "A conflicting conditional operation is currently in progress against this \
+                 resource. Try again.",
+            ),
+            OwnershipControlsNotFoundError => (
+                "OwnershipControlsNotFoundError",
+                GONE,
+                "The bucket ownership controls were not found.",
+            ),
+            PreconditionFailed => (
+                "PreconditionFailed",
+                StatusCode::PRECONDITION_FAILED,
+                "At least one of the pre-conditions you specified did not hold",
+            ),
+            ReplicationConfigurationNotFoundError => (
+                "ReplicationConfigurationNotFoundError",
+                GONE,
+                "The replication configuration was not found",
+            ),
+            RequestTimeTooSkewed => (
+                "RequestTimeTooSkewed",
+                StatusCode::FORBIDDEN,
+                "The difference between the request time and the current time is too large.",
+            ),
+            ServerSideEncryptionConfigurationNotFoundError => (
+                "ServerSideEncryptionConfigurationNotFoundError",
+                GONE,
+                "The server side encryption configuration was not found",
+            ),
+            ServiceUnavailable => (
+                "ServiceUnavailable",
+                StatusCode::SERVICE_UNAVAILABLE,
+                "Please reduce your request rate.",
+            ),
+            SignatureDoesNotMatch => (
+                "SignatureDoesNotMatch",
+                StatusCode::FORBIDDEN,
+                "The request signature we calculated does not match the signature you \
+                 provided. Check your key and signing method.",
+            ),
+            XAmzContentSHA256Mismatch => (
+                "XAmzContentSHA256Mismatch",
+                BAD,
+                "The provided 'x-amz-content-sha256' header does not match what was computed.",
+            ),
+        }
+    }
+
+    /// S3's name of the code.
+    pub(crate) const fn name(self) -> &'static str {
+        self.spec().0
+    }
+
+    /// The status S3 answers the code with.
+    pub(crate) const fn status(self) -> StatusCode {
+        self.spec().1
+    }
+
+    /// AWS's message for the code.
+    pub(crate) const fn message(self) -> &'static str {
+        self.spec().2
+    }
+}
+
+/// A refusal: its code, the message (the code's, or AWS's own for the case), and the
+/// elements AWS adds to the `Error` document, in order.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) struct Refusal {
+    pub(crate) code: Code,
+    message: Cow<'static, str>,
+    extra: Vec<(&'static str, String)>,
+}
+
+impl From<Code> for Refusal {
+    fn from(code: Code) -> Self {
+        Refusal::new(code)
+    }
+}
+
+impl Refusal {
+    /// `code`, with its message.
+    pub(crate) const fn new(code: Code) -> Self {
+        Refusal {
+            code,
+            message: Cow::Borrowed(code.message()),
+            extra: Vec::new(),
+        }
+    }
+
+    /// `code`, with the message AWS gives this case of it.
+    pub(crate) const fn said(code: Code, message: &'static str) -> Self {
+        Refusal {
+            code,
+            message: Cow::Borrowed(message),
+            extra: Vec::new(),
+        }
+    }
+
+    /// [`said`](Self::said), the message made for this request.
+    pub(crate) fn saying(code: Code, message: String) -> Self {
+        Refusal {
+            code,
+            message: Cow::Owned(message),
+            extra: Vec::new(),
+        }
+    }
+
+    /// `InvalidArgument`, as AWS answers it: what is wrong with the argument `name`, which
+    /// was sent as `value`.
+    pub(crate) fn argument(
+        message: impl Into<Cow<'static, str>>,
+        name: &str,
+        value: impl Into<String>,
+    ) -> Self {
+        Refusal {
+            code: Code::InvalidArgument,
+            message: message.into(),
+            extra: Vec::new(),
+        }
+        .with("ArgumentName", name)
+        .with("ArgumentValue", value)
+    }
+
+    /// The refusal with element `name` added, holding `value`.
+    pub(crate) fn with(mut self, name: &'static str, value: impl Into<String>) -> Self {
+        self.extra.push((name, value.into()));
+        self
+    }
+
+    pub(crate) fn message(&self) -> &str {
+        &self.message
+    }
+
+    /// The value of element `name`, when the refusal carries it.
+    #[cfg(test)]
+    pub(crate) fn element(&self, name: &str) -> Option<&str> {
+        self.extra
+            .iter()
+            .find(|(n, _)| *n == name)
+            .map(|(_, v)| v.as_str())
+    }
+
+    /// The `Error` document, for the request `request_id` naming `resource`.
+    pub(crate) fn answer(&self, resource: &str, request_id: &str) -> Response<Body> {
+        let extra: Vec<(&str, &str)> = self.extra.iter().map(|(n, v)| (*n, v.as_str())).collect();
+        xml::error(
+            self.code.status(),
+            self.code.name(),
+            &self.message,
+            &extra,
+            resource,
+            request_id,
+        )
+    }
+}
+
+impl std::fmt::Display for Refusal {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}: {}", self.code.name(), self.message)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_refusal_carries_its_code_s_message_unless_given_one() {
+        let r = Refusal::new(Code::NoSuchBucket).with("BucketName", "b");
+        assert_eq!(r.code.status(), StatusCode::NOT_FOUND);
+        assert_eq!(r.message(), "The specified bucket does not exist.");
+        assert_eq!(r.element("BucketName"), Some("b"));
+        let r = Refusal::argument("Invalid uploadId marker", "upload-id-marker", "x");
+        assert_eq!(r.code, Code::InvalidArgument);
+        assert_eq!(r.message(), "Invalid uploadId marker");
+        assert_eq!(r.element("ArgumentName"), Some("upload-id-marker"));
+        assert_eq!(r.element("ArgumentValue"), Some("x"));
+    }
+
+    #[test]
+    fn every_code_is_named_as_s3_names_it() {
+        for code in [
+            Code::AccessDenied,
+            Code::NoSuchUpload,
+            Code::XAmzContentSHA256Mismatch,
+            Code::ServerSideEncryptionConfigurationNotFoundError,
+        ] {
+            assert_eq!(code.name(), format!("{code:?}"));
+            assert!(!code.message().is_empty());
+        }
+    }
+}
diff --git a/vk-registry/src/s3/list.rs b/vk-registry/src/s3/list.rs
index 669d8d4e..3e8bb3d0 100644
--- a/vk-registry/src/s3/list.rs
+++ b/vk-registry/src/s3/list.rs
@@ -15,8 +15,9 @@
 
 use anyhow::Result;
 use hyper::body::Incoming;
-use hyper::{Request, Response, StatusCode};
+use hyper::{Request, Response};
 
+use super::error::{Code, Refusal};
 use super::path::MAX_KEY;
 use super::{Ctx, NULL_VERSION, Params, bucket, checksum, conditional, refuse, sigv4, xml};
 use crate::files::{self, FILES_REPO, Node, Object, allowed, repo_name};
@@ -73,8 +74,34 @@ struct Query {
     owner: bool,
 }
 
+/// A count a query parameter `name` gives (`max-keys`, `max-uploads`, `max-parts`, a part
+/// number marker): a whole number from 0 to 2147483647, as S3 takes it, or `InvalidArgument`
+/// in S3's words for one that is negative or is no such number.
+pub(super) fn count(name: &'static str, value: &str) -> std::result::Result<u32, Refusal> {
+    match value.parse::<i64>() {
+        Ok(n) if n < 0 => Err(Refusal::argument(
+            format!("Argument {value} must be an integer between 0 and 2147483647"),
+            name,
+            value,
+        )),
+        Ok(n) => i32::try_from(n)
+            .ok()
+            .and_then(|n| u32::try_from(n).ok())
+            .ok_or_else(|| not_a_count(name, value)),
+        Err(_) => Err(not_a_count(name, value)),
+    }
+}
+
+fn not_a_count(name: &'static str, value: &str) -> Refusal {
+    Refusal::argument(
+        format!("Provided {value} not an integer or within integer range"),
+        name,
+        value,
+    )
+}
+
 /// The listing a query asks for, or why it is refused (400 `InvalidArgument`).
-fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
+fn parse(params: &Params) -> std::result::Result<Query, Refusal> {
     let mut q = Query {
         max_keys: MAX_KEYS,
         ..Query::default()
@@ -88,26 +115,44 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
             continue;
         }
         seen.push(name);
+        let text = |value| text(name, value);
         match name {
             "list-type" if value == "2" => q.v2 = true,
-            "list-type" => return Err("list-type is 2, or absent for the first version"),
+            "list-type" => {
+                return Err(Refusal::argument(
+                    "list-type is 2, or absent for the first version",
+                    "list-type",
+                    value,
+                ));
+            }
             "prefix" => q.prefix = Some(text(value)?),
             "delimiter" => q.delimiter = Some(text(value)?).filter(|d| !d.is_empty()),
             "max-keys" => {
-                let n: usize = value
-                    .parse()
-                    .map_err(|_| "max-keys is a whole number from 0")?;
-                q.max_keys = n.min(MAX_KEYS);
+                q.max_keys = usize::try_from(count("max-keys", &value)?)
+                    .unwrap_or(MAX_KEYS)
+                    .min(MAX_KEYS);
             }
             "continuation-token" => q.token = Some(value),
             "start-after" => start_after = Some(text(value)?),
             "marker" => marker = Some(text(value)?),
             "versions" if value.is_empty() => q.versions = true,
-            "versions" => return Err("versions takes no value"),
+            "versions" => {
+                return Err(Refusal::argument(
+                    "versions takes no value",
+                    "versions",
+                    value,
+                ));
+            }
             "key-marker" => key_marker = Some(text(value)?),
             "version-id-marker" => q.version_marker = Some(text(value)?),
             "encoding-type" if value == "url" => q.url = true,
-            "encoding-type" => return Err("encoding-type is url, or absent"),
+            "encoding-type" => {
+                return Err(Refusal::argument(
+                    "Invalid Encoding Method specified in Request",
+                    "encoding-type",
+                    value,
+                ));
+            }
             "fetch-owner" => q.owner = value == "true",
             _ => {}
         }
@@ -116,18 +161,34 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
     // the owner.
     if q.versions {
         if q.v2 {
-            return Err("list-type names ListObjectsV2, which a versions listing is not");
+            return Err(Refusal::argument(
+                "list-type names ListObjectsV2, which a versions listing is not",
+                "list-type",
+                "2",
+            ));
         }
-        if q.version_marker.is_some() && key_marker.is_none() {
-            return Err("a version-id-marker needs the key-marker it is a version of");
+        if let (Some(marker), None) = (&q.version_marker, &key_marker) {
+            return Err(Refusal::argument(
+                "A version-id marker cannot be specified without a key marker.",
+                "version-id-marker",
+                marker.as_str(),
+            ));
         }
         (q.start, q.token, q.owner) = (key_marker, None, true);
     } else if q.v2 {
         q.start = start_after;
-    } else if start_after.is_some() {
-        return Err("start-after is ListObjectsV2's: send list-type=2, or marker");
-    } else if q.token.is_some() {
-        return Err("continuation-token is ListObjectsV2's: send list-type=2, or marker");
+    } else if let Some(start_after) = start_after {
+        return Err(Refusal::argument(
+            "startAfter only supported in REST.GET.BUCKET with list-type=2",
+            "start-after",
+            start_after,
+        ));
+    } else if let Some(token) = &q.token {
+        return Err(Refusal::argument(
+            "continuation-token only supported in REST.GET.BUCKET with list-type=2",
+            "continuation-token",
+            token.as_str(),
+        ));
     } else {
         (q.start, q.owner) = (marker, true);
     }
@@ -136,21 +197,30 @@ fn parse(params: &Params) -> std::result::Result<Query, &'static str> {
     // none, echoed as sent.
     let resumed = match q.token.as_deref() {
         Some("") | None => None,
-        Some(token) => Some(
-            resume_point(token).ok_or("the continuation token is not one this registry gave")?,
-        ),
+        Some(token) => Some(resume_point(token).ok_or_else(|| {
+            Refusal::argument(
+                "The continuation token provided is incorrect",
+                "continuation-token",
+                token,
+            )
+        })?),
     };
     q.after = resumed.max(q.start.clone());
     Ok(q)
 }
 
-/// A prefix, delimiter or start key, which a listing echoes in XML: no control character,
-/// which XML 1.0 cannot carry, and no longer than a key.
-pub(super) fn text(v: String) -> std::result::Result<String, &'static str> {
+/// A prefix, delimiter or start key, which a listing echoes in XML, sent as parameter
+/// `name`: no control character, which XML 1.0 cannot carry, and no longer than a key.
+pub(super) fn text(name: &str, v: String) -> std::result::Result<String, Refusal> {
+    let refused = |rule| Refusal::said(Code::InvalidArgument, rule).with("ArgumentName", name);
     if v.chars().any(char::is_control) {
-        Err("a prefix, delimiter or start key holds no control character")
+        Err(refused(
+            "a prefix, delimiter or start key holds no control character",
+        ))
     } else if v.len() > MAX_KEY {
-        Err("a prefix, delimiter or start key is at most 1024 bytes")
+        Err(refused(
+            "a prefix, delimiter or start key is at most 1024 bytes",
+        ))
     } else {
         Ok(v)
     }
@@ -390,10 +460,7 @@ pub(super) async fn list(
 ) -> Result<Response<Body>> {
     let q = match parse(params) {
         Ok(q) => q,
-        Err(message) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", message);
-            return refuse(req, resp, ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if !admitted(authz, &bucket, q.prefix()) {
         return refuse(req, ctx.access_denied(), ctx).await;
@@ -401,11 +468,7 @@ pub(super) async fn list(
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         if !store.repo_dir_exists(&format!("{FILES_REPO}/{bucket}")) {
-            return Ok(ctx.error(
-                StatusCode::NOT_FOUND,
-                "NoSuchBucket",
-                "the specified bucket does not exist",
-            ));
+            return Ok(ctx.error(bucket::no_such_bucket(&bucket)));
         }
         let (items, truncated) = page(store, authz, &bucket, &q)?;
         Ok(xml::document(
@@ -894,8 +957,8 @@ mod tests {
     fn a_query_names_a_listing_of_either_version() {
         let is_listing = |q: &str| super::is_listing(&crate::s3::parse_query(q).unwrap());
         let parse = |q: &str| match crate::s3::parse_query(q) {
-            Some(params) => super::parse(&params),
-            None => Err("malformed"),
+            Some(params) => super::parse(&params).map_err(|r| r.message().to_string()),
+            None => Err("malformed".to_string()),
         };
         assert!(is_listing(""));
         assert!(is_listing("list-%74ype=2"));
@@ -993,6 +1056,25 @@ mod tests {
         ] {
             assert!(parse(bad).is_err(), "{bad}");
         }
+        // In S3's words where S3 has them.
+        assert_eq!(
+            parse("max-keys=-5").unwrap_err(),
+            "Argument -5 must be an integer between 0 and 2147483647"
+        );
+        assert_eq!(
+            parse("max-keys=x").unwrap_err(),
+            "Provided x not an integer or within integer range"
+        );
+        assert!(parse("max-keys=2147483647").is_ok());
+        assert!(parse("max-keys=2147483648").is_err());
+        assert_eq!(
+            parse("start-after=a").unwrap_err(),
+            "startAfter only supported in REST.GET.BUCKET with list-type=2"
+        );
+        assert_eq!(
+            parse("continuation-token=").unwrap_err(),
+            "continuation-token only supported in REST.GET.BUCKET with list-type=2"
+        );
     }
 
     #[test]
diff --git a/vk-registry/src/s3/meta.rs b/vk-registry/src/s3/meta.rs
index 8c3b668f..00097032 100644
--- a/vk-registry/src/s3/meta.rs
+++ b/vk-registry/src/s3/meta.rs
@@ -6,6 +6,8 @@ use std::collections::BTreeMap;
 
 use hyper::header::{HeaderMap, HeaderName, HeaderValue};
 
+use super::error::{Code, Refusal};
+
 /// The prefix of a user metadata header.
 const HEADER_PREFIX: &str = "x-amz-meta-";
 
@@ -15,13 +17,6 @@ const ANNOTATION_PREFIX: &str = "org.virtkit.s3-meta.";
 /// Most bytes of user metadata, names and values together: S3's own bound.
 pub(crate) const MAX_METADATA: usize = 2048;
 
-/// Why a write's metadata is refused: an S3 error code and the rule.
-#[derive(Debug, PartialEq, Eq)]
-pub(crate) struct Refusal {
-    pub(crate) code: &'static str,
-    pub(crate) message: &'static str,
-}
-
 /// The annotations a write's `x-amz-meta-*` headers become. A name is `[a-z0-9-]`, matched
 /// without regard to case (header names arrive lowercase) and kept lowercase; a value is text;
 /// a name sent twice is one value, the two joined by a comma, as HTTP joins them.
@@ -38,32 +33,32 @@ pub(crate) fn annotations(headers: &HeaderMap) -> Result<BTreeMap<String, String
                 .bytes()
                 .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
         {
-            return Err(Refusal {
-                code: "InvalidArgument",
-                message: "a metadata name is x-amz-meta- then a run of a-z 0-9 -",
-            });
+            return Err(Refusal::said(
+                Code::InvalidArgument,
+                "a metadata name is x-amz-meta- then a run of a-z 0-9 -",
+            )
+            .with("ArgumentName", name.as_str()));
         }
         let values = headers
             .get_all(name)
             .iter()
             .map(|v| v.to_str())
             .collect::<Result<Vec<_>, _>>()
-            .map_err(|_| Refusal {
-                code: "InvalidArgument",
-                message: "a metadata value is printable ASCII",
+            .map_err(|_| {
+                Refusal::said(Code::InvalidArgument, "a metadata value is printable ASCII")
+                    .with("ArgumentName", name.as_str())
             })?;
         let value = values.join(",");
         total = total
             .saturating_add(short.len())
             .saturating_add(value.len());
-        if total > MAX_METADATA {
-            return Err(Refusal {
-                code: "MetadataTooLarge",
-                message: "user metadata is at most 2 KiB, names and values together",
-            });
-        }
         out.insert(format!("{ANNOTATION_PREFIX}{short}"), value);
     }
+    if total > MAX_METADATA {
+        return Err(Refusal::new(Code::MetadataTooLarge)
+            .with("Size", total.to_string())
+            .with("MaxSizeAllowed", MAX_METADATA.to_string()));
+    }
     Ok(out)
 }
 
@@ -146,27 +141,31 @@ mod tests {
         for bad in ["x-amz-meta-", "x-amz-meta-a_b", "x-amz-meta-a.b"] {
             assert_eq!(
                 of(&[(bad, "v")]).unwrap_err().code,
-                "InvalidArgument",
+                Code::InvalidArgument,
                 "{bad}"
             );
         }
         let mut h = HeaderMap::new();
         h.insert("x-amz-meta-v", HeaderValue::from_bytes(b"caf\xe9").unwrap());
-        assert_eq!(annotations(&h).unwrap_err().code, "InvalidArgument");
+        assert_eq!(annotations(&h).unwrap_err().code, Code::InvalidArgument);
         // 2 KiB exactly, names counted without their prefix
         let fill = "v".repeat(MAX_METADATA - 2);
         assert!(of(&[("x-amz-meta-ab", &fill)]).is_ok());
         let over = "v".repeat(MAX_METADATA - 1);
+        let r = of(&[("x-amz-meta-ab", &over)]).unwrap_err();
+        assert_eq!(r.code, Code::MetadataTooLarge);
         assert_eq!(
-            of(&[("x-amz-meta-ab", &over)]).unwrap_err().code,
-            "MetadataTooLarge"
+            r.message(),
+            "Your metadata headers exceed the maximum allowed metadata size"
         );
+        assert_eq!(r.element("Size"), Some("2049"));
+        assert_eq!(r.element("MaxSizeAllowed"), Some("2048"));
         let half = "v".repeat(MAX_METADATA / 2);
         assert_eq!(
             of(&[("x-amz-meta-a", &half), ("x-amz-meta-b", &half)])
                 .unwrap_err()
                 .code,
-            "MetadataTooLarge"
+            Code::MetadataTooLarge
         );
     }
 }
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 05dbedc4..3a0d0d55 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -4,7 +4,7 @@
 //! user) and whose signing secret is that same string (the Basic password for the user), so
 //! nothing new is stored; or by the bearer, Basic or session credential the other routes
 //! take. Every answer carries an `x-amz-request-id` (and the same id as `x-amz-id-2`), and
-//! refusals are S3's XML `Error`.
+//! refusals are S3's XML `Error`, in S3's codes and words ([`error`]).
 //! Presigned URLs and temporary credentials are refused.
 //!
 //! Past the gate, a bucket is a top-level directory of `files/` and an object a key below
@@ -28,6 +28,7 @@ mod checksum;
 mod chunked;
 mod conditional;
 mod copy;
+mod error;
 mod list;
 mod meta;
 mod multipart;
@@ -42,9 +43,10 @@ use hyper::body::Incoming;
 use hyper::header::{
     AUTHORIZATION, DATE, EXPECT, HeaderMap, HeaderValue, RETRY_AFTER, X_CONTENT_TYPE_OPTIONS,
 };
-use hyper::{Method, Request, Response, StatusCode};
+use hyper::{Method, Request, Response};
 use vk_hub_proto::token::Claims;
 
+use self::error::{Code, Refusal};
 use crate::files::{MAX_OBJECT, PutError};
 use crate::{Authenticator, Authz, Body, ServerState, accounts, hubtoken};
 
@@ -122,12 +124,10 @@ pub(crate) async fn route(
     };
     let id = &ctx.id;
     // S3 parses the URI before it looks at the credential.
-    let served = match unparsable {
-        Some(why) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidURI", why);
-            before_auth(req, resp).await
-        }
-        None => serve(state, req, &ctx).await,
+    let served = if unparsable {
+        before_auth(req, ctx.error(Code::InvalidURI)).await
+    } else {
+        serve(state, req, &ctx).await
     };
     let mut resp = match served {
         Ok(resp) => resp,
@@ -154,41 +154,28 @@ struct Ctx {
 }
 
 impl Ctx {
-    fn error(&self, status: StatusCode, code: &str, message: &str) -> Response<Body> {
-        xml::error(status, code, message, &[], &self.path, &self.id)
+    /// The `Error` document of `refusal`, naming this request.
+    fn error(&self, refusal: impl Into<Refusal>) -> Response<Body> {
+        refusal.into().answer(&self.path, &self.id)
     }
 
     fn not_implemented(&self) -> Response<Body> {
-        self.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "this registry does not serve that operation",
-        )
+        self.error(Code::NotImplemented)
     }
 
     fn access_denied(&self) -> Response<Body> {
-        self.error(
-            StatusCode::FORBIDDEN,
-            "AccessDenied",
-            "the credential grants nothing for this bucket or key",
-        )
+        self.error(Code::AccessDenied)
     }
 
     fn too_large(&self) -> Response<Body> {
         self.error(
-            StatusCode::PAYLOAD_TOO_LARGE,
-            "EntityTooLarge",
-            "an object is at most 4 GiB",
+            Refusal::new(Code::EntityTooLarge).with("MaxSizeAllowed", MAX_OBJECT.to_string()),
         )
     }
 }
 
 fn internal_error(ctx: &Ctx) -> Response<Body> {
-    ctx.error(
-        StatusCode::INTERNAL_SERVER_ERROR,
-        "InternalError",
-        "the server could not answer; its log names this request id",
-    )
+    ctx.error(Code::InternalError)
 }
 
 /// Who a request was authenticated as: what [`Authz`] borrows from.
@@ -214,38 +201,31 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
     // Browsers attach cookies or Basic credentials to cross-site requests, as on every
     // other machine route.
     if !matches!(req.method(), &Method::GET | &Method::HEAD) && crate::cross_site(headers) {
-        let resp = ctx.error(
-            StatusCode::FORBIDDEN,
-            "AccessDenied",
+        let resp = ctx.error(Refusal::said(
+            Code::AccessDenied,
             "a write to this registry cannot come from another site's page",
-        );
+        ));
         return before_auth(req, resp).await;
     }
     // A credential in a URL ends up in logs, proxies' included.
     if is_presigned(req.uri().query().unwrap_or("")) {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "AuthorizationQueryParametersError",
+        let resp = ctx.error(Refusal::said(
+            Code::AuthorizationQueryParametersError,
             "presigned URLs are not accepted: sign the Authorization header",
-        );
+        ));
         return before_auth(req, resp).await;
     }
     if headers.contains_key("x-amz-security-token") {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidToken",
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidToken,
             "temporary credentials are not accepted: sign with a key of this registry",
-        );
+        ));
         return before_auth(req, resp).await;
     }
     let who = match scheme(headers) {
         Ok(true) => signed_by(state, &req, ctx),
         Ok(false) => presented(state, &req, ctx).map(|who| (who, None)),
-        Err(why) => Err(Box::new(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidArgument",
-            why,
-        ))),
+        Err(why) => Err(Box::new(ctx.error(why))),
     };
     let (who, seed) = match who {
         Ok(who) => who,
@@ -254,11 +234,10 @@ async fn serve(state: &ServerState, req: Request<Incoming>, ctx: &Ctx) -> Result
 
     // A hub managing the registry may make it refuse writes for a while.
     if state.store.read_only() && crate::is_store_write(req.method(), &ctx.path) {
-        let mut resp = ctx.error(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "ServiceUnavailable",
+        let mut resp = ctx.error(Refusal::said(
+            Code::ServiceUnavailable,
             "the registry is read-only for now",
-        );
+        ));
         resp.headers_mut()
             .insert(RETRY_AFTER, HeaderValue::from_static("60"));
         return refuse(req, resp, ctx).await;
@@ -338,32 +317,28 @@ async fn operate(
 ) -> Result<Response<Body>> {
     let target = match path::parse(&ctx.path) {
         Ok(target) => target,
-        Err(why) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
-            return refuse(req, resp, ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let Some(query) = parse_query(req.uri().query().unwrap_or("")) else {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidArgument",
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidArgument,
             "a query parameter has a malformed percent escape or is not UTF-8",
-        );
+        ));
         return refuse(req, resp, ctx).await;
     };
-    if let Some((status, code, message)) = canned::asked(req.headers()) {
-        return refuse(req, ctx.error(status, code, message), ctx).await;
+    if let Some(why) = canned::asked(req.headers()) {
+        return refuse(req, ctx.error(why), ctx).await;
     }
     let part = match part_asked(&query) {
         None => None,
         Some(value) => match multipart::part_number(value) {
             Some(n) => Some(n),
             None => {
-                let resp = ctx.error(
-                    StatusCode::BAD_REQUEST,
-                    "InvalidArgument",
-                    "Part number must be an integer between 1 and 10000, inclusive.",
-                );
+                let resp = ctx.error(Refusal::argument(
+                    multipart::PART_NUMBER,
+                    "partNumber",
+                    value,
+                ));
                 return refuse(req, resp, ctx).await;
             }
         },
@@ -438,34 +413,36 @@ async fn operate(
 
 /// Whether the `Authorization` header is SigV4's: `false` for none (the session cookie may
 /// stand in) or one of the schemes the other routes take, Basic and Bearer, which
-/// [`presented`] resolves; an error for any other scheme, or a value with no scheme, which
-/// S3 answers 400 as a signature version it does not take rather than 403 as a credential
-/// it refused.
-fn scheme(headers: &HeaderMap) -> std::result::Result<bool, &'static str> {
+/// [`presented`] resolves; refused otherwise: a value with no scheme or of any other scheme
+/// is 400 `InvalidArgument`, as S3 answers a signature version it does not take rather than
+/// 403 as a credential it refused.
+fn scheme(headers: &HeaderMap) -> std::result::Result<bool, Refusal> {
+    let invalid =
+        |why| Refusal::said(Code::InvalidArgument, why).with("ArgumentName", "Authorization");
     let Some(value) = headers.get(AUTHORIZATION) else {
         return Ok(false);
     };
     let Ok(value) = value.to_str() else {
-        return Err("the Authorization header is not text");
+        return Err(invalid("the Authorization header is not text"));
     };
     let Some((scheme, _)) = value.split_once(' ') else {
-        return Err("the Authorization header names no scheme: a space follows the scheme");
+        return Err(invalid(
+            "Authorization header is invalid -- one and only one ' ' (space) required",
+        ));
     };
     if scheme == sigv4::ALGORITHM {
         Ok(true)
     } else if scheme.eq_ignore_ascii_case("basic") || scheme.eq_ignore_ascii_case("bearer") {
         Ok(false)
     } else {
-        Err(
-            "the Authorization scheme is not one this registry takes: AWS4-HMAC-SHA256, Bearer or Basic",
-        )
+        Err(invalid("Unsupported Authorization Type"))
     }
 }
 
 /// Answer `resp` once the request body has been read through, as after every refusal of an
 /// authenticated request: a status sent with request bytes unread resets the connection,
-/// which a client sees instead of the answer. A body past the object cap is refused with 413
-/// instead. A client waiting on `Expect: 100-continue` has sent no body yet: it is answered
+/// which a client sees instead of the answer. A body past the object cap is refused with
+/// `EntityTooLarge` instead. A client waiting on `Expect: 100-continue` has sent no body yet: it is answered
 /// at once, and the `100` it would have sent the body on never goes out.
 async fn refuse(req: Request<Incoming>, resp: Response<Body>, ctx: &Ctx) -> Result<Response<Body>> {
     if expects_continue(req.headers()) {
@@ -483,7 +460,8 @@ fn expects_continue(headers: &HeaderMap) -> bool {
         .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"100-continue"))
 }
 
-/// Read a request's body through and discard it: `Some(413)` if it crosses the object cap.
+/// Read a request's body through and discard it: `Some(EntityTooLarge)` if it crosses the
+/// object cap.
 async fn drain(req: Request<Incoming>, ctx: &Ctx) -> Result<Option<Response<Body>>> {
     let sink = &mut tokio::io::sink();
     match crate::files::drain_into(sink, req.into_body(), MAX_OBJECT, &mut |_| {}).await {
@@ -494,7 +472,8 @@ async fn drain(req: Request<Incoming>, ctx: &Ctx) -> Result<Option<Response<Body
 }
 
 /// A request document read whole, up to `cap` bytes: `Err(too_long)` when it is longer,
-/// once the rest has been read through as a refusal's is (or 413 past the object cap).
+/// once the rest has been read through as a refusal's is (or `EntityTooLarge` past the object
+/// cap).
 async fn read_small(
     mut body: Incoming,
     cap: usize,
@@ -550,14 +529,7 @@ fn presented(
     req: &Request<Incoming>,
     ctx: &Ctx,
 ) -> std::result::Result<Who, Box<Response<Body>>> {
-    let denied = || {
-        let message = if req.headers().contains_key(AUTHORIZATION) {
-            "the credential was refused"
-        } else {
-            "this registry needs a credential: sign the request with a key of this registry"
-        };
-        Box::new(ctx.error(StatusCode::FORBIDDEN, "AccessDenied", message))
-    };
+    let denied = || Box::new(ctx.access_denied());
     if let Some(claims) = token(state, req.headers(), denied)? {
         return Ok(Who::Token(claims));
     }
@@ -598,11 +570,10 @@ fn token(
 /// asked again, anything else is logged under the request's id.
 fn resolve_failed(e: anyhow::Error, ctx: &Ctx) -> Box<Response<Body>> {
     if accounts::is_handed_over_error(&e) {
-        return Box::new(crate::ask_again(ctx.error(
-            StatusCode::SERVICE_UNAVAILABLE,
-            "ServiceUnavailable",
+        return Box::new(crate::ask_again(ctx.error(Refusal::said(
+            Code::ServiceUnavailable,
             "this registry is updating; retry",
-        )));
+        ))));
     }
     eprintln!(
         "vk-registry: S3 request {}: resolving a credential: {e:#}",
@@ -625,26 +596,31 @@ fn signed_by(
     ctx: &Ctx,
 ) -> std::result::Result<(Who, Option<chunked::Seed>), Box<Response<Body>>> {
     let headers = req.headers();
+    // What AWS says after this of every malformed header.
     let malformed = |why: &str| {
-        Box::new(ctx.error(StatusCode::BAD_REQUEST, "AuthorizationHeaderMalformed", why))
+        Box::new(ctx.error(Refusal::saying(
+            Code::AuthorizationHeaderMalformed,
+            format!("The authorization header is malformed; {why}"),
+        )))
     };
     let value = headers
         .get(AUTHORIZATION)
         .and_then(|v| v.to_str().ok())
-        .ok_or_else(|| malformed("the Authorization header is not text"))?;
-    let credential = sigv4::parse_authorization(value).map_err(malformed)?;
+        .ok_or_else(|| malformed("the Authorization header is not text."))?;
+    let credential = sigv4::parse_authorization(value, "s3").map_err(|why| malformed(&why))?;
     if let Some(why) = sigv4::s3_refusal(&credential) {
         return Err(malformed(why));
     }
-    if let Some(name) = sigv4::unsigned_amz_header(&credential, headers) {
-        return Err(Box::new(xml::error(
-            StatusCode::FORBIDDEN,
-            "AccessDenied",
-            "There were headers present in the request which were not signed",
-            &[("HeadersNotSigned", name)],
-            &ctx.path,
-            &ctx.id,
-        )));
+    if let Some(names) = sigv4::unsigned_amz_headers(&credential, headers) {
+        return Err(Box::new(
+            ctx.error(
+                Refusal::said(
+                    Code::AccessDenied,
+                    "There were headers present in the request which were not signed",
+                )
+                .with("HeadersNotSigned", names),
+            ),
+        ));
     }
 
     let now = vk_peer::now_secs();
@@ -656,43 +632,37 @@ fn signed_by(
     match sigv4::check_clock(stamp, credential.date, now) {
         Ok(()) => {}
         Err(sigv4::Clock::Unreadable) => {
-            return Err(Box::new(ctx.error(
-                StatusCode::FORBIDDEN,
-                "AccessDenied",
-                "a signed request needs an x-amz-date header as YYYYMMDDTHHMMSSZ",
-            )));
+            return Err(Box::new(ctx.error(Refusal::said(
+                Code::AccessDenied,
+                "AWS authentication requires a valid Date or x-amz-date header.",
+            ))));
         }
         Err(sigv4::Clock::OtherDay) => {
             return Err(malformed(
-                "the credential's date is not the day of x-amz-date",
+                "Invalid credential date. Date is not the same as X-Amz-Date.",
             ));
         }
         Err(sigv4::Clock::Skewed) => {
-            let server_time = sigv4::format_time(now);
-            let skew = (sigv4::MAX_SKEW_SECS * 1000).to_string();
-            return Err(Box::new(xml::error(
-                StatusCode::FORBIDDEN,
-                "RequestTimeTooSkewed",
-                "the difference between the request time and the server's time is too large",
-                &[
-                    ("RequestTime", stamp),
-                    ("ServerTime", &server_time),
-                    ("MaxAllowedSkewMilliseconds", &skew),
-                ],
-                &ctx.path,
-                &ctx.id,
-            )));
+            return Err(Box::new(
+                ctx.error(
+                    Refusal::new(Code::RequestTimeTooSkewed)
+                        .with("RequestTime", stamp)
+                        .with("ServerTime", sigv4::format_time(now))
+                        .with(
+                            "MaxAllowedSkewMilliseconds",
+                            (sigv4::MAX_SKEW_SECS * 1000).to_string(),
+                        ),
+                ),
+            ));
         }
     }
 
     // The id, authenticated as the bearer it would be: the one header map built here holds
     // nothing else, so no resolver can accept through it what it would not accept as sent.
     let unknown = || {
-        Box::new(ctx.error(
-            StatusCode::FORBIDDEN,
-            "InvalidAccessKeyId",
-            "the access key id is not a credential of this registry",
-        ))
+        Box::new(
+            ctx.error(Refusal::new(Code::InvalidAccessKeyId).with("AWSAccessKeyId", credential.id)),
+        )
     };
     let as_bearer = bearer_of(credential.id).ok_or_else(unknown)?;
     let (who, secret) = match (token(state, &as_bearer, unknown)?, &state.auth) {
@@ -718,7 +688,12 @@ fn signed_by(
     let payload_hash = headers
         .get("x-amz-content-sha256")
         .and_then(|v| v.to_str().ok())
-        .ok_or_else(|| malformed("the signed x-amz-content-sha256 header is missing"))?;
+        .ok_or_else(|| {
+            Box::new(ctx.error(Refusal::said(
+                Code::InvalidRequest,
+                "Missing required header for this request: x-amz-content-sha256",
+            )))
+        })?;
     let canonical = sigv4::canonical_request(
         req.method().as_str(),
         req.uri().path(),
@@ -728,24 +703,21 @@ fn signed_by(
         payload_hash,
     )
     .map_err(|why| match why {
-        sigv4::Canon::Path | sigv4::Canon::Query => Box::new(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidURI",
-            "the request's URI has a malformed escape or is not UTF-8",
-        )),
+        sigv4::Canon::Path | sigv4::Canon::Query => Box::new(ctx.error(Code::InvalidURI)),
         sigv4::Canon::Missing(name) => malformed(&format!("the signed header {name} is missing")),
         sigv4::Canon::NotText(name) => malformed(&format!("the signed header {name} is not text")),
     })?;
     if !sigv4::signature_matches(secret, &credential, stamp, &canonical) {
         let sts = sigv4::string_to_sign(stamp, &credential.scope(), &canonical);
-        return Err(Box::new(xml::error(
-            StatusCode::FORBIDDEN,
-            "SignatureDoesNotMatch",
-            "the request signature does not match the one computed with the key's secret",
-            &[("StringToSign", &sts), ("CanonicalRequest", &canonical)],
-            &ctx.path,
-            &ctx.id,
-        )));
+        return Err(Box::new(
+            ctx.error(
+                Refusal::new(Code::SignatureDoesNotMatch)
+                    .with("AWSAccessKeyId", credential.id)
+                    .with("StringToSign", sts)
+                    .with("SignatureProvided", credential.signature)
+                    .with("CanonicalRequest", canonical),
+            ),
+        ));
     }
     if !chunked::Mode::of(payload_hash).is_some_and(chunked::Mode::signed) {
         return Ok((who, None));
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 244b9dda..c786e269 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -37,7 +37,8 @@ use sha1::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
 use super::copy::{self, COPY_SOURCE, Source};
-use super::object::{self, Refused, admitted, no_such_key, readable, unwritable};
+use super::error::{Code, Refusal};
+use super::object::{self, admitted, no_such_key, readable, unwritable};
 use super::xml::scan::{self, Malformed};
 use super::{
     Ctx, OPERATION_HINT, Params, UNCOMPRESSED_FROM, bucket, checksum, chunked, drain, list, meta,
@@ -231,6 +232,10 @@ fn only(params: &[(&str, &str)], taken: &[&str]) -> bool {
     params.iter().all(|(n, _)| taken.contains(n))
 }
 
+/// What S3 says of a `partNumber` that is not one.
+pub(super) const PART_NUMBER: &str =
+    "Part number must be an integer between 1 and 10000, inclusive.";
+
 /// A part number as a query or a document gives it: 1 to [`MAX_PARTS`], in decimal.
 pub(super) fn part_number(s: &str) -> Option<u32> {
     if s.is_empty() || !s.bytes().all(|b| b.is_ascii_digit()) || s.len() > 5 {
@@ -320,17 +325,9 @@ async fn open_held_async(state: &ServerState, id: &str, segs: &[String]) -> Resu
         .context("holding an upload panicked")?
 }
 
-fn no_such_upload(ctx: &Ctx) -> Response<Body> {
-    ctx.error(
-        StatusCode::NOT_FOUND,
-        "NoSuchUpload",
-        "the specified multipart upload does not exist: its id may be wrong, or it was \
-         completed or aborted",
-    )
-}
-
-fn invalid(ctx: &Ctx, message: &str) -> Response<Body> {
-    ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", message)
+/// `NoSuchUpload`, naming upload `id`.
+fn no_such_upload(ctx: &Ctx, id: &str) -> Response<Body> {
+    ctx.error(Refusal::new(Code::NoSuchUpload).with("UploadId", id))
 }
 
 /// Whether this caller may `action` on the repository the object at `segs` would be in.
@@ -385,24 +382,20 @@ pub(super) async fn create(
     }
     let headers = req.headers();
     if headers.contains_key(COPY_SOURCE) {
-        let resp = invalid(
-            ctx,
-            "a multipart upload's parts are copied by UploadPartCopy, not named at its creation",
-        );
+        let resp = ctx.error(Refusal::argument(
+            "You can only specify a copy source header for copy requests.",
+            "x-amz-copy-source",
+            String::from_utf8_lossy(headers[COPY_SOURCE].as_bytes()),
+        ));
         return refuse(req, resp, ctx).await;
     }
     let annotations = match meta::annotations(headers) {
         Ok(a) => a,
-        Err(why) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
-            return refuse(req, resp, ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let algorithm = match checksum_algorithm(headers) {
         Ok(a) => a,
-        Err((status, code, message)) => {
-            return refuse(req, ctx.error(status, code, message), ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
@@ -449,7 +442,7 @@ pub(super) async fn create(
 /// The `x-amz-checksum-algorithm` a creation names, as S3 spells it: the algorithm the
 /// parts' checksums will be in, which each part's request then carries and is checked by;
 /// one not computed here is refused as a part carrying it would be.
-fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'static str>, Refused> {
+fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'static str>, Refusal> {
     let Some(v) = headers.get("x-amz-checksum-algorithm") else {
         return Ok(None);
     };
@@ -459,10 +452,11 @@ fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'stati
         .find(|a| v.as_bytes().eq_ignore_ascii_case(a.as_bytes()));
     match known {
         Some(name) => Ok(Some(name)),
-        None if v.as_bytes().is_empty() || v.to_str().is_err() => Err((
-            StatusCode::BAD_REQUEST,
-            "InvalidRequest",
-            "x-amz-checksum-algorithm names one of S3's checksum algorithms",
+        None if v.as_bytes().is_empty() || v.to_str().is_err() => Err(Refusal::said(
+            Code::InvalidRequest,
+            "Checksum algorithm provided is unsupported. Please try again with any of the \
+             valid types: [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, \
+             XXHASH3, XXHASH64]",
         )),
         None => Err(checksum::NOT_COMPUTED),
     }
@@ -497,7 +491,11 @@ pub(super) async fn upload(
     match method {
         Method::PUT => {
             let Some(n) = param(&params, "partNumber").and_then(part_number) else {
-                let resp = invalid(ctx, "partNumber is a part's number, 1 to 10000");
+                let resp = ctx.error(Refusal::argument(
+                    PART_NUMBER,
+                    "partNumber",
+                    param(&params, "partNumber").unwrap_or_default(),
+                ));
                 return refuse(req, resp, ctx).await;
             };
             if req.headers().contains_key(COPY_SOURCE) {
@@ -545,17 +543,15 @@ async fn upload_part(
     }
     let plan = match object::plan(headers) {
         Ok(plan) => plan,
-        Err((status, code, message)) => {
-            return refuse(req, ctx.error(status, code, message), ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let Some(up) = open_async(state, &id, &segs).await? else {
-        return refuse(req, no_such_upload(ctx), ctx).await;
+        return refuse(req, no_such_upload(ctx, &id), ctx).await;
     };
     let staging = match temp_in(&up.dir, &format!("part-{n}")) {
         Ok(staging) => staging,
         // Completed or aborted since it was looked up.
-        Err(_) if !up.dir.is_dir() => return refuse(req, no_such_upload(ctx), ctx).await,
+        Err(_) if !up.dir.is_dir() => return refuse(req, no_such_upload(ctx, &id), ctx).await,
         Err(e) => return Err(e),
     };
     let received = match object::receive(plan, req.into_body(), seed, staging, ctx).await? {
@@ -571,7 +567,7 @@ async fn upload_part(
     };
     match installed {
         Ok(()) => {}
-        Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(ctx)),
+        Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(ctx, &id)),
         Err(e) => return Err(e),
     }
     object::written(&format!("\"{md5}\""), received.echo)
@@ -617,17 +613,10 @@ async fn copy_part(
     let src = match copy::source(value) {
         Source::Object(src) => src,
         Source::Versioned => {
-            let resp = ctx.error(
-                StatusCode::NOT_IMPLEMENTED,
-                "NotImplemented",
-                "this registry keeps no versions to copy from",
-            );
-            return refuse(req, resp, ctx).await;
-        }
-        Source::Invalid(code, message) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, code, message);
+            let resp = ctx.error(Refusal::new(Code::NotImplemented).with("Header", COPY_SOURCE));
             return refuse(req, resp, ctx).await;
         }
+        Source::Invalid(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if !admitted(authz, accounts::Action::Read, &src) {
         return refuse(req, ctx.access_denied(), ctx).await;
@@ -637,11 +626,13 @@ async fn copy_part(
         Some(v) => match v.to_str().ok().and_then(copy_range) {
             Some(range) => Some(range),
             None => {
-                let resp = invalid(
-                    ctx,
-                    "x-amz-copy-source-range is bytes=<first>-<last>, the zero-based offsets \
-                     of the first and last bytes to copy",
-                );
+                let resp = ctx.error(Refusal::argument(
+                    "The x-amz-copy-source-range value must be of the form bytes=first-last \
+                     where first and last are the zero-based offsets of the first and last \
+                     bytes to copy",
+                    COPY_SOURCE_RANGE,
+                    String::from_utf8_lossy(v.as_bytes()),
+                ));
                 return refuse(req, resp, ctx).await;
             }
         },
@@ -654,7 +645,7 @@ async fn copy_part(
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let Some(up) = open(store, &id, &segs) else {
-            return Ok(no_such_upload(&ctx));
+            return Ok(no_such_upload(&ctx, &id));
         };
         let Some(obj) = readable(store, authz, &src)? else {
             return Ok(copy::absent(store, authz, &src, &ctx));
@@ -666,23 +657,17 @@ async fn copy_part(
             None => (0, obj.size),
             Some((first, last)) if last < obj.size => (first, last - first + 1),
             Some(_) => {
-                let size = obj.size.to_string();
-                return Ok(xml::error(
-                    StatusCode::RANGE_NOT_SATISFIABLE,
-                    "InvalidRange",
-                    "x-amz-copy-source-range reaches past the source object's end",
-                    &[("ActualObjectSize", &size)],
-                    &ctx.path,
-                    &ctx.id,
+                return Ok(ctx.error(
+                    Refusal::new(Code::InvalidRange).with("ActualObjectSize", obj.size.to_string()),
                 ));
             }
         };
         let Some((_, mut reader)) = store.read_blob_range(&obj.layer, start, len)? else {
-            return Ok(no_such_key(&ctx));
+            return Ok(no_such_key(&ctx, &src));
         };
         let (path, mut file) = match temp_in(&up.dir, &format!("part-{n}")) {
             Ok(staging) => staging,
-            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx)),
+            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx, &id)),
             Err(e) => return Err(e),
         };
         let mut staged = Staged::written(path, 0, String::new());
@@ -704,7 +689,7 @@ async fn copy_part(
         let md5 = crate::hex_of(&md5.finalize().0);
         match install_part(&up.dir, n, staged, &md5) {
             Ok(()) => {}
-            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx)),
+            Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx, &id)),
             Err(e) => return Err(e),
         }
         Ok(xml::document(
@@ -721,7 +706,7 @@ async fn copy_part(
 
 /// Why a `CompleteMultipartUpload` document is refused.
 #[derive(Debug, PartialEq, Eq)]
-enum Refusal {
+enum Unfit {
     /// 400 `MalformedXML`
     Malformed(&'static str),
     /// 400 `InvalidPartOrder`: the part numbers do not ascend
@@ -731,10 +716,10 @@ enum Refusal {
 /// The parts a `CompleteMultipartUpload` document names, in order: each part's number and
 /// the ETag it is expected to have, unquoted and lowercase. Fields beside `PartNumber` and
 /// `ETag` (the parts' checksums) are passed over.
-fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Refusal> {
-    let root = scan::parse(body, MAX_ELEMENTS).map_err(|Malformed(why)| Refusal::Malformed(why))?;
+fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Unfit> {
+    let root = scan::parse(body, MAX_ELEMENTS).map_err(|Malformed(why)| Unfit::Malformed(why))?;
     if root.name != "CompleteMultipartUpload" {
-        return Err(Refusal::Malformed(
+        return Err(Unfit::Malformed(
             "the document is not a CompleteMultipartUpload",
         ));
     }
@@ -742,14 +727,12 @@ fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Refusal> {
     for p in root.all("Part") {
         let field = |name| {
             p.one(name)
-                .map_err(|Malformed(why)| Refusal::Malformed(why))?
+                .map_err(|Malformed(why)| Unfit::Malformed(why))?
                 .map(|e| e.text.trim().to_string())
-                .ok_or(Refusal::Malformed(
-                    "each Part names its PartNumber and ETag",
-                ))
+                .ok_or(Unfit::Malformed("each Part names its PartNumber and ETag"))
         };
         let n = part_number(&field("PartNumber")?)
-            .ok_or(Refusal::Malformed("a PartNumber is 1 to 10000"))?;
+            .ok_or(Unfit::Malformed("a PartNumber is 1 to 10000"))?;
         let etag = field("ETag")?;
         let etag = etag
             .strip_prefix('"')
@@ -757,12 +740,12 @@ fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Refusal> {
             .unwrap_or(&etag)
             .to_ascii_lowercase();
         if parts.last().is_some_and(|(last, _)| *last >= n) {
-            return Err(Refusal::Order);
+            return Err(Unfit::Order);
         }
         parts.push((n, etag));
     }
     if parts.is_empty() {
-        return Err(Refusal::Malformed(
+        return Err(Unfit::Malformed(
             "a CompleteMultipartUpload names at least one Part",
         ));
     }
@@ -791,7 +774,7 @@ struct Whole {
 }
 
 impl Whole {
-    fn of(headers: &HeaderMap) -> std::result::Result<Option<Self>, Refused> {
+    fn of(headers: &HeaderMap) -> std::result::Result<Option<Self>, Refusal> {
         if checksum::not_computed(headers) {
             return Err(checksum::NOT_COMPUTED);
         }
@@ -813,12 +796,7 @@ impl Whole {
                     && part_number(parts).is_some()
             });
             if !composite {
-                return Err((
-                    StatusCode::BAD_REQUEST,
-                    "InvalidRequest",
-                    "an x-amz-checksum header is the checksum of the object in base64, or a \
-                     composite one, <base64>-<parts>",
-                ));
+                return Err(checksum::invalid(header));
             }
         }
         Ok(None)
@@ -843,13 +821,13 @@ fn assemble(
     up: &Upload,
     parts: &[(u32, String)],
     whole: Option<&Whole>,
-) -> Result<std::result::Result<Assembled, Refused>> {
-    let invalid_part: Refused = (
-        StatusCode::BAD_REQUEST,
-        "InvalidPart",
-        "one or more of the specified parts could not be found, or its ETag is not the one \
-         given",
-    );
+) -> Result<std::result::Result<Assembled, Refusal>> {
+    let invalid_part = |n: &u32, etag: &str| {
+        Refusal::new(Code::InvalidPart)
+            .with("UploadId", up.id.as_str())
+            .with("PartNumber", n.to_string())
+            .with("ETag", etag)
+    };
     // Written into, so the gc takes the upload as in use while it is read.
     if let Ok(meta) = std::fs::File::open(up.dir.join(META)) {
         // A failure only leaves the upload as fresh as its last write.
@@ -858,20 +836,20 @@ fn assemble(
     let mut total: u64 = 0;
     for (n, etag) in parts {
         let Some(part) = read_record::<Part>(&record_path(&up.dir, *n)) else {
-            return Ok(Err(invalid_part));
+            return Ok(Err(invalid_part(n, etag)));
         };
         if part.md5 != *etag {
-            return Ok(Err(invalid_part));
+            return Ok(Err(invalid_part(n, etag)));
         }
         total = total.saturating_add(part.size);
     }
-    let too_large: Refused = (
-        StatusCode::PAYLOAD_TOO_LARGE,
-        "EntityTooLarge",
-        "an object is at most 4 GiB, its parts together",
-    );
+    let too_large = |size: u64| {
+        Refusal::new(Code::EntityTooLarge)
+            .with("ProposedSize", size.to_string())
+            .with("MaxSizeAllowed", MAX_OBJECT.to_string())
+    };
     if total > MAX_OBJECT {
-        return Ok(Err(too_large));
+        return Ok(Err(too_large(total)));
     }
 
     let (path, mut out) = store.stage_file()?;
@@ -884,7 +862,9 @@ fn assemble(
     for (n, etag) in parts {
         let mut file = match std::fs::File::open(part_path(&up.dir, *n)) {
             Ok(file) => file,
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Err(invalid_part)),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                return Ok(Err(invalid_part(n, etag)));
+            }
             Err(e) => return Err(anyhow::Error::from(e).context("opening a part")),
         };
         let mut md5 = md5::Context::new();
@@ -898,7 +878,7 @@ fn assemble(
             };
             staged.size = staged.size.saturating_add(got as u64);
             if staged.size > MAX_OBJECT {
-                return Ok(Err(too_large));
+                return Ok(Err(too_large(staged.size)));
             }
             let data = buf.get(..got).unwrap_or_default();
             md5.consume(data);
@@ -910,7 +890,7 @@ fn assemble(
         }
         let md5 = md5.finalize().0;
         if crate::hex_of(&md5) != *etag {
-            return Ok(Err(invalid_part));
+            return Ok(Err(invalid_part(n, etag)));
         }
         md5s.push(md5);
         sizes.push(staged.size.saturating_sub(before));
@@ -954,48 +934,33 @@ async fn complete(
     if !on_parent(authz, accounts::Action::Write, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
-    let Ok(conditions) = WriteConditions::of(req.headers()) else {
-        let resp = ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "a write's If-None-Match is * or nothing",
-        );
-        return refuse(req, resp, ctx).await;
+    let conditions = match WriteConditions::of(req.headers()) {
+        Ok(conditions) => conditions,
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let whole = match Whole::of(req.headers()) {
         Ok(whole) => whole,
-        Err((status, code, message)) => {
-            return refuse(req, ctx.error(status, code, message), ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let (head, body) = req.into_parts();
-    let too_long = ctx.error(
-        StatusCode::BAD_REQUEST,
-        "MalformedXML",
-        "a CompleteMultipartUpload document is at most 1 MiB",
-    );
+    let too_long = ctx.error(Code::MalformedXML);
     let body = match read_small(body, MAX_DOCUMENT, too_long, ctx).await? {
         Ok(body) => body,
         Err(resp) => return Ok(resp),
     };
-    if let Err((status, code, message)) = object::check_document(&head.headers, &body) {
-        return Ok(ctx.error(status, code, message));
+    if let Err(why) = object::check_document(&head.headers, &body) {
+        return Ok(ctx.error(why));
     }
     let parts = match document(&body) {
         Ok(parts) => parts,
-        Err(Refusal::Malformed(why)) => {
-            return Ok(ctx.error(StatusCode::BAD_REQUEST, "MalformedXML", why));
-        }
-        Err(Refusal::Order) => {
-            return Ok(ctx.error(
-                StatusCode::BAD_REQUEST,
-                "InvalidPartOrder",
-                "the list of parts was not in ascending order of part number",
-            ));
+        // What is wrong with it is S3's to say in its own words.
+        Err(Unfit::Malformed(_)) => return Ok(ctx.error(Code::MalformedXML)),
+        Err(Unfit::Order) => {
+            return Ok(ctx.error(Refusal::new(Code::InvalidPartOrder).with("UploadId", id)));
         }
     };
     let found = {
-        let (store, segs) = (Arc::clone(&state.store), segs.clone());
+        let (store, segs, id) = (Arc::clone(&state.store), segs.clone(), id.clone());
         tokio::task::spawn_blocking(move || -> Result<_> {
             let Some((lock, dir)) = hold(&store, &id)? else {
                 return Ok(Found::Gone);
@@ -1015,11 +980,9 @@ async fn complete(
     // Held until the upload is completed, so a completion racing this one waits, then finds
     // it completed rather than its parts going from under it.
     let (Held { _lock, up }, parts, assembled) = match found {
-        Found::Gone => return Ok(no_such_upload(ctx)),
+        Found::Gone => return Ok(no_such_upload(ctx, &id)),
         Found::Completed(done) => return Ok(done.result(ctx)),
-        Found::Assembled(_, _, Err((status, code, message))) => {
-            return Ok(ctx.error(status, code, message));
-        }
+        Found::Assembled(_, _, Err(why)) => return Ok(ctx.error(why)),
         Found::Assembled(held, parts, Ok(assembled)) => (held, parts, assembled),
     };
     let Assembled {
@@ -1081,7 +1044,7 @@ enum Found {
     Assembled(
         Held,
         Vec<(u32, String)>,
-        std::result::Result<Assembled, Refused>,
+        std::result::Result<Assembled, Refusal>,
     ),
 }
 
@@ -1203,8 +1166,12 @@ async fn abort(
             Some(t) if t > SystemTime::now() => None,
             Some(t) => Some(conditional::whole_seconds(t)),
             None => {
-                let why = "x-amz-if-match-initiated-time is an HTTP date";
-                return refuse(req, invalid(ctx, why), ctx).await;
+                let resp = ctx.error(Refusal::argument(
+                    "x-amz-if-match-initiated-time is an HTTP date",
+                    conditional::IF_MATCH_INITIATED,
+                    String::from_utf8_lossy(v.as_bytes()),
+                ));
+                return refuse(req, resp, ctx).await;
             }
         },
     };
@@ -1213,13 +1180,11 @@ async fn abort(
     }
     // Held until the upload is gone: an abort racing a completion waits for it to end.
     let Some(Held { _lock, up }) = open_held_async(state, &id, &segs).await? else {
-        return Ok(no_such_upload(ctx));
+        return Ok(no_such_upload(ctx, &id));
     };
     if initiated.is_some_and(|t| t != up.meta.created) {
         return Ok(ctx.error(
-            StatusCode::PRECONDITION_FAILED,
-            "PreconditionFailed",
-            conditional::PRECONDITION_FAILED,
+            Refusal::new(Code::PreconditionFailed).with("Condition", "If-Match-Initiated-Time"),
         ));
     }
     remove(up.dir).await?;
@@ -1228,14 +1193,14 @@ async fn abort(
         .body(body_of(bytes::Bytes::new()))?)
 }
 
-/// A page size as a query gives it: a count, clamped to [`MAX_LISTED`]; absent, the bound.
-fn page_size(value: Option<&str>) -> Option<usize> {
+/// A page size as query parameter `name` gives it ([`list::count`]), clamped to
+/// [`MAX_LISTED`]; absent, the bound.
+fn page_size(name: &'static str, value: Option<&str>) -> std::result::Result<usize, Refusal> {
     match value {
-        None => Some(MAX_LISTED),
-        Some(v) if !v.is_empty() && v.bytes().all(|b| b.is_ascii_digit()) => {
-            Some(v.parse::<usize>().map_or(MAX_LISTED, |n| n.min(MAX_LISTED)))
-        }
-        Some(_) => None,
+        None => Ok(MAX_LISTED),
+        Some(v) => Ok(usize::try_from(list::count(name, v)?)
+            .unwrap_or(MAX_LISTED)
+            .min(MAX_LISTED)),
     }
 }
 
@@ -1277,23 +1242,21 @@ async fn list_parts(
     if !on_parent(authz, accounts::Action::Read, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
-    let Some(max) = page_size(param(params, "max-parts")) else {
-        return refuse(req, invalid(ctx, "max-parts is a count of parts"), ctx).await;
+    let max = match page_size("max-parts", param(params, "max-parts")) {
+        Ok(max) => max,
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let marker = match param(params, "part-number-marker") {
         None => 0,
-        Some(m) => match m.parse::<u32>() {
+        Some(m) => match list::count("part-number-marker", m) {
             Ok(m) => m,
-            Err(_) => {
-                let resp = invalid(ctx, "part-number-marker is a part's number");
-                return refuse(req, resp, ctx).await;
-            }
+            Err(why) => return refuse(req, ctx.error(why), ctx).await,
         },
     };
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, _| {
         let Some(up) = open(store, &id, &segs) else {
-            return Ok(no_such_upload(&ctx));
+            return Ok(no_such_upload(&ctx, &id));
         };
         let mut numbers = if max == 0 {
             Vec::new()
@@ -1392,13 +1355,21 @@ pub(super) async fn list_uploads(
     let url = match param(&params, "encoding-type") {
         None => false,
         Some("url") => true,
-        Some(_) => return refuse(req, invalid(ctx, "encoding-type is url"), ctx).await,
+        Some(v) => {
+            let resp = ctx.error(Refusal::argument(
+                "Invalid Encoding Method specified in Request",
+                "encoding-type",
+                v,
+            ));
+            return refuse(req, resp, ctx).await;
+        }
     };
-    let Some(max) = page_size(param(&params, "max-uploads")) else {
-        return refuse(req, invalid(ctx, "max-uploads is a count of uploads"), ctx).await;
+    let max = match page_size("max-uploads", param(&params, "max-uploads")) {
+        Ok(max) => max,
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     // Each is echoed in the listing, so held to what a bucket listing's prefix is.
-    let echoed = |name| list::text(param(&params, name).unwrap_or_default().to_string());
+    let echoed = |name| list::text(name, param(&params, name).unwrap_or_default().to_string());
     let (prefix, key_marker, mut id_marker) = match (
         echoed("prefix"),
         echoed("key-marker"),
@@ -1406,7 +1377,7 @@ pub(super) async fn list_uploads(
     ) {
         (Ok(prefix), Ok(key), Ok(id)) => (prefix, key, id),
         (Err(why), _, _) | (_, Err(why), _) | (_, _, Err(why)) => {
-            return refuse(req, invalid(ctx, why), ctx).await;
+            return refuse(req, ctx.error(why), ctx).await;
         }
     };
     if key_marker.is_empty() {
@@ -1419,11 +1390,7 @@ pub(super) async fn list_uploads(
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         if !store.repo_dir_exists(&format!("{FILES_REPO}/{bucket}")) {
-            return Ok(ctx.error(
-                StatusCode::NOT_FOUND,
-                "NoSuchBucket",
-                "the specified bucket does not exist",
-            ));
+            return Ok(ctx.error(bucket::no_such_bucket(&bucket)));
         }
         let mut uploads: Vec<Listed> = Vec::new();
         for (id, dir) in store.multipart_uploads() {
@@ -1455,11 +1422,11 @@ pub(super) async fn list_uploads(
                 .take_while(|u| Some(&u.key) == first.as_ref())
                 .position(|u| u.id == id_marker)
             else {
-                return Ok(ctx.error(
-                    StatusCode::BAD_REQUEST,
-                    "InvalidArgument",
-                    "upload-id-marker names none of the uploads of the first key from key-marker",
-                ));
+                return Ok(ctx.error(Refusal::argument(
+                    "Invalid uploadId marker",
+                    "upload-id-marker",
+                    id_marker,
+                )));
             };
             uploads.drain(..=at);
         }
@@ -1550,7 +1517,7 @@ mod tests {
             format!("{}{}", part("2", MD5), part("1", MD5)),
             format!("{}{}", part("2", MD5), part("2", MD5)),
         ] {
-            assert_eq!(document(&body(&unordered)), Err(Refusal::Order));
+            assert_eq!(document(&body(&unordered)), Err(Unfit::Order));
         }
     }
 
@@ -1571,7 +1538,7 @@ mod tests {
             b"".to_vec(),
         ] {
             assert!(
-                matches!(document(&bad), Err(Refusal::Malformed(_))),
+                matches!(document(&bad), Err(Unfit::Malformed(_))),
                 "{}",
                 String::from_utf8_lossy(&bad)
             );
@@ -1584,7 +1551,7 @@ mod tests {
         let elements = (0..MAX_ELEMENTS).map(|_| "<x/>").collect::<String>();
         assert!(matches!(
             document(&body(&elements)),
-            Err(Refusal::Malformed(_))
+            Err(Unfit::Malformed(_))
         ));
         let big = vec![b' '; MAX_DOCUMENT + 1];
         assert!(document(&big).is_err());
@@ -1734,13 +1701,22 @@ mod tests {
         let q = query("prefix=a%2Fb+c");
         assert_eq!(param(&params(&q), "prefix"), Some("a/b+c"));
         assert!(!names(&query("uploadIds=1"), "uploadId"));
-        assert_eq!(page_size(None), Some(MAX_LISTED));
-        assert_eq!(page_size(Some("5")), Some(5));
+        assert_eq!(page_size("max-parts", None), Ok(MAX_LISTED));
+        assert_eq!(page_size("max-parts", Some("5")), Ok(5));
+        assert_eq!(page_size("max-parts", Some("2147483647")), Ok(MAX_LISTED));
+        // Past what S3 takes, in its words.
+        let refused = |v| page_size("max-parts", Some(v)).unwrap_err();
+        assert_eq!(
+            refused("100000000000000000000000").message(),
+            "Provided 100000000000000000000000 not an integer or within integer range"
+        );
+        let r = refused("-1");
         assert_eq!(
-            page_size(Some("100000000000000000000000")),
-            Some(MAX_LISTED)
+            r.message(),
+            "Argument -1 must be an integer between 0 and 2147483647"
         );
-        assert_eq!(page_size(Some("-1")), None);
+        assert_eq!(r.element("ArgumentName"), Some("max-parts"));
+        assert_eq!(r.element("ArgumentValue"), Some("-1"));
     }
 
     /// An upload is found only for the bucket and key it was created for, and never through an
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index cfc3d914..76db7bc4 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -21,6 +21,7 @@ use hyper::{Request, Response, StatusCode};
 use sha2::Digest as _;
 
 use super::conditional::{self, Conditions, MD5_ANNOTATION, Outcome, WriteConditions};
+use super::error::{Code, Refusal};
 use super::range::{self, Range};
 use super::{Ctx, UNCOMPRESSED_FROM, checksum, chunked, drain, meta, multipart, refuse, xml};
 use crate::dav::http_date;
@@ -47,12 +48,10 @@ pub(super) fn admitted(authz: &Authz<'_>, action: accounts::Action, segs: &[Stri
         || object_of(segs).is_some_and(|(parent, _)| allowed(authz, action, &parent))
 }
 
-pub(super) fn no_such_key(ctx: &Ctx) -> Response<Body> {
-    ctx.error(
-        StatusCode::NOT_FOUND,
-        "NoSuchKey",
-        "the specified key does not exist",
-    )
+/// `NoSuchKey`, naming the key at `segs`.
+pub(super) fn no_such_key(ctx: &Ctx, segs: &[String]) -> Response<Body> {
+    let key = segs.get(1..).unwrap_or_default().join("/");
+    ctx.error(Refusal::new(Code::NoSuchKey).with("Key", key))
 }
 
 /// The object at `segs` as this caller may read it: `None` when nothing is there, when a
@@ -127,11 +126,10 @@ pub(super) async fn get(
     let conditions = Conditions::of(req.headers());
     let asked = range::Asked::of(req.headers());
     if part.is_some() && req.headers().contains_key(hyper::header::RANGE) {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidRequest",
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidRequest,
             "Cannot specify both Range header and partNumber query parameter",
-        );
+        ));
         return refuse(req, resp, ctx).await;
     }
     let checksum = req
@@ -141,7 +139,7 @@ pub(super) async fn get(
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let Some(obj) = readable(store, authz, &segs)? else {
-            return Ok(no_such_key(&ctx));
+            return Ok(no_such_key(&ctx, &segs));
         };
         let etag = conditional::etag_of(&obj);
         let modified = http_date(obj.modified);
@@ -156,14 +154,9 @@ pub(super) async fn get(
                 return Ok(resp);
             }
             Outcome::Failed(condition) => {
-                return Ok(xml::error(
-                    StatusCode::PRECONDITION_FAILED,
-                    "PreconditionFailed",
-                    "at least one of the preconditions you specified did not hold",
-                    &[("Condition", condition)],
-                    &ctx.path,
-                    &ctx.id,
-                ));
+                return Ok(
+                    ctx.error(Refusal::new(Code::PreconditionFailed).with("Condition", condition))
+                );
             }
         }
         let sizes = multipart::part_sizes(&obj.annotations);
@@ -176,16 +169,10 @@ pub(super) async fn get(
                 };
                 let Some((start, len)) = lies else {
                     let count = sizes.as_ref().map_or(1, Vec::len).to_string();
-                    return Ok(xml::error(
-                        StatusCode::RANGE_NOT_SATISFIABLE,
-                        "InvalidPartNumber",
-                        "The requested partnumber is not satisfiable.",
-                        &[
-                            ("ActualPartCount", &count),
-                            ("PartNumberRequested", &n.to_string()),
-                        ],
-                        &ctx.path,
-                        &ctx.id,
+                    return Ok(ctx.error(
+                        Refusal::new(Code::InvalidPartNumber)
+                            .with("ActualPartCount", count)
+                            .with("PartNumberRequested", n.to_string()),
                     ));
                 };
                 if len == 0 {
@@ -202,14 +189,14 @@ pub(super) async fn get(
                 // The layer gone under the tag (a gc between the two reads) is no object
                 // either.
                 if resp.status() != StatusCode::OK {
-                    return Ok(no_such_key(&ctx));
+                    return Ok(no_such_key(&ctx, &segs));
                 }
                 resp.headers_mut().remove("docker-content-digest");
                 resp
             }
             Range::Part { start, len } => {
                 let Some(part) = store.serve_blob_range(&obj.layer, start, len, head)? else {
-                    return Ok(no_such_key(&ctx));
+                    return Ok(no_such_key(&ctx, &segs));
                 };
                 Response::builder()
                     .status(StatusCode::PARTIAL_CONTENT)
@@ -220,16 +207,10 @@ pub(super) async fn get(
             }
             Range::Unsatisfiable => {
                 let total = obj.size.to_string();
-                let mut resp = xml::error(
-                    StatusCode::RANGE_NOT_SATISFIABLE,
-                    "InvalidRange",
-                    "the requested range is not satisfiable",
-                    &[
-                        ("RangeRequested", asked.range()),
-                        ("ActualObjectSize", &total),
-                    ],
-                    &ctx.path,
-                    &ctx.id,
+                let mut resp = ctx.error(
+                    Refusal::new(Code::InvalidRange)
+                        .with("RangeRequested", asked.range())
+                        .with("ActualObjectSize", total.as_str()),
                 );
                 insert(
                     resp.headers_mut(),
@@ -306,11 +287,10 @@ pub(super) async fn attributes(
         count("x-amz-max-parts", 1000, 1000),
         count("x-amz-part-number-marker", 0, u64::from(u32::MAX)),
     ) else {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidArgument",
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidArgument,
             "x-amz-max-parts and x-amz-part-number-marker are whole numbers",
-        );
+        ));
         return refuse(req, resp, ctx).await;
     };
     let mut asked = Vec::new();
@@ -329,18 +309,17 @@ pub(super) async fn attributes(
         "ObjectSize",
     ];
     if asked.is_empty() || asked.iter().any(|a| !known.contains(&a.as_str())) {
-        let resp = ctx.error(
-            StatusCode::BAD_REQUEST,
-            "InvalidArgument",
-            "x-amz-object-attributes names some of ETag, Checksum, ObjectParts, StorageClass \
-             and ObjectSize",
-        );
+        let resp = ctx.error(Refusal::argument(
+            "Invalid attribute name specified.",
+            "x-amz-object-attributes",
+            asked.join(","),
+        ));
         return refuse(req, resp, ctx).await;
     }
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         let Some(obj) = readable(store, authz, &segs)? else {
-            return Ok(no_such_key(&ctx));
+            return Ok(no_such_key(&ctx, &segs));
         };
         let has = |a: &str| asked.iter().any(|x| x == a);
         let mut inner = String::new();
@@ -394,8 +373,8 @@ pub(super) async fn configuration(
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, authz| {
         Ok(match readable(store, authz, &segs)? {
-            Some(_) => canned.answer(&ctx),
-            None => no_such_key(&ctx),
+            Some(_) => canned.answer(&segs[0], &ctx),
+            None => no_such_key(&ctx, &segs),
         })
     })
     .await
@@ -431,22 +410,17 @@ struct Claim {
 }
 
 /// The refusal of a second `x-amz-checksum-*`, as S3 words it.
-const ONE_CHECKSUM: Refused = (
-    StatusCode::BAD_REQUEST,
-    "InvalidRequest",
+const ONE_CHECKSUM: Refusal = Refusal::said(
+    Code::InvalidRequest,
     "Expecting a single x-amz-checksum- header. Multiple checksum Types are not allowed.",
 );
 
-/// What a PutObject's headers ask that cannot be served, or are malformed: a status, a code
-/// and a message.
-pub(super) type Refused = (StatusCode, &'static str, &'static str);
-
 /// What `x-amz-content-sha256`, `Content-Encoding`, `x-amz-decoded-content-length` and
 /// `x-amz-trailer` say of a PutObject's body. A streaming mode, or `aws-chunked` named among
 /// the encodings, makes it an `aws-chunked` body; no other encoding is decoded, so none is
 /// taken beside it.
-fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
-    let invalid = |message| (StatusCode::BAD_REQUEST, "InvalidRequest", message);
+fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
+    let invalid = |message| Refusal::said(Code::InvalidRequest, message);
     let mut sent = headers.get_all("x-amz-content-sha256").iter();
     let value = sent.next().map(|v| v.to_str().unwrap_or_default());
     if sent.next().is_some() {
@@ -457,23 +431,23 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
         Some(v) if v.starts_with("STREAMING-") => match chunked::Mode::of(v) {
             Some(mode) => (None, Some(mode)),
             None => {
-                return Err((
-                    StatusCode::NOT_IMPLEMENTED,
-                    "NotImplemented",
-                    "the streaming payloads taken are STREAMING-AWS4-HMAC-SHA256-PAYLOAD, its \
-                     -TRAILER form and STREAMING-UNSIGNED-PAYLOAD-TRAILER",
-                ));
+                return Err(
+                    Refusal::new(Code::NotImplemented).with("Header", "x-amz-content-sha256")
+                );
             }
         },
         Some(v) if v.len() == 64 && v.bytes().all(|b| b.is_ascii_hexdigit()) => {
             (Some(v.to_ascii_lowercase()), None)
         }
-        Some(_) => {
-            return Err((
-                StatusCode::BAD_REQUEST,
-                "InvalidArgument",
-                "x-amz-content-sha256 is UNSIGNED-PAYLOAD, the body's SHA-256 in hex, or a \
-                 streaming mode",
+        Some(v) => {
+            return Err(Refusal::argument(
+                "x-amz-content-sha256 must be UNSIGNED-PAYLOAD, \
+                 STREAMING-UNSIGNED-PAYLOAD-TRAILER, STREAMING-AWS4-HMAC-SHA256-PAYLOAD, \
+                 STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER, \
+                 STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD, \
+                 STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER or a valid sha256 value.",
+                "x-amz-content-sha256",
+                v,
             ));
         }
     };
@@ -501,11 +475,7 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refused> {
         });
     };
     if other {
-        return Err((
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "an aws-chunked body is decoded, and no other content encoding with it",
-        ));
+        return Err(Refusal::new(Code::NotImplemented).with("Header", "Content-Encoding"));
     }
     let declared = headers
         .get(DECODED_LENGTH)
@@ -566,13 +536,10 @@ pub(super) fn base64_header(
 }
 
 /// The `Content-MD5` a request sends, as bytes.
-fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refused> {
+fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refusal> {
     let md5 = base64_header(headers, "content-md5", 16).map_err(|()| {
-        (
-            StatusCode::BAD_REQUEST,
-            "InvalidDigest",
-            "Content-MD5 is the body's MD5 in base64",
-        )
+        let sent = headers.get("content-md5").and_then(|v| v.to_str().ok());
+        Refusal::new(Code::InvalidDigest).with("Content-MD5", sent.unwrap_or_default())
     })?;
     Ok(md5.map(|(_, b)| b))
 }
@@ -580,7 +547,7 @@ fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refu
 /// What a request's headers ask to be checked: its `Content-MD5` and the one
 /// `x-amz-checksum-*` it carries, in an algorithm computed here; a second one is refused as
 /// S3 refuses it, and one in another algorithm as not implemented.
-fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
+fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refusal> {
     if checksum::not_computed(headers) {
         return Err(checksum::NOT_COMPUTED);
     }
@@ -589,13 +556,7 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
         ..Expected::default()
     };
     for (name, _, len) in checksum::ALGORITHMS {
-        let value = base64_header(headers, name, len).map_err(|()| {
-            (
-                StatusCode::BAD_REQUEST,
-                "InvalidRequest",
-                "an x-amz-checksum header is the checksum of the body in base64",
-            )
-        })?;
+        let value = base64_header(headers, name, len).map_err(|()| checksum::invalid(name))?;
         if let Some((text, bytes)) = value {
             if out.checksum.is_some() {
                 return Err(ONE_CHECKSUM);
@@ -620,14 +581,10 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refused> {
 
 impl Expected {
     /// The trailer's checksum `name`d, as sent: base64 of the checksum's length.
-    fn trailer(&mut self, name: &'static str, text: &str) -> std::result::Result<(), Refused> {
+    fn trailer(&mut self, name: &'static str, text: &str) -> std::result::Result<(), Refusal> {
         let bytes = crate::auth::base64_decode(text)
             .filter(|b| Some(b.len()) == checksum::len(name))
-            .ok_or((
-                StatusCode::BAD_REQUEST,
-                "InvalidRequest",
-                "the trailer's x-amz-checksum is the checksum of the body in base64",
-            ))?;
+            .ok_or_else(|| checksum::invalid_trailing(name))?;
         self.checksum = Some(Claim {
             header: name,
             text: text.to_string(),
@@ -670,13 +627,9 @@ fn verify(
     md5: &[u8],
     sha256: Option<&[u8]>,
     computed: Option<Vec<u8>>,
-) -> std::result::Result<(), Refused> {
+) -> std::result::Result<(), Refusal> {
     if expected.md5.as_deref().is_some_and(|m| m != md5) {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            "BadDigest",
-            "the Content-MD5 you specified did not match what was received",
-        ));
+        return Err(Refusal::new(Code::BadDigest));
     }
     if let Some(claim) = &expected.checksum {
         let got = if claim.header == CHECKSUM_SHA256 {
@@ -694,7 +647,7 @@ fn verify(
 /// Check a request document read whole (a `Delete`) against what its headers say of it, as a
 /// PutObject's body is checked: the signed `x-amz-content-sha256`, `Content-MD5` and the
 /// `x-amz-checksum-*` header. A document is sent whole, not `aws-chunked`.
-pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
+pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refusal> {
     check_document(headers, body)?;
     let expected = expected(headers)?;
     let computed = expected
@@ -712,24 +665,16 @@ pub(super) fn check_body(headers: &HeaderMap, body: &[u8]) -> std::result::Resul
 /// [`check_body`] for a document whose `x-amz-checksum-*` headers are not its own (a
 /// `CompleteMultipartUpload`'s are the object's): the signed `x-amz-content-sha256` and
 /// `Content-MD5` only.
-pub(super) fn check_document(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refused> {
+pub(super) fn check_document(headers: &HeaderMap, body: &[u8]) -> std::result::Result<(), Refusal> {
     let payload = payload(headers)?;
     if payload.framing.is_some() {
-        return Err((
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "a request document is sent whole, not aws-chunked",
-        ));
+        return Err(Refusal::new(Code::NotImplemented).with("Header", "Content-Encoding"));
     }
     if payload
         .sha256
         .is_some_and(|signed| signed != crate::hex_of(&sha2::Sha256::digest(body)))
     {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            "XAmzContentSHA256Mismatch",
-            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
-        ));
+        return Err(Refusal::new(Code::XAmzContentSHA256Mismatch));
     }
     let expected = Expected {
         md5: content_md5(headers)?,
@@ -750,11 +695,10 @@ pub(super) fn unwritable_message(why: Unwritable) -> &'static str {
 
 /// The answer to a write at a path that takes no object, with what is in the way.
 pub(super) fn unwritable(why: Unwritable, ctx: &Ctx) -> Response<Body> {
-    ctx.error(
-        StatusCode::CONFLICT,
-        "OperationAborted",
+    ctx.error(Refusal::said(
+        Code::OperationAborted,
         unwritable_message(why),
-    )
+    ))
 }
 
 /// Whether a write's declared length, `Content-Length` or `x-amz-decoded-content-length`, is
@@ -778,15 +722,11 @@ pub(super) struct Plan {
 }
 
 /// The [`Plan`] of a write's body, or why its headers are refused.
-pub(super) fn plan(headers: &HeaderMap) -> std::result::Result<Plan, Refused> {
+pub(super) fn plan(headers: &HeaderMap) -> std::result::Result<Plan, Refusal> {
     let payload = payload(headers)?;
     let expected = expected(headers)?;
     if payload.framing.is_some_and(|f| f.trailer.is_some()) && expected.checksum.is_some() {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            "InvalidRequest",
-            "a checksum is sent as a header or in the trailer, not both",
-        ));
+        return Err(ONE_CHECKSUM);
     }
     // As beside a checksum header: the trailer's checksum is in the algorithm the SDK names.
     if let (Some(named), Some(trailer)) = (
@@ -843,32 +783,26 @@ pub(super) async fn receive(
         Ok(staged) => staged,
         Err(PutError::TooLarge) => return Ok(Err(ctx.too_large())),
         Err(PutError::Failed(e)) => match e.downcast_ref::<chunked::Error>() {
-            Some(chunked::Error::Refused(why)) => {
-                return Ok(Err(ctx.error(why.status, why.code, why.message)));
-            }
+            Some(chunked::Error::Refused(why)) => return Ok(Err(ctx.error(*why))),
             _ => return Err(e),
         },
     };
     // A refusal from here on drops `staged`, which unlinks it.
     if let Some((name, value)) = trailer
-        && let Err((status, code, message)) = expected.trailer(name, &value)
+        && let Err(why) = expected.trailer(name, &value)
     {
-        return Ok(Err(ctx.error(status, code, message)));
+        return Ok(Err(ctx.error(why)));
     }
     if let Some(signed) = &payload.sha256
         && *signed != staged.hex
     {
-        return Ok(Err(ctx.error(
-            StatusCode::BAD_REQUEST,
-            "XAmzContentSHA256Mismatch",
-            "the body's SHA-256 is not the x-amz-content-sha256 the request was signed with",
-        )));
+        return Ok(Err(ctx.error(Code::XAmzContentSHA256Mismatch)));
     }
     let md5 = digests.md5.finalize().0;
     let computed = digests.checksum.map(checksum::Hasher::finalize);
     let sha256 = hex_bytes(&staged.hex);
-    if let Err((status, code, message)) = verify(&expected, &md5, sha256.as_deref(), computed) {
-        return Ok(Err(ctx.error(status, code, message)));
+    if let Err(why) = verify(&expected, &md5, sha256.as_deref(), computed) {
+        return Ok(Err(ctx.error(why)));
     }
     Ok(Ok(Received {
         staged,
@@ -938,24 +872,15 @@ pub(super) async fn put(
     }
     let plan = match plan(headers) {
         Ok(plan) => plan,
-        Err((status, code, message)) => {
-            return refuse(req, ctx.error(status, code, message), ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let mut annotations = match meta::annotations(headers) {
         Ok(a) => a,
-        Err(why) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, why.code, why.message);
-            return refuse(req, resp, ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
-    let Ok(conditions) = WriteConditions::of(headers) else {
-        let resp = ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "a write's If-None-Match is * or nothing",
-        );
-        return refuse(req, resp, ctx).await;
+    let conditions = match WriteConditions::of(headers) {
+        Ok(conditions) => conditions,
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     // Refused before the body is staged when the answer is already known; checked again
     // once it is, under the namespace lock.
@@ -993,13 +918,7 @@ pub(super) async fn put(
     match written {
         Written::Created | Written::Replaced => {}
         Written::Refused(why) => return Ok(unwritable(why, ctx)),
-        Written::PreconditionFailed => {
-            return Ok(ctx.error(
-                StatusCode::PRECONDITION_FAILED,
-                "PreconditionFailed",
-                "at least one of the preconditions you specified did not hold",
-            ));
-        }
+        Written::PreconditionFailed => return Ok(ctx.error(Code::PreconditionFailed)),
     }
     let mut resp = written_of(&format!("\"{md5_hex}\""), received.echo, Some(size))?;
     if kept.is_some() {
@@ -1034,18 +953,10 @@ pub(super) async fn delete(
     }
     let conditions = match conditional::DeleteConditions::of(req.headers()) {
         Ok(c) => c,
-        Err(why) => {
-            let resp = ctx.error(StatusCode::BAD_REQUEST, "InvalidArgument", why);
-            return refuse(req, resp, ctx).await;
-        }
+        Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if versioned && !conditions.is_empty() {
-        let resp = ctx.error(
-            StatusCode::NOT_IMPLEMENTED,
-            "NotImplemented",
-            "A header you provided implies functionality that is not implemented",
-        );
-        return refuse(req, resp, ctx).await;
+        return refuse(req, ctx.error(conditions.versioned()), ctx).await;
     }
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
@@ -1058,12 +969,8 @@ pub(super) async fn delete(
                 Deleted::Gone => no_content(),
                 Deleted::Denied => ctx.access_denied(),
                 Deleted::Foreign => unwritable(Unwritable::Foreign, &ctx),
-                Deleted::Absent => no_such_key(&ctx),
-                Deleted::Failed => ctx.error(
-                    StatusCode::PRECONDITION_FAILED,
-                    "PreconditionFailed",
-                    conditional::PRECONDITION_FAILED,
-                ),
+                Deleted::Absent => no_such_key(&ctx, &segs),
+                Deleted::Failed => ctx.error(Code::PreconditionFailed),
             },
         )
     })
@@ -1145,7 +1052,7 @@ mod tests {
 
     #[test]
     fn a_payload_is_unsigned_its_sha256_or_chunked() {
-        let code = |pairs: &[(&str, &str)]| payload(&headers(pairs)).err().map(|e| e.1);
+        let code = |pairs: &[(&str, &str)]| payload(&headers(pairs)).err().map(|e| e.code.name());
         let plain = |pairs: &[(&str, &str)]| {
             let p = payload(&headers(pairs)).ok().unwrap();
             assert!(p.framing.is_none());
@@ -1296,7 +1203,7 @@ mod tests {
             let e = expected(&headers(&[(name, &value)])).ok().unwrap();
             assert_eq!(e.checksum.unwrap().header, name);
         }
-        let code = |pairs: &[(&str, &str)]| expected(&headers(pairs)).err().map(|e| e.1);
+        let code = |pairs: &[(&str, &str)]| expected(&headers(pairs)).err().map(|e| e.code.name());
         assert_eq!(code(&[("content-md5", "AAAA")]), Some("InvalidDigest"));
         assert_eq!(code(&[("content-md5", "!!")]), Some("InvalidDigest"));
         assert_eq!(
@@ -1352,7 +1259,7 @@ mod tests {
                 ("x-amz-checksum-sha256", &sha)
             ]))
             .err()
-            .map(|e| e.1),
+            .map(|e| e.code.name()),
             Some("InvalidRequest")
         );
         assert!(plan(&headers(&[streaming, length, crc])).is_ok());
diff --git a/vk-registry/src/s3/path.rs b/vk-registry/src/s3/path.rs
index 93c2bbc0..94ee1890 100644
--- a/vk-registry/src/s3/path.rs
+++ b/vk-registry/src/s3/path.rs
@@ -5,6 +5,7 @@
 //! a repository name's component, the leaf a tag, no empty component and no trailing slash.
 //! Arbitrary keys would need an escaping scheme, which this view deliberately does not have.
 
+use super::error::{Code, Refusal};
 use crate::dav::decode_segment;
 
 /// Most components a key may have: a repository name's bound less `files` and the bucket.
@@ -28,70 +29,52 @@ pub(crate) enum Target {
     Object { key: String, segs: Vec<String> },
 }
 
-/// Why a path names nothing this view serves: an S3 error code and the rule it broke.
-#[derive(Debug, PartialEq, Eq)]
-pub(crate) struct Refusal {
-    pub(crate) code: &'static str,
-    pub(crate) message: &'static str,
-}
+const BAD_ESCAPE: &str = "the key has a malformed percent escape or is not UTF-8";
+const EMPTY_COMPONENT: &str = "a key has no empty component and does not end in a slash";
+const BAD_CHARACTER: &str = "a key's components are runs of A-Z a-z 0-9 . _ - only";
+const DOT_COMPONENT: &str = "a key component cannot be . or ..";
+const RESERVED_COMPONENT: &str = "a key component cannot be tags, manifests or blobs";
+const TOO_DEEP: &str = "a key has at most 14 components";
 
-const fn refusal(code: &'static str, message: &'static str) -> Refusal {
-    Refusal { code, message }
+/// A key the store's names cannot hold: `InvalidArgument`, naming the rule it broke, which no
+/// S3 has.
+const fn invalid_key(rule: &'static str) -> Refusal {
+    Refusal::said(Code::InvalidArgument, rule)
 }
 
-const BAD_BUCKET: Refusal = refusal(
-    "InvalidBucketName",
-    "a bucket name is one run of A-Z a-z 0-9 . _ - and not tags, manifests or blobs",
-);
-const BAD_ESCAPE: Refusal = refusal(
-    "InvalidArgument",
-    "the key has a malformed percent escape or is not UTF-8",
-);
-const EMPTY_COMPONENT: Refusal = refusal(
-    "InvalidArgument",
-    "a key has no empty component and does not end in a slash",
-);
-const BAD_CHARACTER: Refusal = refusal(
-    "InvalidArgument",
-    "a key's components are runs of A-Z a-z 0-9 . _ - only",
-);
-const DOT_COMPONENT: Refusal = refusal("InvalidArgument", "a key component cannot be . or ..");
-const RESERVED_COMPONENT: Refusal = refusal(
-    "InvalidArgument",
-    "a key component cannot be tags, manifests or blobs",
-);
-const TOO_DEEP: Refusal = refusal("InvalidArgument", "a key has at most 14 components");
-const COMPONENT_TOO_LONG: Refusal =
-    refusal("KeyTooLongError", "a key component is at most 255 bytes");
-const KEY_TOO_LONG: Refusal = refusal("KeyTooLongError", "a key is at most 1024 bytes");
+/// A key, or one of its components, longer than `most` bytes: `KeyTooLongError`, with the
+/// length and the bound.
+fn too_long(len: usize, most: usize) -> Refusal {
+    Refusal::new(Code::KeyTooLongError)
+        .with("Size", len.to_string())
+        .with("MaxSizeAllowed", most.to_string())
+}
 
-/// Why S3 could not parse a request's path at all, which it answers 400 `InvalidURI` before
-/// looking at the credential: a component with a malformed percent escape, not UTF-8 once
-/// decoded or holding a control character (as ceph's suite has S3 refuse `\u{8a}`), or `..`
-/// components that climb above the root, `\` separating them as `/` does.
+/// Whether S3 could not parse a request's path at all, which it answers 400 `InvalidURI`
+/// before looking at the credential: a component with a malformed percent escape, not UTF-8
+/// once decoded or holding a control character (as ceph's suite has S3 refuse `\u{8a}`),
+/// or `..` components that climb above the root, `\` separating them as `/` does.
 /// `rel` is the path below the S3 root: what follows `/s3` path-style, the whole path of a
 /// request whose host names the bucket. A `.` or `..` that stays below the root is a key's
 /// component, which [`parse`] refuses as such.
-pub(crate) fn unparsable(rel: &str) -> Option<&'static str> {
+pub(crate) fn unparsable(rel: &str) -> bool {
     let mut depth = 0usize;
     for raw in rel.split('/') {
         let Some(seg) = decode_segment(raw).filter(|s| !s.chars().any(char::is_control)) else {
-            return Some(
-                "the request's path has a malformed percent escape, is not UTF-8 or holds a control character",
-            );
+            return true;
         };
         for part in seg.split('\\') {
             match part {
                 "" | "." => {}
                 ".." => match depth.checked_sub(1) {
                     Some(up) => depth = up,
-                    None => return Some("the request's path climbs above its root"),
+                    None => return true,
                 },
                 _ => depth += 1,
             }
         }
     }
-    None
+    false
 }
 
 /// What the path of a request under `/s3` names; the caller dispatches only `/s3` paths here.
@@ -107,7 +90,7 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
     };
     let bucket = decode_segment(raw_bucket)
         .filter(|b| is_bucket(b))
-        .ok_or(BAD_BUCKET)?;
+        .ok_or_else(|| Refusal::new(Code::InvalidBucketName).with("BucketName", raw_bucket))?;
     let raw_key = match raw_key {
         None | Some("") => return Ok(Target::Bucket(bucket)),
         Some(k) => k,
@@ -115,13 +98,13 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
     let mut segs = vec![bucket];
     for raw in raw_key.split('/') {
         if segs.len() > MAX_KEY_COMPONENTS {
-            return Err(TOO_DEEP);
+            return Err(invalid_key(TOO_DEEP));
         }
         segs.push(component(raw)?);
     }
     let key = segs.get(1..).unwrap_or_default().join("/");
     if key.len() > MAX_KEY {
-        return Err(KEY_TOO_LONG);
+        return Err(too_long(key.len(), MAX_KEY));
     }
     Ok(Target::Object { key, segs })
 }
@@ -135,26 +118,26 @@ pub(crate) fn is_bucket(name: &str) -> bool {
 /// leaf, as a tag, also passes).
 fn component(raw: &str) -> Result<String, Refusal> {
     if raw.is_empty() {
-        return Err(EMPTY_COMPONENT);
+        return Err(invalid_key(EMPTY_COMPONENT));
     }
-    let seg = decode_segment(raw).ok_or(BAD_ESCAPE)?;
+    let seg = decode_segment(raw).ok_or(invalid_key(BAD_ESCAPE))?;
     if seg.len() > MAX_COMPONENT {
-        return Err(COMPONENT_TOO_LONG);
+        return Err(too_long(seg.len(), MAX_COMPONENT));
     }
     if seg.is_empty() {
-        return Err(EMPTY_COMPONENT);
+        return Err(invalid_key(EMPTY_COMPONENT));
     }
     if !seg
         .bytes()
         .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'))
     {
-        return Err(BAD_CHARACTER);
+        return Err(invalid_key(BAD_CHARACTER));
     }
     if seg == "." || seg == ".." {
-        return Err(DOT_COMPONENT);
+        return Err(invalid_key(DOT_COMPONENT));
     }
     if !crate::valid_name(&seg) {
-        return Err(RESERVED_COMPONENT);
+        return Err(invalid_key(RESERVED_COMPONENT));
     }
     Ok(seg)
 }
@@ -168,11 +151,11 @@ mod tests {
     }
 
     #[track_caller]
-    fn refused(key: &str, code: &str) -> &'static str {
+    fn refused(key: &str, code: Code) -> Refusal {
         match object(key) {
             Err(r) => {
-                assert_eq!(r.code, code, "{key:?}: {}", r.message);
-                r.message
+                assert_eq!(r.code, code, "{key:?}: {}", r.message());
+                r
             }
             Ok(t) => panic!("accepted {key:?} as {t:?}"),
         }
@@ -196,7 +179,7 @@ mod tests {
             "/../x",
             "/..",
         ] {
-            assert!(unparsable(bad).is_some(), "{bad}");
+            assert!(unparsable(bad), "{bad}");
         }
         for good in [
             "",
@@ -209,7 +192,7 @@ mod tests {
             "/b/./k",
             "/b/a%2F..%2F..%2F..",
         ] {
-            assert_eq!(unparsable(good), None, "{good}");
+            assert!(!unparsable(good), "{good}");
         }
     }
 
@@ -234,7 +217,8 @@ mod tests {
             "/s3/a%2",
         ] {
             let r = parse(bad).unwrap_err();
-            assert_eq!(r.code, "InvalidBucketName", "{bad}");
+            assert_eq!(r.code, Code::InvalidBucketName, "{bad}");
+            assert_eq!(r.message(), "The specified bucket is not valid.");
         }
     }
 
@@ -281,23 +265,35 @@ mod tests {
     #[test]
     fn keys_outside_the_store_s_names_are_refused_naming_the_rule() {
         let too_deep = vec!["x"; MAX_KEY_COMPONENTS + 1].join("/");
-        assert!(refused(&too_deep, "InvalidArgument").contains("14"));
-        assert!(refused(&"x".repeat(256), "KeyTooLongError").contains("255"));
+        let says = |r: Refusal, rule: &str| r.message().contains(rule);
+        assert!(says(refused(&too_deep, Code::InvalidArgument), "14"));
+        let r = refused(&"x".repeat(256), Code::KeyTooLongError);
+        assert_eq!(r.message(), "Your key is too long.");
+        assert_eq!(r.element("Size"), Some("256"));
+        assert_eq!(r.element("MaxSizeAllowed"), Some("255"));
         let over = format!("{}y", longest());
         assert_eq!(over.len(), MAX_KEY + 1);
-        assert!(refused(&over, "KeyTooLongError").contains("1024"));
+        let r = refused(&over, Code::KeyTooLongError);
+        assert_eq!(r.element("Size"), Some("1025"));
+        assert_eq!(r.element("MaxSizeAllowed"), Some("1024"));
         for empty in ["a//b", "a/", "a/b/", "/a"] {
             assert!(
-                refused(empty, "InvalidArgument").contains("empty"),
+                says(refused(empty, Code::InvalidArgument), "empty"),
                 "{empty}"
             );
         }
         for dot in [".", "..", "a/./b", "a/../b", "%2E%2E/x"] {
-            assert!(refused(dot, "InvalidArgument").contains(". or .."), "{dot}");
+            assert!(
+                says(refused(dot, Code::InvalidArgument), ". or .."),
+                "{dot}"
+            );
         }
         for reserved in ["tags", "a/manifests/b", "blobs/x", "a/blobs"] {
             assert!(
-                refused(reserved, "InvalidArgument").contains("tags, manifests or blobs"),
+                says(
+                    refused(reserved, Code::InvalidArgument),
+                    "tags, manifests or blobs"
+                ),
                 "{reserved}"
             );
         }
@@ -317,12 +313,12 @@ mod tests {
             "a*b",
         ] {
             assert!(
-                refused(bad, "InvalidArgument").contains("A-Z a-z 0-9 . _ -"),
+                says(refused(bad, Code::InvalidArgument), "A-Z a-z 0-9 . _ -"),
                 "{bad}"
             );
         }
         for bad in ["a%2", "a%G0", "%FF", "%C3"] {
-            assert!(refused(bad, "InvalidArgument").contains("escape"), "{bad}");
+            assert!(says(refused(bad, Code::InvalidArgument), "escape"), "{bad}");
         }
     }
 }
diff --git a/vk-registry/src/s3/sigv4.rs b/vk-registry/src/s3/sigv4.rs
index cddcc905..60e4ed80 100644
--- a/vk-registry/src/s3/sigv4.rs
+++ b/vk-registry/src/s3/sigv4.rs
@@ -47,55 +47,81 @@ impl Credential<'_> {
     }
 }
 
+/// What AWS says of an `Authorization` value with fewer or more fields than three.
+const THREE_COMPONENTS: &str =
+    "the authorization header requires three components: Credential, SignedHeaders, and Signature.";
+
 /// Parse an `Authorization` value: `AWS4-HMAC-SHA256 Credential=<id>/<date>/<region>/<service>/
-/// <terminator>, SignedHeaders=<a;b;…>, Signature=<hex>`, the fields in any order, separated
-/// by commas with or without spaces. The scope is split from the right, so an id may hold a
-/// `/` and a scope field may not. The reason a value is malformed otherwise.
-pub(crate) fn parse_authorization(value: &str) -> Result<Credential<'_>, &'static str> {
+/// <terminator>, SignedHeaders=<a;b;…>, Signature=<hex>`, the three fields in any order,
+/// separated by commas with or without spaces, the credential's scope for `service`. The
+/// scope is split from the right, so an id may hold a `/` and a scope field may not. What is
+/// malformed otherwise is said as AWS says it after "The authorization header is malformed; ",
+/// checked in AWS's order: the fields, the credential's shape, its service, its terminator,
+/// its date.
+pub(crate) fn parse_authorization<'v>(
+    value: &'v str,
+    service: &str,
+) -> Result<Credential<'v>, String> {
     let fields = value
         .strip_prefix(ALGORITHM)
         .and_then(|r| r.strip_prefix(' '))
         .ok_or("the algorithm must be AWS4-HMAC-SHA256")?;
+    let fields: Vec<&str> = fields.split(',').map(str::trim).collect();
+    if fields.len() != 3 {
+        return Err(THREE_COMPONENTS.to_string());
+    }
     let (mut credential, mut signed, mut signature) = (None, None, None);
-    for field in fields.split(',') {
-        let (name, v) = field
-            .trim()
-            .split_once('=')
-            .ok_or("each field must be Name=value")?;
-        let slot = match name {
-            "Credential" => &mut credential,
-            "SignedHeaders" => &mut signed,
-            "Signature" => &mut signature,
-            _ => return Err("unknown field: only Credential, SignedHeaders and Signature"),
+    for field in fields {
+        let Some((name, v)) = field.split_once('=') else {
+            return Err(format!(
+                "the authorization component {field:?} is malformed."
+            ));
         };
-        if slot.replace(v).is_some() {
-            return Err("a field is given twice");
+        // Three fields, one named twice or not one of these: another is missing.
+        match name {
+            "Credential" => credential = Some(v),
+            "SignedHeaders" => signed = Some(v),
+            "Signature" => signature = Some(v),
+            _ => {}
         }
     }
-    let credential = credential.ok_or("Credential is missing")?;
-    let signed = signed.ok_or("SignedHeaders is missing")?;
-    let signature = signature.ok_or("Signature is missing")?;
+    let credential = credential.ok_or("missing Credential.")?;
+    let signed = signed.ok_or("missing SignedHeaders.")?;
+    let signature = signature.ok_or("missing Signature.")?;
 
     let mut scope = credential.rsplitn(5, '/');
-    let (Some(terminator), Some(service), Some(region), Some(date), Some(id)) = (
+    let (Some(terminator), Some(asked), Some(region), Some(date), Some(id)) = (
         scope.next(),
         scope.next(),
         scope.next(),
         scope.next(),
         scope.next(),
     ) else {
-        return Err("Credential must be <id>/<date>/<region>/<service>/aws4_request");
+        return Err(MALFORMED_CREDENTIAL.to_string());
     };
-    if id.is_empty() || region.is_empty() || service.is_empty() || terminator.is_empty() {
-        return Err("Credential has an empty field");
+    if id.is_empty() || region.is_empty() || asked.is_empty() || terminator.is_empty() {
+        return Err(MALFORMED_CREDENTIAL.to_string());
+    }
+    if asked != service {
+        return Err(format!(
+            "incorrect service {asked:?}. This endpoint belongs to {service:?}."
+        ));
+    }
+    if terminator != TERMINATOR {
+        return Err(format!(
+            "incorrect terminal {terminator:?}. This endpoint uses {TERMINATOR:?}."
+        ));
     }
     if date.len() != 8 || !date.bytes().all(|b| b.is_ascii_digit()) {
-        return Err("the credential's date must be YYYYMMDD");
+        return Err(format!(
+            "incorrect date format {date:?}. This date in the credential must be in the format \
+             \"yyyyMMdd\"."
+        ));
     }
     let mut signed_headers = Vec::new();
     for name in signed.split(';') {
         if name.is_empty() || !name.bytes().all(is_lowercase_token) {
-            return Err("SignedHeaders must be lowercase header names separated by ';'");
+            return Err("SignedHeaders must be lowercase header names separated by ';'".into());
         }
         signed_headers.push(name);
     }
@@ -106,34 +132,32 @@ pub(crate) fn parse_authorization(value: &str) -> Result<Credential<'_>, &'stati
             .bytes()
             .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
     {
-        return Err("Signature must be 64 lowercase hex digits");
+        return Err("Signature must be 64 lowercase hex digits".into());
     }
     Ok(Credential {
         id,
         date,
         region,
-        service,
+        service: asked,
         terminator,
         signed_headers,
         signature,
     })
 }
 
+/// What AWS says of a credential that is not five fields.
+const MALFORMED_CREDENTIAL: &str =
+    "the Credential is mal-formed; expecting \"<YOUR-AKID>/YYYYMMDD/REGION/SERVICE/aws4_request\".";
+
 /// A header-name byte (RFC 9110 `tchar`), lowercase.
 fn is_lowercase_token(b: u8) -> bool {
     b.is_ascii_lowercase() || b.is_ascii_digit() || b"!#$%&'*+-.^_`|~".contains(&b)
 }
 
-/// What S3 requires of a SigV4 request beyond the signature: its scope names the service
-/// `s3` and ends in `aws4_request`, and it signs `host` (what it was sent to) and
+/// What S3 requires of a SigV4 request beyond the signature and the scope
+/// [`parse_authorization`] checks: it signs `host` (what it was sent to) and
 /// `x-amz-content-sha256` (what it carries). The reason, when it does not.
 pub(crate) fn s3_refusal(credential: &Credential<'_>) -> Option<&'static str> {
-    if credential.service != "s3" {
-        return Some("the credential's service must be s3");
-    }
-    if credential.terminator != TERMINATOR {
-        return Some("the credential must end in aws4_request");
-    }
     for required in ["host", "x-amz-content-sha256"] {
         if !credential.signed_headers.contains(&required) {
             return Some(if required == "host" {
@@ -146,16 +170,20 @@ pub(crate) fn s3_refusal(credential: &Credential<'_>) -> Option<&'static str> {
     None
 }
 
-/// The first `x-amz-*` header of `headers` the signature does not cover: S3 refuses a request
-/// carrying one, as anything on its way could have added it.
-pub(crate) fn unsigned_amz_header<'h>(
+/// The `x-amz-*` headers of `headers` the signature does not cover, as S3 lists them (`, `
+/// between two), sorted: S3 refuses a request carrying one, as anything on its way could have
+/// added it. `None` when it covers them all.
+pub(crate) fn unsigned_amz_headers(
     credential: &Credential<'_>,
-    headers: &'h HeaderMap,
-) -> Option<&'h str> {
-    headers
+    headers: &HeaderMap,
+) -> Option<String> {
+    let mut unsigned: Vec<&str> = headers
         .keys()
         .map(|name| name.as_str())
-        .find(|name| name.starts_with("x-amz-") && !credential.signed_headers.contains(name))
+        .filter(|name| name.starts_with("x-amz-") && !credential.signed_headers.contains(name))
+        .collect();
+    unsigned.sort_unstable();
+    (!unsigned.is_empty()).then(|| unsigned.join(", "))
 }
 
 /// Why a request's time is refused.
@@ -490,9 +518,10 @@ mod tests {
         verifies: bool,
     }
 
-    fn sign(req: &Request, secret: &str, payload_hash: &str) -> Signed {
+    /// What signing `req` for `service` with `secret` makes.
+    fn sign(req: &Request, service: &str, secret: &str, payload_hash: &str) -> Signed {
         let auth = req.headers["authorization"].to_str().unwrap();
-        let cred = parse_authorization(auth).unwrap();
+        let cred = parse_authorization(auth, service).unwrap();
         let stamp = req.headers["x-amz-date"].to_str().unwrap();
         let canonical = canonical_request(
             &req.method,
@@ -556,7 +585,7 @@ mod tests {
                 }
                 None => EMPTY_SHA256.to_string(),
             };
-            let signed = sign(&req, secret, &payload_hash);
+            let signed = sign(&req, "service", secret, &payload_hash);
             if let Some(stem) = name.strip_suffix("-normalized") {
                 assert_eq!(context["normalize"], true, "{name}");
                 let twin = root.join(format!("{stem}-unnormalized"));
@@ -660,18 +689,20 @@ mod tests {
                 text.push('\n');
             }
             let req = parse_request(&text);
-            let cred = parse_authorization(req.headers["authorization"].to_str().unwrap()).unwrap();
+            let cred =
+                parse_authorization(req.headers["authorization"].to_str().unwrap(), "s3").unwrap();
             assert_eq!(cred.id, "AKIAIOSFODNN7EXAMPLE");
             assert_eq!(s3_refusal(&cred), None, "{line}");
             let payload = req.headers["x-amz-content-sha256"].to_str().unwrap();
-            let signed = sign(&req, S3_SECRET, payload);
+            let signed = sign(&req, "s3", S3_SECRET, payload);
             assert_eq!(signed.canonical, canonical, "{line}");
             assert_eq!(signed.signature, sig, "{line}");
             assert!(signed.verifies, "{line}");
             // Another secret, or one byte of the request changed, and it no longer does.
-            assert!(!sign(&req, "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEz", payload).verifies);
+            let other = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEz";
+            assert!(!sign(&req, "s3", other, payload).verifies);
             let moved = parse_request(&text.replacen(" /", " /x", 1));
-            assert!(!sign(&moved, S3_SECRET, payload).verifies, "{line}");
+            assert!(!sign(&moved, "s3", S3_SECRET, payload).verifies, "{line}");
         }
     }
 
@@ -775,7 +806,7 @@ mod tests {
             "team/ci/key/20130524/auto/s3/aws4_request",
             "x-amz-date;host;x-amz-content-sha256",
         );
-        let cred = parse_authorization(&value).unwrap();
+        let cred = parse_authorization(&value, "s3").unwrap();
         assert_eq!(cred.id, "team/ci/key");
         assert_eq!(cred.date, "20130524");
         assert_eq!(cred.region, "auto");
@@ -817,7 +848,7 @@ mod tests {
             "AWS4-HMAC-SHA256".to_string(),
             "AWS4-HMAC-SHA256 ".to_string(),
         ] {
-            assert!(parse_authorization(&bad).is_err(), "{bad}");
+            assert!(parse_authorization(&bad, "s3").is_err(), "{bad}");
         }
     }
 
@@ -827,7 +858,7 @@ mod tests {
             "id/20130524/us-east-1/s3/aws4_request",
             "host;x-amz-content-sha256;x-amz-date;x-amz-meta-x",
         );
-        let cred = parse_authorization(&header).unwrap();
+        let cred = parse_authorization(&header, "s3").unwrap();
         let mut headers = HeaderMap::new();
         for name in [
             "x-amz-content-sha256",
@@ -840,36 +871,91 @@ mod tests {
                 hyper::header::HeaderValue::from_static("v"),
             );
         }
-        assert_eq!(unsigned_amz_header(&cred, &headers), None);
+        assert_eq!(unsigned_amz_headers(&cred, &headers), None);
         headers.insert(
             hyper::header::HeaderName::from_static("x-amz-meta-y"),
             hyper::header::HeaderValue::from_static("v"),
         );
-        assert_eq!(unsigned_amz_header(&cred, &headers), Some("x-amz-meta-y"));
+        assert_eq!(
+            unsigned_amz_headers(&cred, &headers).as_deref(),
+            Some("x-amz-meta-y")
+        );
+        headers.insert(
+            hyper::header::HeaderName::from_static("x-amz-copy-source"),
+            hyper::header::HeaderValue::from_static("v"),
+        );
+        assert_eq!(
+            unsigned_amz_headers(&cred, &headers).as_deref(),
+            Some("x-amz-copy-source, x-amz-meta-y")
+        );
     }
 
     #[test]
     fn s3_requires_its_service_and_both_headers_signed() {
         let refusal = |credential: &str, signed: &str| {
-            s3_refusal(&parse_authorization(&authorization(credential, signed)).unwrap())
+            s3_refusal(&parse_authorization(&authorization(credential, signed), "s3").unwrap())
         };
         let ok = "id/20130524/us-east-1/s3/aws4_request";
         assert_eq!(refusal(ok, "host;x-amz-content-sha256;x-amz-date"), None);
         assert!(refusal(ok, "x-amz-content-sha256;x-amz-date").is_some());
         assert!(refusal(ok, "host;x-amz-date").is_some());
-        assert!(
-            refusal(
-                "id/20130524/us-east-1/service/aws4_request",
-                "host;x-amz-content-sha256"
-            )
-            .is_some()
+    }
+
+    /// The reasons AWS gives, after "The authorization header is malformed; ", in its order:
+    /// the service before the terminator before the date.
+    #[test]
+    fn a_malformed_authorization_is_said_as_aws_says_it() {
+        let why = |value: &str| parse_authorization(value, "s3").unwrap_err();
+        let signed = "host;x-amz-content-sha256";
+        let with = |credential: &str| why(&authorization(credential, signed));
+        assert_eq!(
+            with("id/3223423234/us-east-1/s3/aws4_request"),
+            "incorrect date format \"3223423234\". This date in the credential must be in the \
+             format \"yyyyMMdd\"."
+        );
+        assert_eq!(
+            with("id/32234/us-east-1/ec2/aws4_request"),
+            "incorrect service \"ec2\". This endpoint belongs to \"s3\"."
         );
-        assert!(
-            refusal(
-                "id/20130524/us-east-1/s3/aws4_requesT",
-                "host;x-amz-content-sha256"
-            )
-            .is_some()
+        assert_eq!(
+            with("id/32234/us-east-1/s3/aws_request"),
+            "incorrect terminal \"aws_request\". This endpoint uses \"aws4_request\"."
+        );
+        assert_eq!(
+            with("us-east-1/s3/aws4_request"),
+            "the Credential is mal-formed; expecting \
+             \"<YOUR-AKID>/YYYYMMDD/REGION/SERVICE/aws4_request\"."
+        );
+        let ok = "id/20130524/us-east-1/s3/aws4_request";
+        assert_eq!(
+            why(&format!(
+                "AWS4-HMAC-SHA256 Credential={ok}, SignedHeaders={signed}"
+            )),
+            THREE_COMPONENTS
+        );
+        assert_eq!(
+            why(&format!(
+                "AWS4-HMAC-SHA256 Credential={ok}, SignedHeaders-x, Signature={SIG}"
+            )),
+            "the authorization component \"SignedHeaders-x\" is malformed."
+        );
+        assert_eq!(
+            why(&format!(
+                "AWS4-HMAC-SHA256 Creds={ok}, SignedHeaders={signed}, Signature={SIG}"
+            )),
+            "missing Credential."
+        );
+        assert_eq!(
+            why(&format!(
+                "AWS4-HMAC-SHA256 Credential={ok}, Signature={SIG}, Signature={SIG}"
+            )),
+            "missing SignedHeaders."
+        );
+        assert_eq!(
+            why(&format!(
+                "AWS4-HMAC-SHA256 Credential={ok}, SignedHeaders={signed}, Sig={SIG}"
+            )),
+            "missing Signature."
         );
     }
 
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index ad7f45f1..a8ee7698 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -513,6 +513,27 @@ impl Resp {
         );
         self
     }
+
+    /// For an error, that its `Message` is `message`, S3's words for it.
+    #[track_caller]
+    fn says(&self, message: &str) -> &Self {
+        assert!(
+            self.body
+                .contains(&format!("<Message>{}</Message>", xml_escaped(message))),
+            "{}",
+            self.body
+        );
+        self
+    }
+}
+
+/// `text` as an XML document carries it.
+fn xml_escaped(text: &str) -> String {
+    text.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('\'', "&#39;")
+        .replace('"', "&quot;")
 }
 
 /// A kept-alive connection to the server.
@@ -707,12 +728,18 @@ async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
     let dir = tmp("open");
     let host = spawn(open_state(&dir, true));
     let get = |path: &str| Req::new("GET", path);
-    send(&host, get("/s3/b/k")).await.is(404, "NoSuchKey");
+    send(&host, get("/s3/b/k"))
+        .await
+        .is(404, "NoSuchKey")
+        .says("The specified key does not exist.");
     send(&host, get("/s3/b/k/deeper"))
         .await
         .is(404, "NoSuchKey");
     // A bucket that is not there; listing the buckets is not on an open server.
-    send(&host, get("/s3/b")).await.is(404, "NoSuchBucket");
+    send(&host, get("/s3/b"))
+        .await
+        .is(404, "NoSuchBucket")
+        .says("The specified bucket does not exist.");
     send(&host, get("/s3/b/")).await.is(404, "NoSuchBucket");
     send(&host, get("/s3/")).await.is(403, "AccessDenied");
     send(&host, get("/s3")).await.is(403, "AccessDenied");
@@ -1396,7 +1423,7 @@ async fn a_put_body_is_unsigned_or_its_signed_sha256() {
     let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
         .await
         .expect("answered unread");
-    resp.is(413, "EntityTooLarge");
+    resp.is(400, "EntityTooLarge");
     assert_eq!(staging_left(&dir), 0);
 }
 
@@ -2147,7 +2174,7 @@ async fn a_decoded_length_past_the_cap_is_refused_unread() {
     let resp = tokio::time::timeout(Duration::from_secs(10), conn.response())
         .await
         .expect("answered unread");
-    resp.is(413, "EntityTooLarge");
+    resp.is(400, "EntityTooLarge");
     assert_eq!(staging_left(&dir), 0);
 }
 
@@ -2292,7 +2319,8 @@ async fn conditional_headers_decide_reads_and_writes() {
     send(&host, create("/s3/b/k", HELLO)).await.ok(200);
     send(&host, create("/s3/b/k", b"again"))
         .await
-        .is(412, "PreconditionFailed");
+        .is(412, "PreconditionFailed")
+        .says("At least one of the pre-conditions you specified did not hold");
     let etag = format!("\"{}\"", md5_hex(HELLO));
     // Compare and swap.
     send(
@@ -2926,7 +2954,11 @@ async fn query_names_are_decoded_before_dispatch() {
         .ok(200);
     send(&host, Req::new("GET", "/s3/b/d/k").query("upload%49d=nope"))
         .await
-        .is(404, "NoSuchUpload");
+        .is(404, "NoSuchUpload")
+        .says(
+            "The specified multipart upload does not exist. The upload ID may be invalid, or \
+             the upload may have been aborted or completed.",
+        );
     let resp = send(&host, Req::new("GET", "/s3/b").query("upload%73")).await;
     resp.ok(200);
     assert!(
@@ -3884,7 +3916,8 @@ async fn buckets_are_made_and_removed(host: &str, sign: Sign<'_>) {
     }
     send(host, req("DELETE", "/s3/made"))
         .await
-        .is(409, "BucketNotEmpty");
+        .is(409, "BucketNotEmpty")
+        .says("The bucket you tried to delete is not empty.");
     send(host, req("DELETE", "/s3/made/top")).await.ok(204);
     send(host, req("DELETE", "/s3/made"))
         .await
@@ -5013,7 +5046,7 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
         sign(complete("/s3/b/huge", &id, &[(1, &e1), (2, &e2)])),
     )
     .await;
-    resp.is(413, "EntityTooLarge");
+    resp.is(400, "EntityTooLarge");
     send(&host, sign(Req::new("GET", "/s3/b/huge")))
         .await
         .is(404, "NoSuchKey");

From 411ea114124fee48017cd7f28c3ce67e8139c890 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 11:35:40 +0100
Subject: [PATCH 45/54] vk-registry/s3: say a missing bucket or key before what
 is not served

A request about a bucket that does not exist is 404 NoSuchBucket before
anything else is said of it: an unserved subresource (501), a malformed
argument, a listing's parameters, GetObjectAttributes, a delete of a key
in it, DeleteObjects. A write still makes its bucket, and a request
naming an upload is NoSuchBucket only when the upload is not there
either. A read of an object (GetObject, HeadObject, a part of one) stays
NoSuchKey, as in an empty bucket: OpenDAL takes NoSuchBucket for a broken
configuration rather than a miss, so sccache, whose first request is a
read, would not start on a bucket its first write is to make. An
unserved operation on an object (tagging, retention, legal hold) is
NoSuchKey when the object is not there.

As HeadBucket, this is said only to a caller that may read in the
bucket; any other is answered as before (403, or 501), so it learns
nothing of what exists.
---
 CHANGELOG.md                    |  3 +-
 vk-registry/DESIGN.md           | 21 +++++++++++---
 vk-registry/src/s3/batch.rs     |  4 +--
 vk-registry/src/s3/bucket.rs    | 19 +++++++++++++
 vk-registry/src/s3/mod.rs       | 34 +++++++++++++++++++++--
 vk-registry/src/s3/multipart.rs |  7 +++++
 vk-registry/src/s3/object.rs    | 26 +++++++++++++++++
 vk-registry/tests/s3_e2e.rs     | 49 +++++++++++++++++++++++++++++----
 8 files changed, 148 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8936742d..7d18a728 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,8 @@ All notable changes to virtkit will be documented in this file.
 - **The registry's plain-file area is also served as S3.** Under `/s3/` on `vk-registry`,
   each top-level directory of the WebDAV `files/` area is a bucket, so `sccache`'s S3 backend
   and other S3 clients can share a compiler cache or files with it: point them at
-  `https://<registry>/s3` with any region, and use the registry credential (an API key, a hub
+  `https://<registry>/s3` with any region (a bucket is made by the first write into it, so
+  `sccache` needs none made beforehand), and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
   checksums (in S3's algorithms but the XXHASH family, checked on upload and kept with the
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 8c4b84f6..6c527e93 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -676,6 +676,19 @@ makes (a key outside the store's names, a write over a directory, a presigned UR
 cross-site write, a read-only store), keeps a message that says why. versitygw 1.10.0's
 `s3err` table, which mirrors AWS's messages, and AWS's error-code list are the references.
 
+**A bucket that is not there is said first.** A request about a bucket that does not exist is
+404 `NoSuchBucket` before anything else is said of it — an operation not served, a malformed
+argument, a missing key or upload — except a write, which makes its bucket (below), a
+request naming an upload, which is `NoSuchBucket` only when the upload is not there either,
+since an upload's bucket is made at its completion, and a read of an object (GetObject,
+HeadObject, a part of one), which is 404 `NoSuchKey` as in an empty bucket, where S3 says
+`NoSuchBucket`. Since a write makes the bucket, a bucket not made yet is one with no key; and
+OpenDAL takes `NoSuchBucket` for a broken configuration (`ConfigInvalid`), not for a miss, so
+`sccache`, whose first request is a read of `.sccache_check`, would not start on a bucket its
+first write is to make. As HeadBucket, it is said only to a caller
+that may read in the bucket: one that may not is answered as it would be otherwise (403, or
+501 for what is not served), so it never learns whether the bucket exists.
+
 **A write makes its bucket.** PutObject, CopyObject and CompleteMultipartUpload into a bucket
 that does not exist create it, with every directory above the key, as WebDAV's `PUT` creates
 missing directories, rather than answering S3's `NoSuchBucket`; the write is authorized as
@@ -698,11 +711,11 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`. `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
-| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers, and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
+| `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
-| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted, in a bucket that is not there too), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
+| `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted; a bucket that is not there is 404 `NoSuchBucket`), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
 | `GET /s3/<b>?versioning` and the other configurations | what S3 answers for a bucket with none configured, after HeadBucket's checks: an empty `VersioningConfiguration`, `BucketLoggingStatus`, `NotificationConfiguration` and `AccelerateConfiguration`; `RequestPaymentConfiguration` naming `BucketOwner`; `?tagging` (bucket or object) an empty `TagSet`; `?acl` (bucket or object) an `AccessControlPolicy` granting `FULL_CONTROL` to the owner `vk-registry`; 404 `NoSuchLifecycleConfiguration` (`?lifecycle`), `NoSuchBucketPolicy` (`?policy`, `?policyStatus`), `NoSuchCORSConfiguration` (`?cors`), `ServerSideEncryptionConfigurationNotFoundError` (`?encryption`), `ObjectLockConfigurationNotFoundError` (`?object-lock`), `ReplicationConfigurationNotFoundError` (`?replication`), `NoSuchWebsiteConfiguration` (`?website`), `NoSuchPublicAccessBlockConfiguration` (`?publicAccessBlock`), `OwnershipControlsNotFoundError` (`?ownershipControls`). An object's after GetObject's checks. Tools probe these before they use a bucket. A `PUT` or `DELETE` of any of them is 501 `NotImplemented`, its body read through. So is any request whose headers ask for one of them on the object or bucket it names, rather than the header being taken and dropped: `x-amz-server-side-encryption*` (SSE-S3, SSE-KMS and SSE-C, on a read and a copy's source too: a client that asked for its own key is never told its bytes are stored under it), `x-amz-tagging` naming a tag, `x-amz-acl` other than `private` or `bucket-owner-full-control` (the one ACL there is), `x-amz-grant-*`, `x-amz-storage-class` other than `STANDARD` (400 `InvalidStorageClass` for a class S3 does not have), `x-amz-website-redirect-location` and `x-amz-object-lock-*` |
@@ -719,7 +732,7 @@ reads; a replaced object keeps only what its own write sent.
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
-| anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take; an SDK's `x-id` operation hint is ignored |
+| anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take, once the bucket and, for an object's, the object are found there (404 `NoSuchBucket`, `NoSuchKey`), as S3 looks them up first; an SDK's `x-id` operation hint is ignored |
 
 **XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
 element scanner of this registry's own, not a parser: UTF-8 only; the XML declaration,
diff --git a/vk-registry/src/s3/batch.rs b/vk-registry/src/s3/batch.rs
index d558001c..ec762a78 100644
--- a/vk-registry/src/s3/batch.rs
+++ b/vk-registry/src/s3/batch.rs
@@ -196,8 +196,8 @@ fn refused(entry: &Entry) -> Option<Refusal> {
 }
 
 /// `POST /s3/<bucket>?delete`: each key of the document deleted, or the reason it was not,
-/// in the order asked, a key the store fails on included. A bucket that does not exist holds none of the keys, which all count
-/// as deleted, as DeleteObject answers for each.
+/// in the order asked, a key the store fails on included. A bucket that does not exist is
+/// `NoSuchBucket`, said before ([`super::bucket::missing`]).
 pub(super) async fn delete(
     state: &ServerState,
     authz: &Authz<'_>,
diff --git a/vk-registry/src/s3/bucket.rs b/vk-registry/src/s3/bucket.rs
index dc3b8d01..2ed47413 100644
--- a/vk-registry/src/s3/bucket.rs
+++ b/vk-registry/src/s3/bucket.rs
@@ -94,6 +94,25 @@ async fn check(
     Ok((!exists).then(|| ctx.error(no_such_bucket(bucket))))
 }
 
+/// `NoSuchBucket` for a request about `bucket`, answered before anything else of it, when no
+/// such directory exists and the caller may read in it, as HeadBucket admits: `None` when the
+/// bucket is there, and for a caller that may not, which learns nothing and is answered as the
+/// request would be otherwise.
+pub(super) async fn missing(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: &str,
+    ctx: &Ctx,
+) -> anyhow::Result<Option<Response<Body>>> {
+    let repo = format!("{FILES_REPO}/{bucket}");
+    if !authz.may_read_below(&repo) {
+        return Ok(None);
+    }
+    let store = std::sync::Arc::clone(&state.store);
+    let exists = tokio::task::spawn_blocking(move || store.repo_dir_exists(&repo)).await?;
+    Ok((!exists).then(|| ctx.error(no_such_bucket(bucket))))
+}
+
 /// `HEAD /s3/<bucket>`.
 pub(super) async fn head(
     state: &ServerState,
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index 3a0d0d55..bee123e5 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -303,8 +303,9 @@ fn subresource(params: &Params) -> Option<&str> {
     })
 }
 
-/// An authenticated request, to the operation its method, path and query name. What is not
-/// served answers `NotImplemented` once the body is read, as every refusal past the gate does;
+/// An authenticated request, to the operation its method, path and query name, once a bucket
+/// that is not there has been said to be ([`bucket::missing`]). What is not served answers
+/// `NotImplemented` once the body is read, as every refusal past the gate does;
 /// so does a request whose headers ask for a configuration this registry keeps nothing of
 /// ([`canned::asked`]), whatever its operation. `seed` is what a signed `aws-chunked` body's
 /// signatures are checked against.
@@ -329,6 +330,30 @@ async fn operate(
     if let Some(why) = canned::asked(req.headers()) {
         return refuse(req, ctx.error(why), ctx).await;
     }
+    // Before anything else is said of a bucket that is not there, to one who may know: but
+    // not of a write, which makes its bucket, nor of a request naming an upload, which is
+    // looked up first, nor of a read of an object, which is a miss as it is in an empty
+    // bucket: OpenDAL takes a `NoSuchBucket` for a broken configuration, not for a miss, so
+    // sccache would not start on a bucket its first write was to make.
+    let bucket_first = match (&target, req.method()) {
+        _ if multipart::names(&query, "uploadId") => None,
+        (path::Target::Object { .. }, &Method::GET | &Method::HEAD)
+            if subresource(&query).is_none() || part_asked(&query).is_some() =>
+        {
+            None
+        }
+        (path::Target::Bucket(_), &Method::PUT) if subresource(&query).is_none() => None,
+        (path::Target::Object { .. }, &Method::PUT) if subresource(&query).is_none() => None,
+        (path::Target::Object { .. }, &Method::POST) if multipart::names(&query, "uploads") => None,
+        (path::Target::Bucket(b), _) => Some(b.as_str()),
+        (path::Target::Object { segs, .. }, _) => segs.first().map(String::as_str),
+        (path::Target::Service, _) => None,
+    };
+    if let Some(b) = bucket_first
+        && let Some(resp) = bucket::missing(state, authz, b, ctx).await?
+    {
+        return refuse(req, resp, ctx).await;
+    }
     let part = match part_asked(&query) {
         None => None,
         Some(value) => match multipart::part_number(value) {
@@ -392,7 +417,7 @@ async fn operate(
         }
         (path::Target::Object { segs, .. }, &Method::GET, Some(sub)) => match canned::object(sub) {
             Some(canned) => object::configuration(state, authz, segs, canned, req, ctx).await,
-            None => refuse(req, ctx.not_implemented(), ctx).await,
+            None => object::unserved(state, authz, segs, req, ctx).await,
         },
         // A copy names its source in a header, and its body is not the object.
         (path::Target::Object { segs, .. }, &Method::PUT, None)
@@ -407,6 +432,9 @@ async fn operate(
             let versioned = query.iter().any(|(name, _)| name == "versionId");
             object::delete(state, authz, segs, versioned, req, ctx).await
         }
+        (path::Target::Object { segs, .. }, _, _) => {
+            object::unserved(state, authz, segs, req, ctx).await
+        }
         _ => refuse(req, ctx.not_implemented(), ctx).await,
     }
 }
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index c786e269..6a59b34b 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -474,6 +474,13 @@ pub(super) async fn upload(
 ) -> Result<Response<Body>> {
     let params = params(query);
     let id = param(&params, "uploadId").unwrap_or_default().to_string();
+    // A bucket that is not there is said first, when the upload is not there either: an
+    // upload is made before its bucket is, at its completion.
+    if let Some(resp) = bucket::missing(state, authz, bucket_of(&segs), ctx).await?
+        && open_async(state, &id, &segs).await?.is_none()
+    {
+        return refuse(req, resp, ctx).await;
+    }
     let method = req.method().clone();
     let taken: &[&str] = match method {
         Method::PUT => &["uploadId", "partNumber"],
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 76db7bc4..07c1abe1 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -357,6 +357,32 @@ pub(super) async fn attributes(
     .await
 }
 
+/// An operation on the object at `segs` that is not served: `NoSuchKey` first when no object
+/// is there for a caller that may read it, as S3 looks the object up before what it is asked
+/// of it, and `NotImplemented` otherwise.
+pub(super) async fn unserved(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    segs: Vec<String>,
+    req: Request<Incoming>,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    if !admitted(authz, accounts::Action::Read, &segs) {
+        return refuse(req, ctx.not_implemented(), ctx).await;
+    }
+    let resp = {
+        let ctx = ctx.clone();
+        crate::dav::blocking(state, authz, move |store, authz| {
+            Ok(match readable(store, authz, &segs)? {
+                Some(_) => ctx.not_implemented(),
+                None => no_such_key(&ctx, &segs),
+            })
+        })
+        .await?
+    };
+    refuse(req, resp, ctx).await
+}
+
 /// `GET /s3/<bucket>/<key>?tagging|acl`: the configuration `canned` says an object has, once
 /// the object is one the caller may read.
 pub(super) async fn configuration(
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index a8ee7698..6c01133b 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -728,6 +728,7 @@ async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
     let dir = tmp("open");
     let host = spawn(open_state(&dir, true));
     let get = |path: &str| Req::new("GET", path);
+    // A read of a key in a bucket not made yet is a miss, as in an empty bucket.
     send(&host, get("/s3/b/k"))
         .await
         .is(404, "NoSuchKey")
@@ -735,6 +736,13 @@ async fn an_open_server_checks_no_signature_but_refuses_presigned_and_tokens() {
     send(&host, get("/s3/b/k/deeper"))
         .await
         .is(404, "NoSuchKey");
+    send(&host, get("/s3/b/k").query("partNumber=1"))
+        .await
+        .is(404, "NoSuchKey");
+    send(&host, Req::new("HEAD", "/s3/b/k")).await.ok(404);
+    send(&host, get("/s3/b/k").query("attributes="))
+        .await
+        .is(404, "NoSuchBucket");
     // A bucket that is not there; listing the buckets is not on an open server.
     send(&host, get("/s3/b"))
         .await
@@ -817,6 +825,7 @@ async fn a_shared_bearer_is_the_access_key_and_its_secret() {
     )
     .await
     .is(404, "NoSuchKey");
+    // Outside its grants, nothing is said of what is there.
     send(&host, get().signed(&host, (&token, &token), 0))
         .await
         .is(403, "AccessDenied");
@@ -1191,6 +1200,7 @@ fn is_object(resp: &Resp, body: &[u8]) {
 /// OpenDAL's `stat` sends.
 async fn sccache_sequence(host: &str, sign: Sign<'_>, prefix: &str) {
     let check = format!("/s3/sccache/{prefix}.sccache_check");
+    // Before the bucket is made too: OpenDAL takes `NoSuchBucket` for a broken configuration.
     send(host, sign(Req::new("GET", &check)))
         .await
         .is(404, "NoSuchKey");
@@ -2664,7 +2674,7 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     send(&host, Req::new("DELETE", "/s3/b/k")).await.ok(204);
     send(&host, Req::new("DELETE", "/s3/nobucket/k"))
         .await
-        .ok(204);
+        .is(404, "NoSuchBucket");
     send(&host, Req::new("DELETE", "/s3/b/d")).await.ok(204);
     is_object(&send(&host, Req::new("GET", "/s3/b/d/x")).await, HELLO);
     send(&host, Req::new("DELETE", "/s3/b/img/v1"))
@@ -4395,10 +4405,11 @@ async fn objects_are_deleted_in_batches(host: &str, sign: Sign<'_>, store: &Stor
     assert_eq!(delete_result(&send(host, sign(crc)).await).0, ["c"]);
     let plain = Req::new("POST", "/s3/batch").query("delete=").body(doc);
     assert_eq!(delete_result(&send(host, sign(plain)).await).0, ["c"]);
-    // A bucket that is not there holds none of the keys.
+    // A bucket that is not there is said first.
     let doc = delete_doc(&[&key_of("k")], false);
-    let resp = send(host, sign(delete_objects("nobucket", doc))).await;
-    assert_eq!(delete_result(&resp).0, ["k"]);
+    send(host, sign(delete_objects("nobucket", doc)))
+        .await
+        .is(404, "NoSuchBucket");
 }
 
 #[tokio::test]
@@ -4564,6 +4575,19 @@ async fn configurations_are_canned(host: &str, sign: Sign<'_>) {
             .body(b"<Tagging/>".to_vec());
         send(host, sign(req)).await.is(501, "NotImplemented");
     }
+    // A bucket or a key that is not there is said first, as S3 looks it up first.
+    for (method, path, q, code) in [
+        ("PUT", "/s3/none", "policy", "NoSuchBucket"),
+        ("DELETE", "/s3/none", "cors", "NoSuchBucket"),
+        ("PUT", "/s3/none/k", "tagging", "NoSuchBucket"),
+        ("GET", "/s3/none/k", "attributes", "NoSuchBucket"),
+        ("GET", "/s3/none/k", "retention", "NoSuchBucket"),
+        ("PUT", "/s3/conf/absent", "tagging", "NoSuchKey"),
+        ("GET", "/s3/conf/absent", "legal-hold", "NoSuchKey"),
+    ] {
+        let req = Req::new(method, path).query(&format!("{q}="));
+        send(host, sign(req)).await.is(404, code);
+    }
     is_object(
         &send(host, sign(Req::new("GET", "/s3/conf/k"))).await,
         HELLO,
@@ -4597,6 +4621,16 @@ async fn configurations_are_canned_with_an_api_key() {
     send(&host, other(Req::new("GET", "/s3/conf/k").query("acl=")))
         .await
         .is(403, "AccessDenied");
+    // Nor is it told a bucket or a key is not there.
+    send(&host, other(Req::new("PUT", "/s3/none").query("policy=")))
+        .await
+        .is(501, "NotImplemented");
+    send(
+        &host,
+        other(Req::new("PUT", "/s3/conf/absent").query("tagging=")),
+    )
+    .await
+    .is(501, "NotImplemented");
 }
 
 // ---- multipart uploads ----
@@ -4967,7 +5001,12 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
         let req = Req::new("PUT", other)
             .query(&part_query(&id, 1))
             .body(data.clone());
-        send(&host, sign(req)).await.is(404, "NoSuchUpload");
+        let code = if other == "/s3/c/k" {
+            "NoSuchBucket"
+        } else {
+            "NoSuchUpload"
+        };
+        send(&host, sign(req)).await.is(404, code);
     }
     for bad in ["..", "0-0-zz", "s3"] {
         let req = Req::new("PUT", path)

From 77c56ea984c69502f5937a88e0597b54ba56e095 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 11:49:42 +0100
Subject: [PATCH 46/54] vk-registry/s3: answer the remaining refusals with S3's
 codes and order

- An aws-chunked body whose framing breaks off or is malformed is
  IncompleteBody (`The request body terminated unexpectedly`), one
  holding other than its declared length IncompleteBody with S3's
  Content-Length sentence, a missing or unreadable decoded length 411
  MissingContentLength, and aws-chunked beside UNSIGNED-PAYLOAD 400
  InvalidArgument.
- An upload that is not there is NoSuchUpload before its part number,
  checksums or copy source are looked at, and before a completion's
  document is read; ListParts refuses a count that is no number first,
  a negative one after the upload. A part copy range past the source's
  end and a completion PartNumber below 1 are InvalidArgument in S3's
  words.
- A read of a key the store cannot name, or a copy from one, is
  NoSuchKey; a key of slashes only is BadRequest; an empty versionId is
  InvalidArgument; GetObjectAttributes with no attribute InvalidRequest.
- SigV2 is InvalidRequest, an x-amz-content-sha256 S3 does not take is
  InvalidArgument before the signature, two checksum headers are
  refused whatever they hold, an unknown tagging directive is
  InvalidArgument.
- PutObject, CopyObject and CompleteMultipartUpload take one condition,
  If-None-Match: * or If-Match: <etag>: both at once, or If-Match: *,
  is 501 NotImplemented naming the header, as an If-None-Match other
  than * already was. An If-Match with no object there is 404
  NoSuchKey, still decided under the namespace lock the tag is written
  under, and a condition that fails is 412 naming it in Condition.
---
 vk-registry/DESIGN.md             | 40 +++++++------
 vk-registry/src/dav/files.rs      |  2 +-
 vk-registry/src/files.rs          | 12 ++--
 vk-registry/src/s3/chunked.rs     | 93 ++++++++++++++++++-------------
 vk-registry/src/s3/conditional.rs | 63 +++++++++++++++++----
 vk-registry/src/s3/copy.rs        | 91 +++++++++++++++++++++++-------
 vk-registry/src/s3/error.rs       | 18 ++++--
 vk-registry/src/s3/mod.rs         | 42 +++++++++++++-
 vk-registry/src/s3/multipart.rs   | 93 ++++++++++++++++++++++++-------
 vk-registry/src/s3/object.rs      | 90 +++++++++++++++++++++++-------
 vk-registry/src/s3/path.rs        | 11 ++++
 vk-registry/tests/s3_e2e.rs       | 83 +++++++++++++++++++++++----
 12 files changed, 486 insertions(+), 152 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 6c527e93..ee12b82a 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -617,8 +617,10 @@ and, as S3 requires, every `x-amz-*` header the request carries: one left out is
 it. The request's time must be on the scope's day
 and within 15 minutes of the server's (403 `RequestTimeTooSkewed`, naming the server's
 time). The usual `Authorization: Bearer|Basic` and the session cookie keep working on `/s3/`;
-an `Authorization` of any other scheme (SigV2, say), or with no scheme at all, is 400
-`InvalidArgument`, as S3 answers a signature version it does not take; a request with no
+an `Authorization` of any other scheme, or with no scheme at all, is 400
+`InvalidArgument`, as S3 answers a signature version it does not take, and SigV2's `AWS` 400
+`InvalidRequest`; an `x-amz-content-sha256` that is no value it takes is 400
+`InvalidArgument` before the signature is checked; a request with no
 credential on a server that requires one is S3's 403 `AccessDenied`, not the 401 challenge. On a server with no credential configured, signatures are not checked, as
 nothing else is. Presigned (query-string) URLs are refused with 400
 `AuthorizationQueryParametersError`, since they put a credential in a URL and so in logs, and
@@ -641,7 +643,9 @@ component that is not UTF-8 once decoded or holds a control character (`\u{8a}`)
 one below `/s3` path-style, the host's virtual-hosted), `\` separating them as `/` does. A
 `..` that stays below the root is a key component. Anything else is 400 `InvalidArgument`,
 `KeyTooLongError` (with the `Size` and the `MaxSizeAllowed`, 1024 for the key, 255 for a
-component) or `InvalidBucketName`, an `InvalidArgument` with a message naming the rule. `sccache`'s keys
+component) or `InvalidBucketName`, an `InvalidArgument` with a message naming the rule; a key
+of slashes only is 400 `BadRequest`. Such a key holds no object, so a read of it (GET, HEAD,
+or a copy's source) is 404 `NoSuchKey`, as S3's of a key it does not hold. `sccache`'s keys
 (`a/b/c/<hex>`, `.sccache_check`) pass. A query's parameters, names and values alike, are percent-decoded
 once, as the signature decodes them, before the request is dispatched on them; a malformed
 escape is 400 `InvalidArgument`.
@@ -710,11 +714,11 @@ reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object; an absent one fails too) are checked under the lock the tag is written under: 412 `PreconditionFailed`. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
-| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidArgument` without the header; touches nothing |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
-| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE` |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE`; an `x-amz-metadata-directive` or `x-amz-tagging-directive` other than `COPY` or `REPLACE` is 400 `InvalidArgument` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted; a bucket that is not there is 404 `NoSuchBucket`), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
@@ -726,11 +730,11 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
-| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`); no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
-| UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 416 `InvalidRange`, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). The numbers must ascend (400 `InvalidPartOrder`), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
+| UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
-| `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload` |
+| `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take, once the bucket and, for an object's, the object are found there (404 `NoSuchBucket`, `NoSuchKey`), as S3 looks them up first; an SDK's `x-id` operation hint is ignored |
 
@@ -751,23 +755,27 @@ by an empty one, then, in the `-TRAILER` modes, the checksum `x-amz-trailer` ann
 when signed, `x-amz-trailer-signature`. `x-amz-content-sha256` names the mode:
 `STREAMING-AWS4-HMAC-SHA256-PAYLOAD` signs every chunk, its `-TRAILER` form the trailer too,
 `STREAMING-UNSIGNED-PAYLOAD-TRAILER` signs nothing and carries the checksum, and
-`Content-Encoding: aws-chunked` beside `UNSIGNED-PAYLOAD` or a SHA-256 is framing alone (the
-SHA-256 then being the decoded bytes'). Chunk signatures chain from the request's own as AWS
+`Content-Encoding: aws-chunked` beside a SHA-256, or no `x-amz-content-sha256`, is framing
+alone (the SHA-256 then being the decoded bytes'); beside `UNSIGNED-PAYLOAD` it is 400
+`InvalidArgument`, as S3 takes no unsigned payload aws-chunked. Chunk signatures chain from the request's own as AWS
 defines them, the trailer's signing its `name:value\n` lines after the last chunk's; they are
 checked with the signing key the request's signature was, which is kept while the body
 streams and wiped after. **A request authenticated by a bearer, Basic or session credential
 rather than SigV4** — the way a proxy that authenticates a guest's requests itself forwards
 them — and any request to a server with no credential has no secret to check them with: its
 framing is decoded and its signatures are read, not checked. `x-amz-decoded-content-length`
-is required (400 `InvalidRequest`), past 4 GiB is 400 `EntityTooLarge` before the body is read, and the chunks
+is required (411 `MissingContentLength`), past 4 GiB is 400 `EntityTooLarge` before the body is read, and the chunks
 must hold exactly that many bytes. The trailer's `x-amz-checksum-{crc32,sha1,sha256}` is
 checked against the decoded bytes and echoed, as a header's is; `crc32c` and `crc64nvme` are
 taken unchecked; a checksum sent both as a header and in the trailer is 400. Reading is
 bounded as it goes: a chunk header of at most 256 bytes, a chunk no longer than what is left
 of the declared length, a trailer of at most 8 KiB, nothing after its end, and memory of one
 frame and a line. A body that breaks any of this is refused where it goes wrong — 400
-`InvalidChunkSizeError`, `IncompleteBody` or `MalformedTrailerError`, 403
-`SignatureDoesNotMatch` — and its staging file is dropped, so nothing it held is tagged. No
+`IncompleteBody` for chunks that break off or are malformed (`The request body terminated
+unexpectedly`) or hold other than the declared length (`You did not provide the number of
+bytes specified by the Content-Length HTTP header`), as S3 answers both, 400
+`MalformedTrailerError`, 403 `SignatureDoesNotMatch` — and its staging file is dropped, so
+nothing it held is tagged. No
 other content encoding is decoded: one named beside `aws-chunked` is 501 `NotImplemented`, as
 is another streaming mode (`STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD`); another encoding
 alone is stored as sent, its name not kept.
diff --git a/vk-registry/src/dav/files.rs b/vk-registry/src/dav/files.rs
index a84d032f..1793205b 100644
--- a/vk-registry/src/dav/files.rs
+++ b/vk-registry/src/dav/files.rs
@@ -351,7 +351,7 @@ async fn put(
             Written::Replaced => no_content(),
             Written::Refused(why) => put_refusal(why, href),
             // Unreachable: no precondition was asked for.
-            Written::PreconditionFailed => no_content(),
+            Written::PreconditionFailed { .. } => no_content(),
         },
     )
 }
diff --git a/vk-registry/src/files.rs b/vk-registry/src/files.rs
index ac596a4b..221e8ccf 100644
--- a/vk-registry/src/files.rs
+++ b/vk-registry/src/files.rs
@@ -305,8 +305,8 @@ pub(crate) enum Written {
     /// written
     Refused(Unwritable),
     /// [`Commit::precondition`] refused the object found there, or its absence; nothing was
-    /// written
-    PreconditionFailed,
+    /// written. `found` says whether an object was there.
+    PreconditionFailed { found: bool },
 }
 
 /// Whether a [`commit`] goes ahead, given the object at its path or `None`.
@@ -398,7 +398,9 @@ fn admit(
     if let Some(precondition) = precondition
         && !precondition(existing.as_ref())
     {
-        return Ok(Err(Written::PreconditionFailed));
+        return Ok(Err(Written::PreconditionFailed {
+            found: existing.is_some(),
+        }));
     }
     Ok(Ok(existing.is_some()))
 }
@@ -621,7 +623,7 @@ mod tests {
         };
         assert!(matches!(
             write(b"two", how).await,
-            Written::PreconditionFailed
+            Written::PreconditionFailed { found: true }
         ));
         assert_eq!(store.tag_target("files/b", "k").unwrap().0, hex);
         let staged = std::fs::read_dir(dir.join("uploads"))
@@ -679,7 +681,7 @@ mod tests {
             ..Commit::default()
         };
         let written = link(&store, &held, &dst, &layer, 3, absent).unwrap();
-        assert!(matches!(written, Written::PreconditionFailed));
+        assert!(matches!(written, Written::PreconditionFailed { .. }));
         let below = segs(&["b", "k", "x"]);
         let written = link(&store, &held, &below, &layer, 3, Commit::default()).unwrap();
         assert!(matches!(written, Written::Refused(Unwritable::UnderObject)));
diff --git a/vk-registry/src/s3/chunked.rs b/vk-registry/src/s3/chunked.rs
index 18482a06..6036bb63 100644
--- a/vk-registry/src/s3/chunked.rs
+++ b/vk-registry/src/s3/chunked.rs
@@ -142,27 +142,32 @@ fn trailer_string_to_sign(stamp: &str, scope: &str, previous: &str, lines_sha256
     )
 }
 
-/// Why a chunked body was refused: the S3 code it is answered with, and what was wrong with
-/// it, which the answer leaves to the code's own message.
+/// Why a chunked body was refused: the S3 code and message it is answered with, and what was
+/// wrong with it, which the answer leaves to S3's words.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) struct Refusal {
     pub(crate) code: Code,
+    pub(crate) said: &'static str,
     pub(crate) message: &'static str,
 }
 
 impl Refusal {
-    /// A chunk header that is malformed, too long, or sizes a chunk past the declared length.
-    fn size(message: &'static str) -> Self {
+    /// A body whose framing breaks off or is not `aws-chunked`'s: a chunk header that is
+    /// malformed or too long, data not followed by CRLF, an end before the last chunk. S3
+    /// answers all of it as a body that ended early.
+    fn malformed(message: &'static str) -> Self {
         Refusal {
-            code: Code::InvalidChunkSizeError,
+            code: Code::IncompleteBody,
+            said: "The request body terminated unexpectedly",
             message,
         }
     }
 
-    /// A body that ends early, or holds other than the declared length.
-    fn incomplete(message: &'static str) -> Self {
+    /// Chunks that hold other than `x-amz-decoded-content-length`.
+    fn mismatch(message: &'static str) -> Self {
         Refusal {
             code: Code::IncompleteBody,
+            said: Code::IncompleteBody.message(),
             message,
         }
     }
@@ -171,6 +176,7 @@ impl Refusal {
     fn trailer(message: &'static str) -> Self {
         Refusal {
             code: Code::MalformedTrailerError,
+            said: Code::MalformedTrailerError.message(),
             message,
         }
     }
@@ -179,6 +185,7 @@ impl Refusal {
     fn signature(message: &'static str) -> Self {
         Refusal {
             code: Code::SignatureDoesNotMatch,
+            said: Code::SignatureDoesNotMatch.message(),
             message,
         }
     }
@@ -186,7 +193,7 @@ impl Refusal {
 
 impl From<Refusal> for super::error::Refusal {
     fn from(r: Refusal) -> Self {
-        super::error::Refusal::new(r.code)
+        super::error::Refusal::said(r.code, r.said)
     }
 }
 
@@ -319,7 +326,9 @@ impl<B> Decoder<B> {
             .extend_from_slice(self.pending.get(..end).unwrap_or_default());
         self.pending.advance(end.saturating_add(1));
         if self.line.pop() != Some(b'\r') {
-            return Err(Refusal::size("a line of the body does not end in CRLF"));
+            return Err(Refusal::malformed(
+                "a line of the body does not end in CRLF",
+            ));
         }
         Ok(true)
     }
@@ -327,41 +336,41 @@ impl<B> Decoder<B> {
     /// The chunk header in `line`: the next chunk's size, and its signature.
     fn header(&mut self) -> Result<(), Refusal> {
         let line = std::mem::take(&mut self.line);
-        let text =
-            std::str::from_utf8(&line).map_err(|_| Refusal::size("a chunk header is not text"))?;
+        let text = std::str::from_utf8(&line)
+            .map_err(|_| Refusal::malformed("a chunk header is not text"))?;
         let (size, extension) = match text.split_once(';') {
             Some((size, extension)) => (size, Some(extension)),
             None => (text, None),
         };
         if size.is_empty() || size.len() > 16 || !size.bytes().all(|b| b.is_ascii_hexdigit()) {
-            return Err(Refusal::size("a chunk size is not a hex number"));
+            return Err(Refusal::malformed("a chunk size is not a hex number"));
         }
         let size = u64::from_str_radix(size, 16)
-            .map_err(|_| Refusal::size("a chunk size is not a hex number"))?;
+            .map_err(|_| Refusal::malformed("a chunk size is not a hex number"))?;
         let signature = match (self.framing.mode.signed(), extension) {
             (true, Some(extension)) => Some(
                 extension
                     .strip_prefix("chunk-signature=")
                     .filter(|s| is_signature(s))
-                    .ok_or(Refusal::size(
+                    .ok_or(Refusal::malformed(
                         "a signed chunk's header is its size and chunk-signature=<64 hex>",
                     ))?,
             ),
             (false, None) => None,
             (true, None) => {
-                return Err(Refusal::size(
+                return Err(Refusal::malformed(
                     "a signed chunk's header has no chunk-signature",
                 ));
             }
             (false, Some(_)) => {
-                return Err(Refusal::size(
+                return Err(Refusal::malformed(
                     "an unsigned chunk's header is its size alone",
                 ));
             }
         };
         let left = self.framing.declared.saturating_sub(self.decoded);
         if size > left {
-            return Err(Refusal::size(
+            return Err(Refusal::mismatch(
                 "a chunk runs past x-amz-decoded-content-length",
             ));
         }
@@ -370,7 +379,7 @@ impl<B> Decoder<B> {
             .map(|s| (s.to_string(), Sha256::new()));
         if size == 0 {
             if left != 0 {
-                return Err(Refusal::incomplete(
+                return Err(Refusal::mismatch(
                     "the chunks hold fewer bytes than x-amz-decoded-content-length",
                 ));
             }
@@ -478,14 +487,14 @@ impl<B> Decoder<B> {
     /// Decode what `pending` holds, which is empty only at the inner body's end.
     fn step(&mut self) -> Result<Step, Refusal> {
         let end = self.pending.is_empty();
-        let truncated = Refusal::incomplete("the body ends before its last chunk and trailer");
+        let truncated = Refusal::malformed("the body ends before its last chunk and trailer");
         match self.state {
             State::Failed => Ok(Step::End),
             State::Done if end => Ok(Step::End),
             State::Done => Err(Refusal::trailer("bytes follow the end of the body")),
             _ if end && !matches!(self.state, State::Trailer) => Err(truncated),
             State::Header => {
-                let too_long = Refusal::size("a chunk header is longer than 256 bytes");
+                let too_long = Refusal::malformed("a chunk header is longer than 256 bytes");
                 if self.read_line(MAX_HEADER, too_long)? {
                     self.header()?;
                 }
@@ -509,9 +518,7 @@ impl<B> Decoder<B> {
             State::DataEnd(seen) => {
                 let want = if seen == 0 { b'\r' } else { b'\n' };
                 if self.pending.first() != Some(&want) {
-                    return Err(Refusal::incomplete(
-                        "a chunk's data is not followed by CRLF",
-                    ));
+                    return Err(Refusal::malformed("a chunk's data is not followed by CRLF"));
                 }
                 self.pending.advance(1);
                 if seen == 0 {
@@ -834,7 +841,7 @@ mod tests {
         );
         assert_eq!(
             code(&format!("1;chunk-signature={FINAL}\r\na\r\n0\r\n\r\n"), t),
-            Code::InvalidChunkSizeError
+            Code::IncompleteBody
         );
         // A plain aws-chunked body has no trailer.
         let plain = Framing {
@@ -903,21 +910,32 @@ mod tests {
             };
             decode(body, 3, framing, None).unwrap_err().code
         };
-        // Past the declared length, short of it, or not the length a size says.
+        // Past the declared length, short of it, or not the length a size says, in S3's
+        // words for each.
+        let said = |body: &[u8], declared| {
+            let framing = Framing {
+                mode: Mode::Unsigned,
+                declared,
+                trailer: None,
+            };
+            decode(body, 3, framing, None).unwrap_err().said
+        };
+        let mismatch = "You did not provide the number of bytes specified by the Content-Length \
+                        HTTP header";
+        assert_eq!(said(b"5\r\nhello\r\n0\r\n\r\n", 4), mismatch);
+        assert_eq!(said(b"5\r\nhello\r\n0\r\n\r\n", 6), mismatch);
         assert_eq!(
-            code(b"5\r\nhello\r\n0\r\n\r\n", 4),
-            Code::InvalidChunkSizeError
+            said(b"4\r\nhello\r\n0\r\n\r\n", 5),
+            "The request body terminated unexpectedly"
         );
+        assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 4), Code::IncompleteBody);
         assert_eq!(code(b"5\r\nhello\r\n0\r\n\r\n", 6), Code::IncompleteBody);
         assert_eq!(code(b"4\r\nhello\r\n0\r\n\r\n", 5), Code::IncompleteBody);
         assert_eq!(
             code(b"ffffffffffffffff\r\nhello\r\n0\r\n\r\n", 5),
-            Code::InvalidChunkSizeError
-        );
-        assert_eq!(
-            code(b"10000000000000000\r\n", 5),
-            Code::InvalidChunkSizeError
+            Code::IncompleteBody
         );
+        assert_eq!(code(b"10000000000000000\r\n", 5), Code::IncompleteBody);
         // Sizes in hex only.
         for bad in [
             &b"x\r\n"[..],
@@ -926,7 +944,7 @@ mod tests {
             b" 5\r\nhello\r\n",
             b"+5\r\nhello\r\n",
         ] {
-            assert_eq!(code(bad, 5), Code::InvalidChunkSizeError, "{bad:?}");
+            assert_eq!(code(bad, 5), Code::IncompleteBody, "{bad:?}");
         }
         let plain = Framing {
             mode: Mode::Unsigned,
@@ -950,16 +968,13 @@ mod tests {
             message(&pad(256))
         );
         assert!(message(&pad(257)).contains("256"));
-        assert_eq!(code(&pad(300), 1), Code::InvalidChunkSizeError);
+        assert_eq!(code(&pad(300), 1), Code::IncompleteBody);
         // A header whose LF never comes is refused at the bound, not read further.
         let mut endless = vec![b'0'; 10_000];
         endless.insert(0, b'1');
-        assert_eq!(code(&endless, 1), Code::InvalidChunkSizeError);
+        assert_eq!(code(&endless, 1), Code::IncompleteBody);
         // LF without CR, or data not followed by CRLF.
-        assert_eq!(
-            code(b"5\nhello\r\n0\r\n\r\n", 5),
-            Code::InvalidChunkSizeError
-        );
+        assert_eq!(code(b"5\nhello\r\n0\r\n\r\n", 5), Code::IncompleteBody);
         assert_eq!(code(b"5\r\nhello\n0\r\n\r\n", 5), Code::IncompleteBody);
         assert_eq!(code(b"5\r\nhelloXY0\r\n\r\n", 5), Code::IncompleteBody);
         // Anything after the end.
diff --git a/vk-registry/src/s3/conditional.rs b/vk-registry/src/s3/conditional.rs
index 6d0463fa..fb431cc8 100644
--- a/vk-registry/src/s3/conditional.rs
+++ b/vk-registry/src/s3/conditional.rs
@@ -167,8 +167,8 @@ pub(crate) fn whole_seconds(t: SystemTime) -> u64 {
         .as_secs()
 }
 
-/// A write's conditional headers.
-#[derive(Debug, Default, PartialEq, Eq)]
+/// A write's conditional headers: S3 takes one, `If-None-Match: *` or `If-Match: <etag>`.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub(crate) struct WriteConditions {
     /// `If-None-Match: *`: only where no object is
     pub(crate) absent: bool,
@@ -202,15 +202,39 @@ impl WriteConditions {
                 .collect::<Result<_, _>>()?;
             Ok::<_, Refusal>((!values.is_empty()).then(|| values.join(",")))
         };
-        let absent = match text(IF_NONE_MATCH)? {
+        let (none_match, if_match) = (text(IF_NONE_MATCH)?, text(IF_MATCH)?);
+        if none_match.is_some() && if_match.is_some() {
+            return Err(Refusal::new(Code::NotImplemented)
+                .with("Header", "If-Match,If-None-Match")
+                .with(
+                    "additionalMessage",
+                    "Multiple conditional request headers present in the request",
+                ));
+        }
+        let absent = match none_match {
             None => false,
             Some(v) if v.trim() == "*" => true,
             Some(_) => return Err(unsupported(&IF_NONE_MATCH)),
         };
-        Ok(WriteConditions {
-            absent,
-            if_match: text(IF_MATCH)?,
-        })
+        // An ETag only: S3 replaces any object with no condition at all.
+        if if_match
+            .as_deref()
+            .is_some_and(|v| v.trim().trim_matches('"') == "*")
+        {
+            return Err(unsupported(&IF_MATCH));
+        }
+        Ok(WriteConditions { absent, if_match })
+    }
+
+    /// Why the write was refused when [`precondition`](Self::precondition) failed, an object
+    /// being `found` or not: `If-Match` of no object is `NoSuchKey`, as S3 answers it, and
+    /// any other failure 412 `PreconditionFailed` naming the condition.
+    pub(crate) fn refusal(&self, found: bool) -> Refusal {
+        match (&self.if_match, found) {
+            (Some(_), false) => Refusal::new(Code::NoSuchKey),
+            (Some(_), true) => Refusal::new(Code::PreconditionFailed).with("Condition", "If-Match"),
+            (None, _) => Refusal::new(Code::PreconditionFailed).with("Condition", "If-None-Match"),
+        }
     }
 
     /// What [`crate::files::commit`] checks, or `None` when nothing is asked.
@@ -614,9 +638,26 @@ mod tests {
         assert!(!check(&[(IF_MATCH, &e)], Some(&sha)));
         assert!(check(&[(IF_MATCH, &format!("\"{SHA}\""))], Some(&sha)));
         assert!(!check(&[(IF_MATCH, &e)], None));
-        assert!(check(&[(IF_MATCH, "*")], Some(&sha)));
-        assert!(!check(&[(IF_MATCH, "*")], None));
-        // only `*` is served for If-None-Match
-        assert!(WriteConditions::of(&headers(&[(IF_NONE_MATCH, &e)])).is_err());
+        // only `*` is served for If-None-Match, only an ETag for If-Match, one at most
+        let refused = |pairs: &[(hyper::header::HeaderName, &str)]| {
+            WriteConditions::of(&headers(pairs)).err().map(|r| r.code)
+        };
+        assert_eq!(refused(&[(IF_NONE_MATCH, &e)]), Some(Code::NotImplemented));
+        assert_eq!(refused(&[(IF_MATCH, "*")]), Some(Code::NotImplemented));
+        assert_eq!(refused(&[(IF_MATCH, "\"*\"")]), Some(Code::NotImplemented));
+        assert_eq!(
+            refused(&[(IF_MATCH, &e), (IF_NONE_MATCH, "*")]),
+            Some(Code::NotImplemented)
+        );
+        // a failed If-Match is a miss where there is no object
+        let c = WriteConditions::of(&headers(&[(IF_MATCH, &e)]))
+            .ok()
+            .unwrap();
+        assert_eq!(c.refusal(false).code, Code::NoSuchKey);
+        assert_eq!(c.refusal(true).element("Condition"), Some("If-Match"));
+        let c = WriteConditions::of(&headers(&[(IF_NONE_MATCH, "*")]))
+            .ok()
+            .unwrap();
+        assert_eq!(c.refusal(true).element("Condition"), Some("If-None-Match"));
     }
 }
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index f4846e53..c633db37 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -30,6 +30,9 @@ pub(super) enum Source {
     /// one version of an object other than its [`NULL_VERSION`], which this registry does
     /// not keep
     Versioned,
+    /// a key of a bucket the store cannot name (`x-amz-copy-source` decoded), which holds no
+    /// object: a copy of it is a miss
+    Absent { bucket: String, key: String },
     /// nothing this view serves, and why
     Invalid(Refusal),
 }
@@ -61,23 +64,46 @@ pub(super) fn source(value: &str) -> Source {
     let Some(decoded) = crate::dav::decode_segment(raw) else {
         return invalid("Invalid copy source encoding", value);
     };
+    let decoded = decoded.strip_prefix('/').unwrap_or(&decoded);
+    let absent = || match decoded.split_once('/') {
+        Some((bucket, key)) if path::is_bucket(bucket) => Source::Absent {
+            bucket: bucket.to_string(),
+            key: key.to_string(),
+        },
+        _ => invalid("Invalid copy source bucket name", value),
+    };
+    // No key holds a `%`: it is not decoded twice.
     if decoded.contains('%') {
-        return invalid(
-            "a key's components are runs of A-Z a-z 0-9 . _ - only",
-            value,
-        );
+        return absent();
     }
-    let decoded = decoded.strip_prefix('/').unwrap_or(&decoded);
     match path::parse(&format!("/s3/{decoded}")) {
         Ok(path::Target::Object { segs, .. }) => Source::Object(segs),
         Ok(_) => invalid("Invalid copy source object key", value),
         Err(why) if why.code == Code::InvalidBucketName => {
             invalid("Invalid copy source bucket name", value)
         }
+        Err(why) if matches!(why.code, Code::InvalidArgument | Code::BadRequest) => absent(),
         Err(why) => Source::Invalid(why),
     }
 }
 
+/// The answer to a copy from `bucket`'s `key`, which the store cannot name: `NoSuchBucket` when
+/// the bucket is not there ([`super::bucket::missing`]), else `NoSuchKey`.
+pub(super) async fn absent_source(
+    state: &ServerState,
+    authz: &Authz<'_>,
+    bucket: &str,
+    key: &str,
+    ctx: &Ctx,
+) -> Result<Response<Body>> {
+    Ok(
+        match super::bucket::missing(state, authz, bucket, ctx).await? {
+            Some(resp) => resp,
+            None => ctx.error(Refusal::new(Code::NoSuchKey).with("Key", key)),
+        },
+    )
+}
+
 /// A copy source refused as S3 refuses one: `InvalidArgument` on `x-amz-copy-source`.
 fn invalid(message: &'static str, value: &str) -> Source {
     Source::Invalid(Refusal::argument(message, COPY_SOURCE, value))
@@ -127,6 +153,10 @@ pub(super) async fn copy(
             let resp = ctx.error(Refusal::new(Code::NotImplemented).with("Header", COPY_SOURCE));
             return refuse(req, resp, ctx).await;
         }
+        Source::Absent { bucket, key } => {
+            let resp = absent_source(state, authz, &bucket, &key, ctx).await?;
+            return refuse(req, resp, ctx).await;
+        }
         Source::Invalid(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if !admitted(authz, accounts::Action::Read, &src) {
@@ -147,6 +177,19 @@ pub(super) async fn copy(
             return refuse(req, resp, ctx).await;
         }
     };
+    // Tags are none either way, which is what every object has; another value is no
+    // directive.
+    if let Some(v) = headers
+        .get("x-amz-tagging-directive")
+        .filter(|v| !matches!(v.as_bytes(), b"COPY" | b"REPLACE"))
+    {
+        let resp = ctx.error(Refusal::argument(
+            "Unknown tagging directive.",
+            "x-amz-tagging-directive",
+            String::from_utf8_lossy(v.as_bytes()),
+        ));
+        return refuse(req, resp, ctx).await;
+    }
     if src == segs && !replace {
         let resp = ctx.error(Refusal::said(
             Code::InvalidRequest,
@@ -169,7 +212,7 @@ pub(super) async fn copy(
         Ok(written) => written,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
-    let precondition = written.precondition();
+    let precondition = written.clone().precondition();
     // A copy has no body of its own; whatever came is read through first.
     if let Some(resp) = drain(req, ctx).await? {
         return Ok(resp);
@@ -208,7 +251,7 @@ pub(super) async fn copy(
         match files::link(store, &held, &segs, &obj.layer, obj.size, how)? {
             Written::Created | Written::Replaced => {}
             Written::Refused(why) => return Ok(unwritable(why, &ctx)),
-            Written::PreconditionFailed => return Ok(failed(&ctx)),
+            Written::PreconditionFailed { found } => return Ok(ctx.error(written.refusal(found))),
         }
         let modified = object_of(&segs)
             .and_then(|(repo, tag)| store.tag_target(&repo, tag))
@@ -267,23 +310,29 @@ mod tests {
             other => panic!("{value}: {other:?}"),
         };
         for bad in [
-            "",
-            "/",
-            "/b",
-            "b/",
-            "/b/",
-            "/b/k?acl",
-            "/b/a%2",
-            "/b/%FF",
-            "/b/a%2541",
-            "/b/a//k",
-            "/b/a b",
-            "/b/../k",
-            "/b/tags/k",
-            "//b/k",
+            "", "/", "/b", "b/", "/b/", "/b/k?acl", "/b/a%2", "/b/%FF", "//b/k",
         ] {
             assert_eq!(refusal(bad).code, Code::InvalidArgument, "{bad}");
         }
+        // A key the store cannot name holds no object, as S3 finds none there.
+        for (missing, key) in [
+            ("/b/a%2541", "a%41"),
+            ("/b/a//k", "a//k"),
+            ("/b/a b", "a b"),
+            ("/b/../k", "../k"),
+            ("/b/tags/k", "tags/k"),
+            ("b/d/", "d/"),
+            ("b//", "/"),
+        ] {
+            assert_eq!(
+                source(missing),
+                Source::Absent {
+                    bucket: "b".into(),
+                    key: key.into()
+                },
+                "{missing}"
+            );
+        }
         // In S3's words, naming the header and its value.
         let r = refusal("/b/a%2");
         assert_eq!(r.message(), "Invalid copy source encoding");
diff --git a/vk-registry/src/s3/error.rs b/vk-registry/src/s3/error.rs
index f80bc03a..f2ce7bbf 100644
--- a/vk-registry/src/s3/error.rs
+++ b/vk-registry/src/s3/error.rs
@@ -20,6 +20,7 @@ pub(crate) enum Code {
     AuthorizationHeaderMalformed,
     AuthorizationQueryParametersError,
     BadDigest,
+    BadRequest,
     BucketAlreadyOwnedByYou,
     BucketNotEmpty,
     EntityTooLarge,
@@ -28,7 +29,6 @@ pub(crate) enum Code {
     InvalidAccessKeyId,
     InvalidArgument,
     InvalidBucketName,
-    InvalidChunkSizeError,
     InvalidDigest,
     InvalidPart,
     InvalidPartNumber,
@@ -42,6 +42,7 @@ pub(crate) enum Code {
     MalformedTrailerError,
     MalformedXML,
     MetadataTooLarge,
+    MissingContentLength,
     NoSuchBucket,
     NoSuchBucketPolicy,
     NoSuchCORSConfiguration,
@@ -88,6 +89,11 @@ impl Code {
                 BAD,
                 "The Content-MD5 you specified did not match what we received.",
             ),
+            BadRequest => (
+                "BadRequest",
+                BAD,
+                "An error occurred when parsing the HTTP request.",
+            ),
             BucketAlreadyOwnedByYou => (
                 "BucketAlreadyOwnedByYou",
                 StatusCode::CONFLICT,
@@ -126,11 +132,6 @@ impl Code {
                 BAD,
                 "The specified bucket is not valid.",
             ),
-            InvalidChunkSizeError => (
-                "InvalidChunkSizeError",
-                BAD,
-                "Only the last chunk is allowed to have a size less than 8192 bytes",
-            ),
             InvalidDigest => (
                 "InvalidDigest",
                 BAD,
@@ -189,6 +190,11 @@ impl Code {
                 BAD,
                 "Your metadata headers exceed the maximum allowed metadata size",
             ),
+            MissingContentLength => (
+                "MissingContentLength",
+                StatusCode::LENGTH_REQUIRED,
+                "You must provide the Content-Length HTTP header.",
+            ),
             NoSuchBucket => ("NoSuchBucket", GONE, "The specified bucket does not exist."),
             NoSuchBucketPolicy => (
                 "NoSuchBucketPolicy",
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index bee123e5..faa96644 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -318,6 +318,21 @@ async fn operate(
 ) -> Result<Response<Body>> {
     let target = match path::parse(&ctx.path) {
         Ok(target) => target,
+        // A key the store cannot name holds no object: a read of one is a miss, as S3's is
+        // of a key it does not hold, once its bucket is found.
+        Err(why)
+            if why.code == Code::InvalidArgument
+                && matches!(req.method(), &Method::GET | &Method::HEAD) =>
+        {
+            let resp = match path::bucket_and_raw_key(&ctx.path) {
+                None => ctx.error(why),
+                Some((b, key)) => match bucket::missing(state, authz, &b, ctx).await? {
+                    Some(resp) => resp,
+                    None => ctx.error(Refusal::new(Code::NoSuchKey).with("Key", key)),
+                },
+            };
+            return refuse(req, resp, ctx).await;
+        }
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let Some(query) = parse_query(req.uri().query().unwrap_or("")) else {
@@ -354,6 +369,17 @@ async fn operate(
     {
         return refuse(req, resp, ctx).await;
     }
+    // An object's version named by no id at all.
+    if matches!(target, path::Target::Object { .. })
+        && query.iter().any(|(n, v)| n == "versionId" && v.is_empty())
+    {
+        let resp = ctx.error(Refusal::argument(
+            "Version id cannot be the empty string",
+            "versionId",
+            "",
+        ));
+        return refuse(req, resp, ctx).await;
+    }
     let part = match part_asked(&query) {
         None => None,
         Some(value) => match multipart::part_number(value) {
@@ -441,9 +467,9 @@ async fn operate(
 
 /// Whether the `Authorization` header is SigV4's: `false` for none (the session cookie may
 /// stand in) or one of the schemes the other routes take, Basic and Bearer, which
-/// [`presented`] resolves; refused otherwise: a value with no scheme or of any other scheme
-/// is 400 `InvalidArgument`, as S3 answers a signature version it does not take rather than
-/// 403 as a credential it refused.
+/// [`presented`] resolves; refused otherwise, as S3 refuses it: a value with no scheme or of
+/// an unknown scheme is 400 `InvalidArgument`, a signature version S3 does not take rather
+/// than a credential it refused (403), and SigV2's `AWS` 400 `InvalidRequest`.
 fn scheme(headers: &HeaderMap) -> std::result::Result<bool, Refusal> {
     let invalid =
         |why| Refusal::said(Code::InvalidArgument, why).with("ArgumentName", "Authorization");
@@ -462,6 +488,12 @@ fn scheme(headers: &HeaderMap) -> std::result::Result<bool, Refusal> {
         Ok(true)
     } else if scheme.eq_ignore_ascii_case("basic") || scheme.eq_ignore_ascii_case("bearer") {
         Ok(false)
+    } else if scheme == "AWS" {
+        Err(Refusal::said(
+            Code::InvalidRequest,
+            "The authorization mechanism you have provided is not supported. Please use \
+             AWS4-HMAC-SHA256.",
+        ))
     } else {
         Err(invalid("Unsupported Authorization Type"))
     }
@@ -722,6 +754,10 @@ fn signed_by(
                 "Missing required header for this request: x-amz-content-sha256",
             )))
         })?;
+    // What the header may be is checked before what it signs, as S3 checks it.
+    if let Some(why) = object::content_sha256_refusal(payload_hash) {
+        return Err(Box::new(ctx.error(why)));
+    }
     let canonical = sigv4::canonical_request(
         req.method().as_str(),
         req.uri().path(),
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 6a59b34b..07151a91 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -497,6 +497,13 @@ pub(super) async fn upload(
     }
     match method {
         Method::PUT => {
+            // The upload is looked up before anything asked of it is, as S3 looks it up.
+            if !on_parent(authz, accounts::Action::Write, &segs) {
+                return refuse(req, ctx.access_denied(), ctx).await;
+            }
+            if open_async(state, &id, &segs).await?.is_none() {
+                return refuse(req, no_such_upload(ctx, &id), ctx).await;
+            }
             let Some(n) = param(&params, "partNumber").and_then(part_number) else {
                 let resp = ctx.error(Refusal::argument(
                     PART_NUMBER,
@@ -623,6 +630,10 @@ async fn copy_part(
             let resp = ctx.error(Refusal::new(Code::NotImplemented).with("Header", COPY_SOURCE));
             return refuse(req, resp, ctx).await;
         }
+        Source::Absent { bucket, key } => {
+            let resp = copy::absent_source(state, authz, &bucket, &key, ctx).await?;
+            return refuse(req, resp, ctx).await;
+        }
         Source::Invalid(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if !admitted(authz, accounts::Action::Read, &src) {
@@ -664,9 +675,14 @@ async fn copy_part(
             None => (0, obj.size),
             Some((first, last)) if last < obj.size => (first, last - first + 1),
             Some(_) => {
-                return Ok(ctx.error(
-                    Refusal::new(Code::InvalidRange).with("ActualObjectSize", obj.size.to_string()),
-                ));
+                return Ok(ctx.error(Refusal::argument(
+                    format!(
+                        "Range specified is not valid for source object of size: {}",
+                        obj.size
+                    ),
+                    COPY_SOURCE_RANGE,
+                    obj.size.to_string(),
+                )));
             }
         };
         let Some((_, mut reader)) = store.read_blob_range(&obj.layer, start, len)? else {
@@ -718,6 +734,8 @@ enum Unfit {
     Malformed(&'static str),
     /// 400 `InvalidPartOrder`: the part numbers do not ascend
     Order,
+    /// 400 `InvalidArgument`: a `PartNumber` below 1, as sent
+    Number(String),
 }
 
 /// The parts a `CompleteMultipartUpload` document names, in order: each part's number and
@@ -738,8 +756,11 @@ fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Unfit> {
                 .map(|e| e.text.trim().to_string())
                 .ok_or(Unfit::Malformed("each Part names its PartNumber and ETag"))
         };
-        let n = part_number(&field("PartNumber")?)
-            .ok_or(Unfit::Malformed("a PartNumber is 1 to 10000"))?;
+        let sent = field("PartNumber")?;
+        if sent.parse::<i64>().is_ok_and(|n| n < 1) {
+            return Err(Unfit::Number(sent));
+        }
+        let n = part_number(&sent).ok_or(Unfit::Malformed("a PartNumber is 1 to 10000"))?;
         let etag = field("ETag")?;
         let etag = etag
             .strip_prefix('"')
@@ -945,6 +966,16 @@ async fn complete(
         Ok(conditions) => conditions,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
+    // An upload no id names, in progress or completed, before its document is read.
+    let known = {
+        let (store, id) = (Arc::clone(&state.store), id.clone());
+        tokio::task::spawn_blocking(move || store.multipart_dir(&id).is_some_and(|d| d.is_dir()))
+            .await
+            .context("looking up an upload panicked")?
+    };
+    if !known {
+        return refuse(req, no_such_upload(ctx, &id), ctx).await;
+    }
     let whole = match Whole::of(req.headers()) {
         Ok(whole) => whole,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
@@ -965,6 +996,13 @@ async fn complete(
         Err(Unfit::Order) => {
             return Ok(ctx.error(Refusal::new(Code::InvalidPartOrder).with("UploadId", id)));
         }
+        Err(Unfit::Number(sent)) => {
+            return Ok(ctx.error(Refusal::argument(
+                "PartNumber must be >= 1",
+                "PartNumber",
+                sent,
+            )));
+        }
     };
     let found = {
         let (store, segs, id) = (Arc::clone(&state.store), segs.clone(), id.clone());
@@ -1017,13 +1055,13 @@ async fn complete(
     };
     let how = Commit {
         annotations,
-        precondition: conditions.precondition(),
+        precondition: conditions.clone().precondition(),
         uncompressed: staged.size >= UNCOMPRESSED_FROM,
     };
     match files::commit(Arc::clone(&state.store), segs, staged, how).await? {
         Written::Created | Written::Replaced => {}
         Written::Refused(why) => return Ok(unwritable(why, ctx)),
-        Written::PreconditionFailed => return Ok(copy::failed(ctx)),
+        Written::PreconditionFailed { found } => return Ok(ctx.error(conditions.refusal(found))),
     }
     let resp = done.result(ctx);
     let dir = up.dir;
@@ -1249,22 +1287,32 @@ async fn list_parts(
     if !on_parent(authz, accounts::Action::Read, &segs) {
         return refuse(req, ctx.access_denied(), ctx).await;
     }
-    let max = match page_size("max-parts", param(params, "max-parts")) {
-        Ok(max) => max,
-        Err(why) => return refuse(req, ctx.error(why), ctx).await,
-    };
-    let marker = match param(params, "part-number-marker") {
-        None => 0,
-        Some(m) => match list::count("part-number-marker", m) {
-            Ok(m) => m,
-            Err(why) => return refuse(req, ctx.error(why), ctx).await,
-        },
-    };
+    // S3 refuses a count that is no number first, then looks the upload up, then refuses
+    // one that is negative.
+    let negative =
+        |name| param(params, name).is_some_and(|v| v.parse::<i64>().is_ok_and(|n| n < 0));
+    let max = page_size("max-parts", param(params, "max-parts"));
+    let marker =
+        param(params, "part-number-marker").map_or(Ok(0), |m| list::count("part-number-marker", m));
+    for (sent, name) in [
+        (max.as_ref().err(), "max-parts"),
+        (marker.as_ref().err(), "part-number-marker"),
+    ] {
+        if let Some(why) = sent
+            && !negative(name)
+        {
+            return refuse(req, ctx.error(why.clone()), ctx).await;
+        }
+    }
     let ctx = ctx.clone();
     crate::dav::blocking(state, authz, move |store, _| {
         let Some(up) = open(store, &id, &segs) else {
             return Ok(no_such_upload(&ctx, &id));
         };
+        let (max, marker) = match (max, marker) {
+            (Ok(max), Ok(marker)) => (max, marker),
+            (Err(why), _) | (_, Err(why)) => return Ok(ctx.error(why)),
+        };
         let mut numbers = if max == 0 {
             Vec::new()
         } else {
@@ -1534,9 +1582,7 @@ mod tests {
             body(""),
             body("<Part><PartNumber>1</PartNumber></Part>"),
             body("<Part><ETag>x</ETag></Part>"),
-            body(&part("0", MD5)),
             body(&part("10001", MD5)),
-            body(&part("-1", MD5)),
             body(&part("one", MD5)),
             body(&part("", MD5)),
             body("<Part><PartNumber>1</PartNumber><PartNumber>2</PartNumber><ETag>x</ETag></Part>"),
@@ -1550,6 +1596,13 @@ mod tests {
                 String::from_utf8_lossy(&bad)
             );
         }
+        // A number below 1 is S3's InvalidArgument, naming it as sent.
+        for low in ["0", "-1"] {
+            assert_eq!(
+                document(&body(&part(low, MD5))),
+                Err(Unfit::Number(low.to_string()))
+            );
+        }
         // The most parts there can be fit in the bound; past it, the scan stops.
         let max = (1..=MAX_PARTS)
             .map(|n| part(&n.to_string(), MD5))
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 07c1abe1..62eb2b2e 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -308,7 +308,15 @@ pub(super) async fn attributes(
         "StorageClass",
         "ObjectSize",
     ];
-    if asked.is_empty() || asked.iter().any(|a| !known.contains(&a.as_str())) {
+    if asked.is_empty() {
+        let resp = ctx.error(Refusal::said(
+            Code::InvalidRequest,
+            "The x-amz-object-attributes header specifying the attributes to be retrieved is \
+             either missing or empty",
+        ));
+        return refuse(req, resp, ctx).await;
+    }
+    if asked.iter().any(|a| !known.contains(&a.as_str())) {
         let resp = ctx.error(Refusal::argument(
             "Invalid attribute name specified.",
             "x-amz-object-attributes",
@@ -466,15 +474,7 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
             (Some(v.to_ascii_lowercase()), None)
         }
         Some(v) => {
-            return Err(Refusal::argument(
-                "x-amz-content-sha256 must be UNSIGNED-PAYLOAD, \
-                 STREAMING-UNSIGNED-PAYLOAD-TRAILER, STREAMING-AWS4-HMAC-SHA256-PAYLOAD, \
-                 STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER, \
-                 STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD, \
-                 STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER or a valid sha256 value.",
-                "x-amz-content-sha256",
-                v,
-            ));
+            return Err(content_sha256_refusal(v).unwrap_or(Refusal::new(Code::InvalidArgument)));
         }
     };
     let (mut chunked, mut other) = (false, false);
@@ -491,6 +491,15 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
             other = true;
         }
     }
+    // An unsigned payload is the body as sent, which S3 does not take aws-chunked.
+    if chunked && value == Some("UNSIGNED-PAYLOAD") {
+        return Err(Refusal::argument(
+            "aws-chunked encoding is not supported when x-amz-content-sha256 UNSIGNED-PAYLOAD \
+             is supplied.",
+            "Content-Encoding",
+            "aws-chunked",
+        ));
+    }
     let Some(mode) = streaming.or(chunked.then_some(chunked::Mode::Unsigned)) else {
         if headers.contains_key("x-amz-trailer") {
             return Err(invalid("x-amz-trailer is for a -TRAILER streaming payload"));
@@ -507,9 +516,7 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
         .get(DECODED_LENGTH)
         .and_then(|v| v.to_str().ok())
         .and_then(|v| v.parse::<u64>().ok())
-        .ok_or(invalid(
-            "an aws-chunked body needs x-amz-decoded-content-length, its decoded length",
-        ))?;
+        .ok_or(Refusal::new(Code::MissingContentLength))?;
     let trailer = match headers.get("x-amz-trailer") {
         None => None,
         Some(_) if !mode.trailer() => {
@@ -544,6 +551,25 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
     })
 }
 
+/// Why `x-amz-content-sha256: value` is no value it takes, as S3 says it: `None` for
+/// `UNSIGNED-PAYLOAD`, a streaming mode (which [`chunked::Mode`] may still not serve) and a
+/// SHA-256 in hex.
+pub(super) fn content_sha256_refusal(value: &str) -> Option<Refusal> {
+    let fits = value == "UNSIGNED-PAYLOAD"
+        || value.starts_with("STREAMING-")
+        || (value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit()));
+    (!fits).then(|| {
+        Refusal::argument(
+            "x-amz-content-sha256 must be UNSIGNED-PAYLOAD, STREAMING-UNSIGNED-PAYLOAD-TRAILER, \
+             STREAMING-AWS4-HMAC-SHA256-PAYLOAD, STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER, \
+             STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD, \
+             STREAMING-AWS4-ECDSA-P256-SHA256-PAYLOAD-TRAILER or a valid sha256 value.",
+            "x-amz-content-sha256",
+            value,
+        )
+    })
+}
+
 /// Header `name`'s text and the bytes it decodes to from base64, `len` of them: `Ok(None)`
 /// when it is not sent, `Err` when it is not that.
 pub(super) fn base64_header(
@@ -577,6 +603,14 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refusal> {
     if checksum::not_computed(headers) {
         return Err(checksum::NOT_COMPUTED);
     }
+    // More than one is refused whatever they hold, as S3 refuses it.
+    let sent = checksum::ALGORITHMS
+        .iter()
+        .filter(|(name, _, _)| headers.contains_key(*name))
+        .count();
+    if sent > 1 {
+        return Err(ONE_CHECKSUM);
+    }
     let mut out = Expected {
         md5: content_md5(headers)?,
         ..Expected::default()
@@ -584,9 +618,6 @@ fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refusal> {
     for (name, _, len) in checksum::ALGORITHMS {
         let value = base64_header(headers, name, len).map_err(|()| checksum::invalid(name))?;
         if let Some((text, bytes)) = value {
-            if out.checksum.is_some() {
-                return Err(ONE_CHECKSUM);
-            }
             out.checksum = Some(Claim {
                 header: name,
                 text,
@@ -937,14 +968,14 @@ pub(super) async fn put(
     let size = received.staged.size;
     let how = Commit {
         annotations,
-        precondition: conditions.precondition(),
+        precondition: conditions.clone().precondition(),
         uncompressed: size >= UNCOMPRESSED_FROM,
     };
     let written = files::commit(Arc::clone(&state.store), segs, received.staged, how).await?;
     match written {
         Written::Created | Written::Replaced => {}
         Written::Refused(why) => return Ok(unwritable(why, ctx)),
-        Written::PreconditionFailed => return Ok(ctx.error(Code::PreconditionFailed)),
+        Written::PreconditionFailed { found } => return Ok(ctx.error(conditions.refusal(found))),
     }
     let mut resp = written_of(&format!("\"{md5_hex}\""), received.echo, Some(size))?;
     if kept.is_some() {
@@ -1126,7 +1157,7 @@ mod tests {
             );
             assert_eq!(
                 code(&[("x-amz-content-sha256", value)]),
-                Some("InvalidRequest"),
+                Some("MissingContentLength"),
                 "{value} without its decoded length"
             );
         }
@@ -1148,8 +1179,21 @@ mod tests {
                 ("content-encoding", "aws-chunked"),
                 ("x-amz-decoded-content-length", "-1")
             ]),
-            Some("InvalidRequest")
+            Some("MissingContentLength")
         );
+        // An unsigned payload is not aws-chunked, as S3 takes it.
+        for encoding in ["aws-chunked", "aws-chunked,gzip", "AWS-Chunked"] {
+            let pairs = [
+                ("content-encoding", encoding),
+                ("x-amz-content-sha256", "UNSIGNED-PAYLOAD"),
+                length,
+            ];
+            let r = payload(&headers(&pairs)).err().unwrap();
+            assert_eq!(r.code, Code::InvalidArgument, "{encoding}");
+            assert_eq!(r.element("ArgumentValue"), Some("aws-chunked"));
+        }
+        assert!(content_sha256_refusal("invalid_sha256").is_some());
+        assert!(content_sha256_refusal("UNSIGNED-PAYLOAD").is_none());
         assert_eq!(
             code(&[(
                 "x-amz-content-sha256",
@@ -1273,6 +1317,12 @@ mod tests {
             ]),
             Some("InvalidRequest")
         );
+        // Two are refused whatever they hold, as S3 refuses them.
+        let two = expected(&headers(&[
+            ("x-amz-checksum-sha256", "not base64"),
+            ("x-amz-checksum-crc32", "AAAAAA=="),
+        ]));
+        assert_eq!(two.err(), Some(ONE_CHECKSUM));
         // A header beside a trailer, of any algorithm.
         let crc = ("x-amz-trailer", "x-amz-checksum-crc32");
         let streaming = ("x-amz-content-sha256", "STREAMING-UNSIGNED-PAYLOAD-TRAILER");
diff --git a/vk-registry/src/s3/path.rs b/vk-registry/src/s3/path.rs
index 94ee1890..4b68b364 100644
--- a/vk-registry/src/s3/path.rs
+++ b/vk-registry/src/s3/path.rs
@@ -93,6 +93,8 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
         .ok_or_else(|| Refusal::new(Code::InvalidBucketName).with("BucketName", raw_bucket))?;
     let raw_key = match raw_key {
         None | Some("") => return Ok(Target::Bucket(bucket)),
+        // Slashes only, which S3 cannot make a request of.
+        Some(k) if k.bytes().all(|b| b == b'/') => return Err(Refusal::new(Code::BadRequest)),
         Some(k) => k,
     };
     let mut segs = vec![bucket];
@@ -109,6 +111,15 @@ pub(crate) fn parse(path: &str) -> Result<Target, Refusal> {
     Ok(Target::Object { key, segs })
 }
 
+/// The bucket a path under `/s3` names, decoded, and its key as sent, whether or not the key
+/// is one the store can name: what a read of a key [`parse`] refuses is a miss of.
+pub(crate) fn bucket_and_raw_key(path: &str) -> Option<(String, &str)> {
+    let rest = path.strip_prefix("/s3/")?;
+    let (raw_bucket, raw_key) = rest.split_once('/')?;
+    let bucket = decode_segment(raw_bucket).filter(|b| is_bucket(b))?;
+    Some((bucket, raw_key))
+}
+
 /// Whether `name`, decoded, can name a bucket: one top-level component of `files/`.
 pub(crate) fn is_bucket(name: &str) -> bool {
     crate::valid_name(name) && !name.contains('/') && name.len() <= MAX_COMPONENT
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 6c01133b..09557812 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -636,13 +636,16 @@ async fn sigv4_refusals(host: &str, good: (&str, &str)) {
         "invalid_header",
         "AWS2-HMAC-SHA1 Credential=x/20260101/us-east-1/s3/aws4_request, \
          SignedHeaders=host, Signature=00",
-        "AWS AKIDNOTAKEY:c2ln",
         "Digest username=x",
     ] {
         send(host, get().header("Authorization", value))
             .await
             .is(400, "InvalidArgument");
     }
+    // SigV2's, which S3 no longer takes.
+    send(host, get().header("Authorization", "AWS AKIDNOTAKEY:c2ln"))
+        .await
+        .is(400, "InvalidRequest");
     // An id it does not know, whose signature is consistent with it.
     send(host, get().signed(host, ("AKIDNOTAKEY", "AKIDNOTAKEY"), 0))
         .await
@@ -803,6 +806,9 @@ async fn a_shared_bearer_is_the_access_key_and_its_secret() {
         .is(403, "AccessDenied");
     // A scheme this registry does not take is malformed, not refused.
     send(&host, get().header("Authorization", "AWS AKID:sig"))
+        .await
+        .is(400, "InvalidRequest");
+    send(&host, get().header("Authorization", "Digest x"))
         .await
         .is(400, "InvalidArgument");
     // The bearer itself still works, as on `/dav/`.
@@ -1411,7 +1417,8 @@ async fn a_put_body_is_unsigned_or_its_signed_sha256() {
         .header("Content-Encoding", "aws-chunked, gzip")
         .header("x-amz-decoded-content-length", "13")
         .signed(&host, key, 0);
-    send(&host, gzip).await.is(501, "NotImplemented");
+    // Unsigned, as here, S3 takes no aws-chunked body at all.
+    send(&host, gzip).await.is(400, "InvalidArgument");
     for path in ["/s3/b/ecdsa", "/s3/b/gzip"] {
         send(&host, get(path)).await.is(404, "NoSuchKey");
     }
@@ -2025,7 +2032,7 @@ async fn a_chunked_body_that_does_not_hold_leaves_nothing() {
         Req::new("PUT", path).chunked_declaring(&host, BEARER, mode, &data, trailer, decoded)
     };
     let req = declaring("/s3/b/short", Chunked::Signed, Some(data.len() - 1));
-    cases.push(("/s3/b/short", req, 400, "InvalidChunkSizeError"));
+    cases.push(("/s3/b/short", req, 400, "IncompleteBody"));
     let req = declaring("/s3/b/long", Chunked::UnsignedTrailer, Some(data.len() + 1));
     cases.push(("/s3/b/long", req, 400, "IncompleteBody"));
     let mut req = put("/s3/b/garbage", Chunked::Signed);
@@ -2033,13 +2040,13 @@ async fn a_chunked_body_that_does_not_hold_leaves_nothing() {
     cases.push(("/s3/b/garbage", req, 400, "MalformedTrailerError"));
     let mut req = put("/s3/b/header", Chunked::UnsignedTrailer);
     req.body.splice(0..0, std::iter::repeat_n(b'0', 300));
-    cases.push(("/s3/b/header", req, 400, "InvalidChunkSizeError"));
+    cases.push(("/s3/b/header", req, 400, "IncompleteBody"));
     let mut req = put("/s3/b/truncated", Chunked::Signed);
     req.body.truncate(req.body.len() - 50);
     cases.push(("/s3/b/truncated", req, 400, "IncompleteBody"));
     // No decoded length at all.
     let req = declaring("/s3/b/no-length", Chunked::Signed, None);
-    cases.push(("/s3/b/no-length", req, 400, "InvalidRequest"));
+    cases.push(("/s3/b/no-length", req, 411, "MissingContentLength"));
 
     for (path, req, status, code) in cases {
         send_refused(&host, req).await.is(status, code);
@@ -2339,9 +2346,20 @@ async fn conditional_headers_decide_reads_and_writes() {
     )
     .await
     .is(412, "PreconditionFailed");
+    // No object to compare with is a miss, as S3 answers it.
     send(&host, put("/s3/b/absent", HELLO).header("If-Match", &etag))
         .await
-        .is(412, "PreconditionFailed");
+        .is(404, "NoSuchKey");
+    // One condition, and an ETag to match, else not served.
+    for (name, value) in [("If-Match", "*"), ("If-Match", "\"*\"")] {
+        send(&host, put("/s3/b/k", b"x").header(name, value))
+            .await
+            .is(501, "NotImplemented");
+    }
+    let both = put("/s3/b/k", b"x")
+        .header("If-Match", &etag)
+        .header("If-None-Match", "*");
+    send(&host, both).await.is(501, "NotImplemented");
     let resp = send(&host, put("/s3/b/k", b"swapped").header("If-Match", &etag)).await;
     resp.ok(200);
     let etag = format!("\"{}\"", md5_hex(b"swapped"));
@@ -2594,7 +2612,7 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         .is(400, "InvalidArgument");
     send(&host, Req::new("GET", "/s3/b/k").query("attributes"))
         .await
-        .is(400, "InvalidArgument");
+        .is(400, "InvalidRequest");
     send(&host, attrs("ETag").path_of("/s3/b/absent"))
         .await
         .is(404, "NoSuchKey");
@@ -2632,6 +2650,21 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
     }
     let long = format!("/s3/b/{}", "x".repeat(256));
     send(&host, put(&long)).await.is(400, "KeyTooLongError");
+    // No object is there, so a read of one is a miss, as S3's is; slashes alone are no key.
+    for path in ["/s3/b/a%20b", "/s3/b/k/", "/s3/b/tags/x"] {
+        send(&host, Req::new("GET", path))
+            .await
+            .is(404, "NoSuchKey");
+        send(&host, Req::new("HEAD", path)).await.ok(404);
+    }
+    send(&host, put("/s3/b//")).await.is(400, "BadRequest");
+    // A version named by no id.
+    for method in ["GET", "DELETE"] {
+        send(&host, Req::new(method, "/s3/b/k").query("versionId="))
+            .await
+            .is(400, "InvalidArgument")
+            .says("Version id cannot be the empty string");
+    }
 
     // Where an object cannot go: a directory, below an object, over a foreign tag.
     store
@@ -2736,9 +2769,11 @@ async fn a_path_that_cannot_be_parsed_is_an_invalid_uri() {
     conn.send(&Req::new("GET", "/a%zz"))
         .await
         .is(400, "InvalidURI");
+    // A `..` that stays below it is a key's, which the store cannot name: a read of it is a
+    // miss, here of the bucket first.
     conn.send(&Req::new("GET", "/a/../x"))
         .await
-        .is(400, "InvalidArgument");
+        .is(404, "NoSuchBucket");
 }
 
 /// A key the store fails to delete is reported on its own, and the batch goes on past it.
@@ -2969,6 +3004,24 @@ async fn query_names_are_decoded_before_dispatch() {
             "The specified multipart upload does not exist. The upload ID may be invalid, or \
              the upload may have been aborted or completed.",
         );
+    // An upload no id names is said before what else is asked of it: a part number, or a
+    // count, that is no number S3 takes.
+    for (method, q) in [
+        ("PUT", "partNumber=0&uploadId=..%2Fnope"),
+        ("GET", "max-parts=-3&uploadId=nope"),
+        ("GET", "part-number-marker=-14&uploadId=nope"),
+    ] {
+        send(&host, Req::new(method, "/s3/b/d/k").query(q))
+            .await
+            .is(404, "NoSuchUpload");
+    }
+    send(
+        &host,
+        Req::new("GET", "/s3/b/d/k").query("part-number-marker=x&uploadId=nope"),
+    )
+    .await
+    .is(400, "InvalidArgument")
+    .says("Provided x not an integer or within integer range");
     let resp = send(&host, Req::new("GET", "/s3/b").query("upload%73")).await;
     resp.ok(200);
     assert!(
@@ -4103,6 +4156,8 @@ async fn objects_are_copied(host: &str, sign: Sign<'_>) -> Vec<u8> {
     send(host, sign(req)).await.is(412, "PreconditionFailed");
     let req = copy("/s3/dst/copy", "/src/d/k").header("If-Match", "\"other\"");
     send(host, sign(req)).await.is(412, "PreconditionFailed");
+    let req = copy("/s3/dst/none", "/src/d/k").header("If-Match", "\"other\"");
+    send(host, sign(req)).await.is(404, "NoSuchKey");
     let req = copy("/s3/dst/copy", "/src/d/k").header("If-Match", &etag);
     assert_eq!(copied(&send(host, sign(req)).await), etag);
     let req = copy("/s3/dst/fresh", "/src/d/k").header("If-None-Match", "*");
@@ -4118,13 +4173,18 @@ async fn objects_are_copied(host: &str, sign: Sign<'_>) -> Vec<u8> {
         ("/s3/dst/x", "/nobucket/k", 404, "NoSuchBucket"),
         ("/s3/dst/x", "/src/d/k?versionId=1", 501, "NotImplemented"),
         ("/s3/dst/x", "/src", 400, "InvalidArgument"),
-        ("/s3/dst/x", "/src/a%20b", 400, "InvalidArgument"),
+        ("/s3/dst/x", "/src/a%20b", 404, "NoSuchKey"),
         ("/s3/src/d", "/src/d/k", 409, "OperationAborted"),
         ("/s3/src/d/k/below", "/src/e/copy", 409, "OperationAborted"),
     ] {
         let resp = send(host, sign(copy(to, from))).await;
         resp.is(status, code);
     }
+    let req = copy("/s3/dst/x", "/src/d/k").header("x-amz-tagging-directive", "invalid");
+    send(host, sign(req))
+        .await
+        .is(400, "InvalidArgument")
+        .says("Unknown tagging directive.");
     send(host, sign(Req::new("GET", "/s3/dst/x")))
         .await
         .is(404, "NoSuchKey");
@@ -5055,7 +5115,10 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
     let e2 = element(&resp.body, "ETag").replace("&quot;", "\"");
     assert_eq!(e2, format!("\"{}\"", md5_hex(&src[100..1100])));
     let past = copy(3).header("x-amz-copy-source-range", "bytes=69000-70000");
-    send(&host, sign(past)).await.is(416, "InvalidRange");
+    send(&host, sign(past))
+        .await
+        .is(400, "InvalidArgument")
+        .says("Range specified is not valid for source object of size: 70000");
     let backwards = copy(3).header("x-amz-copy-source-range", "bytes=5-2");
     send(&host, sign(backwards))
         .await

From f603b1e23a5e42d982642229462f54b3617a5dca Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 12:14:16 +0100
Subject: [PATCH 47/54] vk-registry/s3: check and keep XXHASH64, XXHASH3 and
 XXHASH128 checksums

The XXHASH checksums are checked, echoed, kept and listed as the other
algorithms are, rather than refused with 501: base64 of the unseeded
big-endian digest, as the CRCs, computed with xxhash-rust (no
dependencies of its own). With every algorithm S3 has now computed, a
checksum header, SDK algorithm or trailer naming any other is 400
InvalidRequest in S3's words, no longer 501.
---
 CHANGELOG.md                    |   3 +-
 Cargo.lock                      |   7 ++
 Cargo.toml                      |   3 +
 vk-registry/Cargo.toml          |   3 +-
 vk-registry/DESIGN.md           |  12 +--
 vk-registry/src/s3/checksum.rs  | 169 ++++++++++++++++++++++----------
 vk-registry/src/s3/multipart.rs |  31 ++----
 vk-registry/src/s3/object.rs    |  29 +++---
 vk-registry/tests/s3_e2e.rs     |  57 ++++++++---
 9 files changed, 207 insertions(+), 107 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d18a728..3daf0f34 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,8 +13,7 @@ All notable changes to virtkit will be documented in this file.
   `sccache` needs none made beforehand), and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
-  checksums (in S3's algorithms but the XXHASH family, checked on upload and kept with the
-  object), given
+  checksums (in every algorithm S3 has, checked on upload and kept with the object), given
   metadata and deleted, and listed page by page (as object versions too, for
   tools that empty a bucket that way), and are the same files WebDAV and `vk registry get`
   see; a key limited to a directory of a bucket can list that directory.
diff --git a/Cargo.lock b/Cargo.lock
index ffa6bdea..0ebcdcf5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4333,6 +4333,7 @@ dependencies = [
  "vk-oidc",
  "vk-peer",
  "vk-selfupdate",
+ "xxhash-rust",
  "zeroize",
  "zstd",
 ]
@@ -4827,6 +4828,12 @@ dependencies = [
  "rustix",
 ]
 
+[[package]]
+name = "xxhash-rust"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "550a2b930b62486a393c52d5c3b84bff264b28aa437ed64694d31e93b1757af7"
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
diff --git a/Cargo.toml b/Cargo.toml
index 3d0f03f5..b77de3d7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -139,6 +139,9 @@ crc32fast = "1.5"
 # vk-registry: the check of an S3 upload's x-amz-checksum-crc32c and -crc64nvme, from its
 # catalog. Already in the tree via lzma-rs.
 crc = "3"
+# vk-registry: the check of an S3 upload's x-amz-checksum-xxhash64, -xxhash3 and -xxhash128.
+# Pure Rust, no dependencies of its own; XXH3 is too intricate to rewrite safely.
+xxhash-rust = { version = "0.8", features = ["xxh64", "xxh3"] }
 # vk-tpm: the TPM's entropy (TPM2_GetRandom, its seeds) from the OS. Already in the tree via rand.
 getrandom = "0.4"
 # vk-tpm: constant-time comparison of authorization values. Already in the tree via the
diff --git a/vk-registry/Cargo.toml b/vk-registry/Cargo.toml
index 302a992c..1082973f 100644
--- a/vk-registry/Cargo.toml
+++ b/vk-registry/Cargo.toml
@@ -36,11 +36,12 @@ tokio-rustls = { version = "0.26", default-features = false, features = ["ring",
 oci-client.workspace = true
 sha2.workspace = true
 # The digests S3 clients send or expect beside SHA-256: an object's MD5 (its ETag), and the
-# SHA-1, CRC32, CRC32C and CRC64NVME an upload may be checked against.
+# SHA-1, CRC32, CRC32C, CRC64NVME and XXHASH an upload may be checked against.
 md5.workspace = true
 sha1.workspace = true
 crc32fast.workspace = true
 crc.workspace = true
+xxhash-rust.workspace = true
 # SigV4's HMAC chain for /s3/; zeroize wipes the keys it derives.
 hmac.workspace = true
 zeroize.workspace = true
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index ee12b82a..0b3506a5 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -714,7 +714,7 @@ reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5}`, as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 501 `NotImplemented` for S3's XXHASH family, or any other algorithm, rather than taken unchecked) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5,xxhash64,xxhash3,xxhash128}` (every algorithm S3 has; the XXHASHes unseeded, base64 of the big-endian digest as the CRCs', XXH128's high half first), as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 400 `InvalidRequest` in S3's words for an `x-amz-checksum-*` header, `x-amz-sdk-checksum-algorithm` or `x-amz-trailer` naming an algorithm S3 does not have) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
@@ -729,10 +729,10 @@ reads; a replaced object keeps only what its own write sent.
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (501 for an algorithm not computed here); `x-amz-copy-source` is 400 `InvalidArgument` |
+| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (400 `InvalidRequest` for an algorithm S3 does not have); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of the algorithms computed here is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, and an algorithm not computed here 501. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of S3's algorithms is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, as is an algorithm S3 does not have. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
@@ -765,9 +765,9 @@ rather than SigV4** — the way a proxy that authenticates a guest's requests it
 them — and any request to a server with no credential has no secret to check them with: its
 framing is decoded and its signatures are read, not checked. `x-amz-decoded-content-length`
 is required (411 `MissingContentLength`), past 4 GiB is 400 `EntityTooLarge` before the body is read, and the chunks
-must hold exactly that many bytes. The trailer's `x-amz-checksum-{crc32,sha1,sha256}` is
-checked against the decoded bytes and echoed, as a header's is; `crc32c` and `crc64nvme` are
-taken unchecked; a checksum sent both as a header and in the trailer is 400. Reading is
+must hold exactly that many bytes. The trailer's `x-amz-checksum-*`, in any of S3's algorithms, is
+checked against the decoded bytes, echoed and kept, as a header's is; a checksum sent both as
+a header and in the trailer is 400. Reading is
 bounded as it goes: a chunk header of at most 256 bytes, a chunk no longer than what is left
 of the declared length, a trailer of at most 8 KiB, nothing after its end, and memory of one
 frame and a line. A body that breaks any of this is refused where it goes wrong — 400
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index a1f2676f..a74be37e 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -1,7 +1,7 @@
 //! The checksum a write may carry of its body, `x-amz-checksum-<algorithm>` as a header or
-//! as an `aws-chunked` body's trailer, in the algorithms S3 has that this registry computes
-//! (CRC32, CRC32C, SHA1, SHA256, CRC64NVME, SHA512, MD5; the XXHASH family is refused rather
-//! than taken unchecked): one at most, checked against what arrived, echoed once it held,
+//! as an `aws-chunked` body's trailer, in any of S3's algorithms (CRC32, CRC32C, SHA1,
+//! SHA256, CRC64NVME, SHA512, MD5, XXHASH64, XXHASH3, XXHASH128): one at most, checked
+//! against what arrived, echoed once it held,
 //! kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`) and from there
 //! sent back on reads asking for it, listed with the object and reported among its
 //! attributes, as the checksum of the whole object (`FULL_OBJECT`).
@@ -24,9 +24,9 @@ pub(super) const FULL_OBJECT: &str = "FULL_OBJECT";
 /// The header announcing or answering with that.
 pub(super) const TYPE_HEADER: &str = "x-amz-checksum-type";
 
-/// The algorithms computed here: the header carrying each, S3's name for it, and its length
+/// S3's algorithms, every one computed here: the header carrying each, S3's name for it, and its length
 /// in bytes.
-pub(super) const ALGORITHMS: [(&str, &str, usize); 7] = [
+pub(super) const ALGORITHMS: [(&str, &str, usize); 10] = [
     ("x-amz-checksum-crc32", "CRC32", 4),
     ("x-amz-checksum-crc32c", "CRC32C", 4),
     ("x-amz-checksum-sha1", "SHA1", 20),
@@ -34,6 +34,9 @@ pub(super) const ALGORITHMS: [(&str, &str, usize); 7] = [
     ("x-amz-checksum-crc64nvme", "CRC64NVME", 8),
     ("x-amz-checksum-sha512", "SHA512", 64),
     ("x-amz-checksum-md5", "MD5", 16),
+    ("x-amz-checksum-xxhash64", "XXHASH64", 8),
+    ("x-amz-checksum-xxhash3", "XXHASH3", 8),
+    ("x-amz-checksum-xxhash128", "XXHASH128", 16),
 ];
 
 /// The prefix of every checksum header, S3's and any it may add.
@@ -42,31 +45,43 @@ pub(super) const HEADER_PREFIX: &str = "x-amz-checksum-";
 /// The header an SDK names the algorithm of its checksum in, beside the checksum itself.
 pub(super) const SDK_ALGORITHM: &str = "x-amz-sdk-checksum-algorithm";
 
-/// The refusal of a checksum in an algorithm not computed here (S3's XXHASH64, XXHASH3 and
-/// XXHASH128, or anything else), rather than the checksum taken unchecked and the object
-/// then listed without it.
-pub(super) const NOT_COMPUTED: Refusal = Refusal::new(Code::NotImplemented);
+/// The refusal of an `x-amz-checksum-*` header naming no algorithm S3 has, as S3 words it.
+pub(super) const UNKNOWN_HEADER: Refusal = Refusal::said(
+    Code::InvalidRequest,
+    "The algorithm type you specified in x-amz-checksum- header is invalid.",
+);
+
+/// The refusal of an algorithm, named by its own header (`x-amz-sdk-checksum-algorithm`,
+/// `x-amz-checksum-algorithm`), that S3 does not have, as S3 words it.
+pub(super) const UNKNOWN_ALGORITHM: Refusal = Refusal::said(
+    Code::InvalidRequest,
+    "Checksum algorithm provided is unsupported. Please try again with any of the valid types: \
+     [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, XXHASH3, XXHASH64]",
+);
+
+/// The refusal of an `x-amz-trailer` naming no checksum S3 has, as S3 words it.
+pub(super) const UNKNOWN_TRAILER: Refusal = Refusal::said(
+    Code::InvalidRequest,
+    "The value specified in the x-amz-trailer header is not supported",
+);
+
+/// The headers beginning with [`HEADER_PREFIX`] that carry no checksum: they name an
+/// algorithm, a type or a mode.
+const NOT_CHECKSUMS: [&str; 3] = [
+    "x-amz-checksum-algorithm",
+    "x-amz-checksum-type",
+    "x-amz-checksum-mode",
+];
 
 /// The refusal of a checksum that did not hold, as S3 words it, naming the algorithm.
 pub(super) fn mismatch(header: &str) -> Refusal {
-    let message = match header {
-        "x-amz-checksum-crc32" => "The CRC32 you specified did not match the calculated checksum.",
-        "x-amz-checksum-crc32c" => {
-            "The CRC32C you specified did not match the calculated checksum."
-        }
-        "x-amz-checksum-sha1" => "The SHA1 you specified did not match the calculated checksum.",
-        "x-amz-checksum-sha256" => {
-            "The SHA256 you specified did not match the calculated checksum."
-        }
-        "x-amz-checksum-crc64nvme" => {
-            "The CRC64NVME you specified did not match the calculated checksum."
-        }
-        "x-amz-checksum-sha512" => {
-            "The SHA512 you specified did not match the calculated checksum."
-        }
-        _ => "The MD5 you specified did not match the calculated checksum.",
-    };
-    Refusal::said(Code::BadDigest, message)
+    Refusal::saying(
+        Code::BadDigest,
+        format!(
+            "The {} you specified did not match the calculated checksum.",
+            algorithm(header).unwrap_or("MD5")
+        ),
+    )
 }
 
 /// The refusal of a [`SDK_ALGORITHM`] naming an algorithm other than the checksum header's.
@@ -91,18 +106,30 @@ pub(super) fn invalid_trailing(name: &str) -> Refusal {
     )
 }
 
-/// Whether `headers` name a checksum, by header or by [`SDK_ALGORITHM`], in an algorithm
-/// not computed here.
-pub(super) fn not_computed(headers: &hyper::header::HeaderMap) -> bool {
-    let known = |name: &str| ALGORITHMS.iter().any(|(h, _, _)| *h == name);
-    headers
+/// Why `headers` are refused when they name a checksum, by header or by [`SDK_ALGORITHM`],
+/// in an algorithm S3 does not have.
+pub(super) fn unknown(headers: &hyper::header::HeaderMap) -> Option<Refusal> {
+    let known =
+        |name: &str| ALGORITHMS.iter().any(|(h, _, _)| *h == name) || NOT_CHECKSUMS.contains(&name);
+    if headers
         .keys()
         .any(|k| k.as_str().starts_with(HEADER_PREFIX) && !known(k.as_str()))
-        || headers.get_all(SDK_ALGORITHM).iter().any(|v| {
-            !ALGORITHMS
-                .iter()
-                .any(|(_, name, _)| v.as_bytes().eq_ignore_ascii_case(name.as_bytes()))
-        })
+    {
+        return Some(UNKNOWN_HEADER);
+    }
+    headers
+        .get_all(SDK_ALGORITHM)
+        .iter()
+        .any(|v| named(v.as_bytes()).is_none())
+        .then_some(UNKNOWN_ALGORITHM)
+}
+
+/// S3's name of the algorithm `value` names, in any case.
+pub(super) fn named(value: &[u8]) -> Option<&'static str> {
+    ALGORITHMS
+        .iter()
+        .find(|(_, name, _)| value.eq_ignore_ascii_case(name.as_bytes()))
+        .map(|(_, name, _)| *name)
 }
 
 /// CRC-32C (Castagnoli), as S3's `CRC32C`.
@@ -144,6 +171,10 @@ pub(super) enum Hasher {
     Crc64nvme(crc::Digest<'static, u64>),
     Sha512(sha2::Sha512),
     Md5(md5::Context),
+    Xxhash64(xxhash_rust::xxh64::Xxh64),
+    // XXH3's state holds a 256-byte buffer: boxed, so every other hasher stays small.
+    Xxhash3(Box<xxhash_rust::xxh3::Xxh3Default>),
+    Xxhash128(Box<xxhash_rust::xxh3::Xxh3Default>),
 }
 
 impl Hasher {
@@ -156,6 +187,14 @@ impl Hasher {
             "x-amz-checksum-crc64nvme" => Hasher::Crc64nvme(CRC64NVME.digest()),
             "x-amz-checksum-sha512" => Hasher::Sha512(sha2::Sha512::new()),
             "x-amz-checksum-md5" => Hasher::Md5(md5::Context::new()),
+            // S3's XXHASH checksums are unseeded.
+            "x-amz-checksum-xxhash64" => Hasher::Xxhash64(xxhash_rust::xxh64::Xxh64::new(0)),
+            "x-amz-checksum-xxhash3" => {
+                Hasher::Xxhash3(Box::new(xxhash_rust::xxh3::Xxh3Default::new()))
+            }
+            "x-amz-checksum-xxhash128" => {
+                Hasher::Xxhash128(Box::new(xxhash_rust::xxh3::Xxh3Default::new()))
+            }
             _ => return None,
         })
     }
@@ -168,10 +207,13 @@ impl Hasher {
             Hasher::Crc64nvme(h) => h.update(data),
             Hasher::Sha512(h) => h.update(data),
             Hasher::Md5(h) => h.consume(data),
+            Hasher::Xxhash64(h) => h.update(data),
+            Hasher::Xxhash3(h) | Hasher::Xxhash128(h) => h.update(data),
         }
     }
 
-    /// The checksum, as the bytes S3 encodes in base64: big-endian for the CRCs.
+    /// The checksum, as the bytes S3 encodes in base64: big-endian for the CRCs and the
+    /// XXHASHes (XXH128's high half first), as xxHash's canonical form is.
     pub(super) fn finalize(self) -> Vec<u8> {
         match self {
             Hasher::Crc32(h) => h.finalize().to_be_bytes().to_vec(),
@@ -180,6 +222,9 @@ impl Hasher {
             Hasher::Crc64nvme(h) => h.finalize().to_be_bytes().to_vec(),
             Hasher::Sha512(h) => h.finalize().to_vec(),
             Hasher::Md5(h) => h.finalize().0.to_vec(),
+            Hasher::Xxhash64(h) => h.digest().to_be_bytes().to_vec(),
+            Hasher::Xxhash3(h) => h.digest().to_be_bytes().to_vec(),
+            Hasher::Xxhash128(h) => h.digest128().to_be_bytes().to_vec(),
         }
     }
 }
@@ -289,7 +334,21 @@ mod tests {
             b64(&sha2::Sha512::digest(b"123456789"))
         );
         assert_eq!(of("x-amz-checksum-md5"), b64(&md5::compute(b"123456789").0));
-        assert_eq!(super::of("x-amz-checksum-xxhash64", b""), None);
+        // xxHash's own values for no input, unseeded.
+        let empty = |header| b64(&super::of(header, b"").unwrap());
+        assert_eq!(
+            empty("x-amz-checksum-xxhash64"),
+            b64(&0xEF46_DB37_51D8_E999u64.to_be_bytes())
+        );
+        assert_eq!(
+            empty("x-amz-checksum-xxhash3"),
+            b64(&0x2D06_8005_38D3_94C2u64.to_be_bytes())
+        );
+        assert_eq!(
+            empty("x-amz-checksum-xxhash128"),
+            b64(&0x99AA_06D3_0147_98D8_6001_C324_468D_497Fu128.to_be_bytes())
+        );
+        assert_eq!(super::of("x-amz-checksum-xxhash", b""), None);
         // Streamed in pieces, the same.
         let mut h = Hasher::for_("x-amz-checksum-crc64nvme").unwrap();
         h.update(b"1234");
@@ -300,7 +359,7 @@ mod tests {
             assert_eq!(algorithm(header), Some(name));
             assert_eq!(super::header(name), Some(header));
         }
-        assert_eq!(super::len("x-amz-checksum-xxhash64"), None);
+        assert_eq!(super::len("x-amz-checksum-xxhash"), None);
         let of = |pairs: &[(&str, &str)]| {
             let mut h = hyper::header::HeaderMap::new();
             for (n, v) in pairs {
@@ -309,18 +368,23 @@ mod tests {
                     HeaderValue::from_str(v).unwrap(),
                 );
             }
-            not_computed(&h)
+            unknown(&h)
         };
-        assert!(!of(&[]));
-        assert!(!of(&[
-            ("x-amz-checksum-crc32c", "AAAAAA=="),
-            (SDK_ALGORITHM, "crc32c")
-        ]));
-        assert!(of(&[("x-amz-checksum-xxhash64", "AAAAAAAAAAA=")]));
-        assert!(of(&[("x-amz-checksum-xxhash128", "x")]));
-        assert!(of(&[("x-amz-checksum-", "x")]));
-        assert!(of(&[(SDK_ALGORITHM, "XXHASH3")]));
-        assert!(of(&[(SDK_ALGORITHM, "")]));
+        assert_eq!(of(&[]), None);
+        assert_eq!(
+            of(&[
+                ("x-amz-checksum-crc32c", "AAAAAA=="),
+                (SDK_ALGORITHM, "crc32c")
+            ]),
+            None
+        );
+        assert_eq!(of(&[("x-amz-checksum-xxhash128", "x")]), None);
+        assert_eq!(of(&[(SDK_ALGORITHM, "XXHASH3")]), None);
+        assert_eq!(of(&[("x-amz-checksum-type", "COMPOSITE")]), None);
+        assert_eq!(of(&[("x-amz-checksum-xxhash", "x")]), Some(UNKNOWN_HEADER));
+        assert_eq!(of(&[("x-amz-checksum-", "x")]), Some(UNKNOWN_HEADER));
+        assert_eq!(of(&[(SDK_ALGORITHM, "")]), Some(UNKNOWN_ALGORITHM));
+        assert_eq!(of(&[(SDK_ALGORITHM, "XXHASH")]), Some(UNKNOWN_ALGORITHM));
         for (header, name, _) in ALGORITHMS {
             assert!(
                 mismatch(header)
@@ -361,7 +425,7 @@ mod tests {
             kept.elements(),
             "<ChecksumCRC32C>AQIDBA==</ChecksumCRC32C><ChecksumType>FULL_OBJECT</ChecksumType>"
         );
-        assert_eq!(annotation("x-amz-checksum-xxhash64", &value), None);
+        assert_eq!(annotation("x-amz-checksum-xxhash", &value), None);
         // Nothing kept, or something this registry did not write.
         let of = |text: &str| {
             stored(&BTreeMap::from([(
@@ -371,6 +435,7 @@ mod tests {
         };
         assert_eq!(of("CRC32C:AQID"), None);
         assert_eq!(of("XXHASH64:AQIDBA=="), None);
+        assert_eq!(of("XXHASH:AQIDBA=="), None);
         assert_eq!(of("MD5:AQIDBA=="), None);
         assert_eq!(of("AQIDBA=="), None);
         assert_eq!(of("CRC32C:!!"), None);
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 07151a91..bb67a92e 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -441,24 +441,13 @@ pub(super) async fn create(
 
 /// The `x-amz-checksum-algorithm` a creation names, as S3 spells it: the algorithm the
 /// parts' checksums will be in, which each part's request then carries and is checked by;
-/// one not computed here is refused as a part carrying it would be.
+/// one S3 does not have is refused as S3 refuses it.
 fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'static str>, Refusal> {
-    let Some(v) = headers.get("x-amz-checksum-algorithm") else {
-        return Ok(None);
-    };
-    let known = checksum::ALGORITHMS
-        .into_iter()
-        .map(|(_, name, _)| name)
-        .find(|a| v.as_bytes().eq_ignore_ascii_case(a.as_bytes()));
-    match known {
-        Some(name) => Ok(Some(name)),
-        None if v.as_bytes().is_empty() || v.to_str().is_err() => Err(Refusal::said(
-            Code::InvalidRequest,
-            "Checksum algorithm provided is unsupported. Please try again with any of the \
-             valid types: [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, \
-             XXHASH3, XXHASH64]",
-        )),
-        None => Err(checksum::NOT_COMPUTED),
+    match headers.get("x-amz-checksum-algorithm") {
+        None => Ok(None),
+        Some(v) => checksum::named(v.as_bytes())
+            .map(Some)
+            .ok_or(checksum::UNKNOWN_ALGORITHM),
     }
 }
 
@@ -791,10 +780,10 @@ fn multipart_etag(md5s: &[[u8; 16]]) -> String {
 }
 
 /// The whole-object checksum a completion's headers name: the first `x-amz-checksum-*` of
-/// the algorithms computed here sent as a full object's (base64 of the algorithm's length),
+/// S3's algorithms sent as a full object's (base64 of the algorithm's length),
 /// its header, text and bytes. A composite checksum (a checksum of the parts' checksums,
 /// `<base64>-<parts>`) is passed over, since the parts were checked as they came; anything
-/// else is refused, as is an algorithm not computed here.
+/// else is refused, as is an algorithm S3 does not have.
 struct Whole {
     header: &'static str,
     text: String,
@@ -803,8 +792,8 @@ struct Whole {
 
 impl Whole {
     fn of(headers: &HeaderMap) -> std::result::Result<Option<Self>, Refusal> {
-        if checksum::not_computed(headers) {
-            return Err(checksum::NOT_COMPUTED);
+        if let Some(why) = checksum::unknown(headers) {
+            return Err(why);
         }
         for (header, _, len) in checksum::ALGORITHMS {
             let Some(value) = headers.get(header) else {
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 62eb2b2e..9499344a 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -535,7 +535,7 @@ fn payload(headers: &HeaderMap) -> std::result::Result<Payload, Refusal> {
                         .to_ascii_lowercase()
                         .starts_with(checksum::HEADER_PREFIX) =>
                 {
-                    return Err(checksum::NOT_COMPUTED);
+                    return Err(checksum::UNKNOWN_TRAILER);
                 }
                 None => return Err(invalid("x-amz-trailer names one x-amz-checksum header")),
             }
@@ -597,11 +597,11 @@ fn content_md5(headers: &HeaderMap) -> std::result::Result<Option<Vec<u8>>, Refu
 }
 
 /// What a request's headers ask to be checked: its `Content-MD5` and the one
-/// `x-amz-checksum-*` it carries, in an algorithm computed here; a second one is refused as
-/// S3 refuses it, and one in another algorithm as not implemented.
+/// `x-amz-checksum-*` it carries; a second one, or one in an algorithm S3 does not have, is
+/// refused as S3 refuses it.
 fn expected(headers: &HeaderMap) -> std::result::Result<Expected, Refusal> {
-    if checksum::not_computed(headers) {
-        return Err(checksum::NOT_COMPUTED);
+    if let Some(why) = checksum::unknown(headers) {
+        return Err(why);
     }
     // More than one is refused whatever they hold, as S3 refuses it.
     let sent = checksum::ALGORITHMS
@@ -1214,9 +1214,11 @@ mod tests {
             );
         }
         assert_eq!(
-            code(&[trailer, length, ("x-amz-trailer", "x-amz-checksum-xxhash3")]),
-            Some("NotImplemented")
+            code(&[trailer, length, ("x-amz-trailer", "x-amz-checksum-xxhash")]),
+            Some("InvalidRequest")
         );
+        let (_, f) = framing(&[trailer, length, ("x-amz-trailer", "x-amz-checksum-xxhash3")]);
+        assert_eq!(f.trailer, Some("x-amz-checksum-xxhash3"));
         let signed = ("x-amz-content-sha256", "STREAMING-AWS4-HMAC-SHA256-PAYLOAD");
         let crc = ("x-amz-trailer", "x-amz-checksum-crc32");
         assert_eq!(code(&[signed, length, crc]), Some("InvalidRequest"));
@@ -1288,13 +1290,18 @@ mod tests {
             code(&[("x-amz-checksum-crc64nvme", "AAAAAA==")]),
             Some("InvalidRequest")
         );
+        assert_eq!(code(&[("x-amz-checksum-xxhash64", "AAAAAAAAAAA=")]), None);
         assert_eq!(
-            code(&[("x-amz-checksum-xxhash64", "AAAAAAAAAAA=")]),
-            Some("NotImplemented")
+            code(&[("x-amz-checksum-xxhash64", "AAAAAA==")]),
+            Some("InvalidRequest")
         );
         assert_eq!(
-            code(&[("x-amz-sdk-checksum-algorithm", "XXHASH128")]),
-            Some("NotImplemented")
+            code(&[("x-amz-checksum-whirlpool", "AAAAAA==")]),
+            Some("InvalidRequest")
+        );
+        assert_eq!(
+            code(&[("x-amz-sdk-checksum-algorithm", "WHIRLPOOL")]),
+            Some("InvalidRequest")
         );
         assert_eq!(
             code(&[
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 09557812..a4c7cc6e 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1460,6 +1460,9 @@ async fn a_put_checks_the_digests_it_is_sent() {
         sha1::Sha1::digest(b).to_vec()
     };
     let crc = |b: &[u8]| crc32fast::hash(b).to_be_bytes().to_vec();
+    let xxh64 = |b: &[u8]| xxhash_rust::xxh64::xxh64(b, 0).to_be_bytes().to_vec();
+    let xxh3 = |b: &[u8]| xxhash_rust::xxh3::xxh3_64(b).to_be_bytes().to_vec();
+    let xxh128 = |b: &[u8]| xxhash_rust::xxh3::xxh3_128(b).to_be_bytes().to_vec();
     let good: Vec<(&str, String)> = vec![
         ("Content-MD5", b64(&md5::compute(HELLO).0)),
         ("x-amz-checksum-sha256", b64(&sha2::Sha256::digest(HELLO))),
@@ -1469,6 +1472,9 @@ async fn a_put_checks_the_digests_it_is_sent() {
         ("x-amz-checksum-crc64nvme", crc64nvme_b64(HELLO)),
         ("x-amz-checksum-sha512", b64(&sha2::Sha512::digest(HELLO))),
         ("x-amz-checksum-md5", b64(&md5::compute(HELLO).0)),
+        ("x-amz-checksum-xxhash64", b64(&xxh64(HELLO))),
+        ("x-amz-checksum-xxhash3", b64(&xxh3(HELLO))),
+        ("x-amz-checksum-xxhash128", b64(&xxh128(HELLO))),
     ];
     let bad: Vec<(&str, String)> = vec![
         ("Content-MD5", b64(&md5::compute(other).0)),
@@ -1479,6 +1485,9 @@ async fn a_put_checks_the_digests_it_is_sent() {
         ("x-amz-checksum-crc64nvme", crc64nvme_b64(other)),
         ("x-amz-checksum-sha512", b64(&sha2::Sha512::digest(other))),
         ("x-amz-checksum-md5", b64(&md5::compute(other).0)),
+        ("x-amz-checksum-xxhash64", b64(&xxh64(other))),
+        ("x-amz-checksum-xxhash3", b64(&xxh3(other))),
+        ("x-amz-checksum-xxhash128", b64(&xxh128(other))),
     ];
     for (i, (name, value)) in good.iter().enumerate() {
         let path = format!("/s3/b/good{i}");
@@ -1488,6 +1497,9 @@ async fn a_put_checks_the_digests_it_is_sent() {
         if name.starts_with("x-amz-checksum") {
             assert_eq!(resp.header(name), Some(value.as_str()), "{name}");
             assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
+            let asked = Req::new("HEAD", &path).header("x-amz-checksum-mode", "ENABLED");
+            let resp = send(&host, asked).await;
+            assert_eq!(resp.header(name), Some(value.as_str()), "{name} kept");
         } else {
             assert_eq!(resp.header("x-amz-checksum-type"), None);
         }
@@ -1525,23 +1537,33 @@ async fn a_put_checks_the_digests_it_is_sent() {
     )
     .await
     .is(400, "InvalidRequest");
-    // One checksum, of one algorithm, and one computed here: never taken unchecked.
+    // One checksum, of one algorithm, and one S3 has: never taken unchecked.
     let two = put("/s3/b/x", ("x-amz-checksum-crc32c", &crc32c_b64(HELLO)))
         .header("x-amz-checksum-crc32", &crc32_b64(HELLO));
     send(&host, two).await.is(400, "InvalidRequest");
-    for (name, value) in [
-        ("x-amz-checksum-xxhash64", "AAAAAAAAAAA="),
-        ("x-amz-checksum-xxhash128", "AAAAAAAAAAAAAAAAAAAAAA=="),
-        ("x-amz-sdk-checksum-algorithm", "XXHASH3"),
+    for (name, value, message) in [
+        (
+            "x-amz-checksum-xxhash",
+            "AAAAAAAAAAA=",
+            "The algorithm type you specified in x-amz-checksum- header is invalid.",
+        ),
+        (
+            "x-amz-sdk-checksum-algorithm",
+            "XXHASH",
+            "Checksum algorithm provided is unsupported. Please try again with any of the valid \
+             types: [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, XXHASH3, \
+             XXHASH64]",
+        ),
     ] {
         send(&host, put("/s3/b/x", (name, value)))
             .await
-            .is(501, "NotImplemented");
+            .is(400, "InvalidRequest")
+            .says(message);
     }
     let req = Req::new("POST", "/s3/b/x")
         .query("uploads=")
-        .header("x-amz-checksum-algorithm", "XXHASH64");
-    send(&host, req).await.is(501, "NotImplemented");
+        .header("x-amz-checksum-algorithm", "XXHASH");
+    send(&host, req).await.is(400, "InvalidRequest");
     send(&host, get("/s3/b/x")).await.is(404, "NoSuchKey");
     assert_eq!(staging_left(&dir), 0);
 
@@ -1831,10 +1853,10 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
         ("x-amz-checksum-crc32", "AAAAAA==-0", 400, "InvalidRequest"),
         ("x-amz-checksum-crc32", "AAAAAA==-x", 400, "InvalidRequest"),
         (
-            "x-amz-checksum-xxhash64",
+            "x-amz-checksum-xxhash",
             "AAAAAAAAAAA=",
-            501,
-            "NotImplemented",
+            400,
+            "InvalidRequest",
         ),
     ] {
         let req = complete(path, &id, &[(1, e1.as_str())]).header(name, value);
@@ -2139,11 +2161,18 @@ async fn a_trailer_checksum_must_be_the_body_s() {
         resp.ok(200);
         assert_eq!(resp.header("x-amz-checksum-sha1"), Some(sha1.as_str()));
 
-        // Not computed here; not base64 of its length; announced and not sent; sent as a
+        let xxh3 = b64(&xxhash_rust::xxh3::xxh3_64(&data).to_be_bytes());
+        let xx = ("x-amz-checksum-xxhash3", xxh3.as_str());
+        let req = Req::new("PUT", "/s3/b/xx").chunked(&host, BEARER, mode, &data, Some(xx));
+        let resp = send(&host, req).await;
+        resp.ok(200);
+        assert_eq!(resp.header("x-amz-checksum-xxhash3"), Some(xxh3.as_str()));
+
+        // No algorithm S3 has; not base64 of its length; announced and not sent; sent as a
         // header too.
-        let xx = ("x-amz-checksum-xxhash64", "AAAAAAAAAAA=");
+        let xx = ("x-amz-checksum-xxhash", "AAAAAAAAAAA=");
         let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(xx));
-        send(&host, req).await.is(501, "NotImplemented");
+        send(&host, req).await.is(400, "InvalidRequest");
         let crc = ("x-amz-checksum-crc32", "!!");
         let req = Req::new("PUT", "/s3/b/x").chunked(&host, BEARER, mode, &data, Some(crc));
         send(&host, req).await.is(400, "InvalidRequest");

From fb221a4f3f9a0f8aa82c8691d3793499adea22a6 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 12:34:07 +0100
Subject: [PATCH 48/54] vk-registry/s3: hold an upload's parts and completion
 to its checksum

CreateMultipartUpload takes x-amz-checksum-type beside the algorithm,
refuses a type or algorithm S3 does not have, a type without an
algorithm and a type the algorithm cannot make, and records both with
the upload. Each part of such an upload carries a checksum in its
algorithm, or has it computed for a FULL_OBJECT upload, and is recorded
with it. The completion is held to them as S3 holds it: the checksum
type must be the upload's, each part must name the checksum it was
stored with (InvalidArgument, InvalidPart, BadDigest, InvalidRequest in
S3's words), and one final checksum at most. A FULL_OBJECT upload's
checksum is computed as the parts are assembled, checked and kept.
---
 CHANGELOG.md                    |   3 +-
 vk-registry/DESIGN.md           |   6 +-
 vk-registry/src/s3/checksum.rs  |  76 ++++++-
 vk-registry/src/s3/multipart.rs | 354 ++++++++++++++++++++++++++------
 vk-registry/src/s3/object.rs    |  70 +++++--
 vk-registry/tests/s3_e2e.rs     | 285 ++++++++++++++++++++++++-
 6 files changed, 714 insertions(+), 80 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3daf0f34..94a6ab4c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,8 @@ All notable changes to virtkit will be documented in this file.
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
   a refused upload sees its refusal rather than a dropped connection; every refusal carries
   the error code, status and message S3 answers with. Large
-  files can be uploaded in parts, as the AWS CLI uploads them, completed once however many
+  files can be uploaded in parts, as the AWS CLI uploads them, each part and the completion
+  held to the checksum the upload was created with, completed once however many
   completions of the upload are sent, at once or as retries (each answered as the first while
   the object is still the one it made), read back a part at a time,
   parts copied from other objects,
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 0b3506a5..5560d134 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -729,10 +729,10 @@ reads; a replaced object keeps only what its own write sent.
 | `HEAD /s3/<b>` HeadBucket | 200 when `files/<b>` is a directory, 404 `NoSuchBucket` when not; 403 when the caller may read neither `files/<b>` nor anything below it |
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
-| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` is taken and echoed (400 `InvalidRequest` for an algorithm S3 does not have); `x-amz-copy-source` is 400 `InvalidArgument` |
-| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
+| `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` and `x-amz-checksum-type` (`COMPOSITE`, a checksum of the parts' checksums, or `FULL_OBJECT`, by default `FULL_OBJECT` for CRC64NVME and `COMPOSITE` otherwise) are recorded with the upload and echoed; 400 `InvalidRequest` in S3's words for an algorithm or a type S3 does not have, a type without an algorithm, and a type the algorithm cannot make (`FULL_OBJECT` is CRC32, CRC32C and CRC64NVME only; `COMPOSITE` anything but CRC64NVME); `x-amz-copy-source` is 400 `InvalidArgument` |
+| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). A whole-object `x-amz-checksum-*` of any of S3's algorithms is checked against the object (400 `BadDigest`) and kept as a PutObject's is, named in the result with its `ChecksumType`; a composite one (`…-<parts>`) is passed over, anything else is 400 `InvalidRequest`, as is an algorithm S3 does not have. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; for an upload created with none, a final whole-object checksum is checked and kept that way; either is named in the result with its `ChecksumType`. A composite one is passed over. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index a74be37e..9323c796 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -24,6 +24,80 @@ pub(super) const FULL_OBJECT: &str = "FULL_OBJECT";
 /// The header announcing or answering with that.
 pub(super) const TYPE_HEADER: &str = "x-amz-checksum-type";
 
+/// How a multipart upload's checksum is made, as `x-amz-checksum-type` names it: of the
+/// whole object, or of its parts' checksums (`<base64>-<parts>`).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub(super) enum Kind {
+    FullObject,
+    Composite,
+}
+
+impl Kind {
+    /// The kind `value` names, in any case.
+    pub(super) fn of(value: &[u8]) -> Option<Self> {
+        [Kind::FullObject, Kind::Composite]
+            .into_iter()
+            .find(|k| value.eq_ignore_ascii_case(k.name().as_bytes()))
+    }
+
+    pub(super) fn name(self) -> &'static str {
+        match self {
+            Kind::FullObject => FULL_OBJECT,
+            Kind::Composite => "COMPOSITE",
+        }
+    }
+
+    /// Whether a checksum of this kind may be made with `algorithm`, as S3 has them: the
+    /// whole object's with a CRC only, the parts' with anything but CRC64NVME.
+    pub(super) fn fits(self, algorithm: &str) -> bool {
+        match self {
+            Kind::FullObject => matches!(algorithm, "CRC32" | "CRC32C" | "CRC64NVME"),
+            Kind::Composite => algorithm != "CRC64NVME",
+        }
+    }
+
+    /// The kind an upload created with `algorithm` and no `x-amz-checksum-type` has.
+    pub(super) fn default_for(algorithm: &str) -> Self {
+        if algorithm == "CRC64NVME" {
+            Kind::FullObject
+        } else {
+            Kind::Composite
+        }
+    }
+}
+
+/// The refusal of a checksum type `kind` that cannot be made with `algorithm`, as S3 words it.
+pub(super) fn unfit(kind: Kind, algorithm: &str) -> Refusal {
+    Refusal::saying(
+        Code::InvalidRequest,
+        format!(
+            "The {} checksum type cannot be used with the {} checksum algorithm.",
+            kind.name(),
+            algorithm.to_ascii_lowercase()
+        ),
+    )
+}
+
+/// The refusal of an `x-amz-checksum-type` sent without the algorithm, as S3 words it.
+pub(super) const TYPE_WITHOUT_ALGORITHM: Refusal = Refusal::said(
+    Code::InvalidRequest,
+    "The x-amz-checksum-type header can only be used with the x-amz-checksum-algorithm header.",
+);
+
+/// The refusal of a part whose checksum is in `actual`, or in none, when its upload was
+/// created with `expected`, as S3 words it.
+pub(super) fn part_mismatch(expected: &str, actual: Option<&str>) -> Refusal {
+    Refusal::saying(
+        Code::InvalidRequest,
+        format!(
+            "Checksum Type mismatch occurred, expected checksum Type: {expected}, actual \
+             checksum Type: {}",
+            actual.unwrap_or("null")
+        ),
+    )
+}
+
 /// S3's algorithms, every one computed here: the header carrying each, S3's name for it, and its length
 /// in bytes.
 pub(super) const ALGORITHMS: [(&str, &str, usize); 10] = [
@@ -155,7 +229,7 @@ pub(super) fn algorithm(header: &str) -> Option<&'static str> {
 }
 
 /// The header carrying `algorithm`'s checksum, by S3's name of it.
-fn header(algorithm: &str) -> Option<&'static str> {
+pub(super) fn header(algorithm: &str) -> Option<&'static str> {
     ALGORITHMS
         .iter()
         .find(|(_, name, _)| *name == algorithm)
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index bb67a92e..069d3824 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -180,6 +180,24 @@ struct Meta {
     created: u64,
     /// the user metadata the object will carry, as [`meta::annotations`] made it
     annotations: BTreeMap<String, String>,
+    /// the checksum the upload was created with, which its parts are held to; absent from
+    /// the record of an upload created without one
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    checksum: Option<Asked>,
+}
+
+/// The checksum a CreateMultipartUpload asks for: S3's name of its algorithm, and its kind.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+struct Asked {
+    algorithm: String,
+    kind: checksum::Kind,
+}
+
+impl Asked {
+    /// The checksum header of its algorithm; `None` for a record this server did not write.
+    fn header(&self) -> Option<&'static str> {
+        checksum::header(&self.algorithm)
+    }
 }
 
 /// What a part's record says of it.
@@ -188,6 +206,10 @@ struct Part {
     size: u64,
     /// lowercase hex
     md5: String,
+    /// the checksum the part carried, or was given for its upload's, as an object's
+    /// annotation keeps one (`<ALGORITHM>:<base64>`)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    checksum: Option<String>,
 }
 
 /// An upload this request may act on: its directory and what it recorded.
@@ -353,12 +375,19 @@ fn temp_in(dir: &Path, what: &str) -> Result<(PathBuf, std::fs::File)> {
 /// part's, then its record. Each rename replaces its file whole, but the two are not one
 /// step: a reader between them sees new bytes beside the old record, which is why Complete
 /// checks every part's MD5 as it reads it.
-fn install_part(dir: &Path, n: u32, staged: Staged, md5: &str) -> Result<()> {
+fn install_part(
+    dir: &Path,
+    n: u32,
+    staged: Staged,
+    md5: &str,
+    checksum: Option<String>,
+) -> Result<()> {
     let size = staged.size;
     staged.rename_to(&part_path(dir, n))?;
     let record = serde_json::to_vec(&Part {
         size,
         md5: md5.to_string(),
+        checksum,
     })?;
     vk_fs::write_atomic_unsynced(&record_path(dir, n), &record, 0o600)
 }
@@ -393,8 +422,8 @@ pub(super) async fn create(
         Ok(a) => a,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
-    let algorithm = match checksum_algorithm(headers) {
-        Ok(a) => a,
+    let asked = match asked(headers) {
+        Ok(asked) => asked,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     if let Some(resp) = drain(req, ctx).await? {
@@ -410,6 +439,7 @@ pub(super) async fn create(
             key: key_of(&segs),
             created: vk_peer::now_secs(),
             annotations,
+            checksum: asked,
         };
         let (id, dir) = store.create_multipart()?;
         let recorded = serde_json::to_vec(&meta)
@@ -429,26 +459,55 @@ pub(super) async fn create(
                 xml::element("UploadId", &id)
             ),
         );
-        if let Some(algorithm) = algorithm
-            && let Ok(v) = hyper::header::HeaderValue::from_str(algorithm)
+        if let Some(asked) = &meta.checksum
+            && let Ok(v) = hyper::header::HeaderValue::from_str(&asked.algorithm)
         {
-            resp.headers_mut().insert("x-amz-checksum-algorithm", v);
+            let headers = resp.headers_mut();
+            headers.insert(CHECKSUM_ALGORITHM, v);
+            headers.insert(
+                checksum::TYPE_HEADER,
+                hyper::header::HeaderValue::from_static(asked.kind.name()),
+            );
         }
         Ok(resp)
     })
     .await
 }
 
-/// The `x-amz-checksum-algorithm` a creation names, as S3 spells it: the algorithm the
-/// parts' checksums will be in, which each part's request then carries and is checked by;
-/// one S3 does not have is refused as S3 refuses it.
-fn checksum_algorithm(headers: &HeaderMap) -> std::result::Result<Option<&'static str>, Refusal> {
-    match headers.get("x-amz-checksum-algorithm") {
-        None => Ok(None),
-        Some(v) => checksum::named(v.as_bytes())
-            .map(Some)
-            .ok_or(checksum::UNKNOWN_ALGORITHM),
+/// The header a CreateMultipartUpload names its parts' checksum algorithm in.
+const CHECKSUM_ALGORITHM: &str = "x-amz-checksum-algorithm";
+
+/// The checksum a creation asks for: the algorithm `x-amz-checksum-algorithm` names, as S3
+/// spells it, which each part is then held to, and the kind `x-amz-checksum-type` names, by
+/// default a full object's for CRC64NVME and a composite one otherwise. Refused as S3
+/// refuses them: an algorithm or a kind S3 does not have, a kind without an algorithm, and
+/// a kind the algorithm cannot make.
+fn asked(headers: &HeaderMap) -> std::result::Result<Option<Asked>, Refusal> {
+    let algorithm = match headers.get(CHECKSUM_ALGORITHM) {
+        None => None,
+        Some(v) => Some(checksum::named(v.as_bytes()).ok_or(checksum::UNKNOWN_ALGORITHM)?),
+    };
+    let kind = match headers.get(checksum::TYPE_HEADER) {
+        None => None,
+        Some(v) => Some(
+            checksum::Kind::of(v.as_bytes())
+                .ok_or_else(|| checksum::invalid(checksum::TYPE_HEADER))?,
+        ),
+    };
+    let Some(algorithm) = algorithm else {
+        return match kind {
+            None => Ok(None),
+            Some(_) => Err(checksum::TYPE_WITHOUT_ALGORITHM),
+        };
+    };
+    let kind = kind.unwrap_or(checksum::Kind::default_for(algorithm));
+    if !kind.fits(algorithm) {
+        return Err(checksum::unfit(kind, algorithm));
     }
+    Ok(Some(Asked {
+        algorithm: algorithm.to_string(),
+        kind,
+    }))
 }
 
 /// A request naming `uploadId` on an object, to the operation its method names.
@@ -544,13 +603,30 @@ async fn upload_part(
     if object::declared_too_large(headers) {
         return Ok(ctx.too_large());
     }
-    let plan = match object::plan(headers) {
+    let mut plan = match object::plan(headers) {
         Ok(plan) => plan,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
     let Some(up) = open_async(state, &id, &segs).await? else {
         return refuse(req, no_such_upload(ctx, &id), ctx).await;
     };
+    // A part of an upload created with a checksum carries one in its algorithm; a full
+    // object's is computed for a part that carries none, as S3 combines it from the parts'.
+    if let Some(asked) = &up.meta.checksum
+        && let Some(want) = asked.header()
+    {
+        match plan.claimed() {
+            Some(header) if header == want => {}
+            None if asked.kind == checksum::Kind::FullObject => plan.compute(want),
+            claimed => {
+                let why = checksum::part_mismatch(
+                    &asked.algorithm,
+                    claimed.and_then(checksum::algorithm),
+                );
+                return refuse(req, ctx.error(why), ctx).await;
+            }
+        }
+    }
     let staging = match temp_in(&up.dir, &format!("part-{n}")) {
         Ok(staging) => staging,
         // Completed or aborted since it was looked up.
@@ -562,9 +638,14 @@ async fn upload_part(
         Err(resp) => return Ok(resp),
     };
     let md5 = crate::hex_of(&received.md5);
+    let kept = received
+        .echo
+        .as_ref()
+        .and_then(|(header, text)| checksum::annotation(header, text))
+        .map(|(_, value)| value);
     let installed = {
         let (dir, md5) = (up.dir.clone(), md5.clone());
-        tokio::task::spawn_blocking(move || install_part(&dir, n, received.staged, &md5))
+        tokio::task::spawn_blocking(move || install_part(&dir, n, received.staged, &md5, kept))
             .await
             .context("installing a part panicked")?
     };
@@ -699,7 +780,7 @@ async fn copy_part(
         }
         drop(file);
         let md5 = crate::hex_of(&md5.finalize().0);
-        match install_part(&up.dir, n, staged, &md5) {
+        match install_part(&up.dir, n, staged, &md5, None) {
             Ok(()) => {}
             Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx, &id)),
             Err(e) => return Err(e),
@@ -727,10 +808,17 @@ enum Unfit {
     Number(String),
 }
 
+/// The checksums a `Part` of a `CompleteMultipartUpload` names (`ChecksumCRC32`…), each its
+/// algorithm's header and its text, trimmed, as sent.
+type Sent = Vec<(&'static str, String)>;
+
+/// What [`document`] reads: each part's number and ETag, and the checksums each names.
+type Named = (Vec<(u32, String)>, Vec<Sent>);
+
 /// The parts a `CompleteMultipartUpload` document names, in order: each part's number and
-/// the ETag it is expected to have, unquoted and lowercase. Fields beside `PartNumber` and
-/// `ETag` (the parts' checksums) are passed over.
-fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Unfit> {
+/// the ETag it is expected to have, unquoted and lowercase; and beside them the checksums
+/// each names. Other fields are passed over.
+fn document(body: &[u8]) -> std::result::Result<Named, Unfit> {
     let root = scan::parse(body, MAX_ELEMENTS).map_err(|Malformed(why)| Unfit::Malformed(why))?;
     if root.name != "CompleteMultipartUpload" {
         return Err(Unfit::Malformed(
@@ -738,6 +826,7 @@ fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Unfit> {
         ));
     }
     let mut parts: Vec<(u32, String)> = Vec::new();
+    let mut checksums_of = Vec::new();
     for p in root.all("Part") {
         let field = |name| {
             p.one(name)
@@ -760,13 +849,90 @@ fn document(body: &[u8]) -> std::result::Result<Vec<(u32, String)>, Unfit> {
             return Err(Unfit::Order);
         }
         parts.push((n, etag));
+        let mut checksums = Sent::new();
+        for (header, name, _) in checksum::ALGORITHMS {
+            let element = p
+                .one(&format!("Checksum{name}"))
+                .map_err(|Malformed(why)| Unfit::Malformed(why))?;
+            if let Some(e) = element.filter(|e| !e.text.trim().is_empty()) {
+                checksums.push((header, e.text.trim().to_string()));
+            }
+        }
+        checksums_of.push(checksums);
     }
     if parts.is_empty() {
         return Err(Unfit::Malformed(
             "a CompleteMultipartUpload names at least one Part",
         ));
     }
-    Ok(parts)
+    Ok((parts, checksums_of))
+}
+
+/// Check the checksums a completion names for part `n` (`sent`) against the one the part
+/// was stored with (`kept`, `<ALGORITHM>:<base64>`), as S3 checks them: one at most, in
+/// base64 of its algorithm's length (400 `InvalidArgument`); none for a part stored with
+/// none, and that one for a part stored with one (`InvalidPart` when it differs, `BadDigest`
+/// when it is in another algorithm); and one for every part of an upload `asked` for a
+/// checksum (400 `InvalidRequest`).
+fn check_part(
+    n: u32,
+    sent: &[(&'static str, String)],
+    kept: Option<&str>,
+    asked: Option<&Asked>,
+    invalid_part: Refusal,
+) -> std::result::Result<(), Refusal> {
+    let argument = |value: String| {
+        Refusal::argument(
+            "Invalid Base64 or multiple checksums present in request",
+            "Checksum",
+            value,
+        )
+    };
+    if sent.len() > 1 {
+        let all: String = sent
+            .iter()
+            .map(|(header, text)| format!("{}:{text};", checksum::algorithm(header).unwrap_or("")))
+            .collect();
+        return Err(argument(all));
+    }
+    let kept = kept.and_then(|k| k.split_once(':'));
+    match (kept, sent.first()) {
+        (None, None) => Ok(()),
+        (None, Some(_)) => Err(invalid_part),
+        (Some((algorithm, _)), None) => match asked {
+            None => Ok(()),
+            Some(_) => Err(Refusal::saying(
+                Code::InvalidRequest,
+                format!(
+                    "The upload was created using a {} checksum. The complete request must \
+                     include the checksum for each part. It was missing for part {n} in the \
+                     request.",
+                    algorithm.to_ascii_lowercase()
+                ),
+            )),
+        },
+        (Some((algorithm, value)), Some((header, text))) => {
+            let fits = crate::auth::base64_decode(text)
+                .is_some_and(|b| Some(b.len()) == checksum::len(header));
+            if !fits {
+                return Err(argument(text.clone()));
+            }
+            if text == value {
+                return Ok(());
+            }
+            let named = checksum::algorithm(header).unwrap_or("");
+            if named == algorithm {
+                return Err(invalid_part);
+            }
+            Err(Refusal::saying(
+                Code::BadDigest,
+                format!(
+                    "The {} you specified for part {n} did not match what we received.",
+                    named.to_ascii_lowercase()
+                ),
+            ))
+        }
+    }
 }
 
 /// The ETag of an object made of parts whose MD5s are `md5s`, unquoted: the MD5 of their
@@ -779,15 +945,16 @@ fn multipart_etag(md5s: &[[u8; 16]]) -> String {
     format!("{}-{}", crate::hex_of(&all.finalize().0), md5s.len())
 }
 
-/// The whole-object checksum a completion's headers name: the first `x-amz-checksum-*` of
-/// S3's algorithms sent as a full object's (base64 of the algorithm's length),
-/// its header, text and bytes. A composite checksum (a checksum of the parts' checksums,
-/// `<base64>-<parts>`) is passed over, since the parts were checked as they came; anything
-/// else is refused, as is an algorithm S3 does not have.
+/// The checksum a completion's headers name for the object: one `x-amz-checksum-*` of S3's
+/// algorithms at most, its header and bytes, either a whole object's (base64 of the
+/// algorithm's length) or a composite one, a checksum of the parts' checksums
+/// (`<base64>-<parts>`, never for CRC64NVME, whose checksum is a full object's). Two, or one
+/// that is neither, or in an algorithm S3 does not have, are refused as S3 refuses them.
 struct Whole {
     header: &'static str,
-    text: String,
     bytes: Vec<u8>,
+    /// how many parts a composite checksum says it was made of
+    composite: Option<u32>,
 }
 
 impl Whole {
@@ -795,28 +962,48 @@ impl Whole {
         if let Some(why) = checksum::unknown(headers) {
             return Err(why);
         }
+        let sent = checksum::ALGORITHMS
+            .iter()
+            .filter(|(h, _, _)| headers.contains_key(*h));
+        if sent.count() > 1 {
+            return Err(object::ONE_CHECKSUM);
+        }
+        let mut found = None;
         for (header, _, len) in checksum::ALGORITHMS {
             let Some(value) = headers.get(header) else {
                 continue;
             };
-            if let Some((text, bytes)) = object::base64_header(headers, header, len).ok().flatten()
-            {
-                return Ok(Some(Whole {
-                    header,
-                    text,
-                    bytes,
-                }));
-            }
             let text = value.to_str().unwrap_or_default().trim();
-            let composite = text.rsplit_once('-').is_some_and(|(sum, parts)| {
-                crate::auth::base64_decode(sum).is_some_and(|b| b.len() == len)
-                    && part_number(parts).is_some()
+            let decoded = |sum: &str| crate::auth::base64_decode(sum).filter(|b| b.len() == len);
+            let (bytes, composite) = match decoded(text) {
+                Some(bytes) => (bytes, None),
+                None => text
+                    .rsplit_once('-')
+                    .filter(|_| header != CRC64NVME)
+                    .and_then(|(sum, parts)| Some((decoded(sum)?, Some(part_number(parts)?))))
+                    .ok_or_else(|| checksum::invalid(header))?,
+            };
+            found = Some(Whole {
+                header,
+                bytes,
+                composite,
             });
-            if !composite {
-                return Err(checksum::invalid(header));
-            }
         }
-        Ok(None)
+        Ok(found)
+    }
+}
+
+/// The header of S3's one checksum that is only ever a full object's.
+const CRC64NVME: &str = "x-amz-checksum-crc64nvme";
+
+/// The kind of checksum a completion's `x-amz-checksum-type` names, which must be its
+/// upload's: 400 `InvalidRequest` for anything else.
+fn completion_kind(headers: &HeaderMap) -> std::result::Result<Option<checksum::Kind>, Refusal> {
+    match headers.get(checksum::TYPE_HEADER) {
+        None => Ok(None),
+        Some(v) => checksum::Kind::of(v.as_bytes())
+            .map(Some)
+            .ok_or_else(|| checksum::invalid(checksum::TYPE_HEADER)),
     }
 }
 
@@ -832,12 +1019,16 @@ struct Assembled {
 /// Concatenate the `parts` of `up`, in order, into a staging file, in one pass, hashing on
 /// the way: each part's MD5, checked against both the ETag asked and the part's record, so a
 /// part replaced while this reads it is noticed rather than built in; the whole object's
-/// SHA-256, and the checksum `whole` asks to be checked against, in its algorithm.
+/// SHA-256; and its checksum: the full object's of an upload created with one, checked
+/// against what `whole` names in its algorithm, or for an upload created with none, the
+/// one `whole` names. First, the completion's `kind` must be the upload's, and the checksums
+/// `sent` for each part what [`check_part`] takes. A composite checksum is passed over.
 fn assemble(
     store: &Store,
     up: &Upload,
     parts: &[(u32, String)],
-    whole: Option<&Whole>,
+    sent: &[Sent],
+    (whole, kind): (Option<&Whole>, Option<checksum::Kind>),
 ) -> Result<std::result::Result<Assembled, Refusal>> {
     let invalid_part = |n: &u32, etag: &str| {
         Refusal::new(Code::InvalidPart)
@@ -845,19 +1036,59 @@ fn assemble(
             .with("PartNumber", n.to_string())
             .with("ETag", etag)
     };
+    let asked = up.meta.checksum.as_ref();
+    if let Some(kind) = kind
+        && asked.map(|a| a.kind) != Some(kind)
+    {
+        return Ok(Err(Refusal::saying(
+            Code::InvalidRequest,
+            format!(
+                "The upload was created using the {} checksum mode. The complete request must \
+                 use the same checksum mode.",
+                asked.map_or("null", |a| a.kind.name())
+            ),
+        )));
+    }
+    // The checksum the object will have, and the one sent to check it against.
+    let (target, check) = match asked {
+        None => {
+            let full = whole.filter(|w| w.composite.is_none());
+            (full.map(|w| w.header), full)
+        }
+        Some(a) if a.kind == checksum::Kind::FullObject => {
+            let named = whole.filter(|w| Some(w.header) == a.header());
+            if let Some(w) = named
+                && w.composite.is_some()
+            {
+                return Ok(Err(checksum::mismatch(w.header)));
+            }
+            (a.header(), named)
+        }
+        Some(_) => (None, None),
+    };
     // Written into, so the gc takes the upload as in use while it is read.
     if let Ok(meta) = std::fs::File::open(up.dir.join(META)) {
         // A failure only leaves the upload as fresh as its last write.
         let _ = meta.set_modified(SystemTime::now());
     }
     let mut total: u64 = 0;
-    for (n, etag) in parts {
+    for ((n, etag), sent) in parts.iter().zip(sent) {
         let Some(part) = read_record::<Part>(&record_path(&up.dir, *n)) else {
             return Ok(Err(invalid_part(n, etag)));
         };
         if part.md5 != *etag {
             return Ok(Err(invalid_part(n, etag)));
         }
+        let checked = check_part(
+            *n,
+            sent,
+            part.checksum.as_deref(),
+            asked,
+            invalid_part(n, etag),
+        );
+        if let Err(why) = checked {
+            return Ok(Err(why));
+        }
         total = total.saturating_add(part.size);
     }
     let too_large = |size: u64| {
@@ -872,7 +1103,7 @@ fn assemble(
     let (path, mut out) = store.stage_file()?;
     let mut staged = Staged::written(path, 0, String::new());
     let mut sha256 = sha2::Sha256::new();
-    let mut hasher = whole.and_then(|w| checksum::Hasher::for_(w.header));
+    let mut hasher = target.and_then(checksum::Hasher::for_);
     let mut md5s = Vec::with_capacity(parts.len());
     let mut sizes = Vec::with_capacity(parts.len());
     let mut buf = vec![0u8; STREAM_CHUNK];
@@ -914,20 +1145,22 @@ fn assemble(
     }
     drop(out);
     let sha256 = sha256.finalize().to_vec();
-    if let Some(whole) = whole {
+    let mut kept = None;
+    if let Some(header) = target {
         let got = match hasher {
             Some(h) => h.finalize(),
             None => sha256.clone(),
         };
-        if got != whole.bytes {
-            return Ok(Err(checksum::mismatch(whole.header)));
+        if check.is_some_and(|w| got != w.bytes) {
+            return Ok(Err(checksum::mismatch(header)));
         }
+        kept = Some((header, vk_hub_proto::to_base64(&got)));
     }
     staged.hex = crate::hex_of(&sha256);
     Ok(Ok(Assembled {
         staged,
         etag: multipart_etag(&md5s),
-        checksum: whole.map(|w| (w.header, w.text.clone())),
+        checksum: kept,
         sizes,
     }))
 }
@@ -965,10 +1198,11 @@ async fn complete(
     if !known {
         return refuse(req, no_such_upload(ctx, &id), ctx).await;
     }
-    let whole = match Whole::of(req.headers()) {
-        Ok(whole) => whole,
-        Err(why) => return refuse(req, ctx.error(why), ctx).await,
-    };
+    let whole =
+        match Whole::of(req.headers()).and_then(|w| Ok((w, completion_kind(req.headers())?))) {
+            Ok(whole) => whole,
+            Err(why) => return refuse(req, ctx.error(why), ctx).await,
+        };
     let (head, body) = req.into_parts();
     let too_long = ctx.error(Code::MalformedXML);
     let body = match read_small(body, MAX_DOCUMENT, too_long, ctx).await? {
@@ -978,7 +1212,7 @@ async fn complete(
     if let Err(why) = object::check_document(&head.headers, &body) {
         return Ok(ctx.error(why));
     }
-    let parts = match document(&body) {
+    let (parts, sent) = match document(&body) {
         Ok(parts) => parts,
         // What is wrong with it is S3's to say in its own words.
         Err(Unfit::Malformed(_)) => return Ok(ctx.error(Code::MalformedXML)),
@@ -1005,7 +1239,8 @@ async fn complete(
                     None => Found::Gone,
                 });
             };
-            let assembled = assemble(&store, &up, &parts, whole.as_ref())?;
+            let (whole, kind) = &whole;
+            let assembled = assemble(&store, &up, &parts, &sent, (whole.as_ref(), *kind))?;
             Ok(Found::Assembled(Held { _lock: lock, up }, parts, assembled))
         })
         .await
@@ -1550,7 +1785,7 @@ mod tests {
         )))
         .unwrap();
         assert_eq!(
-            parts,
+            parts.0,
             [
                 (1, MD5.to_string()),
                 (3, MD5.to_string()),
@@ -1596,7 +1831,7 @@ mod tests {
         let max = (1..=MAX_PARTS)
             .map(|n| part(&n.to_string(), MD5))
             .collect::<String>();
-        assert_eq!(document(&body(&max)).unwrap().len(), MAX_PARTS as usize);
+        assert_eq!(document(&body(&max)).unwrap().0.len(), MAX_PARTS as usize);
         let elements = (0..MAX_ELEMENTS).map(|_| "<x/>").collect::<String>();
         assert!(matches!(
             document(&body(&elements)),
@@ -1781,6 +2016,7 @@ mod tests {
             key: "a/k".into(),
             created: 1,
             annotations: BTreeMap::new(),
+            checksum: None,
         };
         std::fs::write(up.join(META), serde_json::to_vec(&meta).unwrap()).unwrap();
         let segs = |s: &[&str]| s.iter().map(|s| s.to_string()).collect::<Vec<_>>();
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 9499344a..f7b50426 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -444,7 +444,7 @@ struct Claim {
 }
 
 /// The refusal of a second `x-amz-checksum-*`, as S3 words it.
-const ONE_CHECKSUM: Refusal = Refusal::said(
+pub(super) const ONE_CHECKSUM: Refusal = Refusal::said(
     Code::InvalidRequest,
     "Expecting a single x-amz-checksum- header. Multiple checksum Types are not allowed.",
 );
@@ -660,9 +660,10 @@ struct Digests {
 }
 
 impl Digests {
-    /// The digests `expected` asks for, or the one a trailer announced as `trailer`.
-    fn for_(expected: &Expected, trailer: Option<&str>) -> Self {
-        let header = expected.checksum.as_ref().map(|c| c.header).or(trailer);
+    /// The digests `expected` asks for, or else `other`: the checksum a trailer announced, or
+    /// the one a plan computes.
+    fn for_(expected: &Expected, other: Option<&str>) -> Self {
+        let header = expected.checksum.as_ref().map(|c| c.header).or(other);
         Digests {
             md5: md5::Context::new(),
             checksum: header.and_then(checksum::Hasher::for_),
@@ -776,6 +777,10 @@ pub(super) fn declared_too_large(headers: &HeaderMap) -> bool {
 pub(super) struct Plan {
     payload: Payload,
     expected: Expected,
+    /// the checksum header of the algorithm `x-amz-sdk-checksum-algorithm` names
+    sdk: Option<&'static str>,
+    /// the checksum header of the algorithm to compute when the body carries no checksum
+    compute: Option<&'static str>,
 }
 
 /// The [`Plan`] of a write's body, or why its headers are refused.
@@ -785,16 +790,41 @@ pub(super) fn plan(headers: &HeaderMap) -> std::result::Result<Plan, Refusal> {
     if payload.framing.is_some_and(|f| f.trailer.is_some()) && expected.checksum.is_some() {
         return Err(ONE_CHECKSUM);
     }
+    let sdk = headers
+        .get(checksum::SDK_ALGORITHM)
+        .and_then(|v| checksum::named(v.as_bytes()))
+        .and_then(checksum::header);
     // As beside a checksum header: the trailer's checksum is in the algorithm the SDK names.
-    if let (Some(named), Some(trailer)) = (
-        headers.get(checksum::SDK_ALGORITHM),
-        payload.framing.and_then(|f| f.trailer),
-    ) && !checksum::algorithm(trailer)
-        .is_some_and(|a| named.as_bytes().eq_ignore_ascii_case(a.as_bytes()))
+    if let (Some(sdk), Some(trailer)) = (sdk, payload.framing.and_then(|f| f.trailer))
+        && sdk != trailer
     {
         return Err(checksum::ALGORITHM_MISMATCH);
     }
-    Ok(Plan { payload, expected })
+    Ok(Plan {
+        payload,
+        expected,
+        sdk,
+        compute: None,
+    })
+}
+
+impl Plan {
+    /// The checksum header of the algorithm the body is said to carry a checksum in: by a
+    /// header, the trailer or `x-amz-sdk-checksum-algorithm`.
+    pub(super) fn claimed(&self) -> Option<&'static str> {
+        self.expected
+            .checksum
+            .as_ref()
+            .map(|c| c.header)
+            .or(self.payload.framing.and_then(|f| f.trailer))
+            .or(self.sdk)
+    }
+
+    /// Compute the checksum `header` names when the body carries none, to answer and keep
+    /// as if it had.
+    pub(super) fn compute(&mut self, header: &'static str) {
+        self.compute = Some(header);
+    }
 }
 
 /// A write's body, received whole and checked against what its request said of it.
@@ -802,7 +832,8 @@ pub(super) struct Received {
     /// the bytes, staged
     pub(super) staged: files::Staged,
     pub(super) md5: [u8; 16],
-    /// the `x-amz-checksum-*` that held, its header and text: to echo, and to keep
+    /// the `x-amz-checksum-*` that held, its header and text, or the one the plan had
+    /// computed in its place: to echo, and to keep
     pub(super) echo: Option<(&'static str, String)>,
 }
 
@@ -822,8 +853,12 @@ pub(super) async fn receive(
     let Plan {
         payload,
         mut expected,
+        compute,
+        ..
     } = plan;
-    let mut digests = Digests::for_(&expected, payload.framing.and_then(|f| f.trailer));
+    let trailer = payload.framing.and_then(|f| f.trailer);
+    let compute = compute.filter(|_| expected.checksum.is_none() && trailer.is_none());
+    let mut digests = Digests::for_(&expected, trailer.or(compute));
     let mut tap = |d: &[u8]| digests.update(d);
     let (staged, trailer) = match payload.framing {
         None => (files::stage_into(path, file, body, &mut tap).await, None),
@@ -858,13 +893,22 @@ pub(super) async fn receive(
     let md5 = digests.md5.finalize().0;
     let computed = digests.checksum.map(checksum::Hasher::finalize);
     let sha256 = hex_bytes(&staged.hex);
+    // What the plan computes in place of a checksum the body did not carry.
+    let made = compute.and_then(|header| {
+        let bytes = if header == CHECKSUM_SHA256 {
+            sha256.as_deref()
+        } else {
+            computed.as_deref()
+        };
+        Some((header, vk_hub_proto::to_base64(bytes?)))
+    });
     if let Err(why) = verify(&expected, &md5, sha256.as_deref(), computed) {
         return Ok(Err(ctx.error(why)));
     }
     Ok(Ok(Received {
         staged,
         md5,
-        echo: expected.checksum.map(|c| (c.header, c.text)),
+        echo: expected.checksum.map(|c| (c.header, c.text)).or(made),
     }))
 }
 
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index a4c7cc6e..d5b44e8d 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -4750,6 +4750,25 @@ fn multipart_etag(parts: &[&[u8]]) -> String {
     format!("\"{}-{}\"", md5_hex(&md5s), parts.len())
 }
 
+/// A part a completion names: its number, its ETag and its checksums' `(element, value)`.
+type Named<'a> = (u32, &'a str, &'a [(&'a str, &'a str)]);
+
+/// [`complete_doc`] with checksums.
+fn complete_doc_with(parts: &[Named<'_>]) -> Vec<u8> {
+    let mut doc = String::from("<CompleteMultipartUpload>");
+    for (n, etag, checksums) in parts {
+        doc.push_str(&format!(
+            "<Part><ETag>{etag}</ETag><PartNumber>{n}</PartNumber>"
+        ));
+        for (name, value) in *checksums {
+            doc.push_str(&format!("<{name}>{value}</{name}>"));
+        }
+        doc.push_str("</Part>");
+    }
+    doc.push_str("</CompleteMultipartUpload>");
+    doc.into_bytes()
+}
+
 /// Start an upload of the object at `path`: its id.
 async fn create_upload(host: &str, sign: Sign<'_>, path: &str) -> String {
     let resp = send(host, sign(Req::new("POST", path).query("uploads="))).await;
@@ -4798,6 +4817,267 @@ fn multipart_left(dir: &std::path::Path) -> Vec<String> {
     ids
 }
 
+/// An upload created with a checksum: its algorithm and kind checked, answered and recorded,
+/// each part held to the algorithm (a full object's computed for a part that carries none),
+/// and the completion held to what the parts were stored with and to the upload's kind; a
+/// full object's checksum is computed as the parts are assembled, checked and kept.
+#[tokio::test]
+async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
+    let dir = tmp("mp-checksums");
+    let host = spawn(open_state(&dir, true));
+    let path = "/s3/b/k";
+    let create = |pairs: &[(&str, &str)]| {
+        let mut req = Req::new("POST", path).query("uploads=");
+        for (name, value) in pairs {
+            req = req.header(name, value);
+        }
+        req
+    };
+    let (algo, kind) = ("x-amz-checksum-algorithm", "x-amz-checksum-type");
+    for (pairs, message) in [
+        (
+            &[(algo, "crc31")][..],
+            "Checksum algorithm provided is unsupported. Please try again with any of the valid \
+             types: [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, XXHASH3, \
+             XXHASH64]",
+        ),
+        (
+            &[(algo, "crc32"), (kind, "whole")],
+            "Value for x-amz-checksum-type header is invalid.",
+        ),
+        (
+            &[(kind, "COMPOSITE")],
+            "The x-amz-checksum-type header can only be used with the x-amz-checksum-algorithm \
+             header.",
+        ),
+        (
+            &[(algo, "SHA1"), (kind, "FULL_OBJECT")],
+            "The FULL_OBJECT checksum type cannot be used with the sha1 checksum algorithm.",
+        ),
+        (
+            &[(algo, "crc64nvme"), (kind, "composite")],
+            "The COMPOSITE checksum type cannot be used with the crc64nvme checksum algorithm.",
+        ),
+    ] {
+        send(&host, create(pairs))
+            .await
+            .is(400, "InvalidRequest")
+            .says(message);
+    }
+    for (pairs, algorithm, made) in [
+        (&[(algo, "crc64nvme")][..], "CRC64NVME", "FULL_OBJECT"),
+        (&[(algo, "Sha256")], "SHA256", "COMPOSITE"),
+        (
+            &[(algo, "crc32"), (kind, "full_object")],
+            "CRC32",
+            "FULL_OBJECT",
+        ),
+    ] {
+        let resp = send(&host, create(pairs)).await;
+        resp.ok(200);
+        assert_eq!(resp.header(algo), Some(algorithm));
+        assert_eq!(resp.header(kind), Some(made));
+    }
+
+    // A composite SHA256 upload: every part carries its SHA256.
+    let id = element(
+        &send(&host, create(&[(algo, "SHA256")])).await.body,
+        "UploadId",
+    );
+    let part = |n: u32, data: &[u8], pair: Option<(&str, &str)>| {
+        let mut req = Req::new("PUT", path).query(&part_query(&id, n));
+        if let Some((name, value)) = pair {
+            req = req.header(name, value);
+        }
+        req.body(data.to_vec())
+    };
+    let (one, two) = (bytes_of_len(1000), bytes_of_len(300));
+    let (sha1, sha2) = (
+        b64(&sha2::Sha256::digest(&one)),
+        b64(&sha2::Sha256::digest(&two)),
+    );
+    send(&host, part(1, &one, None))
+        .await
+        .is(400, "InvalidRequest")
+        .says(
+            "Checksum Type mismatch occurred, expected checksum Type: SHA256, actual checksum \
+             Type: null",
+        );
+    send(
+        &host,
+        part(1, &one, Some(("x-amz-checksum-crc32", &crc32_b64(&one)))),
+    )
+    .await
+    .is(400, "InvalidRequest")
+    .says(
+        "Checksum Type mismatch occurred, expected checksum Type: SHA256, actual checksum \
+             Type: CRC32",
+    );
+    let named = part(1, &one, None).header("x-amz-sdk-checksum-algorithm", "SHA1");
+    send(&host, named).await.is(400, "InvalidRequest");
+    let sent = send(&host, part(1, &one, Some(("x-amz-checksum-sha256", &sha1)))).await;
+    sent.ok(200);
+    assert_eq!(sent.header("x-amz-checksum-sha256"), Some(sha1.as_str()));
+    let e1 = format!("\"{}\"", md5_hex(&one));
+    send(&host, part(2, &two, Some(("x-amz-checksum-sha256", &sha2))))
+        .await
+        .ok(200);
+    let e2 = format!("\"{}\"", md5_hex(&two));
+    let completion = |parts: &[Named<'_>]| {
+        Req::new("POST", path)
+            .query(&format!("uploadId={id}"))
+            .body(complete_doc_with(parts))
+    };
+    let other = b64(&sha2::Sha256::digest(b"other"));
+    let crc = crc32_b64(&one);
+    let both = [
+        ("ChecksumCRC32", crc.as_str()),
+        ("ChecksumSHA256", sha1.as_str()),
+    ];
+    for (first, status, code, message) in [
+        (
+            &[][..],
+            400,
+            "InvalidRequest",
+            "The upload was created using a sha256 checksum. The complete request must include \
+             the checksum for each part. It was missing for part 1 in the request.",
+        ),
+        (
+            &both[..],
+            400,
+            "InvalidArgument",
+            "Invalid Base64 or multiple checksums present in request",
+        ),
+        (
+            &[("ChecksumSHA256", "invalid_checksum")],
+            400,
+            "InvalidArgument",
+            "Invalid Base64 or multiple checksums present in request",
+        ),
+        (
+            &[("ChecksumSHA256", other.as_str())],
+            400,
+            "InvalidPart",
+            "One or more of the specified parts could not be found.  The part may not have been \
+             uploaded, or the specified entity tag may not match the part's entity tag.",
+        ),
+        (
+            &[("ChecksumCRC32", crc.as_str())],
+            400,
+            "BadDigest",
+            "The crc32 you specified for part 1 did not match what we received.",
+        ),
+    ] {
+        let parts = [
+            (1, e1.as_str(), first),
+            (2, e2.as_str(), &[("ChecksumSHA256", sha2.as_str())][..]),
+        ];
+        send(&host, completion(&parts))
+            .await
+            .is(status, code)
+            .says(message);
+    }
+    let resp = send(
+        &host,
+        completion(&[
+            (1, e1.as_str(), &both[..]),
+            (2, e2.as_str(), &[("ChecksumSHA256", sha2.as_str())]),
+        ]),
+    )
+    .await;
+    assert!(
+        resp.body.contains(&format!(
+            "<ArgumentValue>CRC32:{crc};SHA256:{sha1};</ArgumentValue>"
+        )),
+        "{}",
+        resp.body
+    );
+    let typed = completion(&[(1, e1.as_str(), &[("ChecksumSHA256", sha1.as_str())])])
+        .header(kind, "FULL_OBJECT");
+    send(&host, typed).await.is(400, "InvalidRequest").says(
+        "The upload was created using the COMPOSITE checksum mode. The complete request must use \
+         the same checksum mode.",
+    );
+    let typed =
+        completion(&[(1, e1.as_str(), &[("ChecksumSHA256", sha1.as_str())])]).header(kind, "PARTS");
+    send(&host, typed)
+        .await
+        .is(400, "InvalidRequest")
+        .says("Value for x-amz-checksum-type header is invalid.");
+    let two_finals = completion(&[(1, e1.as_str(), &[("ChecksumSHA256", sha1.as_str())])])
+        .header("x-amz-checksum-crc32", "AAAAAA==")
+        .header("x-amz-checksum-crc32c", "AAAAAA==");
+    send(&host, two_finals)
+        .await
+        .is(400, "InvalidRequest")
+        .says(
+            "Expecting a single x-amz-checksum- header. Multiple checksum Types are not allowed.",
+        );
+    let resp = send(
+        &host,
+        completion(&[
+            (1, e1.as_str(), &[("ChecksumSHA256", sha1.as_str())]),
+            (2, e2.as_str(), &[("ChecksumSHA256", sha2.as_str())]),
+        ])
+        .header(kind, "composite"),
+    )
+    .await;
+    resp.ok(200);
+
+    // A full object's CRC32C upload: a part with none has it computed, the object's is
+    // computed as it is assembled, checked against the one sent, and kept.
+    let path = "/s3/b/full";
+    let create = Req::new("POST", path)
+        .query("uploads=")
+        .header(algo, "CRC32C")
+        .header(kind, "FULL_OBJECT");
+    let id = element(&send(&host, create).await.body, "UploadId");
+    let resp = send(
+        &host,
+        Req::new("PUT", path)
+            .query(&part_query(&id, 1))
+            .body(one.clone()),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(
+        resp.header("x-amz-checksum-crc32c"),
+        Some(&*crc32c_b64(&one))
+    );
+    let e2 = upload_part(&host, &|r| r, path, &id, 2, &two).await;
+    let whole = [one.as_slice(), &two].concat();
+    let (c1, c2) = (crc32c_b64(&one), crc32c_b64(&two));
+    let complete = |final_header: Option<(&str, &str)>| {
+        let mut req = Req::new("POST", path)
+            .query(&format!("uploadId={id}"))
+            .body(complete_doc_with(&[
+                (1, &e1, &[("ChecksumCRC32C", &c1)]),
+                (2, &e2, &[("ChecksumCRC32C", &c2)]),
+            ]));
+        if let Some((name, value)) = final_header {
+            req = req.header(name, value);
+        }
+        req
+    };
+    send(
+        &host,
+        complete(Some(("x-amz-checksum-crc32c", &crc32c_b64(&one)))),
+    )
+    .await
+    .is(400, "BadDigest")
+    .says("The CRC32C you specified did not match the calculated checksum.");
+    let resp = send(&host, complete(None)).await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "ChecksumCRC32C"), crc32c_b64(&whole));
+    assert_eq!(element(&resp.body, "ChecksumType"), "FULL_OBJECT");
+    let asked = Req::new("HEAD", path).header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, asked).await;
+    assert_eq!(
+        resp.header("x-amz-checksum-crc32c"),
+        Some(&*crc32c_b64(&whole))
+    );
+}
+
 /// An upload in three parts, as the AWS CLI sends a large file (the first part SigV4-signed
 /// `aws-chunked`, the second with its `Content-MD5`, the last with its SHA-256 signed and an
 /// `x-amz-checksum-sha256`), one part replaced, listed, refused when completed wrong, then
@@ -4811,13 +5091,12 @@ async fn a_multipart_upload_is_assembled_from_its_parts() {
     let path = "/s3/b/big/obj";
     let create = Req::new("POST", path)
         .query("uploads=")
-        .header("x-amz-meta-mtime", "1700000000")
-        .header("x-amz-checksum-algorithm", "sha256");
+        .header("x-amz-meta-mtime", "1700000000");
     let resp = send(&host, sign(create)).await;
     resp.ok(200);
     assert_eq!(element(&resp.body, "Bucket"), "b");
     assert_eq!(element(&resp.body, "Key"), "big/obj");
-    assert_eq!(resp.header("x-amz-checksum-algorithm"), Some("SHA256"));
+    assert_eq!(resp.header("x-amz-checksum-algorithm"), None);
     let id = element(&resp.body, "UploadId");
     assert!(
         id.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-'),

From 9350001a07ac6fee8abbd6ef803049bc354358a2 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 12:41:09 +0100
Subject: [PATCH 49/54] vk-registry/s3: compute the checksum a copy asks for

CopyObject with x-amz-checksum-algorithm gives the object a checksum in
that algorithm, computed from the source's bytes unless the source kept
one in it, and an algorithm S3 does not have is refused before a copy
onto itself is. UploadPartCopy into an upload created with a checksum
computes the upload's algorithm as the part is copied and records it.
Both results now name the checksum.
---
 CHANGELOG.md                    |  2 +-
 vk-registry/DESIGN.md           |  4 +-
 vk-registry/src/s3/checksum.rs  | 50 ++++++++++++++++--
 vk-registry/src/s3/copy.rs      | 29 ++++++++++-
 vk-registry/src/s3/multipart.rs | 20 ++++++--
 vk-registry/src/s3/object.rs    |  2 +-
 vk-registry/tests/s3_e2e.rs     | 90 +++++++++++++++++++++++++++++++++
 7 files changed, 183 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 94a6ab4c..74cd9735 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,7 +20,7 @@ All notable changes to virtkit will be documented in this file.
   The chunked uploads AWS SDKs and the CLI send are taken, their signatures and checksums
   checked, and objects can be read in byte ranges, as the AWS CLI downloads large files.
   Buckets can be created and removed, objects copied without their bytes being stored twice
-  and deleted in batches — only while still the ETag, modification time or size a delete
+  (or with the checksum a copy asks for computed from them) and deleted in batches — only while still the ETag, modification time or size a delete
   names, when it names one, as S3's conditional deletes — and the configuration probes tools send before using a bucket
   (versioning, ACLs, tagging and the like) are answered as for a bucket with none set, and a
   write asking for one of them — encryption under the client's own key, tags, an ACL, a
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 5560d134..4cf51885 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -718,7 +718,7 @@ reads; a replaced object keeps only what its own write sent.
 | `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
-| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along; its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE`; an `x-amz-metadata-directive` or `x-amz-tagging-directive` other than `COPY` or `REPLACE` is 400 `InvalidArgument` |
+| `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along, the checksum named in the result with its `ChecksumType`; with `x-amz-checksum-algorithm` (400 `InvalidRequest` for one S3 does not have, before a copy onto itself is refused), the object's checksum is in that algorithm, the source's computed from its bytes, read once under the same locks, unless it kept one in it (a SHA-256 is the blob's name); its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE`; an `x-amz-metadata-directive` or `x-amz-tagging-directive` other than `COPY` or `REPLACE` is 400 `InvalidArgument` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted; a bucket that is not there is 404 `NoSuchBucket`), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
 | `PUT /s3/<b>` CreateBucket | 200 with `Location: /s3/<b>`: the directory `files/<b>`, made as WebDAV's `MKCOL` makes it, under the namespace lock; needs `Write` on `files/<b>`. 409 `BucketAlreadyOwnedByYou` when it is a directory already, 409 `OperationAborted` when something else has its name in the store. A `CreateBucketConfiguration` body of at most 1 KiB is taken and ignored (a larger or malformed body is 400 `MalformedXML`); `x-amz-bucket-object-lock-enabled: true` is 501 `NotImplemented`, and so is an `x-amz-acl` other than the owner's (below) |
 | `DELETE /s3/<b>` DeleteBucket | 204 when the bucket holds no key: its directory tree is removed deepest first, each directory as WebDAV's `DELETE` removes an empty one, since the directories of deleted keys are left behind and S3 calls such a bucket empty; needs `Write` on `files/<b>`. 409 `BucketNotEmpty` while a key, a foreign tag or a record too fresh to be a deleted object's (an image's manifest pushed over `/v2/` lately, its message says) is there; 404 `NoSuchBucket`; the removal needs the store lock exclusive, retried for up to 30 s, then 503 `ServiceUnavailable` with `Retry-After` |
@@ -731,7 +731,7 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` and `x-amz-checksum-type` (`COMPOSITE`, a checksum of the parts' checksums, or `FULL_OBJECT`, by default `FULL_OBJECT` for CRC64NVME and `COMPOSITE` otherwise) are recorded with the upload and echoed; 400 `InvalidRequest` in S3's words for an algorithm or a type S3 does not have, a type without an algorithm, and a type the algorithm cannot make (`FULL_OBJECT` is CRC32, CRC32C and CRC64NVME only; `COMPOSITE` anything but CRC64NVME); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
-| UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
+| UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. The part has the checksum of its upload's algorithm computed as it is copied, recorded with it and named in the result (`ChecksumCRC32`…). A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; for an upload created with none, a final whole-object checksum is checked and kept that way; either is named in the result with its `ChecksumType`. A composite one is passed over. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index 9323c796..b5617328 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -237,8 +237,9 @@ pub(super) fn header(algorithm: &str) -> Option<&'static str> {
 }
 
 /// A digest of a body as it streams, in the algorithm `header` names: SHA-256 is left to
-/// the store, which names every blob by it.
+/// the store, which names every blob by it, but where bytes are read back ([`Hasher::any`]).
 pub(super) enum Hasher {
+    Sha256(sha2::Sha256),
     Crc32(crc32fast::Hasher),
     Crc32c(crc::Digest<'static, u32>),
     Sha1(sha1::Sha1),
@@ -273,8 +274,17 @@ impl Hasher {
         })
     }
 
+    /// [`Hasher::for_`], SHA-256 included.
+    pub(super) fn any(header: &str) -> Option<Self> {
+        if header == "x-amz-checksum-sha256" {
+            return Some(Hasher::Sha256(sha2::Sha256::new()));
+        }
+        Self::for_(header)
+    }
+
     pub(super) fn update(&mut self, data: &[u8]) {
         match self {
+            Hasher::Sha256(h) => h.update(data),
             Hasher::Crc32(h) => h.update(data),
             Hasher::Crc32c(h) => h.update(data),
             Hasher::Sha1(h) => h.update(data),
@@ -290,6 +300,7 @@ impl Hasher {
     /// XXHASHes (XXH128's high half first), as xxHash's canonical form is.
     pub(super) fn finalize(self) -> Vec<u8> {
         match self {
+            Hasher::Sha256(h) => h.finalize().to_vec(),
             Hasher::Crc32(h) => h.finalize().to_be_bytes().to_vec(),
             Hasher::Crc32c(h) => h.finalize().to_be_bytes().to_vec(),
             Hasher::Sha1(h) => h.finalize().to_vec(),
@@ -306,14 +317,43 @@ impl Hasher {
 /// The checksum of `data` in the algorithm `header` names, SHA-256 included; `None` for a
 /// header that names none.
 pub(super) fn of(header: &str, data: &[u8]) -> Option<Vec<u8>> {
-    if header == "x-amz-checksum-sha256" {
-        return Some(sha2::Sha256::digest(data).to_vec());
-    }
-    let mut hasher = Hasher::for_(header)?;
+    let mut hasher = Hasher::any(header)?;
     hasher.update(data);
     Some(hasher.finalize())
 }
 
+/// The checksum, in base64, of the `size` bytes of the blob `layer` (their SHA-256, in hex)
+/// in the algorithm `header` names: SHA-256's is the blob's name, any other's is read off it.
+/// `None` when the blob is gone.
+pub(super) fn of_blob(
+    store: &crate::Store,
+    layer: &str,
+    size: u64,
+    header: &str,
+) -> anyhow::Result<Option<String>> {
+    use std::io::Read as _;
+    if header == "x-amz-checksum-sha256" {
+        return Ok(super::object::hex_bytes(layer).map(|b| vk_hub_proto::to_base64(&b)));
+    }
+    let Some(mut hasher) = Hasher::for_(header) else {
+        return Ok(None);
+    };
+    let Some((_, mut reader)) = store.read_blob_range(layer, 0, size)? else {
+        return Ok(None);
+    };
+    let mut buf = vec![0u8; crate::STREAM_CHUNK];
+    loop {
+        let got = match reader.read(&mut buf) {
+            Ok(0) => break,
+            Ok(got) => got,
+            Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+            Err(e) => return Err(anyhow::Error::from(e).context("reading an object to hash it")),
+        };
+        hasher.update(buf.get(..got).unwrap_or_default());
+    }
+    Ok(Some(vk_hub_proto::to_base64(&hasher.finalize())))
+}
+
 /// What an object's annotation keeps: the algorithm, by S3's name, and the checksum in
 /// base64.
 #[derive(Debug, PartialEq, Eq)]
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index c633db37..d90b300e 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -5,7 +5,9 @@
 //! destination is written as PutObject writes, its `If-None-Match: *`/`If-Match` checked
 //! where the tag is written. The source's MD5, and so its ETag, comes along, with the
 //! checksum its write kept and its parts; its user metadata too, unless
-//! `x-amz-metadata-directive: REPLACE` gives the request's instead.
+//! `x-amz-metadata-directive: REPLACE` gives the request's instead. A copy that asks for a
+//! checksum algorithm (`x-amz-checksum-algorithm`) other than the one the source kept has
+//! it computed from the source's bytes, read once.
 
 use anyhow::Result;
 use hyper::body::Incoming;
@@ -22,6 +24,9 @@ use crate::{Authz, Body, ServerState, Store, accounts};
 /// The header naming a copy's source.
 pub(super) const COPY_SOURCE: &str = "x-amz-copy-source";
 
+/// The header a copy names the algorithm of the checksum its object is to have in.
+const CHECKSUM_ALGORITHM: &str = "x-amz-checksum-algorithm";
+
 /// What `x-amz-copy-source` names.
 #[derive(Debug, PartialEq, Eq)]
 pub(super) enum Source {
@@ -190,6 +195,13 @@ pub(super) async fn copy(
         ));
         return refuse(req, resp, ctx).await;
     }
+    let algorithm = match headers.get(CHECKSUM_ALGORITHM) {
+        None => None,
+        Some(v) => match checksum::named(v.as_bytes()).and_then(checksum::header) {
+            Some(header) => Some(header),
+            None => return refuse(req, ctx.error(checksum::UNKNOWN_ALGORITHM), ctx).await,
+        },
+    };
     if src == segs && !replace {
         let resp = ctx.error(Refusal::said(
             Code::InvalidRequest,
@@ -242,6 +254,19 @@ pub(super) async fn copy(
                 annotations.insert(name.to_string(), value.clone());
             }
         }
+        // Another algorithm than the one kept: computed, in place of it.
+        let kept = checksum::stored(&obj.annotations);
+        if let Some(header) = algorithm
+            && kept.is_none_or(|k| checksum::header(k.algorithm) != Some(header))
+        {
+            let Some(value) = checksum::of_blob(store, &obj.layer, obj.size, header)? else {
+                return Ok(no_such_key(&ctx, &src));
+            };
+            if let Some((name, value)) = checksum::annotation(header, &value) {
+                annotations.insert(name, value);
+            }
+        }
+        let checksum = checksum::stored(&annotations).map_or(String::new(), |k| k.elements());
         let etag = conditional::etag(&obj.layer, &annotations);
         let how = Commit {
             annotations,
@@ -259,7 +284,7 @@ pub(super) async fn copy(
         Ok(xml::document(
             "CopyObjectResult",
             &format!(
-                "{}{}",
+                "{}{}{checksum}",
                 xml::element("LastModified", &list::iso8601(modified)),
                 xml::element("ETag", &etag)
             ),
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 069d3824..4397eee8 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -676,7 +676,8 @@ fn copy_range(value: &str) -> Option<(u64, u64)> {
 /// object, whole or the bytes `x-amz-copy-source-range` names, read as CopyObject reads its
 /// source and checked against the same `x-amz-copy-source-if-*` conditions. The bytes are
 /// copied into the upload (a part is the upload's own until it completes), off the runtime,
-/// hashed on the way. 200 with `CopyPartResult`.
+/// hashed on the way: their MD5, and the checksum of the upload's algorithm, which the part
+/// is recorded with and the answer names. 200 with `CopyPartResult`.
 async fn copy_part(
     state: &ServerState,
     authz: &Authz<'_>,
@@ -765,6 +766,9 @@ async fn copy_part(
         };
         let mut staged = Staged::written(path, 0, String::new());
         let mut md5 = md5::Context::new();
+        // The checksum of the upload's algorithm, which the part is recorded with.
+        let header = up.meta.checksum.as_ref().and_then(Asked::header);
+        let mut hasher = header.and_then(checksum::Hasher::any);
         let mut buf = vec![0u8; STREAM_CHUNK];
         loop {
             let got = match reader.read(&mut buf) {
@@ -775,12 +779,22 @@ async fn copy_part(
             };
             let data = buf.get(..got).unwrap_or_default();
             md5.consume(data);
+            if let Some(h) = &mut hasher {
+                h.update(data);
+            }
             file.write_all(data).context("writing a copied part")?;
             staged.size = staged.size.saturating_add(got as u64);
         }
         drop(file);
         let md5 = crate::hex_of(&md5.finalize().0);
-        match install_part(&up.dir, n, staged, &md5, None) {
+        let made = header.zip(hasher).and_then(|(header, h)| {
+            checksum::annotation(header, &vk_hub_proto::to_base64(&h.finalize()))
+        });
+        let element = made.as_ref().map_or(String::new(), |(_, kept)| {
+            let (algorithm, value) = kept.split_once(':').unwrap_or_default();
+            xml::element(&format!("Checksum{algorithm}"), value)
+        });
+        match install_part(&up.dir, n, staged, &md5, made.map(|(_, kept)| kept)) {
             Ok(()) => {}
             Err(_) if !up.dir.is_dir() => return Ok(no_such_upload(&ctx, &id)),
             Err(e) => return Err(e),
@@ -788,7 +802,7 @@ async fn copy_part(
         Ok(xml::document(
             "CopyPartResult",
             &format!(
-                "{}{}",
+                "{}{}{element}",
                 xml::element("LastModified", &list::iso8601(SystemTime::now())),
                 xml::element("ETag", &format!("\"{md5}\""))
             ),
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index f7b50426..1b1e93be 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -78,7 +78,7 @@ fn sha256_base64(layer: &str) -> String {
     vk_hub_proto::to_base64(&hex_bytes(layer).unwrap_or_default())
 }
 
-fn hex_bytes(hex: &str) -> Option<Vec<u8>> {
+pub(super) fn hex_bytes(hex: &str) -> Option<Vec<u8>> {
     let b = hex.as_bytes();
     if !b.len().is_multiple_of(2) {
         return None;
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index d5b44e8d..7e8ad215 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -5078,6 +5078,96 @@ async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
     );
 }
 
+/// A copy asking for a checksum algorithm has the object's checksum in it, computed from the
+/// source's bytes unless the source kept one in it, and named in the result; a part copied
+/// into an upload created with a checksum has the upload's computed.
+#[tokio::test]
+async fn a_copy_computes_the_checksum_it_asks_for() {
+    let dir = tmp("copy-checksum");
+    let host = spawn(open_state(&dir, true));
+    let data = bytes_of_len(70_000);
+    let put = Req::new("PUT", "/s3/b/src")
+        .header("x-amz-checksum-crc32c", &crc32c_b64(&data))
+        .body(data.clone());
+    send(&host, put).await.ok(200);
+    let copy = |dst: &str, algorithm: Option<&str>| {
+        let req = Req::new("PUT", dst).header("x-amz-copy-source", "/b/src");
+        match algorithm {
+            Some(a) => req.header("x-amz-checksum-algorithm", a),
+            None => req,
+        }
+    };
+    let head = |path: &str| Req::new("HEAD", path).header("x-amz-checksum-mode", "ENABLED");
+    // The source's own, carried.
+    let resp = send(&host, copy("/s3/b/same", None)).await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "ChecksumCRC32C"), crc32c_b64(&data));
+    assert_eq!(element(&resp.body, "ChecksumType"), "FULL_OBJECT");
+    // Another algorithm, computed in its place.
+    for (algorithm, header, value) in [
+        ("SHA1", "x-amz-checksum-sha1", sha1_b64(&data)),
+        (
+            "sha256",
+            "x-amz-checksum-sha256",
+            b64(&sha2::Sha256::digest(&data)),
+        ),
+        (
+            "CRC64NVME",
+            "x-amz-checksum-crc64nvme",
+            crc64nvme_b64(&data),
+        ),
+    ] {
+        let resp = send(&host, copy("/s3/b/other", Some(algorithm))).await;
+        resp.ok(200);
+        let name = header
+            .trim_start_matches("x-amz-checksum-")
+            .to_ascii_uppercase();
+        assert_eq!(element(&resp.body, &format!("Checksum{name}")), value);
+        assert!(!resp.body.contains("ChecksumCRC32C"), "{}", resp.body);
+        let resp = send(&host, head("/s3/b/other")).await;
+        assert_eq!(resp.header(header), Some(value.as_str()), "{algorithm}");
+        assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
+    }
+    // Onto itself, with its metadata replaced.
+    let resp = send(
+        &host,
+        copy("/s3/b/src", Some("CRC32")).header("x-amz-metadata-directive", "REPLACE"),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(element(&resp.body, "ChecksumCRC32"), crc32_b64(&data));
+    // An algorithm S3 does not have is said before a copy onto itself is refused.
+    send(&host, copy("/s3/b/src", Some("CRC31")))
+        .await
+        .is(400, "InvalidRequest")
+        .says(
+            "Checksum algorithm provided is unsupported. Please try again with any of the valid \
+             types: [CRC32, CRC32C, CRC64NVME, MD5, SHA1, SHA256, SHA512, XXHASH128, XXHASH3, \
+             XXHASH64]",
+        );
+
+    // A part copied into a CRC32 upload has its CRC32, which the completion names.
+    let path = "/s3/b/parts";
+    let create = Req::new("POST", path)
+        .query("uploads=")
+        .header("x-amz-checksum-algorithm", "CRC32");
+    let id = element(&send(&host, create).await.body, "UploadId");
+    let req = Req::new("PUT", path)
+        .query(&part_query(&id, 1))
+        .header("x-amz-copy-source", "/b/src")
+        .header("x-amz-copy-source-range", "bytes=0-999");
+    let resp = send(&host, req).await;
+    resp.ok(200);
+    let part = data.get(..1000).unwrap();
+    let crc = crc32_b64(part);
+    assert_eq!(element(&resp.body, "ChecksumCRC32"), crc);
+    let etag = format!("\"{}\"", md5_hex(part));
+    let done = Req::new("POST", path)
+        .query(&format!("uploadId={id}"))
+        .body(complete_doc_with(&[(1, &etag, &[("ChecksumCRC32", &crc)])]));
+    send(&host, done).await.ok(200);
+}
+
 /// An upload in three parts, as the AWS CLI sends a large file (the first part SigV4-signed
 /// `aws-chunked`, the second with its `Content-MD5`, the last with its SHA-256 signed and an
 /// `x-amz-checksum-sha256`), one part replaced, listed, refused when completed wrong, then

From 211b5228a1ed9116d271a9093e447a76e0b7b10c Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 12:47:28 +0100
Subject: [PATCH 50/54] vk-registry/s3: give an upload sent without a checksum
 S3's CRC64NVME

A PutObject that carries no checksum gets a full-object CRC64NVME,
computed in the pass that already hashes the body, echoed, kept and
listed as a sent one is, as S3 does since 2025. A multipart upload
created without a checksum algorithm gets the whole object's CRC64NVME
from the assembling pass, and the final checksum its completion is sent
is passed over, as S3 passes it over. Objects written otherwise (WebDAV,
vk registry put) still answer their SHA-256 rather than be read again.

The CRC32C and CRC64NVME tables now use sixteen lanes, since every
write computes one.
---
 CHANGELOG.md                    |  3 +-
 vk-registry/DESIGN.md           |  8 ++--
 vk-registry/src/s3/checksum.rs  | 16 ++++++--
 vk-registry/src/s3/multipart.rs | 13 +++----
 vk-registry/src/s3/object.rs    |  4 +-
 vk-registry/tests/s3_e2e.rs     | 66 ++++++++++++++++++++-------------
 6 files changed, 67 insertions(+), 43 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74cd9735..bc14652e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,8 @@ All notable changes to virtkit will be documented in this file.
   `sccache` needs none made beforehand), and use the registry credential (an API key, a hub
   token or the shared bearer) as both the access key and the secret access key, or the shared
   Basic user and its password. Objects can be written, read with conditional headers and
-  checksums (in every algorithm S3 has, checked on upload and kept with the object), given
+  checksums (in every algorithm S3 has, checked on upload and kept with the object, and a
+  CRC64NVME computed for an upload that sends none, as S3 does), given
   metadata and deleted, and listed page by page (as object versions too, for
   tools that empty a bucket that way), and are the same files WebDAV and `vk registry get`
   see; a key limited to a directory of a bucket can list that directory.
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 4cf51885..792a3167 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -708,14 +708,14 @@ which a `PutObject` computes in the same pass as the SHA-256 and records on the
 MD5 and its ETag is its SHA-256, quoted — 64 hex digits, which a client checking an ETag as
 an MD5 sees is not one. An object a multipart upload made has S3's multipart ETag,
 `"<MD5 of its parts' MD5s>-<parts>"`, recorded in the same annotation, so GetObject, HeadObject,
-the listings and a copy's source all answer it. The `x-amz-checksum-*` a write carried, once it held, is kept as `org.virtkit.s3-checksum` and is the object's checksum from then on, in listings and on reads. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
+the listings and a copy's source all answer it. The `x-amz-checksum-*` a write carried, once it held, or S3's default CRC64NVME computed as it was written, is kept as `org.virtkit.s3-checksum` and is the object's checksum from then on, in listings and on reads. User metadata (`x-amz-meta-<name>`, names `[a-z0-9-]`, at most 2 KiB
 of names and values) is kept on the manifest as `org.virtkit.s3-meta.<name>` and sent back on
 reads; a replaced object keeps only what its own write sent.
 
 | Request | Answer |
 |---|---|
-| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5,xxhash64,xxhash3,xxhash128}` (every algorithm S3 has; the XXHASHes unseeded, base64 of the big-endian digest as the CRCs', XXH128's high half first), as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 400 `InvalidRequest` in S3's words for an `x-amz-checksum-*` header, `x-amz-sdk-checksum-algorithm` or `x-amz-trailer` naming an algorithm S3 does not have) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5,xxhash64,xxhash3,xxhash128}` (every algorithm S3 has; the XXHASHes unseeded, base64 of the big-endian digest as the CRCs', XXH128's high half first), as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 400 `InvalidRequest` in S3's words for an `x-amz-checksum-*` header, `x-amz-sdk-checksum-algorithm` or `x-amz-trailer` naming an algorithm S3 does not have) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. A write that carries none gets S3's default, a CRC64NVME computed in the same pass over the body, echoed and kept the same way, as S3 has given every object since 2025. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none: one written otherwise than through S3 (WebDAV, `vk registry put`), or before the default was given, rather than its bytes being read again to compute one. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
 | `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along, the checksum named in the result with its `ChecksumType`; with `x-amz-checksum-algorithm` (400 `InvalidRequest` for one S3 does not have, before a copy onto itself is refused), the object's checksum is in that algorithm, the source's computed from its bytes, read once under the same locks, unless it kept one in it (a SHA-256 is the blob's name); its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE`; an `x-amz-metadata-directive` or `x-amz-tagging-directive` other than `COPY` or `REPLACE` is 400 `InvalidArgument` |
@@ -732,7 +732,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` and `x-amz-checksum-type` (`COMPOSITE`, a checksum of the parts' checksums, or `FULL_OBJECT`, by default `FULL_OBJECT` for CRC64NVME and `COMPOSITE` otherwise) are recorded with the upload and echoed; 400 `InvalidRequest` in S3's words for an algorithm or a type S3 does not have, a type without an algorithm, and a type the algorithm cannot make (`FULL_OBJECT` is CRC32, CRC32C and CRC64NVME only; `COMPOSITE` anything but CRC64NVME); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. The part has the checksum of its upload's algorithm computed as it is copied, recorded with it and named in the result (`ChecksumCRC32`…). A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; for an upload created with none, a final whole-object checksum is checked and kept that way; either is named in the result with its `ChecksumType`. A composite one is passed over. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. A composite one is passed over. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index b5617328..63763566 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -113,6 +113,9 @@ pub(super) const ALGORITHMS: [(&str, &str, usize); 10] = [
     ("x-amz-checksum-xxhash128", "XXHASH128", 16),
 ];
 
+/// The header of the checksum every write is given when it carries none, as S3 gives it.
+pub(super) const DEFAULT: &str = "x-amz-checksum-crc64nvme";
+
 /// The prefix of every checksum header, S3's and any it may add.
 pub(super) const HEADER_PREFIX: &str = "x-amz-checksum-";
 
@@ -207,10 +210,15 @@ pub(super) fn named(value: &[u8]) -> Option<&'static str> {
 }
 
 /// CRC-32C (Castagnoli), as S3's `CRC32C`.
-static CRC32C: crc::Crc<u32> = crc::Crc::<u32>::new(&crc::CRC_32_ISCSI);
+/// Sixteen lanes of tables (16 KiB, built at compile time) rather than the default one: every
+/// write computes a CRC, CRC64NVME by default, as it streams.
+static CRC32C: crc::Crc<u32, crc::Table<16>> =
+    crc::Crc::<u32, crc::Table<16>>::new(&crc::CRC_32_ISCSI);
 
 /// CRC-64/NVME, as S3's `CRC64NVME`.
-static CRC64NVME: crc::Crc<u64> = crc::Crc::<u64>::new(&crc::CRC_64_NVME);
+/// As [`CRC32C`], with 32 KiB of tables.
+static CRC64NVME: crc::Crc<u64, crc::Table<16>> =
+    crc::Crc::<u64, crc::Table<16>>::new(&crc::CRC_64_NVME);
 
 /// How many bytes the checksum `header` carries is, for one of [`ALGORITHMS`].
 pub(super) fn len(header: &str) -> Option<usize> {
@@ -241,9 +249,9 @@ pub(super) fn header(algorithm: &str) -> Option<&'static str> {
 pub(super) enum Hasher {
     Sha256(sha2::Sha256),
     Crc32(crc32fast::Hasher),
-    Crc32c(crc::Digest<'static, u32>),
+    Crc32c(crc::Digest<'static, u32, crc::Table<16>>),
     Sha1(sha1::Sha1),
-    Crc64nvme(crc::Digest<'static, u64>),
+    Crc64nvme(crc::Digest<'static, u64, crc::Table<16>>),
     Sha512(sha2::Sha512),
     Md5(md5::Context),
     Xxhash64(xxhash_rust::xxh64::Xxh64),
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 4397eee8..500e9a0a 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -1034,8 +1034,8 @@ struct Assembled {
 /// the way: each part's MD5, checked against both the ETag asked and the part's record, so a
 /// part replaced while this reads it is noticed rather than built in; the whole object's
 /// SHA-256; and its checksum: the full object's of an upload created with one, checked
-/// against what `whole` names in its algorithm, or for an upload created with none, the
-/// one `whole` names. First, the completion's `kind` must be the upload's, and the checksums
+/// against what `whole` names in its algorithm, or for an upload created with none, S3's
+/// default CRC64NVME. First, the completion's `kind` must be the upload's, and the checksums
 /// `sent` for each part what [`check_part`] takes. A composite checksum is passed over.
 fn assemble(
     store: &Store,
@@ -1063,12 +1063,11 @@ fn assemble(
             ),
         )));
     }
-    // The checksum the object will have, and the one sent to check it against.
+    // The checksum the object will have, and the one sent to check it against. An upload
+    // created with none has S3's default, of the whole object; what it is sent is passed
+    // over, as S3 passes it over.
     let (target, check) = match asked {
-        None => {
-            let full = whole.filter(|w| w.composite.is_none());
-            (full.map(|w| w.header), full)
-        }
+        None => (Some(checksum::DEFAULT), None),
         Some(a) if a.kind == checksum::Kind::FullObject => {
             let named = whole.filter(|w| Some(w.header) == a.header());
             if let Some(w) = named
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index 1b1e93be..cd4eb728 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -971,10 +971,12 @@ pub(super) async fn put(
     if declared_too_large(headers) {
         return Ok(ctx.too_large());
     }
-    let plan = match plan(headers) {
+    let mut plan = match plan(headers) {
         Ok(plan) => plan,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
     };
+    // An object written with no checksum gets S3's default, computed as the body streams.
+    plan.compute(checksum::DEFAULT);
     let mut annotations = match meta::annotations(headers) {
         Ok(a) => a,
         Err(why) => return refuse(req, ctx.error(why), ctx).await,
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 7e8ad215..3d2fd679 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1501,7 +1501,12 @@ async fn a_put_checks_the_digests_it_is_sent() {
             let resp = send(&host, asked).await;
             assert_eq!(resp.header(name), Some(value.as_str()), "{name} kept");
         } else {
-            assert_eq!(resp.header("x-amz-checksum-type"), None);
+            // None sent: S3's default, computed.
+            assert_eq!(
+                resp.header("x-amz-checksum-crc64nvme"),
+                Some(&*crc64nvme_b64(HELLO))
+            );
+            assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
         }
         is_object(&send(&host, get(&path)).await, HELLO);
     }
@@ -1567,18 +1572,24 @@ async fn a_put_checks_the_digests_it_is_sent() {
     send(&host, get("/s3/b/x")).await.is(404, "NoSuchKey");
     assert_eq!(staging_left(&dir), 0);
 
-    // On a read, the SHA-256 the store has, when asked, for an object whose write kept no
-    // checksum.
-    let resp = send(&host, get("/s3/b/good0")).await;
+    // On a read, the SHA-256 the store has, when asked, for an object written otherwise than
+    // through S3, which kept no checksum.
+    let dav = send(
+        &host,
+        Req::new("PUT", "/dav/files/b/dav").body(HELLO.to_vec()),
+    )
+    .await;
+    assert_eq!(dav.status, 201);
+    let resp = send(&host, get("/s3/b/dav")).await;
     assert_eq!(resp.header("x-amz-checksum-sha256"), None);
-    let asked = get("/s3/b/good0").header("x-amz-checksum-mode", "ENABLED");
+    let asked = get("/s3/b/dav").header("x-amz-checksum-mode", "ENABLED");
     let resp = send(&host, asked).await;
     is_object(&resp, HELLO);
     assert_eq!(
         resp.header("x-amz-checksum-sha256"),
         Some(&*b64(&sha2::Sha256::digest(HELLO)))
     );
-    let asked = Req::new("HEAD", "/s3/b/good0").header("x-amz-checksum-mode", "enabled");
+    let asked = Req::new("HEAD", "/s3/b/dav").header("x-amz-checksum-mode", "enabled");
     let resp = send(&host, asked).await;
     resp.ok(200);
     assert_eq!(
@@ -1796,11 +1807,11 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
         assert_eq!(keys(&resp.body), ["copy", "k", "plain"]);
         assert_eq!(
             elements(&resp.body, "ChecksumAlgorithm"),
-            ["CRC32C", "CRC32C"]
+            ["CRC32C", "CRC32C", "CRC64NVME"]
         );
         assert_eq!(
             elements(&resp.body, "ChecksumType"),
-            ["FULL_OBJECT", "FULL_OBJECT"]
+            ["FULL_OBJECT", "FULL_OBJECT", "FULL_OBJECT"]
         );
         assert!(
             resp.body.contains(
@@ -1811,17 +1822,21 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
             resp.body
         );
     }
-    // Replaced by a write carrying none, the object has none.
+    // Replaced by a write carrying none, the object has S3's default.
     send(&host, Req::new("PUT", "/s3/b/k").body(HELLO.to_vec()))
         .await
         .ok(200);
     let asked = Req::new("GET", "/s3/b/k").header("x-amz-checksum-mode", "ENABLED");
     let resp = send(&host, asked).await;
     assert_eq!(resp.header("x-amz-checksum-crc32c"), None);
-    assert_eq!(resp.header("x-amz-checksum-type"), None);
+    assert_eq!(
+        resp.header("x-amz-checksum-crc64nvme"),
+        Some(&*crc64nvme_b64(HELLO))
+    );
+    assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
 
-    // An upload completed with the whole object's checksum keeps it; a composite one is
-    // passed over, and a wrong one refused.
+    // An upload created with no checksum has S3's default, of the whole object, whatever
+    // final checksum its completion is sent (one that is not one is still refused).
     let sign = |r: Req| r;
     let path = "/s3/b/parts";
     let id = create_upload(&host, &sign, path).await;
@@ -1833,12 +1848,7 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
     let parts = [(1, e1.as_str()), (2, e2.as_str())];
     let wrong =
         complete(path, &id, &parts).header("x-amz-checksum-crc64nvme", &crc64nvme_b64(&one));
-    send(&host, wrong).await.is(400, "BadDigest");
-    let resp = send(
-        &host,
-        complete(path, &id, &parts).header("x-amz-checksum-crc64nvme", &nvme),
-    )
-    .await;
+    let resp = send(&host, wrong).await;
     resp.ok(200);
     assert_eq!(element(&resp.body, "ChecksumCRC64NVME"), nvme);
     assert_eq!(element(&resp.body, "ChecksumType"), "FULL_OBJECT");
@@ -1866,7 +1876,11 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
         complete(path, &id, &[(1, e1.as_str())]).header("x-amz-checksum-crc32", "AAAAAA==-1");
     let resp = send(&host, composite).await;
     resp.ok(200);
-    assert_eq!(elements(&resp.body, "ChecksumType"), Vec::<String>::new());
+    assert_eq!(
+        element(&resp.body, "ChecksumCRC64NVME"),
+        crc64nvme_b64(&one)
+    );
+    assert_eq!(elements(&resp.body, "ChecksumCRC32"), Vec::<String>::new());
 }
 
 /// The shared bearer of [`bearer_server`], which is also its access key and secret.
@@ -2630,10 +2644,10 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
         format!(
             "<?xml version=\"1.0\" encoding=\"UTF-8\"?><GetObjectAttributesResponse \
              xmlns=\"http://s3.amazonaws.com/doc/2006-03-01/\"><ETag>{}</ETag><Checksum>\
-             <ChecksumSHA256>{}</ChecksumSHA256></Checksum><ObjectSize>13</ObjectSize>\
-             </GetObjectAttributesResponse>",
+             <ChecksumCRC64NVME>{}</ChecksumCRC64NVME><ChecksumType>FULL_OBJECT</ChecksumType>\
+             </Checksum><ObjectSize>13</ObjectSize></GetObjectAttributesResponse>",
             md5_hex(HELLO),
-            b64(&sha2::Sha256::digest(HELLO))
+            crc64nvme_b64(HELLO)
         )
     );
     send(&host, attrs("Nonsense"))
@@ -3815,17 +3829,17 @@ async fn ranges_of_plain_and_zstd_stored_objects() {
         let asked = |value: &str| ranged(value).header("x-amz-checksum-mode", "ENABLED");
         let resp = send(&host, asked("bytes=0-9")).await;
         is_part(&resp, data, 0, 10, &etag);
-        assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+        assert_eq!(resp.header("x-amz-checksum-crc64nvme"), None);
         let resp = send(&host, asked(&format!("bytes=0-{}", n - 1))).await;
         is_part(&resp, data, 0, n, &etag);
-        assert_eq!(resp.header("x-amz-checksum-sha256"), None);
+        assert_eq!(resp.header("x-amz-checksum-crc64nvme"), None);
         let resp = send(
             &host,
             Req::new("GET", &path).header("x-amz-checksum-mode", "ENABLED"),
         )
         .await;
-        let sha = b64(&sha2::Sha256::digest(data));
-        assert_eq!(resp.header("x-amz-checksum-sha256"), Some(&*sha));
+        let crc = crc64nvme_b64(data);
+        assert_eq!(resp.header("x-amz-checksum-crc64nvme"), Some(&*crc));
 
         // A HEAD answers what the GET would.
         let resp = send(

From 8d51f60c4448a87142465ff6be4554043ce131d7 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 13:00:25 +0100
Subject: [PATCH 51/54] vk-registry/s3: give an upload's object S3's composite
 checksum

An upload created with a COMPOSITE checksum gets, at completion, its
algorithm's checksum of the parts' checksums, <base64>-<parts>, checked
against the final header with or without its count, and kept. The
parts' checksums are kept with the object too, so a part read with
checksum mode answers its own and GetObjectAttributes lists them in
ObjectParts. ListParts names each part's checksum and the upload's
algorithm and type, as ListMultipartUploads does for each upload. Reads,
listings and attributes name each object's ChecksumType as it was made.
---
 CHANGELOG.md                    |   3 +-
 vk-registry/DESIGN.md           |  10 +--
 vk-registry/src/s3/checksum.rs  |  60 ++++++++++++--
 vk-registry/src/s3/copy.rs      |   3 +
 vk-registry/src/s3/multipart.rs | 139 +++++++++++++++++++++++++++-----
 vk-registry/src/s3/object.rs    |  29 ++++++-
 vk-registry/tests/s3_e2e.rs     |  91 ++++++++++++++++++++-
 7 files changed, 298 insertions(+), 37 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc14652e..4699410f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,8 @@ All notable changes to virtkit will be documented in this file.
   a refused upload sees its refusal rather than a dropped connection; every refusal carries
   the error code, status and message S3 answers with. Large
   files can be uploaded in parts, as the AWS CLI uploads them, each part and the completion
-  held to the checksum the upload was created with, completed once however many
+  held to the checksum the upload was created with, and the object given S3's composite or
+  full-object checksum of them, completed once however many
   completions of the upload are sent, at once or as retries (each answered as the first while
   the object is still the one it made), read back a part at a time,
   parts copied from other objects,
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 792a3167..c16476a8 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -715,8 +715,8 @@ reads; a replaced object keeps only what its own write sent.
 | Request | Answer |
 |---|---|
 | `PUT /s3/<b>/<k>` PutObject | 200 with `ETag` and `x-amz-object-size`; streamed to `uploads/` while hashed (SHA-256, MD5, and the SHA-1 or CRC32 when asked), then tagged under the namespace lock as a WebDAV `PUT` is. `x-amz-content-sha256` is `UNSIGNED-PAYLOAD`, the body's SHA-256 (else 400 `XAmzContentSHA256Mismatch` and nothing is tagged), or a streaming mode whose `aws-chunked` body is decoded on the way in (below). `Content-MD5` and one `x-amz-checksum-{crc32,crc32c,sha1,sha256,crc64nvme,sha512,md5,xxhash64,xxhash3,xxhash128}` (every algorithm S3 has; the XXHASHes unseeded, base64 of the big-endian digest as the CRCs', XXH128's high half first), as a header or in a chunked body's trailer, are checked (400 `BadDigest`; 400 `InvalidDigest`/`InvalidRequest` when malformed, or when two are sent, whatever they hold, or when `x-amz-sdk-checksum-algorithm` names another algorithm than the header or the trailer; 400 `InvalidRequest` in S3's words for an `x-amz-checksum-*` header, `x-amz-sdk-checksum-algorithm` or `x-amz-trailer` naming an algorithm S3 does not have) and the checksum echoed with `x-amz-checksum-type: FULL_OBJECT` and kept on the manifest as `org.virtkit.s3-checksum` (`<ALGORITHM>:<base64>`), the object's from then on. A write that carries none gets S3's default, a CRC64NVME computed in the same pass over the body, echoed and kept the same way, as S3 has given every object since 2025. `If-None-Match: *` (create only) and `If-Match: <etag>` (replace only that object) are checked under the lock the tag is written under: 412 `PreconditionFailed` naming the `Condition`, or 404 `NoSuchKey` for an `If-Match` with no object there, as S3's conditional writes answer; S3 takes one of them, with those values only, so both at once, `If-Match: *` or an `If-None-Match` other than `*` is 501 `NotImplemented` naming the `Header`. CopyObject and CompleteMultipartUpload check them as PutObject does. 409 `OperationAborted` onto a directory, below an object, or over a foreign tag; 400 `EntityTooLarge` past 4 GiB, declared or streamed; 400 `MetadataTooLarge` |
-| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none: one written otherwise than through S3 (WebDAV, `vk registry put`), or before the default was given, rather than its bytes being read again to compute one. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
-| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
+| `GET`, `HEAD /s3/<b>/<k>` GetObject, HeadObject | 200 with the bytes, `ETag`, `Last-Modified` from the tag, `Content-Length` and the metadata; with `x-amz-checksum-mode: ENABLED`, the checksum the write kept (`x-amz-checksum-<algorithm>` and `x-amz-checksum-type: FULL_OBJECT`), or `x-amz-checksum-sha256` (the store's digest, base64) for an object that kept none: one written otherwise than through S3 (WebDAV, `vk registry put`), or before the default was given, rather than its bytes being read again to compute one. `If-Match`, `If-Unmodified-Since`, `If-None-Match` and `If-Modified-Since` in RFC 9110's order: 412 `PreconditionFailed`, or 304 with the `ETag`. Then one byte range of `Range` (`bytes=a-b`, `bytes=a-`, `bytes=-n`): 206 with `Content-Range: bytes a-b/<size>`, the part's `Content-Length` and the same headers but no checksum, which S3 sends with the whole object only (the AWS CLI checks one it is sent against each part it reads); a last byte past the end, or a suffix longer than the object, is cut to it, and a suffix of an empty object is all of it (200); a first byte past the end, an empty object's first byte included, or `bytes=-0` is 416 `InvalidRange` with `Content-Range: bytes */<size>`; several ranges, another unit or a header that does not parse (whitespace in the range, `bytes= -1`, or a last byte before the first, `bytes=5-2`, as S3 takes them) are ignored (200), as RFC 9110 allows, as is a `Range` whose `If-Range` (an ETag compared strongly, or a date equal to `Last-Modified`) no longer holds. `?partNumber=<n>` instead of a `Range` (both is 400 `InvalidRequest`) serves part `n` of the object as it was uploaded: 206 with its `Content-Range` and `x-amz-mp-parts-count` for an object a multipart upload made (its parts' sizes are kept on the manifest as `org.virtkit.s3-parts`), an object written whole being its one part (206, no count), a part of no bytes the whole object (200); with `x-amz-checksum-mode: ENABLED`, a part of an upload created with a checksum is sent its own, with the object's `ChecksumType`, as S3 sends it; a part there is not is 416 `InvalidPartNumber`, a number outside 1 to 10000 400 `InvalidArgument`. A HEAD answers what the GET would. Every answer with the object says `Accept-Ranges: bytes`. A directory, a foreign tag or a missing key is 404 `NoSuchKey`, in a bucket not made yet too (above). `?versionId=null`, the one version ListObjectVersions gives every object, names the object itself, here and on a delete or a copy source; any other version id is 501 `NotImplemented`, an empty one (`?versionId=`) 400 `InvalidArgument`. A `GET` refreshes an idle tag as WebDAV's does, a ranged one included; a `HEAD` touches nothing |
+| `GET /s3/<b>/<k>?attributes` GetObjectAttributes | 200 `GetObjectAttributesResponse` with what `x-amz-object-attributes` names of `ETag`, `Checksum` (the kept checksum, named by its algorithm, with its `ChecksumType`; else the SHA-256), `ObjectParts` (for an object a multipart upload made: each part's number and size, and its checksum when the upload was created with one, `x-amz-max-parts` of them from after `x-amz-part-number-marker`, with `PartsCount`; absent for an object written whole), `StorageClass` (`STANDARD`) and `ObjectSize`, and `Last-Modified`; 400 `InvalidRequest` without the header; touches nothing |
 | `DELETE /s3/<b>/<k>` DeleteObject | 204 whether or not the key held an object, as S3 answers (404 `NoSuchBucket` when the bucket is not there), and for a key that is a directory, which holds no object to delete, with or without `?versionId=null`; 409 `OperationAborted` for a foreign tag; 403 when the caller may read the object but not write it. Writing the key's repository is what deletes: a grant to write and not read deletes too. `If-Match` (an ETag, quoted or not, or `*`, quoted or not, for any object), `x-amz-if-match-last-modified-time` (an HTTP date, or one with a numeric zone such as `+0200`, compared to the second) and `x-amz-if-match-size` are checked under the namespace lock against the object the delete would remove, each one given having to hold: 412 `PreconditionFailed` and the object kept when one does not, 404 `NoSuchKey` when no object is there (a directory, or one the caller may not see, included), as S3's conditional deletes answer; 400 `InvalidArgument` for a time or size that does not parse; 501 `NotImplemented` with `?versionId=null`, a condition applying to the current object only. S3 serves the time and size on directory buckets only; they are served here on every bucket, rather than taken and dropped |
 | `PUT /s3/<b>/<k>` with `x-amz-copy-source` CopyObject | 200 `CopyObjectResult` (`LastModified`, `ETag`): the source tagged again at the key on the same layer, so no byte moves and the pool holds it once; the destination's repository records the layer as a member, so a caller that may read only the copy reads its bytes. The source is `<bucket>/<key>`, with or without a leading `/`, escaped as a whole or not, `?versionId=null` naming the same; another `?versionId=` is 501 `NotImplemented`. It is read as GetObject reads it (403 when the caller may read neither its path nor its parent, 404 `NoSuchKey` when absent, a directory, foreign or unreadable, `NoSuchBucket` when its bucket is not there), and the destination written as PutObject writes (`Write` on its parent, 409 `OperationAborted`, `If-None-Match: *`/`If-Match` checked where the tag is written), under the namespace and shared store lock across both. `x-amz-copy-source-if-match`, `-if-none-match`, `-if-modified-since` and `-if-unmodified-since` decide on the source in GetObject's order, what a read would answer 304 failing too: 412 `PreconditionFailed`. The source's MD5 (so its ETag), the checksum it kept and its parts come along, the checksum named in the result with its `ChecksumType`; with `x-amz-checksum-algorithm` (400 `InvalidRequest` for one S3 does not have, before a copy onto itself is refused), the object's checksum is in that algorithm, the source's computed from its bytes, read once under the same locks, unless it kept one in it (a SHA-256 is the blob's name); its user metadata too with `x-amz-metadata-directive: COPY` (the default), the request's `x-amz-meta-*` instead with `REPLACE`; a retention annotation is not copied. A copy onto itself is 400 `InvalidRequest` unless it is a `REPLACE`; an `x-amz-metadata-directive` or `x-amz-tagging-directive` other than `COPY` or `REPLACE` is 400 `InvalidArgument` |
 | `POST /s3/<b>?delete` DeleteObjects | 200 `DeleteResult`: each key of the `Delete` document deleted as DeleteObject deletes it (a key with no object counts as deleted; a bucket that is not there is 404 `NoSuchBucket`), in the order asked, as `<Deleted>` (left out with `<Quiet>true</Quiet>`) or as an `<Error>` with its `Key`, `Code` and `Message`: `AccessDenied` for a key the caller may not delete, `InvalidArgument`/`KeyTooLongError` for one the store cannot name, `OperationAborted` for a foreign tag, `NotImplemented` for one naming a `VersionId` other than `null`, `InternalError` for one the store failed to delete (logged with the request id), the batch going on past it. An `<Object>`'s `ETag`, `LastModifiedTime` and `Size` are DeleteObject's conditions on that key, checked as its headers are: `PreconditionFailed` or `NoSuchKey` for that key, `InvalidArgument` for an empty `ETag`, `NotImplemented` for a condition beside a `VersionId`; a `VersionId` given is echoed in the key's `<Deleted>` or `<Error>`. A `LastModifiedTime` that is not a date refuses the whole document (400 `InvalidRequest`, naming the first as sent; an empty one 400 `MalformedXML`), as does a `Size` that is not a count (400 `MalformedXML`), before a key is touched. The namespace lock is taken once for the batch. The document is at most 1 MiB and 1000 keys, and holds no character XML 1.0 does not allow, literal or as a reference, else 400 `MalformedXML`, and is checked as a PutObject's body is against `x-amz-content-sha256`, `Content-MD5` and `x-amz-checksum-{sha256,sha1,crc32}` before a key is touched (400 `XAmzContentSHA256Mismatch`, `BadDigest`); an `aws-chunked` document is 501 |
@@ -732,10 +732,10 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` and `x-amz-checksum-type` (`COMPOSITE`, a checksum of the parts' checksums, or `FULL_OBJECT`, by default `FULL_OBJECT` for CRC64NVME and `COMPOSITE` otherwise) are recorded with the upload and echoed; 400 `InvalidRequest` in S3's words for an algorithm or a type S3 does not have, a type without an algorithm, and a type the algorithm cannot make (`FULL_OBJECT` is CRC32, CRC32C and CRC64NVME only; `COMPOSITE` anything but CRC64NVME); `x-amz-copy-source` is 400 `InvalidArgument` |
 | `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. The part has the checksum of its upload's algorithm computed as it is copied, recorded with it and named in the result (`ChecksumCRC32`…). A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. A composite one is passed over. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`. Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. An upload created with a `COMPOSITE` checksum gets S3's composite one, its algorithm's checksum of the parts' checksums concatenated in the order named, in base64 then `-<parts>`, checked against a final header in its algorithm with or without its count (400 `BadDigest`), kept (`<ALGORITHM>:<base64>-<parts>`) and answered with `ChecksumType` `COMPOSITE` in the result, on reads, listings and GetObjectAttributes; a composite final header is passed over for an upload created without a checksum. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`, and for an upload created with a checksum the parts' checksums too (`org.virtkit.s3-part-checksums`, base64 joined by commas). Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
-| `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag` and `Size`, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
-| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass` and `Initiated`. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
+| `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag`, `Size` and the checksum it was recorded with (`ChecksumCRC32`…), and the upload's `ChecksumAlgorithm` and `ChecksumType` when it was created with one, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
+| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass`, `Initiated`, and its `ChecksumAlgorithm` and `ChecksumType` when it was created with one. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take, once the bucket and, for an object's, the object are found there (404 `NoSuchBucket`, `NoSuchKey`), as S3 looks them up first; an SDK's `x-id` operation hint is ignored |
 
 **XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
diff --git a/vk-registry/src/s3/checksum.rs b/vk-registry/src/s3/checksum.rs
index 63763566..aa7067fa 100644
--- a/vk-registry/src/s3/checksum.rs
+++ b/vk-registry/src/s3/checksum.rs
@@ -362,12 +362,13 @@ pub(super) fn of_blob(
     Ok(Some(vk_hub_proto::to_base64(&hasher.finalize())))
 }
 
-/// What an object's annotation keeps: the algorithm, by S3's name, and the checksum in
-/// base64.
+/// What an object's annotation keeps: the algorithm, by S3's name, the checksum in base64
+/// (then `-<parts>` for a composite one), and its kind.
 #[derive(Debug, PartialEq, Eq)]
 pub(super) struct Stored {
     pub(super) algorithm: &'static str,
     pub(super) value: String,
+    pub(super) kind: Kind,
 }
 
 /// The annotation keeping `value`, the checksum `header` carried once it held.
@@ -377,17 +378,40 @@ pub(super) fn annotation(header: &str, value: &str) -> Option<(String, String)>
 }
 
 /// The checksum `annotations` keep, when they keep one this registry wrote: an algorithm it
-/// has, and base64 of that algorithm's length.
+/// has, and base64 of that algorithm's length, alone (a full object's) or followed by
+/// `-<parts>` (a composite one, from 1 to 10000 parts).
 pub(super) fn stored(annotations: &BTreeMap<String, String>) -> Option<Stored> {
     let (algorithm, value) = annotations.get(ANNOTATION)?.split_once(':')?;
     let header = header(algorithm)?;
-    let decoded = crate::auth::base64_decode(value)?;
+    let (sum, kind) = match value.rsplit_once('-') {
+        None => (value, Kind::FullObject),
+        Some((sum, parts)) => {
+            let count = parts.parse::<u32>().ok()?;
+            let fits = (1..=10_000).contains(&count)
+                && !parts.starts_with(['+', '0'])
+                && Kind::Composite.fits(algorithm);
+            fits.then_some((sum, Kind::Composite))?
+        }
+    };
+    let decoded = crate::auth::base64_decode(sum)?;
     (Some(decoded.len()) == len(header)).then(|| Stored {
         algorithm: algorithm_static(algorithm),
         value: value.to_string(),
+        kind,
     })
 }
 
+/// The composite checksum of parts whose checksums, in the algorithm `header` names, are
+/// `parts`: that algorithm's checksum of their concatenation, as S3 makes it (which it
+/// writes in base64, then `-` and how many parts there are).
+pub(super) fn composite(header: &str, parts: &[Vec<u8>]) -> Option<Vec<u8>> {
+    let mut hasher = Hasher::any(header)?;
+    for part in parts {
+        hasher.update(part);
+    }
+    Some(hasher.finalize())
+}
+
 /// `name` as the static S3 name it is, once [`header`] found it.
 fn algorithm_static(name: &str) -> &'static str {
     ALGORITHMS
@@ -404,21 +428,21 @@ impl Stored {
         let value = HeaderValue::from_str(&self.value).ok();
         name.zip(value).into_iter().chain([(
             HeaderName::from_static(TYPE_HEADER),
-            HeaderValue::from_static(FULL_OBJECT),
+            HeaderValue::from_static(self.kind.name()),
         )])
     }
 
     /// The elements a listing adds to an object: its algorithm and the checksum's type.
     pub(super) fn listed(&self) -> String {
         xml::element("ChecksumAlgorithm", self.algorithm)
-            + &xml::element("ChecksumType", FULL_OBJECT)
+            + &xml::element("ChecksumType", self.kind.name())
     }
 
     /// The elements a `Checksum` attribute or a completed upload's result holds: the
     /// checksum itself, named by its algorithm, and its type.
     pub(super) fn elements(&self) -> String {
         xml::element(&format!("Checksum{}", self.algorithm), &self.value)
-            + &xml::element("ChecksumType", FULL_OBJECT)
+            + &xml::element("ChecksumType", self.kind.name())
     }
 }
 
@@ -556,6 +580,28 @@ mod tests {
             )]))
         };
         assert_eq!(of("CRC32C:AQID"), None);
+        // A composite one: the parts' count after it.
+        let composite = of("SHA1:2jmj7l5rSw0yVb/vlWAYkK/YBwk=-12").unwrap();
+        assert_eq!(composite.kind, Kind::Composite);
+        assert_eq!(composite.value, "2jmj7l5rSw0yVb/vlWAYkK/YBwk=-12");
+        assert_eq!(
+            composite.listed(),
+            "<ChecksumAlgorithm>SHA1</ChecksumAlgorithm><ChecksumType>COMPOSITE</ChecksumType>"
+        );
+        for bad in ["-0", "-10001", "-x", "-", "-+1", "-01"] {
+            assert_eq!(
+                of(&format!("SHA1:2jmj7l5rSw0yVb/vlWAYkK/YBwk={bad}")),
+                None,
+                "{bad}"
+            );
+        }
+        assert_eq!(of("CRC64NVME:AAAAAAAAAAA=-2"), None);
+        // Made as S3 makes it: the checksum of the parts' checksums, and their count.
+        let parts = [vec![1u8; 32], vec![2u8; 32]];
+        assert_eq!(
+            super::composite("x-amz-checksum-sha256", &parts).unwrap(),
+            sha2::Sha256::digest(parts.concat()).to_vec()
+        );
         assert_eq!(of("XXHASH64:AQIDBA=="), None);
         assert_eq!(of("XXHASH:AQIDBA=="), None);
         assert_eq!(of("MD5:AQIDBA=="), None);
diff --git a/vk-registry/src/s3/copy.rs b/vk-registry/src/s3/copy.rs
index d90b300e..7454bc34 100644
--- a/vk-registry/src/s3/copy.rs
+++ b/vk-registry/src/s3/copy.rs
@@ -249,6 +249,7 @@ pub(super) async fn copy(
             MD5_ANNOTATION,
             checksum::ANNOTATION,
             super::multipart::PARTS_ANNOTATION,
+            super::multipart::PART_CHECKSUMS_ANNOTATION,
         ] {
             if let Some(value) = obj.annotations.get(name) {
                 annotations.insert(name.to_string(), value.clone());
@@ -265,6 +266,8 @@ pub(super) async fn copy(
             if let Some((name, value)) = checksum::annotation(header, &value) {
                 annotations.insert(name, value);
             }
+            // The parts' are in the algorithm it replaces.
+            annotations.remove(super::multipart::PART_CHECKSUMS_ANNOTATION);
         }
         let checksum = checksum::stored(&annotations).map_or(String::new(), |k| k.elements());
         let etag = conditional::etag(&obj.layer, &annotations);
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index 500e9a0a..b110abc3 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -68,6 +68,32 @@ const META: &str = crate::MULTIPART_RECORD;
 /// upload in equal parts is one run whatever their number.
 pub(crate) const PARTS_ANNOTATION: &str = "org.virtkit.s3-parts";
 
+/// The manifest annotation holding the checksums of the parts an object was completed from,
+/// in order, for an upload created with a checksum: each in base64, in the algorithm of the
+/// object's own checksum, joined by commas.
+pub(crate) const PART_CHECKSUMS_ANNOTATION: &str = "org.virtkit.s3-part-checksums";
+
+/// The checksums of its `count` parts `annotations` keep, and their algorithm, by S3's name:
+/// `None` unless there is one for each, in base64 of the length of the algorithm of the
+/// object's checksum.
+pub(super) fn part_checksums(
+    annotations: &BTreeMap<String, String>,
+    count: usize,
+) -> Option<(&'static str, Vec<String>)> {
+    let algorithm = checksum::stored(annotations)?.algorithm;
+    let len = checksum::header(algorithm).and_then(checksum::len)?;
+    let values: Vec<String> = annotations
+        .get(PART_CHECKSUMS_ANNOTATION)?
+        .split(',')
+        .map(str::to_string)
+        .collect();
+    let fit = values.len() == count
+        && values
+            .iter()
+            .all(|v| crate::auth::base64_decode(v).is_some_and(|b| b.len() == len));
+    fit.then_some((algorithm, values))
+}
+
 /// The [`PARTS_ANNOTATION`] for parts of `sizes`.
 fn parts_annotation(sizes: &[u64]) -> String {
     let mut runs: Vec<(u64, usize)> = Vec::new();
@@ -132,9 +158,15 @@ pub(super) fn part_range(sizes: &[u64], n: u32) -> Option<(u64, u64)> {
 }
 
 /// The `ObjectParts` of GetObjectAttributes for an object of parts `sizes`: `max` of them
-/// from after part `marker`, each with its number and size (no checksum: none is kept per
-/// part), with the paging S3 writes around them and the count of them all.
-pub(super) fn object_parts(sizes: &[u64], max: usize, marker: u32) -> String {
+/// from after part `marker`, each with its number and size, and its checksum when the
+/// object keeps them (`checksums`, by algorithm), with the paging S3 writes around them and
+/// the count of them all.
+pub(super) fn object_parts(
+    sizes: &[u64],
+    checksums: Option<&(&'static str, Vec<String>)>,
+    max: usize,
+    marker: u32,
+) -> String {
     let after: Vec<(usize, &u64)> = sizes
         .iter()
         .enumerate()
@@ -155,8 +187,14 @@ pub(super) fn object_parts(sizes: &[u64], max: usize, marker: u32) -> String {
     }
     out.push_str(&xml::element("PartNumberMarker", &marker.to_string()));
     for (i, size) in page {
+        let checksum = checksums
+            .and_then(|(algorithm, values)| {
+                let value = values.get(*i)?;
+                Some(xml::element(&format!("Checksum{algorithm}"), value))
+            })
+            .unwrap_or_default();
         out.push_str(&format!(
-            "<Part>{}{}</Part>",
+            "<Part>{checksum}{}{}</Part>",
             xml::element("PartNumber", &i.saturating_add(1).to_string()),
             xml::element("Size", &size.to_string())
         ));
@@ -198,6 +236,12 @@ impl Asked {
     fn header(&self) -> Option<&'static str> {
         checksum::header(&self.algorithm)
     }
+
+    /// The elements ListParts and ListMultipartUploads name it with.
+    fn listed(&self) -> String {
+        xml::element("ChecksumAlgorithm", &self.algorithm)
+            + &xml::element("ChecksumType", self.kind.name())
+    }
 }
 
 /// What a part's record says of it.
@@ -1028,6 +1072,8 @@ struct Assembled {
     etag: String,
     checksum: Option<(&'static str, String)>,
     sizes: Vec<u64>,
+    /// the parts' checksums in the upload's algorithm, base64, for an upload created with one
+    part_checksums: Option<Vec<String>>,
 }
 
 /// Concatenate the `parts` of `up`, in order, into a staging file, in one pass, hashing on
@@ -1035,8 +1081,10 @@ struct Assembled {
 /// part replaced while this reads it is noticed rather than built in; the whole object's
 /// SHA-256; and its checksum: the full object's of an upload created with one, checked
 /// against what `whole` names in its algorithm, or for an upload created with none, S3's
-/// default CRC64NVME. First, the completion's `kind` must be the upload's, and the checksums
-/// `sent` for each part what [`check_part`] takes. A composite checksum is passed over.
+/// default CRC64NVME; or the composite one, made of the parts' checksums, of an upload
+/// created with one, checked against what `whole` names in its algorithm, with or without
+/// its count of parts. First, the completion's `kind` must be the upload's, and the
+/// checksums `sent` for each part what [`check_part`] takes.
 fn assemble(
     store: &Store,
     up: &Upload,
@@ -1085,6 +1133,8 @@ fn assemble(
         let _ = meta.set_modified(SystemTime::now());
     }
     let mut total: u64 = 0;
+    // The parts' checksums in the upload's algorithm, which every part of it has.
+    let mut part_checksums = asked.map(|_| Vec::with_capacity(parts.len()));
     for ((n, etag), sent) in parts.iter().zip(sent) {
         let Some(part) = read_record::<Part>(&record_path(&up.dir, *n)) else {
             return Ok(Err(invalid_part(n, etag)));
@@ -1102,6 +1152,17 @@ fn assemble(
         if let Err(why) = checked {
             return Ok(Err(why));
         }
+        let own = asked.and_then(|a| {
+            let (algorithm, value) = part.checksum.as_deref()?.split_once(':')?;
+            (algorithm == a.algorithm).then(|| value.to_string())
+        });
+        match own {
+            Some(value) => part_checksums
+                .iter_mut()
+                .for_each(|c| c.push(value.clone())),
+            // A part recorded before its upload's checksum was: none made of them.
+            None => part_checksums = None,
+        }
         total = total.saturating_add(part.size);
     }
     let too_large = |size: u64| {
@@ -1169,12 +1230,31 @@ fn assemble(
         }
         kept = Some((header, vk_hub_proto::to_base64(&got)));
     }
+    if let Some(a) = asked.filter(|a| a.kind == checksum::Kind::Composite)
+        && let (Some(header), Some(values)) = (a.header(), &part_checksums)
+    {
+        let decoded: Option<Vec<Vec<u8>>> = values
+            .iter()
+            .map(|v| crate::auth::base64_decode(v))
+            .collect();
+        if let Some(digest) = decoded.and_then(|d| checksum::composite(header, &d)) {
+            // Sent with its count of parts or without, as S3 takes it.
+            if let Some(w) = whole.filter(|w| w.header == header)
+                && (w.bytes != digest || w.composite.is_some_and(|n| n as usize != parts.len()))
+            {
+                return Ok(Err(checksum::mismatch(header)));
+            }
+            let made = format!("{}-{}", vk_hub_proto::to_base64(&digest), parts.len());
+            kept = Some((header, made));
+        }
+    }
     staged.hex = crate::hex_of(&sha256);
     Ok(Ok(Assembled {
         staged,
         etag: multipart_etag(&md5s),
         checksum: kept,
         sizes,
+        part_checksums,
     }))
 }
 
@@ -1254,7 +1334,8 @@ async fn complete(
             };
             let (whole, kind) = &whole;
             let assembled = assemble(&store, &up, &parts, &sent, (whole.as_ref(), *kind))?;
-            Ok(Found::Assembled(Held { _lock: lock, up }, parts, assembled))
+            let held = Held { _lock: lock, up };
+            Ok(Found::Assembled(held, parts, Box::new(assembled)))
         })
         .await
         .context("assembling an upload panicked")??
@@ -1264,18 +1345,24 @@ async fn complete(
     let (Held { _lock, up }, parts, assembled) = match found {
         Found::Gone => return Ok(no_such_upload(ctx, &id)),
         Found::Completed(done) => return Ok(done.result(ctx)),
-        Found::Assembled(_, _, Err(why)) => return Ok(ctx.error(why)),
-        Found::Assembled(held, parts, Ok(assembled)) => (held, parts, assembled),
+        Found::Assembled(held, parts, assembled) => match *assembled {
+            Err(why) => return Ok(ctx.error(why)),
+            Ok(assembled) => (held, parts, assembled),
+        },
     };
     let Assembled {
         staged,
         etag,
         checksum,
         sizes,
+        part_checksums,
     } = assembled;
     let mut annotations = up.meta.annotations;
     annotations.insert(MD5_ANNOTATION.to_string(), etag.clone());
     annotations.insert(PARTS_ANNOTATION.to_string(), parts_annotation(&sizes));
+    if let Some(values) = part_checksums {
+        annotations.insert(PART_CHECKSUMS_ANNOTATION.to_string(), values.join(","));
+    }
     if let Some((name, value)) =
         checksum.and_then(|(header, text)| checksum::annotation(header, &text))
     {
@@ -1326,7 +1413,7 @@ enum Found {
     Assembled(
         Held,
         Vec<(u32, String)>,
-        std::result::Result<Assembled, Refusal>,
+        Box<std::result::Result<Assembled, Refusal>>,
     ),
 }
 
@@ -1558,12 +1645,16 @@ async fn list_parts(
         let truncated = numbers.len() > max;
         numbers.truncate(max);
         let mut out = format!(
-            "{}{}{}{}{}{}",
+            "{}{}{}{}{}{}{}",
             xml::element("Bucket", &up.meta.bucket),
             xml::element("Key", &up.meta.key),
             xml::element("UploadId", &up.id),
             initiator_and_owner(),
             xml::element("StorageClass", "STANDARD"),
+            up.meta
+                .checksum
+                .as_ref()
+                .map_or(String::new(), Asked::listed),
             xml::element("PartNumberMarker", &marker.to_string()),
         );
         if let Some(last) = numbers.last() {
@@ -1583,8 +1674,15 @@ async fn list_parts(
             let written = std::fs::metadata(&path)
                 .and_then(|m| m.modified())
                 .unwrap_or_else(|_| SystemTime::now());
+            let checksum = part
+                .checksum
+                .as_deref()
+                .and_then(|kept| kept.split_once(':'))
+                .map_or(String::new(), |(algorithm, value)| {
+                    xml::element(&format!("Checksum{algorithm}"), value)
+                });
             out.push_str(&format!(
-                "<Part>{}{}{}{}</Part>",
+                "<Part>{}{}{}{}{checksum}</Part>",
                 xml::element("PartNumber", &n.to_string()),
                 xml::element("LastModified", &list::iso8601(written)),
                 xml::element("ETag", &format!("\"{}\"", part.md5)),
@@ -1601,6 +1699,7 @@ struct Listed {
     key: String,
     id: String,
     created: u64,
+    checksum: Option<Asked>,
 }
 
 impl Listed {
@@ -1703,6 +1802,7 @@ pub(super) async fn list_uploads(
                     key: meta.key,
                     id,
                     created: meta.created,
+                    checksum: meta.checksum,
                 });
             }
         }
@@ -1756,12 +1856,13 @@ pub(super) async fn list_uploads(
         for u in &uploads {
             let created = SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(u.created);
             out.push_str(&format!(
-                "<Upload>{}{}{}{}{}</Upload>",
+                "<Upload>{}{}{}{}{}{}</Upload>",
                 xml::element("Key", &enc(&u.key)),
                 xml::element("UploadId", &u.id),
                 initiator_and_owner(),
                 xml::element("StorageClass", "STANDARD"),
-                xml::element("Initiated", &list::iso8601(created))
+                xml::element("Initiated", &list::iso8601(created)),
+                u.checksum.as_ref().map_or(String::new(), Asked::listed),
             ));
         }
         Ok(xml::document("ListMultipartUploadsResult", &out))
@@ -1942,29 +2043,29 @@ mod tests {
     fn object_parts_are_paged_as_s3_pages_them() {
         let sizes = [5, 7, 3];
         assert_eq!(
-            object_parts(&sizes, 1000, 0),
+            object_parts(&sizes, None, 1000, 0),
             "<ObjectParts><IsTruncated>false</IsTruncated><MaxParts>1000</MaxParts>\
              <PartNumberMarker>0</PartNumberMarker><Part><PartNumber>1</PartNumber><Size>5</Size>\
              </Part><Part><PartNumber>2</PartNumber><Size>7</Size></Part><Part><PartNumber>3\
              </PartNumber><Size>3</Size></Part><PartsCount>3</PartsCount></ObjectParts>"
         );
         assert_eq!(
-            object_parts(&sizes, 2, 0),
+            object_parts(&sizes, None, 2, 0),
             "<ObjectParts><IsTruncated>true</IsTruncated><MaxParts>2</MaxParts>\
              <NextPartNumberMarker>2</NextPartNumberMarker><PartNumberMarker>0</PartNumberMarker>\
              <Part><PartNumber>1</PartNumber><Size>5</Size></Part><Part><PartNumber>2</PartNumber>\
              <Size>7</Size></Part><PartsCount>3</PartsCount></ObjectParts>"
         );
         assert_eq!(
-            object_parts(&sizes, 2, 2),
+            object_parts(&sizes, None, 2, 2),
             "<ObjectParts><IsTruncated>false</IsTruncated><MaxParts>2</MaxParts>\
              <PartNumberMarker>2</PartNumberMarker><Part><PartNumber>3</PartNumber><Size>3</Size>\
              </Part><PartsCount>3</PartsCount></ObjectParts>"
         );
-        let none = object_parts(&sizes, 0, 0);
+        let none = object_parts(&sizes, None, 0, 0);
         assert!(none.contains("<IsTruncated>true</IsTruncated><MaxParts>0</MaxParts>"));
         assert!(!none.contains("<Part>") && !none.contains("NextPartNumberMarker"));
-        assert!(!object_parts(&sizes, 5, 3).contains("<Part>"));
+        assert!(!object_parts(&sizes, None, 5, 3).contains("<Part>"));
     }
 
     #[test]
diff --git a/vk-registry/src/s3/object.rs b/vk-registry/src/s3/object.rs
index cd4eb728..328ce161 100644
--- a/vk-registry/src/s3/object.rs
+++ b/vk-registry/src/s3/object.rs
@@ -237,10 +237,12 @@ pub(super) async fn get(
                 &sizes.len().to_string(),
             );
         }
-        // The whole object's checksum, on the whole object only: S3 sends none with a part,
-        // and the AWS CLI checks what it is sent against the bytes of each part it fetches.
+        // The whole object's checksum, on the whole object only: S3 sends none with a range,
+        // and the AWS CLI checks what it is sent against the bytes of each part it fetches. A
+        // part of an upload that kept its parts' checksums is sent its own, as S3 sends it.
+        let kept = checksum::stored(&obj.annotations);
         if checksum && !partial {
-            match checksum::stored(&obj.annotations) {
+            match &kept {
                 Some(kept) => headers.extend(kept.headers()),
                 None => insert(
                     headers,
@@ -248,6 +250,19 @@ pub(super) async fn get(
                     &sha256_base64(&obj.layer),
                 ),
             }
+        } else if checksum
+            && let (Some(n), Some(sizes), Some(kept)) = (part, &sizes, &kept)
+            && let Some((_, values)) = multipart::part_checksums(&obj.annotations, sizes.len())
+            && let Some(value) = usize::try_from(n)
+                .ok()
+                .and_then(|n| values.get(n.checked_sub(1)?))
+        {
+            let own = checksum::Stored {
+                algorithm: kept.algorithm,
+                value: value.clone(),
+                kind: kept.kind,
+            };
+            headers.extend(own.headers());
         }
         for (name, value) in meta::headers(&obj.annotations) {
             headers.append(name, value);
@@ -350,7 +365,13 @@ pub(super) async fn attributes(
         {
             let max = usize::try_from(max_parts).unwrap_or(1000);
             let marker = u32::try_from(marker).unwrap_or(u32::MAX);
-            inner.push_str(&multipart::object_parts(&sizes, max, marker));
+            let checksums = multipart::part_checksums(&obj.annotations, sizes.len());
+            inner.push_str(&multipart::object_parts(
+                &sizes,
+                checksums.as_ref(),
+                max,
+                marker,
+            ));
         }
         if has("StorageClass") {
             inner.push_str(&xml::element("StorageClass", "STANDARD"));
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 3d2fd679..4eafc88b 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -4839,6 +4839,7 @@ fn multipart_left(dir: &std::path::Path) -> Vec<String> {
 async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
     let dir = tmp("mp-checksums");
     let host = spawn(open_state(&dir, true));
+    send(&host, Req::new("PUT", "/s3/b")).await.ok(200);
     let path = "/s3/b/k";
     let create = |pairs: &[(&str, &str)]| {
         let mut req = Req::new("POST", path).query("uploads=");
@@ -5027,16 +5028,97 @@ async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
         .says(
             "Expecting a single x-amz-checksum- header. Multiple checksum Types are not allowed.",
         );
+    // Listed with the parts' checksums and the upload's.
     let resp = send(
         &host,
+        Req::new("GET", path).query(&format!("uploadId={id}")),
+    )
+    .await;
+    resp.ok(200);
+    assert_eq!(
+        elements(&resp.body, "ChecksumSHA256"),
+        [sha1.clone(), sha2.clone()]
+    );
+    assert_eq!(element(&resp.body, "ChecksumAlgorithm"), "SHA256");
+    assert_eq!(element(&resp.body, "ChecksumType"), "COMPOSITE");
+    let resp = send(&host, Req::new("GET", "/s3/b").query("uploads=")).await;
+    let upload = elements(&resp.body, "Upload")
+        .into_iter()
+        .find(|u| u.contains(&id))
+        .unwrap();
+    assert!(
+        upload.contains(
+            "<ChecksumAlgorithm>SHA256</ChecksumAlgorithm><ChecksumType>COMPOSITE</ChecksumType>"
+        ),
+        "{upload}"
+    );
+    // The composite checksum: the SHA256 of the parts' SHA256s, and their count; one sent is
+    // checked, with its count or without.
+    let digest = |b: &[u8]| sha2::Sha256::digest(b).to_vec();
+    let composite = b64(&digest(&[digest(&one), digest(&two)].concat()));
+    let both = || {
         completion(&[
             (1, e1.as_str(), &[("ChecksumSHA256", sha1.as_str())]),
             (2, e2.as_str(), &[("ChecksumSHA256", sha2.as_str())]),
         ])
-        .header(kind, "composite"),
+    };
+    for wrong in [format!("{composite}-3"), format!("{sha1}-2"), sha1.clone()] {
+        send(&host, both().header("x-amz-checksum-sha256", &wrong))
+            .await
+            .is(400, "BadDigest")
+            .says("The SHA256 you specified did not match the calculated checksum.");
+    }
+    let resp = send(
+        &host,
+        both()
+            .header(kind, "composite")
+            .header("x-amz-checksum-sha256", &composite),
     )
     .await;
     resp.ok(200);
+    let composite = format!("{composite}-2");
+    assert_eq!(element(&resp.body, "ChecksumSHA256"), composite);
+    assert_eq!(element(&resp.body, "ChecksumType"), "COMPOSITE");
+    let asked = |r: Req| r.header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, asked(Req::new("HEAD", path))).await;
+    assert_eq!(
+        resp.header("x-amz-checksum-sha256"),
+        Some(composite.as_str())
+    );
+    assert_eq!(resp.header("x-amz-checksum-type"), Some("COMPOSITE"));
+    // A part read is sent its own.
+    let resp = send(&host, asked(Req::new("GET", path).query("partNumber=2"))).await;
+    resp.ok(206);
+    assert_eq!(resp.header("x-amz-checksum-sha256"), Some(sha2.as_str()));
+    assert_eq!(resp.header("x-amz-checksum-type"), Some("COMPOSITE"));
+    let attrs = Req::new("GET", path)
+        .query("attributes")
+        .header("x-amz-object-attributes", "Checksum,ObjectParts");
+    let resp = send(&host, attrs).await;
+    resp.ok(200);
+    assert_eq!(
+        element(&resp.body, "Checksum"),
+        format!(
+            "<ChecksumSHA256>{composite}</ChecksumSHA256><ChecksumType>COMPOSITE</ChecksumType>"
+        )
+    );
+    assert_eq!(
+        elements(&resp.body, "Part"),
+        [
+            format!(
+                "<ChecksumSHA256>{sha1}</ChecksumSHA256><PartNumber>1</PartNumber><Size>1000</Size>"
+            ),
+            format!(
+                "<ChecksumSHA256>{sha2}</ChecksumSHA256><PartNumber>2</PartNumber><Size>300</Size>"
+            ),
+        ]
+    );
+    let resp = send(
+        &host,
+        Req::new("GET", "/s3/b").query("list-type=2&prefix=k"),
+    )
+    .await;
+    assert_eq!(element(&resp.body, "ChecksumType"), "COMPOSITE");
 
     // A full object's CRC32C upload: a part with none has it computed, the object's is
     // computed as it is assembled, checked against the one sent, and kept.
@@ -5090,6 +5172,13 @@ async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
         resp.header("x-amz-checksum-crc32c"),
         Some(&*crc32c_b64(&whole))
     );
+    let part = Req::new("HEAD", path)
+        .query("partNumber=1")
+        .header("x-amz-checksum-mode", "ENABLED");
+    let resp = send(&host, part).await;
+    resp.ok(206);
+    assert_eq!(resp.header("x-amz-checksum-crc32c"), Some(c1.as_str()));
+    assert_eq!(resp.header("x-amz-checksum-type"), Some("FULL_OBJECT"));
 }
 
 /// A copy asking for a checksum algorithm has the object's checksum in it, computed from the

From 9e5ceb32b34781fb9fc8203f8eef9a0ddfc53e36 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 15:13:38 +0100
Subject: [PATCH 52/54] vk-registry/s3: refuse an aws-chunked chunk shorter
 than 8192 bytes before another

Every chunk of an aws-chunked body that holds data, but the last, holds
at least 8192 bytes, as S3 requires: a shorter one followed by more data
is 400 InvalidChunkSizeError in S3's words, naming the chunk and its
size. SDKs frame in 64 KiB chunks, so only hand-framed bodies change.
---
 vk-registry/DESIGN.md         |  4 +-
 vk-registry/src/s3/chunked.rs | 80 +++++++++++++++++++++++++++++++++--
 vk-registry/src/s3/error.rs   |  6 +++
 3 files changed, 86 insertions(+), 4 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index c16476a8..576ceeba 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -765,7 +765,9 @@ rather than SigV4** — the way a proxy that authenticates a guest's requests it
 them — and any request to a server with no credential has no secret to check them with: its
 framing is decoded and its signatures are read, not checked. `x-amz-decoded-content-length`
 is required (411 `MissingContentLength`), past 4 GiB is 400 `EntityTooLarge` before the body is read, and the chunks
-must hold exactly that many bytes. The trailer's `x-amz-checksum-*`, in any of S3's algorithms, is
+must hold exactly that many bytes; every chunk holding data but the last holds at least 8192
+bytes, as S3 requires (400 `InvalidChunkSizeError`, naming the `Chunk` and its
+`BadChunkSize`). The trailer's `x-amz-checksum-*`, in any of S3's algorithms, is
 checked against the decoded bytes, echoed and kept, as a header's is; a checksum sent both as
 a header and in the trailer is 400. Reading is
 bounded as it goes: a chunk header of at most 256 bytes, a chunk no longer than what is left
diff --git a/vk-registry/src/s3/chunked.rs b/vk-registry/src/s3/chunked.rs
index 6036bb63..6b668bbc 100644
--- a/vk-registry/src/s3/chunked.rs
+++ b/vk-registry/src/s3/chunked.rs
@@ -11,7 +11,8 @@
 //! decoded and its signatures read but not checked, as no seed is known.
 //!
 //! What is read is bounded as it is read: a chunk header of at most [`MAX_HEADER`] bytes, a
-//! chunk no longer than what is left of `x-amz-decoded-content-length`, a trailer section of
+//! chunk no longer than what is left of `x-amz-decoded-content-length` and, but for the last
+//! one holding data, no shorter than [`MIN_CHUNK`], as S3 holds it, a trailer section of
 //! at most [`MAX_TRAILER`], and nothing after its end. Memory is one frame of the inner body
 //! and a line. Anything else stops the body with a [`Refusal`]; the data already passed on
 //! is then in a staging file its caller drops, so nothing it decoded is ever tagged.
@@ -31,6 +32,9 @@ use super::sigv4::{self, SigningKey};
 /// The longest chunk header taken, its CRLF included: a size and a signature need 91.
 pub(crate) const MAX_HEADER: usize = 256;
 
+/// The fewest bytes a chunk holds when another chunk of data follows it: S3's minimum.
+pub(crate) const MIN_CHUNK: u64 = 8192;
+
 /// The longest trailer section taken, every line's CRLF included.
 pub(crate) const MAX_TRAILER: usize = 8 * 1024;
 
@@ -149,6 +153,8 @@ pub(crate) struct Refusal {
     pub(crate) code: Code,
     pub(crate) said: &'static str,
     pub(crate) message: &'static str,
+    /// the chunk too short to have another follow it: its number, from 1, and its size
+    short: Option<(u64, u64)>,
 }
 
 impl Refusal {
@@ -160,6 +166,7 @@ impl Refusal {
             code: Code::IncompleteBody,
             said: "The request body terminated unexpectedly",
             message,
+            short: None,
         }
     }
 
@@ -169,6 +176,7 @@ impl Refusal {
             code: Code::IncompleteBody,
             said: Code::IncompleteBody.message(),
             message,
+            short: None,
         }
     }
 
@@ -178,6 +186,7 @@ impl Refusal {
             code: Code::MalformedTrailerError,
             said: Code::MalformedTrailerError.message(),
             message,
+            short: None,
         }
     }
 
@@ -187,13 +196,33 @@ impl Refusal {
             code: Code::SignatureDoesNotMatch,
             said: Code::SignatureDoesNotMatch.message(),
             message,
+            short: None,
+        }
+    }
+}
+
+impl Refusal {
+    /// Chunk number `chunk`, of `size` bytes, followed by another holding data, though it is
+    /// shorter than [`MIN_CHUNK`].
+    fn short(chunk: u64, size: u64) -> Self {
+        Refusal {
+            code: Code::InvalidChunkSizeError,
+            said: Code::InvalidChunkSizeError.message(),
+            message: "only the last chunk may hold fewer than 8192 bytes",
+            short: Some((chunk, size)),
         }
     }
 }
 
 impl From<Refusal> for super::error::Refusal {
     fn from(r: Refusal) -> Self {
-        super::error::Refusal::said(r.code, r.said)
+        let refusal = super::error::Refusal::said(r.code, r.said);
+        match r.short {
+            Some((chunk, size)) => refusal
+                .with("Chunk", chunk.to_string())
+                .with("BadChunkSize", size.to_string()),
+            None => refusal,
+        }
     }
 }
 
@@ -275,6 +304,8 @@ pub(crate) struct Decoder<B> {
     /// the line being read, its CRLF not yet seen
     line: Vec<u8>,
     decoded: u64,
+    /// how many chunks holding data were read, and the size of the last of them
+    chunks: (u64, u64),
     /// the signature of the chunk being read and the hash of its data, when checked
     chunk: Option<(String, Sha256)>,
     trailer: Trailer,
@@ -298,6 +329,7 @@ impl<B> Decoder<B> {
             pending: Bytes::new(),
             line: Vec::new(),
             decoded: 0,
+            chunks: (0, 0),
             chunk: None,
             trailer: Trailer::default(),
         }
@@ -368,6 +400,10 @@ impl<B> Decoder<B> {
                 ));
             }
         };
+        let (count, last) = self.chunks;
+        if size > 0 && count > 0 && last < MIN_CHUNK {
+            return Err(Refusal::short(count, last));
+        }
         let left = self.framing.declared.saturating_sub(self.decoded);
         if size > left {
             return Err(Refusal::mismatch(
@@ -386,6 +422,7 @@ impl<B> Decoder<B> {
             self.chunk_done()?;
             self.state = State::Trailer;
         } else {
+            self.chunks = (count.saturating_add(1), size);
             self.state = State::Data(size);
         }
         Ok(())
@@ -802,7 +839,7 @@ mod tests {
     #[test]
     fn an_unsigned_trailer_carries_its_checksum() {
         let crc = vk_hub_proto::to_base64(&crc32fast::hash(b"hello world").to_be_bytes());
-        let body = format!("5\r\nhello\r\n6\r\n world\r\n0\r\nx-amz-checksum-crc32:{crc}\r\n\r\n");
+        let body = format!("b\r\nhello world\r\n0\r\nx-amz-checksum-crc32:{crc}\r\n\r\n");
         for frame in [1, 3, body.len()] {
             // A seed changes nothing for a body that is not signed.
             let (out, trailer) = decode(
@@ -859,6 +896,43 @@ mod tests {
         );
     }
 
+    #[test]
+    fn only_the_last_chunk_of_data_may_be_short() {
+        let plain = |declared| Framing {
+            mode: Mode::Unsigned,
+            declared,
+            trailer: None,
+        };
+        let body = |sizes: &[usize]| {
+            let mut out = Vec::new();
+            for &n in sizes.iter().chain([&0]) {
+                out.extend_from_slice(format!("{n:x}\r\n").as_bytes());
+                out.extend(std::iter::repeat_n(b'a', n));
+                if n > 0 {
+                    out.extend_from_slice(b"\r\n");
+                }
+            }
+            out.extend_from_slice(b"\r\n");
+            (out, sizes.iter().sum::<usize>() as u64)
+        };
+        for sizes in [&[100][..], &[8192, 8192, 100], &[10_000, 9500, 20]] {
+            let (b, n) = body(sizes);
+            assert_eq!(decode(&b, 4096, plain(n), None).unwrap().0.len() as u64, n);
+        }
+        for (sizes, chunk, size) in [
+            (&[100, 8192, 100][..], 1, 100),
+            (&[8192, 10, 100], 2, 10),
+            (&[10_000, 10, 8192, 8192], 2, 10),
+        ] {
+            let (b, n) = body(sizes);
+            let r = decode(&b, 4096, plain(n), None).unwrap_err();
+            assert_eq!(r.code, Code::InvalidChunkSizeError, "{sizes:?}");
+            let r = super::super::error::Refusal::from(r);
+            assert_eq!(r.element("Chunk"), Some(&*chunk.to_string()));
+            assert_eq!(r.element("BadChunkSize"), Some(&*size.to_string()));
+        }
+    }
+
     #[test]
     fn a_signed_trailer_needs_its_signature_last() {
         let framing = Framing {
diff --git a/vk-registry/src/s3/error.rs b/vk-registry/src/s3/error.rs
index f2ce7bbf..d3a2e25c 100644
--- a/vk-registry/src/s3/error.rs
+++ b/vk-registry/src/s3/error.rs
@@ -29,6 +29,7 @@ pub(crate) enum Code {
     InvalidAccessKeyId,
     InvalidArgument,
     InvalidBucketName,
+    InvalidChunkSizeError,
     InvalidDigest,
     InvalidPart,
     InvalidPartNumber,
@@ -132,6 +133,11 @@ impl Code {
                 BAD,
                 "The specified bucket is not valid.",
             ),
+            InvalidChunkSizeError => (
+                "InvalidChunkSizeError",
+                BAD,
+                "Only the last chunk is allowed to have a size less than 8192 bytes",
+            ),
             InvalidDigest => (
                 "InvalidDigest",
                 BAD,

From f1127b96b7cf192387558612bbdca826a9dbafdf Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 15:29:50 +0100
Subject: [PATCH 53/54] vk-registry/s3: refuse a completion whose parts but the
 last are under 5 MiB

CompleteMultipartUpload holds every part it names but the last to S3's
5 MiB minimum: a smaller one is 400 EntityTooSmall in S3's words,
naming the part, its ETag, its size and the minimum, and the upload is
left as it was. Parts of any size are still taken as they are uploaded,
as S3 takes them. SDKs, the AWS CLI and sccache upload parts of 5 MiB or
more, so only hand-made uploads change.
---
 CHANGELOG.md                    |  3 ++-
 vk-registry/DESIGN.md           |  4 +--
 vk-registry/src/s3/error.rs     |  6 +++++
 vk-registry/src/s3/multipart.rs | 13 ++++++++-
 vk-registry/tests/s3_e2e.rs     | 48 ++++++++++++++++++++++++---------
 5 files changed, 57 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4699410f..08788e98 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,7 +28,8 @@ All notable changes to virtkit will be documented in this file.
   storage class, a redirect, a retention lock — is refused rather than stored without it, and
   a refused upload sees its refusal rather than a dropped connection; every refusal carries
   the error code, status and message S3 answers with. Large
-  files can be uploaded in parts, as the AWS CLI uploads them, each part and the completion
+  files can be uploaded in parts, as the AWS CLI uploads them, every part but the last at
+  least 5 MiB as S3 requires, each part and the completion
   held to the checksum the upload was created with, and the object given S3's composite or
   full-object checksum of them, completed once however many
   completions of the upload are sent, at once or as retries (each answered as the first while
diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 576ceeba..88272b07 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -730,9 +730,9 @@ reads; a replaced object keeps only what its own write sent.
 | `GET /s3/<b>?location` GetBucketLocation | the region the request was signed for, which is any the client chose, or an empty `LocationConstraint` for an unsigned request; after HeadBucket's checks |
 | `GET /s3/` ListBuckets | `ListAllMyBucketsResult`: the readable top-level directories, each dated by its directory's mtime, and the owner `vk-registry`; 403 `AccessDenied` on a server with no credential |
 | `POST /s3/<b>/<k>?uploads` CreateMultipartUpload | 200 `InitiateMultipartUploadResult` (`Bucket`, `Key`, `UploadId`): a new upload of the key, its user metadata recorded for the object; needs `Write` on the key's parent, and the key is checked as PutObject's is (409 `OperationAborted`), and again at completion. `x-amz-checksum-algorithm` and `x-amz-checksum-type` (`COMPOSITE`, a checksum of the parts' checksums, or `FULL_OBJECT`, by default `FULL_OBJECT` for CRC64NVME and `COMPOSITE` otherwise) are recorded with the upload and echoed; 400 `InvalidRequest` in S3's words for an algorithm or a type S3 does not have, a type without an algorithm, and a type the algorithm cannot make (`FULL_OBJECT` is CRC32, CRC32C and CRC64NVME only; `COMPOSITE` anything but CRC64NVME); `x-amz-copy-source` is 400 `InvalidArgument` |
-| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; no minimum part size is enforced. An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
+| `PUT /s3/<b>/<k>?partNumber=<n>&uploadId=<id>` UploadPart | 200 with the part's `ETag` (its MD5): its body received as a PutObject's is — the same payload modes, `aws-chunked` decoding, `Content-MD5` and `x-amz-checksum-*` checks and echoes, 400 `EntityTooLarge` past 4 GiB — into the upload's directory, replacing any earlier part `n` whole; the checksum it carried is recorded with it. A part of an upload created with a checksum carries one in that algorithm (header, trailer or `x-amz-sdk-checksum-algorithm`), else 400 `InvalidRequest` naming both; one that carries none is refused for a `COMPOSITE` upload and has the algorithm computed, echoed and recorded for a `FULL_OBJECT` one. Part numbers are 1 to 10000 (else 400 `InvalidArgument`), once the upload is found: an upload that is not there is 404 `NoSuchUpload` before what is asked of it is looked at, as S3 answers; a part of any size is taken, and held to S3's minimum at completion (below). An upload id that is not one of the key's own uploads, completed or aborted is 404 `NoSuchUpload`, whatever key it was made for |
 | UploadPart with `x-amz-copy-source` UploadPartCopy | 200 `CopyPartResult` (`LastModified`, `ETag`): the source object, or the bytes `x-amz-copy-source-range: bytes=<first>-<last>` names, copied into the part off the runtime (a part is the upload's own until it completes), the source read and its `x-amz-copy-source-if-*` conditions checked as CopyObject's are. The part has the checksum of its upload's algorithm computed as it is copied, recorded with it and named in the result (`ChecksumCRC32`…). A range past the source's end is 400 `InvalidArgument` naming the source's size, a malformed one 400 `InvalidArgument` |
-| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. An upload created with a `COMPOSITE` checksum gets S3's composite one, its algorithm's checksum of the parts' checksums concatenated in the order named, in base64 then `-<parts>`, checked against a final header in its algorithm with or without its count (400 `BadDigest`), kept (`<ALGORITHM>:<base64>-<parts>`) and answered with `ChecksumType` `COMPOSITE` in the result, on reads, listings and GetObjectAttributes; a composite final header is passed over for an upload created without a checksum. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`, and for an upload created with a checksum the parts' checksums too (`org.virtkit.s3-part-checksums`, base64 joined by commas). Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
+| `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), each but the last at least 5 MiB, S3's minimum (400 `EntityTooSmall`, naming the part, its ETag, its `ProposedSize` and the `MinSizeAllowed`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. An upload created with a `COMPOSITE` checksum gets S3's composite one, its algorithm's checksum of the parts' checksums concatenated in the order named, in base64 then `-<parts>`, checked against a final header in its algorithm with or without its count (400 `BadDigest`), kept (`<ALGORITHM>:<base64>-<parts>`) and answered with `ChecksumType` `COMPOSITE` in the result, on reads, listings and GetObjectAttributes; a composite final header is passed over for an upload created without a checksum. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`, and for an upload created with a checksum the parts' checksums too (`org.virtkit.s3-part-checksums`, base64 joined by commas). Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag`, `Size` and the checksum it was recorded with (`ChecksumCRC32`…), and the upload's `ChecksumAlgorithm` and `ChecksumType` when it was created with one, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
 | `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass`, `Initiated`, and its `ChecksumAlgorithm` and `ChecksumType` when it was created with one. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
diff --git a/vk-registry/src/s3/error.rs b/vk-registry/src/s3/error.rs
index d3a2e25c..fcc55b26 100644
--- a/vk-registry/src/s3/error.rs
+++ b/vk-registry/src/s3/error.rs
@@ -24,6 +24,7 @@ pub(crate) enum Code {
     BucketAlreadyOwnedByYou,
     BucketNotEmpty,
     EntityTooLarge,
+    EntityTooSmall,
     IncompleteBody,
     InternalError,
     InvalidAccessKeyId,
@@ -111,6 +112,11 @@ impl Code {
                 BAD,
                 "Your proposed upload exceeds the maximum allowed object size.",
             ),
+            EntityTooSmall => (
+                "EntityTooSmall",
+                BAD,
+                "Your proposed upload is smaller than the minimum allowed size",
+            ),
             IncompleteBody => (
                 "IncompleteBody",
                 BAD,
diff --git a/vk-registry/src/s3/multipart.rs b/vk-registry/src/s3/multipart.rs
index b110abc3..0f3bb2f6 100644
--- a/vk-registry/src/s3/multipart.rs
+++ b/vk-registry/src/s3/multipart.rs
@@ -50,6 +50,10 @@ use crate::{Authz, Body, STREAM_CHUNK, ServerState, Store, accounts, body_of};
 /// Most parts an upload has, and the highest part number: S3's bound.
 const MAX_PARTS: u32 = 10_000;
 
+/// The fewest bytes a part holds when it is not the last one an upload completes with:
+/// S3's minimum.
+const MIN_PART: u64 = 5 << 20;
+
 /// Longest `CompleteMultipartUpload` document taken.
 const MAX_DOCUMENT: usize = 1 << 20;
 
@@ -1135,7 +1139,7 @@ fn assemble(
     let mut total: u64 = 0;
     // The parts' checksums in the upload's algorithm, which every part of it has.
     let mut part_checksums = asked.map(|_| Vec::with_capacity(parts.len()));
-    for ((n, etag), sent) in parts.iter().zip(sent) {
+    for (i, ((n, etag), sent)) in parts.iter().zip(sent).enumerate() {
         let Some(part) = read_record::<Part>(&record_path(&up.dir, *n)) else {
             return Ok(Err(invalid_part(n, etag)));
         };
@@ -1152,6 +1156,13 @@ fn assemble(
         if let Err(why) = checked {
             return Ok(Err(why));
         }
+        if part.size < MIN_PART && i.saturating_add(1) < parts.len() {
+            return Ok(Err(Refusal::new(Code::EntityTooSmall)
+                .with("ProposedSize", part.size.to_string())
+                .with("MinSizeAllowed", MIN_PART.to_string())
+                .with("PartNumber", n.to_string())
+                .with("ETag", etag)));
+        }
         let own = asked.and_then(|a| {
             let (algorithm, value) = part.checksum.as_deref()?.split_once(':')?;
             (algorithm == a.algorithm).then(|| value.to_string())
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index 4eafc88b..b665c99f 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -22,6 +22,9 @@ use vk_registry::{Authenticator, ServerConfig, ServerState, Store};
 const AUD: &str = "9c2f4e1a7b3d5e60f1a2b3c4d5e6f708";
 const UNSIGNED: &str = "UNSIGNED-PAYLOAD";
 
+/// The fewest bytes S3 takes in a part that is not an upload's last.
+const MIN_PART: usize = 5 << 20;
+
 fn tmp(tag: &str) -> std::path::PathBuf {
     let p = std::env::temp_dir().join(format!(
         "vk-registry-s3-e2e-{tag}-{}-{:?}",
@@ -1609,7 +1612,9 @@ async fn an_object_made_of_parts_is_read_a_part_at_a_time() {
     let sign = |r: Req| r;
     let path = "/s3/b/parts";
     let id = create_upload(&host, &sign, path).await;
-    let parts: Vec<Vec<u8>> = vec![bytes_of_len(70_000), bytes_of_len(500), b"end".to_vec()];
+    // Every part but the last holds S3's minimum at least.
+    let (a, b) = (MIN_PART + 70_000, MIN_PART + 500);
+    let parts: Vec<Vec<u8>> = vec![bytes_of_len(a), bytes_of_len(b), b"end".to_vec()];
     let mut etags = Vec::new();
     for (i, data) in parts.iter().enumerate() {
         etags.push(upload_part(&host, &sign, path, &id, i as u32 + 1, data).await);
@@ -1679,7 +1684,7 @@ async fn an_object_made_of_parts_is_read_a_part_at_a_time() {
     is_object(&send(&host, Req::new("GET", path)).await, &whole);
     let resp = send(
         &host,
-        Req::new("GET", path).header("Range", "bytes=70000-70499"),
+        Req::new("GET", path).header("Range", &format!("bytes={a}-{}", a + b - 1)),
     )
     .await;
     resp.ok(206);
@@ -1696,12 +1701,14 @@ async fn an_object_made_of_parts_is_read_a_part_at_a_time() {
     resp.ok(200);
     assert_eq!(
         element(&resp.body, "ObjectParts"),
-        "<IsTruncated>false</IsTruncated><MaxParts>1000</MaxParts><PartNumberMarker>0\
-         </PartNumberMarker><Part><PartNumber>1</PartNumber><Size>70000</Size></Part><Part>\
-         <PartNumber>2</PartNumber><Size>500</Size></Part><Part><PartNumber>3</PartNumber>\
-         <Size>3</Size></Part><PartsCount>3</PartsCount>"
+        format!(
+            "<IsTruncated>false</IsTruncated><MaxParts>1000</MaxParts><PartNumberMarker>0\
+             </PartNumberMarker><Part><PartNumber>1</PartNumber><Size>{a}</Size></Part><Part>\
+             <PartNumber>2</PartNumber><Size>{b}</Size></Part><Part><PartNumber>3</PartNumber>\
+             <Size>3</Size></Part><PartsCount>3</PartsCount>"
+        )
     );
-    assert_eq!(element(&resp.body, "ObjectSize"), "70503");
+    assert_eq!(element(&resp.body, "ObjectSize"), (a + b + 3).to_string());
     let resp = send(
         &host,
         attrs("ObjectParts")
@@ -1840,7 +1847,7 @@ async fn the_checksum_a_write_carried_is_kept_with_the_object() {
     let sign = |r: Req| r;
     let path = "/s3/b/parts";
     let id = create_upload(&host, &sign, path).await;
-    let (one, two) = (bytes_of_len(70_000), bytes_of_len(500));
+    let (one, two) = (bytes_of_len(MIN_PART), bytes_of_len(500));
     let e1 = upload_part(&host, &sign, path, &id, 1, &one).await;
     let e2 = upload_part(&host, &sign, path, &id, 2, &two).await;
     let whole = [one.as_slice(), &two].concat();
@@ -4906,7 +4913,7 @@ async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
         }
         req.body(data.to_vec())
     };
-    let (one, two) = (bytes_of_len(1000), bytes_of_len(300));
+    let (one, two) = (bytes_of_len(MIN_PART), bytes_of_len(300));
     let (sha1, sha2) = (
         b64(&sha2::Sha256::digest(&one)),
         b64(&sha2::Sha256::digest(&two)),
@@ -5106,7 +5113,7 @@ async fn an_upload_holds_its_parts_to_the_checksum_it_was_created_with() {
         elements(&resp.body, "Part"),
         [
             format!(
-                "<ChecksumSHA256>{sha1}</ChecksumSHA256><PartNumber>1</PartNumber><Size>1000</Size>"
+                "<ChecksumSHA256>{sha1}</ChecksumSHA256><PartNumber>1</PartNumber><Size>{MIN_PART}</Size>"
             ),
             format!(
                 "<ChecksumSHA256>{sha2}</ChecksumSHA256><PartNumber>2</PartNumber><Size>300</Size>"
@@ -5382,6 +5389,18 @@ async fn a_multipart_upload_is_assembled_from_its_parts() {
         let resp = send(&host, sign(complete(path, &id, &parts))).await;
         resp.is(status, code);
     }
+    // Every part but the last holds S3's minimum: part 3 cannot come before another.
+    let e4 = upload_part(&host, &sign, path, &id, 4, b"tail").await;
+    let resp = send(
+        &host,
+        sign(complete(path, &id, &[(1, e1), (3, e3), (4, &e4)])),
+    )
+    .await;
+    resp.is(400, "EntityTooSmall")
+        .says("Your proposed upload is smaller than the minimum allowed size");
+    assert_eq!(element(&resp.body, "PartNumber"), "3");
+    assert_eq!(element(&resp.body, "ProposedSize"), three.len().to_string());
+    assert_eq!(element(&resp.body, "MinSizeAllowed"), MIN_PART.to_string());
     let resp = send(
         &host,
         sign(complete(path, &id, &[(1, e1), (2, e2), (3, e3)])),
@@ -5591,7 +5610,7 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
     send(&host, sign(req)).await.is(409, "OperationAborted");
 
     // Parts copied from an object: whole, then a range of it.
-    let src = bytes_of_len(70_000);
+    let src = bytes_of_len(MIN_PART);
     send(&host, sign(Req::new("PUT", "/s3/b/src").body(src.clone())))
         .await
         .ok(200);
@@ -5615,11 +5634,14 @@ async fn multipart_uploads_are_aborted_copied_bounded_and_swept() {
     resp.ok(200);
     let e2 = element(&resp.body, "ETag").replace("&quot;", "\"");
     assert_eq!(e2, format!("\"{}\"", md5_hex(&src[100..1100])));
-    let past = copy(3).header("x-amz-copy-source-range", "bytes=69000-70000");
+    let past = format!("bytes={}-{MIN_PART}", MIN_PART - 1000);
+    let past = copy(3).header("x-amz-copy-source-range", &past);
     send(&host, sign(past))
         .await
         .is(400, "InvalidArgument")
-        .says("Range specified is not valid for source object of size: 70000");
+        .says(&format!(
+            "Range specified is not valid for source object of size: {MIN_PART}"
+        ));
     let backwards = copy(3).header("x-amz-copy-source-range", "bytes=5-2");
     send(&host, sign(backwards))
         .await

From 220e4d42d41b9a9d63c2adad9107241e382575e5 Mon Sep 17 00:00:00 2001
From: Antoine Bernardeau <abernardeau@wallix.com>
Date: Fri, 6 Nov 2026 15:34:29 +0100
Subject: [PATCH 54/54] vk-registry/s3: refuse a request no operation takes
 before its credential

As S3 routes a request before it authenticates it, query parameters
that conflict or do not go with the method or resource, and a copy
source where nothing is copied, are refused before the credential is
looked at, in S3's words: 400 InvalidArgument (uploads with uploadId, a
misplaced x-amz-copy-source, partNumber without uploadId) or
InvalidRequest (?uploads or ?versions on a key), and 405
MethodNotAllowed naming the method and resource type, with Allow, for a
POST of the service or of a bare object, a PUT naming an upload but no
part, and ?torrent. They were 403 to an unsigned request.
---
 vk-registry/DESIGN.md       |  11 ++-
 vk-registry/src/s3/error.rs |   6 ++
 vk-registry/src/s3/mod.rs   |  84 +++++++++++++++++++++-
 vk-registry/tests/s3_e2e.rs | 138 +++++++++++++++++++++++++++++++++++-
 4 files changed, 234 insertions(+), 5 deletions(-)

diff --git a/vk-registry/DESIGN.md b/vk-registry/DESIGN.md
index 88272b07..4484ffd9 100644
--- a/vk-registry/DESIGN.md
+++ b/vk-registry/DESIGN.md
@@ -641,7 +641,14 @@ cannot smuggle a separator. A path S3 could not parse at all is 400 `InvalidURI`
 before the credential is looked at, as S3 parses the URI first: a malformed percent escape, a
 component that is not UTF-8 once decoded or holds a control character (`\u{8a}`), or `..` components climbing above the root (the
 one below `/s3` path-style, the host's virtual-hosted), `\` separating them as `/` does. A
-`..` that stays below the root is a key component. Anything else is 400 `InvalidArgument`,
+`..` that stays below the root is a key component. A request S3 cannot route to any operation is
+refused before the credential too, as S3 routes it first: `uploads` beside `uploadId` (400
+`InvalidArgument`), `x-amz-copy-source` on a GET, HEAD, DELETE or a POST naming an upload (400
+`InvalidArgument`), `partNumber` without `uploadId` on an object's PUT (400 `InvalidArgument`),
+`?uploads` or `?versions` on an object's GET (400 `InvalidRequest`), and 405
+`MethodNotAllowed`, naming the `Method` and the `ResourceType` and with the methods taken in
+`Allow`, for a POST of the service or of an object with no operation named, an object's PUT
+naming an upload but no part, and `?torrent` on an object. Anything else is 400 `InvalidArgument`,
 `KeyTooLongError` (with the `Size` and the `MaxSizeAllowed`, 1024 for the key, 255 for a
 component) or `InvalidBucketName`, an `InvalidArgument` with a message naming the rule; a key
 of slashes only is 400 `BadRequest`. Such a key holds no object, so a read of it (GET, HEAD,
@@ -735,7 +742,7 @@ reads; a replaced object keeps only what its own write sent.
 | `POST /s3/<b>/<k>?uploadId=<id>` CompleteMultipartUpload | 200 `CompleteMultipartUploadResult` (`Location`, the object's absolute URL as S3 gives it, from the listener's scheme, the `Host` and the path as sent; `Bucket`, `Key`, `ETag`): the parts the `CompleteMultipartUpload` document names, concatenated in that order into one staging file in a single pass off the runtime, then tagged as a PutObject's body is (the key checked again, `If-None-Match: *`/`If-Match` where the tag is written, stored plain from 8 MiB), with the metadata recorded at creation; the upload then goes, leaving the record of what it made (below). An upload that is not there is 404 `NoSuchUpload` before the document is read. The numbers must ascend (400 `InvalidPartOrder`) from 1 (400 `InvalidArgument` below), each part must be there with the ETag given (400 `InvalidPart`; each part's MD5 is checked again as it is read), at least one part (400 `MalformedXML`), each but the last at least 5 MiB, S3's minimum (400 `EntityTooSmall`, naming the part, its ETag, its `ProposedSize` and the `MinSizeAllowed`), and the total at most 4 GiB (400 `EntityTooLarge`). Each `Part` names at most one checksum (`ChecksumCRC32`…), in base64 of its algorithm's length (400 `InvalidArgument`, naming them), none for a part recorded without one and that one for a part recorded with one (400 `InvalidPart`; 400 `BadDigest` for one in another algorithm), and one for every part of an upload created with a checksum (400 `InvalidRequest`). The completion's `x-amz-checksum-type` is the upload's (400 `InvalidRequest`, also for a type S3 does not have). One final `x-amz-checksum-*` at most (400 `InvalidRequest`), a whole object's (base64 of the algorithm's length) or a composite one (`…-<parts>`, not for CRC64NVME), else 400 `InvalidRequest`, as is an algorithm S3 does not have. An upload created with a `FULL_OBJECT` checksum has it computed as the parts are assembled, checked against a final header in its algorithm (400 `BadDigest`; one in another algorithm is passed over, as S3 does) and kept as a PutObject's is; an upload created with none gets S3's default, a CRC64NVME of the whole object computed the same way, and any final checksum it is sent is passed over (S3, by versitygw's tests, ignores it); either is named in the result with its `ChecksumType`. An upload created with a `COMPOSITE` checksum gets S3's composite one, its algorithm's checksum of the parts' checksums concatenated in the order named, in base64 then `-<parts>`, checked against a final header in its algorithm with or without its count (400 `BadDigest`), kept (`<ALGORITHM>:<base64>-<parts>`) and answered with `ChecksumType` `COMPOSITE` in the result, on reads, listings and GetObjectAttributes; a composite final header is passed over for an upload created without a checksum. The parts' sizes are kept with the object, for a read of one part and `ObjectParts`, and for an upload created with a checksum the parts' checksums too (`org.virtkit.s3-part-checksums`, base64 joined by commas). Every refusal is a real status, never S3's late `200` carrying an `Error`, and leaves the upload to be completed again. A completion or an abort of an upload waits for one already under way, then finds the upload as that one left it, never a part going from under it. A completed upload is remembered until a `gc` finds it idle past the grace window (a day by default) from its completion: the same completion sent again — the same parts with the same ETags, as an SDK retries one whose answer it lost, or as several are sent at once — is 200 with the same `CompleteMultipartUploadResult` while the key still holds the object it made (the same bytes under the same ETag), its conditions and checksum headers not checked again, since that object is what they asked for. Another list of parts, or an object written over or deleted since, is 404 `NoSuchUpload`, as is an abort, a part or a ListParts of a completed upload. AWS's reference says only that `NoSuchUpload` may mean the upload was completed and that a failed completion should be retried; the 200 on a repeat and the 404 for other parts or another object are what S3 answers by versitygw's and ceph's tests |
 | `DELETE /s3/<b>/<k>?uploadId=<id>` AbortMultipartUpload | 204: the upload and its parts removed; 404 `NoSuchUpload`. With `x-amz-if-match-initiated-time` (an HTTP date), only an upload initiated in that second is removed: 412 `PreconditionFailed` for another, 400 `InvalidArgument` for a value that is not a date; a time still to come is no condition, as S3 (by versitygw's tests) takes it. A missing upload stays 404 with the header too, where S3's reference says 204 for directory buckets |
 | `GET /s3/<b>/<k>?uploadId=<id>` ListParts | 200 `ListPartsResult`: the parts in ascending order after `part-number-marker`, `max-parts` of them (at most and by default 1000), each with `PartNumber`, `LastModified`, `ETag`, `Size` and the checksum it was recorded with (`ChecksumCRC32`…), and the upload's `ChecksumAlgorithm` and `ChecksumType` when it was created with one, `IsTruncated` and `NextPartNumberMarker`; needs `Read` on the key's parent; 404 `NoSuchUpload`. A count that is no number is 400 `InvalidArgument` first, a negative one after the upload is found, as S3 orders them |
-| `GET /s3/<b>?uploads` ListMultipartUploads | 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass`, `Initiated`, and its `ChecksumAlgorithm` and `ChecksumType` when it was created with one. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
+| `GET /s3/<b>?uploads` ListMultipartUploads | (`uploadId` beside it is 400 `InvalidArgument`) 200 `ListMultipartUploadsResult`: the bucket's uploads in progress whose key starts with `prefix`, by key then, as S3 lists a key's uploads, in the order they were initiated, after `key-marker`, `max-uploads` of them (at most and by default 1000), each with `Key`, `UploadId`, `Initiator`, `Owner`, `StorageClass`, `Initiated`, and its `ChecksumAlgorithm` and `ChecksumType` when it was created with one. With `upload-id-marker` too, the page starts after that upload, which has to be one of the first key from `key-marker` on (that key's own when it has uploads), else 400 `InvalidArgument`, as S3 takes it; without `key-marker` it is ignored and echoed empty. `NextKeyMarker` and `NextUploadIdMarker` name the page's last upload, truncated or not, and `Prefix` is echoed only when sent; admitted as a listing of the bucket with that prefix is, showing only the uploads whose key the caller may read; `encoding-type=url` honoured, `delimiter` 501 `NotImplemented`; a `prefix` or marker holding a control character, or past 1024 bytes, is 400 `InvalidArgument`, as a bucket listing's; 404 `NoSuchBucket` |
 | anything else | 501 `NotImplemented`: writes of tagging, ACLs, versioning and the other configurations, `partNumber` on a read, every other subresource, and a parameter an operation does not take, once the bucket and, for an object's, the object are found there (404 `NoSuchBucket`, `NoSuchKey`), as S3 looks them up first; an SDK's `x-id` operation hint is ignored |
 
 **XML in** (`Delete`, `CreateBucketConfiguration`, `CompleteMultipartUpload`) is read by an
diff --git a/vk-registry/src/s3/error.rs b/vk-registry/src/s3/error.rs
index fcc55b26..46f99cfd 100644
--- a/vk-registry/src/s3/error.rs
+++ b/vk-registry/src/s3/error.rs
@@ -44,6 +44,7 @@ pub(crate) enum Code {
     MalformedTrailerError,
     MalformedXML,
     MetadataTooLarge,
+    MethodNotAllowed,
     MissingContentLength,
     NoSuchBucket,
     NoSuchBucketPolicy,
@@ -202,6 +203,11 @@ impl Code {
                 BAD,
                 "Your metadata headers exceed the maximum allowed metadata size",
             ),
+            MethodNotAllowed => (
+                "MethodNotAllowed",
+                StatusCode::METHOD_NOT_ALLOWED,
+                "The specified method is not allowed against this resource.",
+            ),
             MissingContentLength => (
                 "MissingContentLength",
                 StatusCode::LENGTH_REQUIRED,
diff --git a/vk-registry/src/s3/mod.rs b/vk-registry/src/s3/mod.rs
index faa96644..a0612228 100644
--- a/vk-registry/src/s3/mod.rs
+++ b/vk-registry/src/s3/mod.rs
@@ -123,9 +123,11 @@ pub(crate) async fn route(
         },
     };
     let id = &ctx.id;
-    // S3 parses the URI before it looks at the credential.
+    // S3 parses the URI, and routes the request, before it looks at the credential.
     let served = if unparsable {
         before_auth(req, ctx.error(Code::InvalidURI)).await
+    } else if let Some(resp) = misrouted(&req, &ctx) {
+        before_auth(req, resp).await
     } else {
         serve(state, req, &ctx).await
     };
@@ -465,6 +467,86 @@ async fn operate(
     }
 }
 
+/// The answer to a request S3 cannot route to any operation, which it gives before it looks
+/// at the credential, as it does to a URI it cannot parse: query parameters that conflict or
+/// do not go with the method or the resource, or a copy source on a request that copies
+/// nothing. Those are 400 `InvalidArgument` or `InvalidRequest` in S3's words, or 405
+/// `MethodNotAllowed` naming the method and the kind of resource (with the methods it takes
+/// in `Allow`). `None` for a request that names an operation, served or not.
+fn misrouted(req: &Request<Incoming>, ctx: &Ctx) -> Option<Response<Body>> {
+    let params = parse_query(req.uri().query().unwrap_or(""))?;
+    let has = |name: &str| params.iter().any(|(n, _)| n == name);
+    let rest = ctx.path.strip_prefix("/s3").unwrap_or(&ctx.path);
+    let rest = rest.strip_prefix('/').unwrap_or(rest);
+    let (service, object) = match rest.split_once('/') {
+        _ if rest.is_empty() => (true, false),
+        Some((_, key)) => (false, !key.is_empty()),
+        None => (false, false),
+    };
+    let method = req.method();
+    let not_allowed = |resource: &str, allowed: &'static str| {
+        let mut resp = ctx.error(
+            Refusal::new(Code::MethodNotAllowed)
+                .with("Method", method.as_str())
+                .with("ResourceType", resource),
+        );
+        if !allowed.is_empty() {
+            resp.headers_mut()
+                .insert(hyper::header::ALLOW, HeaderValue::from_static(allowed));
+        }
+        Some(resp)
+    };
+    let invalid = |message| Some(ctx.error(Refusal::said(Code::InvalidRequest, message)));
+    if service {
+        return match *method {
+            Method::POST => not_allowed("SERVICE", ""),
+            _ => None,
+        };
+    }
+    if has("uploads") && has("uploadId") {
+        return Some(ctx.error(Refusal::argument(
+            "Conflicting query string parameters: uploadId, uploads",
+            "ResourceType",
+            "uploadId",
+        )));
+    }
+    if let Some(source) = req.headers().get(copy::COPY_SOURCE)
+        && (matches!(*method, Method::GET | Method::HEAD | Method::DELETE)
+            || (method == Method::POST && has("uploadId")))
+    {
+        return Some(ctx.error(Refusal::argument(
+            "You can only specify a copy source header for copy requests.",
+            copy::COPY_SOURCE,
+            String::from_utf8_lossy(source.as_bytes()),
+        )));
+    }
+    if !object {
+        return None;
+    }
+    match *method {
+        _ if has("torrent") => match *method {
+            Method::GET => not_allowed("TORRENT", ""),
+            _ => not_allowed("TORRENT", "GET"),
+        },
+        Method::GET if has("uploads") => {
+            invalid("Key is not expected for the GET method ?uploads subresource")
+        }
+        Method::GET if has("versions") => {
+            invalid("There is no such thing as the ?versions sub-resource for a key")
+        }
+        Method::PUT if has("partNumber") && !has("uploadId") => Some(ctx.error(Refusal::argument(
+            "This operation does not accept partNumber without uploadId",
+            "partNumber",
+            "partNumber",
+        ))),
+        Method::PUT if has("uploadId") && !has("partNumber") => {
+            not_allowed("UPLOAD", "DELETE, POST, GET")
+        }
+        Method::POST if params.iter().all(implicit) => not_allowed("SERVICE", ""),
+        _ => None,
+    }
+}
+
 /// Whether the `Authorization` header is SigV4's: `false` for none (the session cookie may
 /// stand in) or one of the schemes the other routes take, Basic and Bearer, which
 /// [`presented`] resolves; refused otherwise, as S3 refuses it: a value with no scheme or of
diff --git a/vk-registry/tests/s3_e2e.rs b/vk-registry/tests/s3_e2e.rs
index b665c99f..584afa9a 100644
--- a/vk-registry/tests/s3_e2e.rs
+++ b/vk-registry/tests/s3_e2e.rs
@@ -1146,8 +1146,14 @@ async fn a_read_only_registry_refuses_writes_with_retry_after() {
     let state = open_state(&dir, true);
     state.store.set_read_only(true);
     let host = spawn(state);
-    for method in ["PUT", "DELETE", "POST"] {
-        let resp = send(&host, Req::new(method, "/s3/b/k").body(b"x".to_vec())).await;
+    for (method, query) in [("PUT", ""), ("DELETE", ""), ("POST", "uploads")] {
+        let req = Req::new(method, "/s3/b/k").body(b"x".to_vec());
+        let req = if query.is_empty() {
+            req
+        } else {
+            req.query(query)
+        };
+        let resp = send(&host, req).await;
         resp.is(503, "ServiceUnavailable");
         assert_eq!(resp.header("retry-after"), Some("60"));
     }
@@ -2768,6 +2774,130 @@ async fn attributes_deletes_and_the_paths_a_key_cannot_take() {
 }
 
 /// A path S3 cannot parse — a malformed escape, or `..` climbing above the root — is 400
+/// A request S3 cannot route to an operation is refused before the credential is looked at,
+/// as an unparsable URI is: conflicting or misplaced query parameters and a copy source where
+/// nothing is copied are 400, a method the resource does not take 405 naming both.
+#[tokio::test]
+async fn a_request_no_operation_takes_is_refused_before_its_credential() {
+    let (_dir, host) = bearer_server("misrouted");
+    let unsigned = |method: &'static str, path: &str, query: &str| {
+        let req = Req::new(method, path);
+        if query.is_empty() {
+            req
+        } else {
+            req.query(query)
+        }
+    };
+    for (method, path, query, status, code, message) in [
+        (
+            "PUT",
+            "/s3/b/k",
+            "partNumber=1",
+            400,
+            "InvalidArgument",
+            "This operation does not accept partNumber without uploadId",
+        ),
+        (
+            "GET",
+            "/s3/b/k",
+            "uploads",
+            400,
+            "InvalidRequest",
+            "Key is not expected for the GET method ?uploads subresource",
+        ),
+        (
+            "GET",
+            "/s3/b/k",
+            "versions",
+            400,
+            "InvalidRequest",
+            "There is no such thing as the ?versions sub-resource for a key",
+        ),
+        (
+            "DELETE",
+            "/s3/b",
+            "uploads&uploadId=x",
+            400,
+            "InvalidArgument",
+            "Conflicting query string parameters: uploadId, uploads",
+        ),
+        (
+            "PUT",
+            "/s3/b/k",
+            "uploads&uploadId=x",
+            400,
+            "InvalidArgument",
+            "Conflicting query string parameters: uploadId, uploads",
+        ),
+        (
+            "POST",
+            "/s3/",
+            "",
+            405,
+            "MethodNotAllowed",
+            "The specified method is not allowed against this resource.",
+        ),
+        (
+            "POST",
+            "/s3/b/k",
+            "",
+            405,
+            "MethodNotAllowed",
+            "The specified method is not allowed against this resource.",
+        ),
+        (
+            "PUT",
+            "/s3/b/k",
+            "uploadId=x",
+            405,
+            "MethodNotAllowed",
+            "The specified method is not allowed against this resource.",
+        ),
+        (
+            "GET",
+            "/s3/b/k",
+            "torrent",
+            405,
+            "MethodNotAllowed",
+            "The specified method is not allowed against this resource.",
+        ),
+    ] {
+        let resp = send(&host, unsigned(method, path, query)).await;
+        resp.is(status, code).says(message);
+    }
+    let resp = send(&host, unsigned("PUT", "/s3/b/k", "uploadId=x")).await;
+    assert_eq!(element(&resp.body, "ResourceType"), "UPLOAD");
+    assert_eq!(element(&resp.body, "Method"), "PUT");
+    assert_eq!(resp.header("allow"), Some("DELETE, POST, GET"));
+    let resp = send(&host, unsigned("DELETE", "/s3/b/k", "torrent")).await;
+    assert_eq!(element(&resp.body, "ResourceType"), "TORRENT");
+    assert_eq!(resp.header("allow"), Some("GET"));
+    assert_eq!(
+        send(&host, unsigned("HEAD", "/s3/b/k", "torrent"))
+            .await
+            .status,
+        405
+    );
+    for (method, path, query) in [
+        ("GET", "/s3/b", ""),
+        ("DELETE", "/s3/b/k", ""),
+        ("POST", "/s3/b/k", "uploadId=x"),
+    ] {
+        let req = unsigned(method, path, query).header("x-amz-copy-source", "b/k");
+        let resp = send(&host, req).await;
+        resp.is(400, "InvalidArgument")
+            .says("You can only specify a copy source header for copy requests.");
+        assert_eq!(element(&resp.body, "ArgumentValue"), "b/k");
+    }
+    // Any other request is the gate's to refuse.
+    send(&host, unsigned("GET", "/s3/b/k", ""))
+        .await
+        .is(403, "AccessDenied");
+    send(&host, unsigned("POST", "/s3/b/k", "uploads"))
+        .await
+        .is(403, "AccessDenied");
+}
+
 /// `InvalidURI` before the credential is looked at, path-style or virtual-hosted; a `..`
 /// that stays below the root is a key's component, refused as one. Other routes keep their
 /// own answers.
@@ -3072,6 +3202,10 @@ async fn query_names_are_decoded_before_dispatch() {
     .await
     .is(400, "InvalidArgument")
     .says("Provided x not an integer or within integer range");
+    send(&host, Req::new("GET", "/s3/b").query("uploads&uploadId=x"))
+        .await
+        .is(400, "InvalidArgument")
+        .says("Conflicting query string parameters: uploadId, uploads");
     let resp = send(&host, Req::new("GET", "/s3/b").query("upload%73")).await;
     resp.ok(200);
     assert!(