cvmfs-rust

A pure Rust implementation of the CernVM-FS client. Mount remote CVMFS repositories as local filesystems via FUSE, with full content verification and transparent decompression.

Why Rust?

The original CernVM-FS client is written in C++. This project rewrites the client in Rust to get:

• Memory safety without garbage collection
• Fearless concurrency for multi-threaded FUSE operations
• Modern tooling: cargo, clippy, built-in testing, dependency management
• Smaller binary: single static binary, no shared library dependencies beyond FUSE

Features

• FUSE filesystem mounting via fuse_mt (multi-threaded)
• Transparent decompression (zlib, LZ4, Zstd) of content-addressed objects
• RSA-PKCS1v15 signature verification of repository manifests
• Whitelist validation (repository name matching + expiry checks)
• SQLite catalog traversal with nested catalog support
• Multiple hash algorithms: SHA-1, RIPEMD-160, SHA-256, SHAKE-128
• Full directory entry metadata: uid/gid, hardlinks, xattr, special file types
• Chunked file reassembly for large files
• External data file support (content stored outside CAS)
• Local object caching with TTL-based invalidation and negative caching
• Reflog support for tracking historical root catalog hashes
• HTTP/HTTPS retrieval from Stratum-1 replica servers
• Mirror failover with automatic retry across multiple sources
• Geolocation-based server selection via CVMFS geo API
• DNS-based repository server discovery via TXT records

Quick Start

Prerequisites

• Rust (stable)
• FUSE 3 libraries:
  • macOS: macFUSE (brew install --cask macfuse)
  • Linux: sudo apt install libfuse3-dev (Debian/Ubuntu) or sudo dnf install fuse3-devel (Fedora)

Build

git clone https://github.com/moliholy/cvmfs-rust.git
cd cvmfs-rust
cargo build --release

Mount a Repository

mkdir -p /tmp/cvmfs_mount
./target/release/cvmfs-cli http://cvmfs-stratum-one.cern.ch/opt/boss /tmp/cvmfs_mount

Then browse /tmp/cvmfs_mount like any local directory. Unmount with:

# macOS
umount /tmp/cvmfs_mount

# Linux
fusermount -u /tmp/cvmfs_mount

CLI Reference

cvmfs-cli <repository_url> <mount_point> [cache_directory]

Logging

RUST_LOG=info cvmfs-cli http://cvmfs-stratum-one.cern.ch/opt/boss /tmp/cvmfs_mount

Library Usage

cvmfs-rust exposes a library crate for programmatic access:

use cvmfs::{fetcher::Fetcher, repository::Repository};

let fetcher = Fetcher::new("http://cvmfs-stratum-one.cern.ch/opt/boss", "/tmp/cache", true) ?;
let mut repo = Repository::new(fetcher) ?;

// List root directory
for entry in repo.list_directory("/") ? {
println ! ("{} ({})", entry.name, if entry.is_directory() { "dir" } else { "file" });
}

// Read a file
let mut file = repo.get_file("/testfile") ?;
let mut contents = String::new();
file.read_to_string( & mut contents) ?;

Mirror failover

use cvmfs::fetcher::Fetcher;

let fetcher = Fetcher::with_mirrors(
& ["http://primary.cern.ch/opt/boss", "http://mirror1.cern.ch/opt/boss"],
"/tmp/cache",
true,
) ?;

DNS-based discovery

use cvmfs::dns::discover_servers;

let servers = discover_servers("boss.cern.ch") ?;

Benchmarks

Both implementations mounted via FUSE, benchmarked with hyperfine (100 runs, 10 warmup). Rust cvmfs-cli v0.2.0, C++ cvmfs2 v2.11.5. Repository: boss.cern.ch.

Result: Rust wins 15/23 benchmarks.

Metadata operations

Directory listing

File reads

Recursive traversal

Large file I/O (10 runs, 2 warmup)

make bench    # run benchmarks (requires sudo, cvmfs2, hyperfine)

Development

make test           # run all tests (uses cargo-nextest)
make lint           # clippy with -D warnings
make fmt            # format with nightly rustfmt
make coverage       # generate coverage report
make bench          # benchmark Rust vs C++ cvmfs2 (requires sudo)

License

BSD 3-Clause. See LICENSE.

Acknowledgments

• CernVM-FS (the original C++ implementation)
• CERN for maintaining public Stratum-1 servers