oxistore-blob-s3 — S3-compatible BlobStore backend (Pure Rust)

oxistore-blob-s3 implements the oxistore-blob::BlobStore trait against any S3-compatible endpoint — AWS S3, MinIO, Ceph RGW, DigitalOcean Spaces, and similar. Once constructed, an S3BlobStore is a drop-in BlobStore, so it inherits all the trait's default helpers (CAS, copy/rename, prefix delete, paginated metadata listing) for free.

The backend is Pure Rust and ring-free. Requests are signed with AWS Signature Version 4 using the aws-sigv4 crate's pure signing closure (no AWS C SDK, no ring, no aws-lc-rs on normal dependency edges — verified 2026-05-27). HTTP transport runs over oxihttp-client (a hyper-based client with connection pooling and Pure-Rust TLS), so a single client instance handles both http:// (MinIO / mocks) and https:// (real AWS) endpoints. XML responses are parsed with quick-xml. The crate forbids unsafe code.

Installation

[dependencies]
oxistore-blob-s3 = "0.1.0"
oxistore-blob = "0.1.0"  # for the BlobStore trait + BlobError

This crate has no Cargo features; all functionality is always available.

Quick Start

use oxistore_blob_s3::{S3BlobStore, S3BlobStoreBuilder, S3Credentials};
use oxistore_blob::BlobStore;
use bytes::Bytes;

# async fn example() -> Result<(), oxistore_blob::BlobError> {
let store = S3BlobStoreBuilder::new()
    .endpoint("http://localhost:9000")   // MinIO; or https://s3.us-east-1.amazonaws.com
    .region("us-east-1")
    .bucket("mybucket")
    .credentials(S3Credentials::from_env()?)
    .path_style(true)                    // path-style for MinIO; false for AWS virtual-host
    .build()?;

store.put("readme.txt", Bytes::from("hello S3")).await?;
let data = store.get("readme.txt").await?;
assert_eq!(data.as_ref(), b"hello S3");
# Ok(())
# }

Presigned URLs

Generated offline (no HTTP round-trip); anyone with the URL can perform the operation without AWS credentials.

# use oxistore_blob_s3::S3BlobStore;
# use std::time::Duration;
# fn example(store: &S3BlobStore) -> Result<(), oxistore_blob::BlobError> {
let get_url = store.presign_get("report.pdf", Duration::from_secs(3600))?;
let put_url = store.presign_put("upload.bin", Duration::from_secs(900), Some("application/octet-stream"))?;
# Ok(())
# }

Multipart upload

# use oxistore_blob_s3::S3BlobStore;
# use bytes::Bytes;
# async fn example(store: S3BlobStore) -> Result<(), oxistore_blob::BlobError> {
let mut up = store.create_multipart_upload("big-file.bin").await?;
up.upload_part(1, Bytes::from(vec![0u8; 5 * 1024 * 1024])).await?; // >= 5 MiB except last
up.upload_part(2, Bytes::from(vec![1u8; 1024])).await?;
up.complete().await?; // parts are sorted by number automatically
# Ok(())
# }

API Overview

S3BlobStore

S3-compatible blob store implementing BlobStore. Clone; implements Debug (credentials redacted). Created via S3BlobStoreBuilder.

S3MultipartUpload<'a>

Handle for an in-progress multipart upload.

S3Credentials

AWS credentials for SigV4 signing. Clone; implements Debug with the secret key and session token redacted.

S3Config

Full configuration (Debug, Clone).

S3BlobStoreBuilder

Default. Builder for S3Config and the resulting store.

RetryConfig (retry module)

Debug, Clone, PartialEq, Eq, Default (3 attempts, 100 ms base, 5000 ms cap). Truncated binary exponential backoff with deterministic per-attempt variance; HTTP 429/503 and transport errors are retried.

Error handling (error module)

Errors are surfaced as oxistore_blob::BlobError; transport/HTTP failures that exhaust retries become BlobError::RetryExhausted.

SigV4 signing (sigv4 module)

Feature Flags

This crate defines no Cargo features.

Cross-references

• oxistore-blob — the BlobStore trait, BlobMeta, Digest, and BlobError this crate builds on.
• oxistore-blob-gcs / oxistore-blob-azure — sibling cloud backends for Google Cloud Storage and Azure Blob Storage.
• oxistore-core / oxistore — the trait crate and top-level facade.

License

Apache-2.0 — COOLJAPAN OU (Team Kitasan)