rclone/rclone
"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files
How rclone is put together
Rclone is a Go command-line program ('rsync for cloud storage') that syncs files between local filesystems and 70+ cloud storage providers. Its architecture centers on a core 'fs' package defining filesystem abstractions, configuration, and a registry pattern; each storage provider is implemented as a self-contained backend package under backend/<name> registered into a common interface. A VFS layer presents remotes as mounted filesystems (FUSE/cgofuse), while cmd/ wires providers into cobra CLI commands and librclone exposes the functionality as a C-compatible shared library. Data flows from user commands through the fs abstraction layer to concrete backend implementations over HTTP/SFTP/SMB protocols, with an interactive state-machine-based config system (ConfigIn/ConfigOut) that can be driven via CLI or a JSON RPC ('rc') HTTP API on localhost:5572.
Languages
Frameworks
Infrastructure
Major components
fs (core)
Defines the Fs/Object interfaces, global config options, logging, pacer/retry logic, metadata handling, and the state-machine backend configuration system (ConfigIn/ConfigOut).
backend/* (storage providers)
Implements each cloud/local storage provider (S3, azureblob, b2, drive, ftp, sftp, smb, webdav, crypt, etc.) against the common Fs interface, each registering itself in the backend registry.
vfs
Virtual filesystem layer presenting remotes as mountable filesystems with file/dir handles, caching, write buffering, zip support, and its own rc endpoints.
cmd
Cobra-based CLI command definitions, argument parsing, signal handling, progress display, and optional self-update command.
librclone
Exposes rclone functionality as a C-shared library entry point for embedding in other applications.
fstest
Shared test harness and helpers for exercising all backends uniformly.
rc (remote control API)
JSON-over-HTTP control API (default port 5572) exposing commands like config/create and config/update, callable locally via 'rclone rc --loopback' or remotely against 'rclone rcd'.
bin (build/dev scripts)
Python/Go/shell utilities for docs generation, changelog building, cross-compilation, test certificates, and demonstrating the config API.
A quiet week focused on fixing OneDrive configuration errors and welcoming new contributors.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quiet week focused on fixing OneDrive configuration errors and welcoming new contributors.
Week of 2026-08-17
A large week of housekeeping: the codebase was modernized for Go 1.27 while fixing upload truncation bugs across several backends.
Week of 2026-08-10
Memory leaks were plugged, servers were hardened against leaking resources, and encrypted uploads got more reliable.
Week of 2026-08-03
A broad sweep of reliability fixes ensured incomplete uploads never silently produce corrupt or truncated files, plus faster checksumming.
Week of 2026-07-27
Version 1.75.0 was released with important security fixes, followed by a burst of upload-reliability work starting v1.76.0 development.
Over the past five weeks rclone shipped its v1.75.0 release, which included several security fixes (CVEs and GHSA advisories), then immediately started v1.76.0 development. A major theme has been hardening uploads so that files are never silently truncated or corrupted when a source ends early, with fixes across many cloud backends. Other work included memory-leak fixes for long-running servers, a wave of code modernization to newer Go versions, and performance improvements like parallel checksumming.
Week by week
2026-08-24A quiet week focused on fixing OneDrive configuration errors and welcoming new contributors.latest3 changes
Fix
OneDrive personal accounts no longer blocked
Fixed a 403 Forbidden error that stopped people from configuring personal OneDrive accounts.
Fix
Azure Blob test repaired
Fixed a test that wouldn't compile in the Azure Blob storage backend.
Chore
New contributors credited
Added Sanjay Kanth A, Rahman Yilmaz, and Rohit Behera to the contributors list.
2026-08-17A large week of housekeeping: the codebase was modernized for Go 1.27 while fixing upload truncation bugs across several backends.6 changes
Fix
Truncated uploads fixed on multiple backends
Huawei Drive, Box, and Yandex could report success for files that were cut short mid-upload; all now fail properly instead.
Fix
Dropbox shared-file names decoded correctly
Files received via Dropbox sharing now show their proper names instead of encoded strings.
Fix
VFS cache corruption errors resolved
Fixed spurious cache corruption errors during chunked reads from Azure Blob storage.
Refactor
Codebase modernized for newer Go
Applied dozens of automated updates (like replacing old patterns with modern Go equivalents) as part of upgrading to Go 1.27, making Go 1.26 the minimum required version.
Refactor
Faster local checksummed copies
Local file copies that verify checksums now write in larger blocks, speeding them up.
Docs
Security advisory details added
The changelog now lists the assigned CVE numbers for the v1.75.0 security fixes.
2026-08-10Memory leaks were plugged, servers were hardened against leaking resources, and encrypted uploads got more reliable.6 changes
Fix
Server resource leaks fixed
Both mounted filesystems and served VFS instances could leak when startup failed or things shut down; these leaks are now fixed and covered by tests.
Fix
Encrypted uploads fixed on hash-checking backends
Crypt (encrypted) transfers no longer report hash mismatches on backends that verify upload hashes when data encryption is off.
Feature
Pattern-based transfer ordering
Sync can now order file transfers based on patterns you specify.
Fix
iCloud app-container uploads fixed
Uploading into an iCloud app container no longer fails with a 412 error.
Fix
Sensitive config values redacted in logs
Environment-variable configuration values are now hidden in log output instead of being exposed.
Fix
Go upgraded to patch known vulnerabilities
Updated to Go 1.26.6 and a newer image library to fix multiple published CVEs.
2026-08-03A broad sweep of reliability fixes ensured incomplete uploads never silently produce corrupt or truncated files, plus faster checksumming.6 changes
Refactor
Checksumming now runs in parallel
Verifying file checksums hashes multiple files at once, making it much faster.
Fix
Truncated/corrupt uploads fixed across many backends
Internet Archive, Sia, PikPak, FileLu, Azure Files, compress, and multipart uploads all now fail cleanly if the source ends early, instead of creating broken files.
Fix
Proton Drive retry corruption fixed
Retried Proton Drive uploads no longer produce corrupted files.
Fix
Memory leaks fixed in long-running servers
Statistics tracking and bisync no longer leak memory when running through the remote-control server for long periods.
Fix
S3 serving improvements
The S3 server now cleans up abandoned partial uploads, reserves a temp-file prefix, and no longer crashes when an upload is aborted mid-part.
Fix
Accounting stats groups leak fixed
Long-running remote-control sessions no longer accumulate leaked statistics-group memory.
2026-07-27Version 1.75.0 was released with important security fixes, followed by a burst of upload-reliability work starting v1.76.0 development.6 changes
Fix
Security release v1.75.0 shipped
The release included fixes preventing source filenames escaping the destination directory, backend panics crashing the whole process, plaintext FTP password checks, missing TLS on listeners, and unauthenticated remote listing — each tracked under GHSA/CVE advisories.
Fix
Proton Drive v1.75.0 files made readable again
Files uploaded with the previous release couldn't be opened in Proton's own apps; this is now fixed.
Fix
Dropbox chunked uploads complete reliably
Chunked Dropbox uploads of truncated sources no longer hang forever, and cancelled uploads stop retrying.
Fix
Failed S3 uploads no longer destroy existing objects
An upload failure on the S3 server can no longer delete or corrupt the object already stored at that key.
Fix
Drive metadata fetched faster
Google Drive now fetches file permissions concurrently, speeding up operations.
Fix
Polling shutdown race fixed
VFS background polling is now safely synchronized with shutdown, preventing crashes during unmount.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required