Rclone 1.74.2

FractalOps pins the official rclone/rclone:1.74.2 image at multi-platform digest sha256:9ce0d49b611d3781233e25334e9e23d7af01e5546da7087f90d55f034ef13637. Investigation date: 2026-07-16.

Supported Path

A manual, immutable Assembly Job runs rclone check --download from the legacy SeaweedFS S3 endpoint to the PVC-backed endpoint. Rclone streams both objects and compares their bytes without writing either remote.
The Job checks that every object in each of the five legacy buckets exists byte-identically in the durable target. Target-only retained backups are allowed because the migration copy is additive. The target-only Supabase Storage bucket must remain empty because no source bucket exists yet.
Both remotes use path-style S3 and the same bucket-scoped identity for each comparison. A proof-only ExternalSecret projects OpenBao references; credentials never enter Git, command arguments, or logs.
Egress is limited to cluster DNS and TCP 8333 on the two SeaweedFS S3 Services. The Job uses two checkers, a 4 MiB buffer, a read-only root filesystem, and no Kubernetes service-account token.

Compatibility and Traps

Plain rclone check may rely on remote hashes. --download is mandatory here because the migration gate must read both payloads end to end.
--one-way is required for the additive migration: it fails any missing or changed source object while preserving target-only retained backups. copy, sync, delete, purge, and cleanup commands are forbidden in this proof composition.
An online pass is not cutover authority. Freeze source writers, let the native copy tail catch up, run strict zero-difference metadata verification, then run a new immutable byte-proof generation before changing consumer endpoints.
S3 multipart staging entries are not completed objects and do not appear in the S3 object comparison. Their bounded metadata treatment remains owned by the separate native SeaweedFS verification gate.
Online generation 001 failed before reading payloads because the legacy auth-disabled SeaweedFS S3 endpoint returned an empty account-owned ListBuckets result even though all five direct bucket paths were readable. Generation 002 therefore removes root enumeration and opens every pinned bucket directly; any missing or unreadable bucket still fails its byte comparison.
Online generation 002 read payloads successfully and found no source object missing from the target. It failed symmetric comparison because the target retained nine Velero objects already expired from the active source. Generation 003 therefore proves the migration’s actual safety invariant: every current source object is byte-identical in the additive target.

Verification

skopeo inspect docker://docker.io/rclone/rclone:1.74.2 --format '{{.Digest}}'
uv run --frozen --group test pytest -q \
  platform/k8s/composition/seaweedfs-durable-byte-verification/seaweedfs_durable_byte_verification_contract_test.py

Authoritative references: rclone v1.74.2 release, rclone check, S3 integrity behavior, and official image tags.