Store: rewrite the ONTAP store as an adapter over S3Store

[LakshmirajSunilSawant]

What and why

Fixes #2779.

ontap_s3_store.rs was a 790-line fork of s3_store.rs that had drifted, and its hand-built checksum header was the bug in #2767. With #2768 merged, it is now a thin adapter like R2Store and OciStore: it builds an SDK client for ONTAP and hands it to S3Store.

The client keeps what is ONTAP-specific: path-style addressing, vserver_name as the signing region, 30s/2min timeouts, the optional root_certificates CA bundle and the default credential chain. ONTAP now gets S3Store's optimized_for, health checks and future fixes. The existence cache now builds its listing client through the adapter, so it honours root_certificates.

Checksums are set to WhenRequired, as in OciStore, so uploads stay plain bodies (no aws-chunked, no checksum header). #2767 suggested "checksums on, chunked off", but the SDK only puts a checksum in a header for in-memory bodies. S3Store streams uploads, so that would need buffering, which is left for a follow-up if ONTAP needs it.

No config fields change. how-to/stores/s3-and-compatible.mdx is updated.

How was this verified?

ontap_s3_store_test.rs is rewritten in the style of oci_store_test.rs, checking the requests on the wire with a StaticReplayClient: path-style URLs, SigV4 scope using the vserver, NotFound mapping, ranged GET, and that single and multipart uploads carry no aws-chunked encoding or checksum headers (the regression guard for #2767). The old tests for retries, expiry and zero digests covered generic behaviour that s3_store_test.rs already tests.

cargo test -p nativelink-store, clippy and rustfmt pass locally, on Linux and on top of current main.

Not verified against a real ONTAP endpoint, which I don't have access to. Bazel and pre-commit are left to CI.

Risk

Medium for existing ONTAP users, since it can't be checked against ONTAP before merge. Differences from the old store:

• No upload checksum header. The old one was malformed, so ONTAP was either rejecting small uploads already or ignoring it.
• max_retry_buffer_per_request defaults to 5MB instead of 20MB, matching S3Store. Single-part uploads are always under 5MB, so no practical effect.
• insecure_allow_http and disable_http2 now apply to ONTAP. Both default to off.
• OntapS3Store::new now returns Arc<S3Store<_>>. The only callers are in this crate.

base64 and sha2 are no longer used by the store library; I left them in Cargo.toml to keep lockfile churn out of this PR.

AI assistance

Claude Code (Opus 5.5) wrote the patch, tests and docs change under my direction. I reviewed the changes, checked the SDK behaviour against the aws-sdk-s3 source, and ran the tests locally.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nativelink	Ready	Preview	Oct 2, 2026 2:10pm UTC
nativelink-aidm	Ready	Preview	Oct 2, 2026 2:10pm UTC

[CLAassistant]

All committers have signed the CLA.

[palfrey]

Not verified against a real ONTAP endpoint, which I don't have access to.

So that's going to be a blocker here. We do need to test any changes for this against a real ONTAP store (or a NetApp-provided simulator), and figuring out access to that has been one of our maintenance problems here.