S3 Explorer v0.3.8

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, Dell ECS, and 17+ other S3-compatible providers.

What's new in v0.3.8

Compatibility release. v0.3.7 was skipped — its work is folded into this version. Three independent improvements ship together: real S3-compat support, a much better network diagnostic, and a more usable browsing UI on long paths.

🪣 Real S3-compat — fix DeleteObjects on Dell ECS, MinIO, Cloudflare R2, Wasabi, Backblaze B2, Tigris…

A user on Dell ECS reported Operation failed: invalid request when deleting a folder with two files. The root cause turned out to be far broader than one provider:

The AWS SDK Rust 1.69+ flipped RequestChecksumCalculation from WhenRequired to WhenSupported, injecting a x-amz-sdk-checksum-algorithm: CRC32 header + x-amz-checksum-crc32 trailer over aws-chunked body encoding on every supporting operation. AWS S3 itself accepts both modes, but most S3-compat servers don't recognise the modern flexible-checksum framework and reject the request — Dell ECS as InvalidRequest, older MinIO as Missing required header: Content-MD5, Cloudflare R2 as NotImplemented: Header x-amz-checksum-crc32, and so on.

v0.3.8 ships a defense-in-depth fix:

• SDK upgrade — aws-sdk-s3 1.17 → 1.132, aws-config 1.1 → 1.8 (5 minors of upstream fixes, plus the future-proofing ChecksumAlgorithm::Md5 enum landing).
• RequestChecksumCalculation::WhenRequired — disables auto CRC32 injection on every operation that doesn't strictly need it (PutObject, ListObjectsV2, GetObject…). Restores the pre-2025 SDK behaviour that S3-compat servers know how to parse.
• New LegacyChecksumStripper interceptor — for the few operations like DeleteObjects whose Smithy trait declares httpChecksumRequired: true and ignore WhenRequired, this Smithy interceptor strips x-amz-checksum-*, x-amz-trailer, and x-amz-sdk-checksum-algorithm headers before transmit. Last line of defense.
• map_s3_error enriched — when an S3-compat server rejects a request, the user now sees the server's actual message (e.g. InvalidRequest: <Dell ECS message exact>) instead of our generic explanation. extract_server_message parses the <Message> field from the SDK's debug repr.

🔍 Network diagnostic — multi-step pipeline

The connectivity test in Settings → Advanced → Network was a single pass-or-fail probe — useful but opaque. v0.3.8 turns it into a full diagnostic pipeline:

Step	What it checks	What it tells you
DNS resolution	Resolves api.lemonsqueezy.com via system + DoH cascade (Cloudflare 1.1.1.1 + Google /resolve)	All IPs returned, suspicious responses (loopback / RFC1918), latency
TCP connect	Opens a socket to each resolved IP	Per-IP connect time, happy-eyeballs IPv4↔IPv6 fallback if one family is broken
TLS handshake	Negotiates TLS through your configured proxy + OS trust store	Certificate chain length, verified subject, cipher suite
API contract	HEAD /v1/licenses/activate	Confirms the endpoint actually responds (catches transparent gateway errors)
Sanity	Response analysis	Detects body redirection / captive portals

Each step shows its outcome (ok / warning / error / skipped), a human message, structured details, and elapsed milliseconds — so when the License tab fails, you can see exactly which layer broke.

Other related fixes:

• DNS multi-IP — resolve_with_fallback now returns Vec<IpAddr> instead of Option<IpAddr>. Some hosts (especially in corporate networks behind /etc/hosts overrides or split-horizon DNS) have multiple A/AAAA records, and we previously dropped all but the first — breaking happy-eyeballs IPv4↔IPv6 fallback.
• Coherent HTTP client — build_http_client_for_host factored so license activation and the diagnostic share the same TLS/proxy/DNS configuration. No more "diagnostic says OK, activation fails".

🧭 Adaptive breadcrumb

The breadcrumb in ObjectBrowser had two failure modes on long paths: it overflowed off the right edge (cutting the current folder, the most important segment), and it hid intermediate segments under ... without a way to read them.

v0.3.8 reworks it as an adaptive component:

• 5-step truncation strategy based on the actual toolbar width (measured via ResizeObserver):
  1. Show all segments full
  2. Collapse middle: [first, "...", last]
  3. Truncate first: [first_t, "...", last]
  4. Drop first entirely: ["...", last]
  5. Last resort: ["...", last_truncated_with_ellipsis]
• The current folder is always visible — truncated mid-name (hhh...hhh) only when the window is genuinely too narrow.
• truncateMiddle(text, max) + truncateEnd(text, max) helpers in formatters.ts.
• The pill is content-sized — when the path is short, the freed space goes to the search bar (which had a needless max-w-md cap, now removed).
• Click-to-edit mode keeps the pill's exact width so the box doesn't shrink/grow when toggling between view and edit.

📂 Indexation behaviour — explicit "no auto-indexing"

Settings → Performance → max indexing requests had a 1-100 range, with no way to disable indexing for very large buckets where the user just wants to navigate. v0.3.8 expands this to 0-5000:

• 0 = no indexing on bucket open at all (counts/sizes display as —, manual Full Index button still works)
• 1-5000 = caps the auto-indexing at that many ListObjectsV2 calls
• The Full Index button uses an internal u32::MAX sentinel to bypass any cap

🪟 UI compaction

• BucketList — bucket creation date moved from the card body into a tooltip on the bucket name. Card padding tightened from p-3 to px-3 py-2. Saves ~16-18 px per card → roughly one extra bucket visible on screen.
• Sidebar footer — Metrics & Settings buttons row padding p-4 → p-2. Footer height 68 px → 52 px (-16 px = ~1 bucket row reclaimed for the list).

🐛 Licensed users no longer see the purchase popup

The NagPopup (5 min timer + click-based trigger that nudges unregistered users to buy a license) was reading the frontend license store at trigger time. The store was only hydrated when the user opened Settings → License — at boot it stayed at 's0' (unregistered), so the popup fired even on machines with a valid licence active in profiles.json.

App.vue now hydrates the store via licenseStore.checkStatus() on mount, before any popup timer can fire. The backend remains the source of truth (license stays validated against Lemon Squeezy, machine-bound, tampering-detected) — we just stopped reading a stale frontend cache.

Internal

• AWS SDK upgrade brings 5 minors of upstream fixes for free (retry logic, IMDS handling, DNS caching).
• New file s3_compat.rs — small, self-contained Smithy interceptor with unit tests.
• s3_errors.rs gained extract_server_message + 4 unit tests covering the parsed/empty/long/missing cases.
• 74 cargo tests passing.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64	.AppImage · .deb · .rpm

Existing v0.3.6 users on Linux/Windows will receive v0.3.8 automatically via the in-app updater. macOS users will receive it once the macOS bundle is uploaded.

S3 Explorer v0.3.6

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.6

Major release focused on corporate network compatibility. v0.3.5 was skipped (folded into this release). Two related but distinct improvements ship together.

🌐 Real corporate proxy support (transparent + manual)

v0.3.4 added rustls + DoH for SSL-inspection / DNS sinkholing networks, but missed the most common corporate scenario: HTTP proxies (Zscaler, Cisco Umbrella, Palo Alto, etc.) where all traffic must transit through 127.0.0.1:9000 or a corporate gateway. A native Rust app didn't see those proxies the way the system browser does.

v0.3.6 adds a proper Network section in Settings → Advanced:

• Auto-detect (default) — reads system proxy from Windows registry (HKCU + HKLM Group Policy fallback), macOS SCDynamicStore, and Linux env vars (HTTPS_PROXY, HTTP_PROXY, ALL_PROXY with both upper/lower case). Works transparently for ~80% of corporate setups.
• Manual proxy — paste an http://, https:// or socks5:// URL. Import a Zscaler/corporate .pac file from disk or fetch from URL — we extract the first PROXY directive automatically.
• No proxy — explicit bypass for testing.
• Test connectivity button — sends a probe to LemonSqueezy with a synthetic key (no activation slot consumed) and reports DNS / TCP / TLS / proxy errors with empathetic messages.

When activation fails on a network error, a contextual hint banner now appears in the License tab pointing the user directly to the Network settings — one click to diagnose and configure.

🐛 Critical fixes

• Google DoH fallback was broken since v0.3.3 — wrong endpoint URL (/dns-query is wireformat-only on Google, JSON requires /resolve). The cascade was effectively a single point of failure on Cloudflare. Now fixed.
• Lemon Squeezy live mode migration — product IDs updated to live mode following copyToLiveMode.

🔒 Security improvements

• PAC parser rejects directives pointing to loopback (127/8), link-local incl. cloud metadata (169.254.169.254), and IPv6 equivalents (::1, fe80::/10). RFC1918 ranges (10/8, 172.16/12, 192.168/16) remain allowed for legitimate corporate use.
• Detected proxy URLs are sanitized — user:pass@ Basic Auth credentials in env vars are stripped before display in the UI or logs.
• Connectivity probe is rate-limited (2 seconds minimum between calls) to prevent IP bans on Lemon's API from accidental UI spam.

Coverage matrix

Network configuration	v0.3.4	v0.3.6
Open Internet	✅	✅
DNS sinkhole only	🟡 (Cloudflare DoH only — Google branch broken)	✅ (cascade actually has 2 working branches now)
SSL inspection proxy only	✅	✅
DNS sinkhole + SSL inspection	✅	✅
Corporate HTTP proxy (Zscaler/Cisco/Palo Alto)	❌	✅
Whitelist-by-destination only (paranoid IT)	❌	❌ (still requires IT whitelist)

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64	.AppImage · .deb · .rpm

Existing v0.3.4 users on Linux/Windows will receive v0.3.6 automatically via the in-app updater. macOS users will receive it once the macOS bundle is uploaded.

S3 Explorer v0.3.4

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.4

Hotfix release for v0.3.3.

v0.3.3 introduced corporate network compatibility (platform TLS verifier + DoH cascade) but shipped with a critical bug: the app panicked silently on every launch because rustls 0.23+ requires a crypto provider to be installed at startup before any TLS code runs, and our migration replaced the previous implicit setup with an explicit one that didn't include this step.

v0.3.4 contains exactly that one fix — rustls::crypto::aws_lc_rs::default_provider().install_default() is now called once at the top of the app entry point, before any module that touches TLS (telemetry, license validation, DoH resolver). Everything else from v0.3.3 is unchanged: corporate SSL inspection proxies still work, DNS sinkhole bypass via DoH still works.

If you tried to install v0.3.3 and saw the app fail to launch (no window, no error message — just a process that exits within seconds), this release fixes it. Please redownload from the table below. Existing v0.3.2 users will receive v0.3.4 automatically via the in-app updater.

Carry-over from v0.3.3 — corporate network compatibility

Two complementary fixes that automatically activate only when needed (zero impact on home / café / regular Internet):

• TLS validation now uses the OS trust store instead of a fixed Mozilla CA bundle baked into the binary. License activation works behind enterprise SSL inspection proxies (Zscaler, Cisco Umbrella, Palo Alto, Symantec, Netskope, etc.) that intercept HTTPS with an IT-installed enterprise CA.
• DNS-over-HTTPS (DoH) fallback for license validation. When the system DNS resolver fails to resolve api.lemonsqueezy.com (corporate DNS sinkholing), the app falls back to Cloudflare's DoH endpoint, then Google's. The system resolver is always tried first.

The two work together: networks that combine DNS sinkholing AND SSL inspection (common in larger enterprises) now activate licenses where they couldn't before.

Coverage matrix

Network configuration	Result
Open Internet	✅ works
DNS sinkhole only	✅ works (DoH fallback)
SSL inspection proxy only	✅ works (platform verifier)
DNS sinkhole + SSL inspection	✅ works (both fixes combined)
Whitelist-by-destination only (paranoid IT)	❌ still requires IT whitelist

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

S3 Explorer v0.3.3

⚠️ This release is broken — DO NOT install

v0.3.3 panics silently on launch on every machine due to a missing rustls
crypto provider initialization. The bug was introduced by the TLS migration
and slipped through testing because the crash leaves no stderr / crash log.

Use v0.3.4
instead — it ships the same corporate-network compatibility features
(platform TLS verifier + DoH cascade) plus the panic fix.

---

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.3

This release is focused on a single goal: make the app work in restrictive corporate networks.

🛡️ Corporate network compatibility

Two complementary fixes that automatically activate only when needed (zero impact on home / café / regular Internet):

• TLS validation now uses the OS trust store instead of a fixed Mozilla CA bundle baked into the binary. This means license activation works behind enterprise SSL inspection proxies (Zscaler, Cisco Umbrella, Palo Alto, Symantec, Netskope, etc.), where IT installs a custom CA on managed machines to inspect HTTPS traffic. Previously, our app rejected those certificates as "not from a trusted root" and showed a generic "Network error" with no path forward; now it accepts them just like Chrome, Firefox and Outlook do.
• DNS-over-HTTPS (DoH) fallback for license validation. When the system DNS resolver fails to resolve api.lemonsqueezy.com (most commonly because of corporate DNS sinkholing of payment / e-commerce categories), the app automatically falls back to Cloudflare's DoH endpoint (https://1.1.1.1/dns-query), then Google's (https://dns.google/dns-query). The system resolver is always tried first and used when it works — so paying users on open networks see no behavioural change.

The two fixes work together: if the corporate network has both DNS sinkholing AND SSL inspection (a common combination in larger enterprises), the app will now activate licenses where it previously couldn't.

Coverage matrix

Network configuration	Before v0.3.3	After v0.3.3
Open Internet	✅ works	✅ works
DNS sinkhole only	❌ network error	✅ works (DoH fallback)
SSL inspection proxy only	❌ TLS error	✅ works (platform verifier)
DNS sinkhole + SSL inspection	❌ both layers fail	✅ works (both fixes combined)
Whitelist-by-destination only (paranoid IT)	❌ blocked	❌ still requires IT whitelist

Security note

The previous behavior pinned TLS to the Mozilla CA bundle as a defense against a narrow attack scenario (a local cracker installing a fake certificate authority in their own OS to impersonate our license server). This release accepts that trade-off because the practical security impact is minimal: a determined attacker can already reverse-engineer the binary to obtain the obfuscated identifiers needed to forge a server response. All other defenses are unchanged — HMAC machine-binding, constant obfuscation, the four dispersed validation checkpoints, anti-debug watchdog, AES-256-GCM credential encryption.

The DoH fallback queries Cloudflare and Google DNS over HTTPS only when the system resolver fails, never on the happy path — there is zero impact on users with normal connectivity.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

S3 Explorer v0.3.2

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.2

✨ New features

• Incomplete multipart uploads cleanup — surfaces S3 multipart uploads that were started but never completed (a silent storage cost most users don't know about). A yellow ⚠ icon now appears on bucket cards in the sidebar when orphan uploads older than your configured threshold are detected. Click it to open a sortable, filterable table per bucket with single-row and bulk Abort actions, age filter (1h / 24h / 7d / Custom hours / All), live size aggregation across the orphans, and a confirm dialog before any destructive action. Universal across all 21 supported providers — uses the standard ListMultipartUploads / ListParts / AbortMultipartUpload S3 API, no provider-specific quirks. Configurable threshold under Settings → S3 / Storage → Incomplete upload threshold (hours), defaulting to 24 hours.

🛡️ License experience overhaul

• Offline grace extended from 7 days to 35 days — aligns with industry standard (Microsoft 365: 30 days, Adobe Creative Cloud annual: 99 days, Keygen.sh recommended default: 30 days) and accommodates legitimate offline scenarios such as travel, corporate firewalls, and slow-link work environments.
• Profiles are no longer auto-disabled when license downgrades. Previously, falling back to the free tier silently disabled connection profiles 6 and beyond. From v0.3.2 forward, all your existing profiles stay enabled forever — only the creation of new profiles past the free-tier limit is blocked.
• Empathetic downgrade modal at the actual transition event, with reason-specific wording for each cause (offline grace expired, server-side revocation, integrity check failure). Always reassures that profiles are intact and provides a concrete next step.
• Heads-up modal at day 30: if your license has been unable to sync for 30 days, you get a single non-intrusive notice that you have 5 days remaining, so you can plan to reconnect — no silent surprise on day 35.
• All new wording is deliberately reassuring rather than accusatory: no "license invalid" panic language, every message provides actionable guidance.

🔧 Improvements

• Fix: suppress an unused-variable compiler warning in release builds of the cache manager (cosmetic only — no behavior change).
• Telemetry: license tier sent to PostHog now uses a single shared vocabulary (monthly / lifetime) across web (purchase events) and desktop (activation events), so funnels can join correctly on the tier field.

🛡️ Security

All existing defenses are preserved unchanged: HMAC machine-binding on the license file (so the config can't be moved between machines), NTP-verified time-skew detection, anti-debug watchdog (still silent on detection by design), AES-256-GCM credential encryption, four dispersed CHECK POINTs across the codebase. The HMAC signature now also covers the new grace-warning persistence flag, so it can't be tampered with on disk.

A one-shot, transparent v2→v3 storage migration is in place: existing licensed users will simply have their signature silently re-signed on first launch of v0.3.2 — no re-activation required.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

S3 Explorer v0.3.1

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

Downloads

Platform	Download
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Changelog

See the full changelog on the source repo.

S3 Explorer v0.3.0

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

Downloads

Platform	Download
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Changelog

See the full changelog on the source repo.

S3 Explorer v0.2.2

Download the installer for your platform below.

See changelog for details.

S3 Explorer v0.2.1

Download the installer for your platform below.

See changelog for details.

S3 Explorer v0.2.0

Download the installer for your platform below.

See changelog for details.