ZeroFS: A log-structured filesystem for S3. ZeroFS serves S3-compatible buckets as POSIX filesystems over NFS and 9P, or as raw block devices over NBD.
This report summarizes scanner evidence for Barre/ZeroFS, a Rust project with 3,162 GitHub stars. SynthScan examined 194,816 lines of code across 544 source files, recording 263 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 1.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 252 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 80 finding(s).
Which changes need focused human review? 263 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 263 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packaging/config.toml | 1 | # ZeroFS system service configuration. | COMMENT |
| LOW | packaging/kernel/scripts/dkms-fetch-module.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/generate.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/generate.sh | 61 | grep -qF 'Math.floor(nanos / 1000000)' "$out/runtime/ffi-converters.js" || { | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1 | COMMENT | |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 381 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 401 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 421 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 441 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 461 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 481 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 501 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 521 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 541 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 561 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 581 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 601 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 621 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 641 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 661 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 681 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 701 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 721 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 741 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 761 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 781 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 801 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 821 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 841 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 861 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 881 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 901 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 921 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 941 | ); | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 981 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1041 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1101 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1161 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1221 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.h | 1281 | #endif | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/go/facade.go | 21 | COMMENT | |
| LOW | zerofs/zerofs-ffi/bindings/go/zerofs_ffi.go | 2461 | // Mark the handle closed, then clunk best-effort. Idempotent; never hangs. | COMMENT |
| LOW | zerofs/zerofs-ffi/bindings/typescript/zerofs.ts | 1 | // Idiomatic TypeScript facade over the generated `uniffi-bindgen-node-js` | COMMENT |
| LOW | …s/zerofs-ffi/bindings/typescript/packaging/assemble.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …rofs/zerofs-ffi/bindings/typescript/packaging/index.js | 1 | // Native-addon loader for the `zerofs-client` npm package. | COMMENT |
| LOW | …fs/zerofs-ffi/bindings/typescript/packaging/index.d.ts | 1 | // Type surface for the loader `index.js`. The runtime resolves the platform | COMMENT |
| LOW | …indings/typescript/packaging/platform-package/index.js | 1 | // Per-platform native package: ships exactly one prebuilt cdylib and exports | COMMENT |
| LOW | zerofs/zerofs-ffi/src/types.rs | 1 | //! FFI records and conversions for client data. | COMMENT |
| LOW | zerofs/zerofs-ffi/src/types.rs | 61 | } | COMMENT |
| LOW | zerofs/zerofs-ffi/src/types.rs | 141 | #[derive(Clone, Copy, Debug, uniffi::Record)] | COMMENT |
| LOW | zerofs/zerofs-ffi/src/types.rs | 181 | #[uniffi(default = None)] | COMMENT |
| LOW | zerofs/zerofs-ffi/src/error.rs | 1 | //! FFI mirror of [`zerofs_client::ZeroFsError`]. | COMMENT |
| LOW | zerofs/zerofs-ffi/src/error.rs | 21 | /// The operation requires ownership or privilege (EPERM). | COMMENT |
| LOW | zerofs/tests/dst/sim.rs | 21 | pub(crate) struct Hooks { | COMMENT |
| LOW | zerofs/tests/dst/mod.rs | 1 | //! Deterministic simulation testing for the extent-store data plane. | COMMENT |
| LOW | zerofs/tests/dst/mod.rs | 21 | //! Targeted reclamation cases force cancellation and crash windows, verify | COMMENT |
| LOW | zerofs/scripts/release-client.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | zerofs/ninep-proto/src/lib.rs | 1 | #![cfg_attr(not(feature = "std"), no_std)] | COMMENT |
| LOW | zerofs/ninep-proto/src/slice_codec.rs | 1 | //! Allocation-free 9P codec shared by the server, userspace, and kernel clients. | COMMENT |
| LOW | zerofs/zerofs-csi/deploy/gateway-example.yaml | 1 | # Example ZeroFS gateway: a leader/standby pair over one object store, deployed | COMMENT |
| 103 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packaging/kernel/kernel-source-package.py | 205 | def normalize_staging_timestamps(root: Path, epoch: int) -> None: | CODE |
| LOW⚡ | packaging/kernel/tests/test_kernel_targets.py | 175 | def test_reconcile_noop_preserves_lock_exactly(self): | CODE |
| LOW⚡ | packaging/kernel/tests/test_kernel_targets.py | 180 | def test_field_exposes_validated_apt_suite(self): | CODE |
| LOW⚡ | packaging/kernel/tests/test_kernel_targets.py | 188 | def test_builder_image_is_resolved_by_provider_and_release(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 205 | def test_builder_image_rejects_an_unknown_provider_release(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 216 | def test_builder_image_rejects_ambiguous_images(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 232 | def test_reconcile_same_uname_package_rebuild_replaces_lock(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 245 | def test_reconcile_accepts_distinct_apt_source_version(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 258 | def test_reconcile_accepts_ubuntu_source_name_from_candidate(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 270 | def test_reconcile_retains_two_distinct_kernels_and_prunes_oldest(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 296 | def test_reconcile_rejects_rebuild_of_non_latest_retained_kernel(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 334 | def test_reconcile_rejects_stale_and_duplicate_candidates(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 345 | def test_reconcile_two_architectures_is_order_independent(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 354 | def test_reconcile_carries_failed_channel_from_pending_pr(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 374 | def test_reconcile_keeps_pending_pr_when_all_discovery_fails(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 390 | def test_reconcile_keeps_pending_pr_after_noop_discovery(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 407 | def test_reconcile_default_branch_wins_without_blocking_other_channels(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 431 | def test_reconcile_discards_pending_removed_channel(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 457 | def test_reconcile_rejects_pending_configuration_change(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 474 | def test_matrices_are_derived_from_stream_architectures(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 488 | def test_reconcile_rejects_mutated_pending_lock(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 503 | def test_reconcile_rejects_pending_retention_shrink(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_targets.py | 530 | def test_reconcile_allows_fedora_key_rollover_only_once(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 64 | def test_package_revision_overrides_are_explicit(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 68 | def test_builds_one_architecture_independent_package_per_family(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 159 | def test_prebuilt_paths_match_distribution_header_identities(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 228 | def test_fetcher_installs_only_the_exact_signed_module(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 497 | def test_delayed_builds_with_the_same_epoch_are_identical(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 528 | def test_fetcher_serializes_rpm_epoch_without_a_colon(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 593 | def test_timestamp_normalization_covers_files_and_directories(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 605 | def test_source_date_epoch_defaults_to_checked_out_commit(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 622 | def test_staged_configuration_mode_is_independent_of_umask(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 639 | def test_source_tree_preflight_rejects_symbolic_links(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 730 | def test_source_resolver_selects_archive_root_not_rust_directory(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 740 | def test_source_resolver_accepts_distinct_trusted_package_revisions(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 752 | def test_source_resolver_ignores_failed_rpm_ownership_diagnostic(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 766 | def test_source_resolver_rejects_wrong_ubuntu_abi(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 778 | def test_source_resolver_rejects_unknown_package_revision(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 788 | def test_source_resolver_skips_wrong_candidate_before_exact_one(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 814 | def test_source_resolver_skips_diversions_then_checks_package_revision(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 927 | def test_postinstall_builds_only_selected_module_and_kernel(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 954 | def test_postinstall_does_not_split_or_expand_selected_kernel(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 986 | def test_postinstall_registers_without_installed_headers(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1005 | def test_postinstall_rejects_stale_same_version_dkms_state(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1028 | def test_postinstall_stops_on_running_kernel_build_failure(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1079 | def test_postinstall_skips_kernel_below_floor_and_builds_next(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1133 | def test_postinstall_keeps_selected_kernel_failure_fatal(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1156 | def test_postinstall_keeps_selected_kernel_install_failure_fatal(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1287 | def test_unpublished_module_without_source_fallback_is_fatal(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1335 | def test_prebuilt_wrapper_succeeds_without_source_build_inputs(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_source_package.py | 1382 | def test_failed_build_removes_a_partial_module(self): | STRING |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 29 | def test_rejects_reversed_retained_locks_for_each_provider(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 54 | def test_package_version_ordering_handles_numeric_and_prerelease_parts(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 68 | def test_fedora_lock_requires_complete_pinned_toolchain(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 83 | def test_ids_cover_effective_stream_config_and_provider_lock(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 119 | def test_rejects_mutable_builder_and_excess_retention(self): | CODE |
| LOW | packaging/kernel/tests/test_kernel_catalog.py | 141 | def test_fedora_discovery_key_does_not_reidentify_retained_locks(self): | CODE |
| LOW⚡ | packaging/kernel/tests/test_repository_policy.py | 65 | def test_version_policy_compares_version_then_revision(self): | CODE |
| LOW⚡ | packaging/kernel/tests/test_repository_policy.py | 75 | def test_version_policy_ignores_unowned_historical_schemes(self): | CODE |
| LOW⚡ | packaging/kernel/tests/test_repository_policy.py | 80 | def test_apt_policy_is_scoped_to_package_and_architecture(self): | CODE |
| 17 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | zerofs/zerofs-ffi/tests/python/test_smoke.py | 90 | except z.ZeroFsError.NotFound: | CODE |
| HIGH | zerofs/zerofs-ffi/tests/python/test_facade.py | 39 | except zerofs_client.ZeroFsError.Closed: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packaging/kernel/kernel-source-package.py | 5 | CODE | |
| LOW | packaging/kernel/kernel_targets/discovery/__init__.py | 1 | CODE | |
| LOW | packaging/kernel/kernel_targets/discovery/__init__.py | 2 | CODE | |
| LOW | …rofs/zerofs-ffi/bindings/python/zerofs_ffi/__init__.py | 8 | CODE | |
| LOW | …s/zerofs-ffi/bindings/python/zerofs_client/__init__.py | 25 | CODE | |
| LOW | …s/zerofs-ffi/bindings/python/zerofs_client/__init__.py | 35 | CODE | |
| LOW | kernel/ci/upstream_kernels.py | 3 | CODE | |
| LOW | kernel/ci/dkms-package-smoke.py | 5 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/kernel-compile-fuse.yml | 129 | # Check if vmlinux was created | COMMENT |
| LOW | .github/workflows/stress-ng.yml | 169 | # Check if 9p kernel module is available | COMMENT |
| LOW | .github/workflows/kernel-compile-nfs.yml | 119 | # Check if vmlinux was created | COMMENT |
| LOW | .github/workflows/zfs-test.yml | 237 | # Check if the NBD device is in use by looking at /sys/block/nbd0/size | COMMENT |
| LOW | .github/workflows/pjdfstest-9p.yml | 69 | # Check if 9p kernel module is available | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/zfs-test.yml | 116 | # Create a ZFS filesystem | COMMENT |
| MEDIUM | .github/workflows/zfs-test.yml | 147 | # Create a snapshot | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | documentation/package-lock.json | 9841 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz", | CODE |
| MEDIUM | zerofs/Cargo.toml | 170 | # start_paused virtual-time runtimes for the DST harness. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packaging/kernel/stage-prebuilt-modules.py | 199 | CODE | |
| LOW | packaging/kernel/kernel_targets/catalog.py | 685 | CODE | |
| LOW | packaging/kernel/kernel_targets/discovery/runtime.py | 66 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packaging/kernel/kernel_targets/discovery/__init__.py | 4 | __all__ = ["discover_candidate", "parse_as_of"] | CODE |