openshift · RomanBednar · Sep 18, 2025 · Sep 22, 2025 · Sep 23, 2025 · Sep 24, 2025
diff --git a/ChangeLog.md b/ChangeLog.md
@@ -1,9 +1,91 @@
 
 # Change Log
 
+## Version 10.32.0
+
+### New Features
+1. Added support for AMLFS style posix metadata. ([#3317](https://github.com/Azure/azure-storage-azcopy/pull/3317))
+
+### Bug Fixes
+1. Fixed a bug where hdi_isfolder metadata key would sometimes not be sent in all lowercase, resulting in unexpected behavior on the service side when fetching properties. ([#3312](https://github.com/Azure/azure-storage-azcopy/pull/3312))
+2. Fixed a typo in the `benchmark` command, to allow the `--put-md5` flag to work. ([#3324](https://github.com/Azure/azure-storage-azcopy/issues/3324))
+3. Fixed a bug where network errors would not be retried on. ([#3338](https://github.com/Azure/azure-storage-azcopy/pull/3338))
+4. Fixed a bug where unexpected requests would be logged in syslog. ([#3339](https://github.com/Azure/azure-storage-azcopy/pull/3339))
+5. Fixed a bug where pre-existing folders would be recreated. ([#3295](https://github.com/Azure/azure-storage-azcopy/pull/3295))
+
+### Documentation
+1. Updated README to clarify supported source-destination pairs and authorization mechanisms. ([#3213](https://github.com/Azure/azure-storage-azcopy/pull/3213))
+2. Updated format of wiki generated docs to improve readability. ([#3311](https://github.com/Azure/azure-storage-azcopy/pull/3311))
+
+### Breaking changes
+1. AzCopy download URLs starting with https://azcopyvnext-awgzd8g7aagqhzhe.b02.azurefd.net/ are no longer supported.
+   Please download AzCopy from the official GitHub Releases page instead.
+   If you rely on an older AzCopy version that is not available on GitHub, please open an issue in the AzCopy repository and request that it be added.
+
+## Version 10.32.0-preview.1
+
+### Bug Fixes
+1. Fixed a bug where throughput was not being displayed for copy and resume. ([#3271](https://github.com/Azure/azure-storage-azcopy/issues/3271))
+2. Fixed a bug where S3 and GCP transfers would panic. ([#3273](https://github.com/Azure/azure-storage-azcopy/issues/3273))
+
+### Code Improvements
+1. Refactored [copy](https://github.com/Azure/azure-storage-azcopy/pull/3310), [sync](https://github.com/Azure/azure-storage-azcopy/pull/3293), [resume](https://github.com/Azure/azure-storage-azcopy/pull/3289), [login, logout, login status](https://github.com/Azure/azure-storage-azcopy/pull/3266) business logic into the azcopy package. 
+
+## Version 10.31.1
+
+### Dependency updates
+1.	Golang 1.24.6 -> 1.24.11
+2. golang.org/x/crypto 0.40.0 ->  0.45.0
+
+## Version 10.31.0
+
+### New Features
+1. `--include-root` flag now allows customers to preserve root properties when used in conjunction with `--preserve-XXXX` flags. ([#3163](https://github.com/Azure/azure-storage-azcopy/pull/3163))
+
+### Bug Fixes
+1. Fixed a bug to retry on various network errors. ([#3237](https://github.com/Azure/azure-storage-azcopy/pull/3237])) ([#3252](https://github.com/Azure/azure-storage-azcopy/pull/3252))
+2. Fixed a bug where remove would not work on paths with encoded characters. ([#2977](https://github.com/Azure/azure-storage-azcopy/issues/2977))
+3. Fixed a bug where jobs resume would not produce any output for previously failed jobs. ([#3103](https://github.com/Azure/azure-storage-azcopy/pull/3103))
+4. Fixed a bug where FileBlob transfers with EntraID on the source would pass the wrong service version. ([#3242](https://github.com/Azure/azure-storage-azcopy/issues/3242))
+
+## Code Improvements
+1. Refactored traverser related code into its own package. ([#3251](https://github.com/Azure/azure-storage-azcopy/pull/3251))
+2. Refactored OAuth token manager access to use a client-based pattern instead of global singleton access. ([#3260](https://github.com/Azure/azure-storage-azcopy/pull/3260))
+3. Removed unused code related to credential management. ([#3260](https://github.com/Azure/azure-storage-azcopy/pull/3260))
+4. Refactored Lifecycle UI code into the cmd package ([#3262](https://github.com/Azure/azure-storage-azcopy/pull/3262)).
+5. Error handling code is now injected into JobMgr, or appropriately bubbled upwards instead of using global LCM error handling. ([#3262](https://github.com/Azure/azure-storage-azcopy/pull/3262))
+
+## Version 10.31.0-preview.1
+
+### Dependency updates
+1.	Golang 1.24.4 -> 1.24.6 ([#3154](https://github.com/Azure/azure-storage-azcopy/issues/3154))
+
+### New Features
+1. Azure Files NFS -> Azure Files SMB transfers.
+   - Transfer from Azure Files NFS to Azure Files SMB. (`--from-to=FileNFSFileSMB`)
+2. Azure Files SMB -> Azure Files NFS transfers.
+   - Transfer from Azure Files SMB to Azure Files NFS. (`--from-to=FileSMBFileNFS`)
+3. Symlink support for Azure Files NFS shares.
+   Introduced support for symbolic links in Azure Files NFS shares. 
+   Symlinks can be preserved, skipped, or followed based on command-line flags.  
+   - Preserve symlinks: `--preserve-symlinks=true`
+   - Skip symlinks: default behavior when flags are not provided  
+   - Follow symlinks: `--follow-symlinks=true`
+4. Added a --check-version flag to make version checking an opt in feature. ([#3173](https://github.com/Azure/azure-storage-azcopy/pull/3173))
+
+### Bug Fixes
+1. Fixed a bug to retry on WSAETIMEDOUT on Windows. ([#3195](https://github.com/Azure/azure-storage-azcopy/pull/3195))
+2. Fixed a bug with the folder creation tracker which caused folder creation calls to happen more often than necessary. ([#3151](https://github.com/Azure/azure-storage-azcopy/pull/3151)) 
+3. Fixed a bug to redact x-ams-credential from logs. ([#3206](https://github.com/Azure/azure-storage-azcopy/pull/3206))
+4. Fixed a bug where powershell login would fail with older versions of Az.Accounts. ([#3191](https://github.com/Azure/azure-storage-azcopy/pull/3191))
+5. Fixed a bug where symlink direct targets would be handled as a file instead of a symlink. ([#3222](https://github.com/Azure/azure-storage-azcopy/pull/3222))
+
+### Breaking changes
+1. AzCopy no longer checks version by default. ([#3173](https://github.com/Azure/azure-storage-azcopy/pull/3173))
+
 ## Version 10.30.1
 
-### Bug Fixes 
+### Bug Fixes
 1. Fixed `--exclude-path` flag not available in remove operations.([PR #3165](https://github.com/Azure/azure-storage-azcopy/pull/3165)) ([GH Issue #3159](https://github.com/Azure/azure-storage-azcopy/issues/3159))
 2. Fixed regression where AzCopy was not honoring concurrency value in copy operations ([#3192](https://github.com/Azure/azure-storage-azcopy/pull/3192))
 3. Fixed the incorrect JSON output format of the warning message when there are multiple AzCopy processes running. ([PR #3188](https://github.com/Azure/azure-storage-azcopy/pull/3188)) ([GH Issue #3182](https://github.com/Azure/azure-storage-azcopy/issues/3182))
@@ -13,11 +95,6 @@
 ### Dependency Updates
 1.	Golang 1.24.2 -> 1.24.6 (CVE-2025-47907) ([#3154](https://github.com/Azure/azure-storage-azcopy/issues/3154))
 
-## Version 10.31.0-preview.1
-
-### Dependency updates
-1.	Golang 1.24.4 -> 1.24.6 ([#3154](https://github.com/Azure/azure-storage-azcopy/issues/3154))
-
 ## Version 10.30.0
 ### Breaking changes
 1. For transfers involving Azure Files (NFS or SMB), AzCopy will not auto create file shares.
@@ -1246,3 +1323,4 @@ information, including those needed to set the new headers.
    1. excludedBlobType -> excluded-blob-type
    1. outputRaw (in "list" command) -> output
    1. stdIn-enable (reserved for internal use) -> stdin-enable
+
diff --git a/README.md b/README.md
@@ -62,25 +62,42 @@ The general format of the AzCopy commands is: `azcopy [command] [arguments] --[f
 
 * `bench` - Runs a performance benchmark by uploading or downloading test data to or from a specified destination
 
-* `copy` - Copies source data to a destination location. The supported directions are:
-    - Local File System <-> Azure Blob (SAS or OAuth authentication)
-    - Local File System <-> Azure Files (Share/directory SAS or OAuth authentication)
-    - Local File System <-> Azure Data Lake Storage (ADLS Gen2) (SAS, OAuth, or SharedKey authentication)
-    - Azure Blob (SAS, OAuth or public authentication) -> Azure Blob (SAS or OAuth authentication)
-    - Azure Blob (SAS, OAuth or public authentication) -> Azure Files (SAS or OAuth authentication)
-    - Azure Files (SAS or OAuth authentication) -> Azure Files (SAS or OAuth authentication)
-    - Azure Files (SAS or OAuth authentication) -> Azure Blob (SAS or OAuth authentication)
-    - AWS S3 (Access Key) -> Azure Block Blob (SAS or OAuth authentication)
-    - Google Cloud Storage (Service Account Key) -> Azure Block Blob (SAS or OAuth authentication) [Preview]
-
-* `sync` - Replicate source to the destination location. The supported directions are:
-    - Local File System <-> Azure Blob (SAS or OAuth authentication)
-    - Local File System <-> Azure Files (Share/directory SAS or OAuth authentication)
-    - Azure Blob (SAS, OAuth or public authentication) -> Azure Files (SAS or OAuth authentication)
-
-* `login` - Log in to Azure Active Directory (AD) to access Azure Storage resources.
-
-* `logout` - Log out to terminate access to Azure Storage resources.
+* `copy` - Copies source data to a destination location. The supported directions and forms of authorization are:
+    Source | Destination
+    --- | ---
+    Local | Azure Blob (Microsoft Entra ID or SAS)
+    Local | Azure Files SMB (Microsoft Entra ID or share/directory SAS)
+    Local | Azure Files NFS (Microsoft Entra ID or share/directory SAS)
+    Local | Azure Data Lake Storage (Microsoft Entra ID, SAS, or Shared Key)
+    Azure Blob (Microsoft Entra ID or SAS) | Local
+    Azure Files SMB (Microsoft Entra ID or share/directory SAS) | Local
+    Azure Files NFS (Microsoft Entra ID or share/directory SAS) | Local
+    Azure Data Lake Storage (Microsoft Entra ID, SAS, or Shared Key) | Local
+    Azure Blob (Microsoft Entra ID, SAS, or public) | Azure Blob (Microsoft Entra ID or SAS)
+    Azure Blob (Microsoft Entra ID, SAS, or public) | Azure Files SMB (Microsoft Entra ID or SAS)
+    Azure Blob (Microsoft Entra ID or SAS) | Azure Data Lake Storage (Microsoft Entra ID or SAS)
+    Azure Data Lake Storage (Microsoft Entra ID or SAS) | Azure Blob (Microsoft Entra ID or SAS)
+    Azure Data Lake Storage (Microsoft Entra ID or SAS) | Azure Data Lake Storage (Microsoft Entra ID or SAS)
+    Azure Files SMB (Microsoft Entra ID or SAS) | Azure Blob (Microsoft Entra ID or SAS)
+    Azure Files SMB (Microsoft Entra ID or SAS) | Azure Files SMB (Microsoft Entra ID or SAS)
+    Azure Files NFS (Microsoft Entra ID or SAS) | Azure Files NFS (Microsoft Entra ID or SAS)
+    AWS S3 (Access Key) | Azure Block Blob (Microsoft Entra ID or SAS)
+    Google Cloud Storage (Service Account Key) | Azure Block Blob (Microsoft Entra ID or SAS)
+
+* `sync` - Replicate source to the destination location. The supported directions and forms of authorization are:
+    Source | Destination
+    --- | ---
+    Local | Azure Blob (Microsoft Entra ID or SAS)
+    Local | Azure File (Microsoft Entra ID or SAS)
+    Azure Blob (Microsoft Entra ID or SAS) | Local
+    Azure File (Microsoft Entra ID or SAS) | Local
+    Azure Blob (Microsoft Entra ID or SAS) | Azure Blob (Microsoft Entra ID or SAS)
+    Azure Blob (Microsoft Entra ID or SAS) | Azure File (Microsoft Entra ID or SAS)
+    Azure Data Lake Storage (Microsoft Entra ID or SAS) | Azure Data Lake Storage (Microsoft Entra ID or SAS)
+    Azure File (Microsoft Entra ID or SAS) | Azure Blob (Microsoft Entra ID or SAS)
+    Azure File (SAS or public) | Azure File (SAS)
+
+* `login` - Log in to Azure Active Directory (AD) to access Azure Storage resources.* `logout` - Log out to terminate access to Azure Storage resources.
 
 * `list` - List the entities in a given resource
 

diff --git a/azcopy/client.go b/azcopy/client.go
@@ -21,23 +21,54 @@
 package azcopy
 
 import (
+	"log"
+	"runtime"
+
 	"github.com/Azure/azure-storage-azcopy/v10/common"
 	"github.com/Azure/azure-storage-azcopy/v10/jobsAdmin"
 	"github.com/Azure/azure-storage-azcopy/v10/ste"
-	"log"
-	"runtime"
 )
 
+const (
+	oauthLoginSessionCacheKeyName     = "AzCopyOAuthTokenCache"
+	oauthLoginSessionCacheServiceName = "AzCopyV10"
+	oauthLoginSessionCacheAccountName = "AzCopyOAuthTokenCache"
+)
+
+const (
+	// Base10Mega For networking throughput in Mbps, (and only for networking), we divide by 1000*1000 (not 1024 * 1024) because
+	// networking is traditionally done in base 10 units (not base 2).
+	// E.g. "gigabit ethernet" means 10^9 bits/sec, not 2^30. So by using base 10 units
+	// we give the best correspondence to the sizing of the user's network pipes.
+	// See https://networkengineering.stackexchange.com/questions/3628/iec-or-si-units-binary-prefixes-used-for-network-measurement
+	// NOTE that for everything else in the app (e.g. sizes of files) we use the base 2 units (i.e. 1024 * 1024) because
+	// for RAM and disk file sizes, it is conventional to use the power-of-two-based units.
+	Base10Mega = 1000 * 1000
+)
+
+// It's not pretty that this one is read directly by credential util.
+// But doing otherwise required us passing it around in many places, even though really
+// it can be thought of as an "ambient" property. That's the (weak?) justification for implementing
+// it as a global
+var TrustedSuffixes string
+
 type Client struct {
-	CurrentJobID common.JobID // TODO (gapra): In future this should only be set when there is a current job running. On complete, this should be cleared. It can also behave as something we can check to see if a current job is running
+	CurrentJobID      common.JobID                  // TODO (gapra): In future this should only be set when there is a current job running. On complete, this should be cleared. It can also behave as something we can check to see if a current job is running
+	oauthTokenManager *common.UserOAuthTokenManager // OAuth token manager for the current user, used for authentication
+	logLevel          common.LogLevel
 }
 
 type ClientOptions struct {
-	CapMbps float64
+	CapMbps         float64
+	TrustedSuffixes string
+	LogLevel        *common.LogLevel
 }
 
 func NewClient(opts ClientOptions) (Client, error) {
-	c := Client{}
+	c := Client{
+		logLevel: common.IffNil(opts.LogLevel, common.ELogLevel.Info()), // Default: Info
+	}
+	TrustedSuffixes = opts.TrustedSuffixes
 	common.InitializeFolders()
 	configureGoMaxProcs()
 	// Perform os specific initialization
@@ -51,9 +82,33 @@ func NewClient(opts ClientOptions) (Client, error) {
 	if err != nil {
 		return c, err
 	}
+	// only one UserOAuthTokenManager should exist in azcopy process for current user.
+	// (a given AzcopyJobPlanFolder is mapped to current user)
+	if common.AzcopyJobPlanFolder == "" {
+		panic("invalid state, AzcopyJobPlanFolder should not be an empty string")
+	}
+	cacheName := common.GetEnvironmentVariable(common.EEnvironmentVariable.LoginCacheName())
+
+	c.oauthTokenManager = common.NewUserOAuthTokenManagerInstance(common.CredCacheOptions{
+		DPAPIFilePath: common.AzcopyJobPlanFolder,
+		KeyName:       common.Iff(cacheName != "", cacheName, oauthLoginSessionCacheKeyName),
+		ServiceName:   oauthLoginSessionCacheServiceName,
+		AccountName:   common.Iff(cacheName != "", cacheName, oauthLoginSessionCacheAccountName),
+	})
 	return c, nil
 }
 
+// GetUserOAuthTokenManagerInstance gets or creates OAuthTokenManager for current user.
+// Note: Currently, only support to have TokenManager for one user mapping to one tenantID.
+func (c *Client) GetUserOAuthTokenManagerInstance() *common.UserOAuthTokenManager {
+	return c.oauthTokenManager
+}
+
+// GetLogLevel returns the log level of the client.
+func (c *Client) GetLogLevel() common.LogLevel {
+	return c.logLevel
+}
+
 // Ensure we always have more than 1 OS thread running goroutines, since there are issues with having just 1.
 // (E.g. version check doesn't happen at login time, if have only one go proc. Not sure why that happens if have only one
 // proc. Is presumably due to the high CPU usage we see on login if only 1 CPU, even tho can't see any busy-wait in that code)
@@ -63,3 +118,9 @@ func configureGoMaxProcs() {
 		runtime.GOMAXPROCS(2)
 	}
 }
+
+// JobContext contains initialization context for a job.
+type JobContext struct {
+	JobID   common.JobID
+	LogPath string
+}