WebDAV stores
WebDAV is an encrypted object store transport, available with the webdav feature. It uses the same relative object paths and cipherfs-store.json descriptor as Directory and S3 stores. It is not a WebDAV file-access service.
The desktop App registers a collection under Sync & storage → WebDAV → Add WebDAV store. CLI and native APIs also register it. Runtime Basic credentials travel through the authenticated private owner transport and remain session-only; public TCP registration does not accept them. Sealing or closing clears them, so provide them again after reopening. Use HTTPS; HTTP is accepted only on explicit loopback IP addresses for a local owned service. URLs must not contain credentials, query parameters or fragments. Redirects never forward credentials.
The same immutable-store contract runs against two independent real implementations:
| Service | Verification |
|---|---|
| Apache HTTP Server 2.4.65, mod_dav/mod_dav_fs | Conditional create, descriptor, HEAD/GET/Range, streaming, Depth1 pages, signed two-device synchronization, authentication and expiry; owned-publication fault tests |
| WsgiDAV 4.3.5 with Cheroot 10.0.1 | The same unmodified store contract, including a 32 MiB object and signed two-device synchronization |
Both services use synthetic authenticated users and owned temporary data. The WsgiDAV dependencies have exact versions and PyPI distribution hashes; its installation and execution stay in the fixed test container. The full workspace gate includes this second service. Desktop owner/client registration additionally runs against the real Apache fixture on the host.
Other services must support authenticated HEAD/GET/PUT/DELETE, collection creation, bounded Depth1 PROPFIND responses, and atomic If-None-Match: * creation. CipherFS probes conditional creation before publishing a real object and rejects a service that overwrites an existing probe. It verifies object lengths and ciphertext identities; listings and ETags never establish integrity or deletion authority. Range support is probed; its absence does not imply that unbounded downloads are allowed.
Multistatus parsing accepts extra DAV/vendor properties in bounded subtrees, while required DAV structure, successful properties, exact lengths, direct-child scope and response budgets remain strict. A property in a vendor namespace cannot substitute for a required DAV field. Object paths use the canonical object alphabet, not arbitrary plaintext file names.
This is tested interoperability with the two services above, not acceptance of every cloud vendor, reverse proxy or authentication scheme. Digest, OAuth-only services, redirect-based credential forwarding and live cloud accounts are not covered by these tests. A new provider must pass the same immutable-store contract before deployment.