Rclone — Dependencies#

Module info#

• Module: github.com/rclone/rclone
• Go version: 1.25.0
• Direct dependencies: 107
• Indirect dependencies in go.mod: 166
• Total go.sum entries: ~577 (1,154 lines / 2)

Dependency categories#

Core infrastructure#

Rclone’s core infrastructure dependencies support the CLI, configuration, logging, and system integration:

• github.com/spf13/cobra + github.com/spf13/pflag — CLI framework and flag parsing. Cobra drives the entire command tree (sync, copy, mount, etc.).
• github.com/unknwon/goconfig — INI-format config file parsing for ~/.config/rclone/rclone.conf.
• gopkg.in/natefinch/lumberjack.v2 — Log rotation for persistent log files.
• github.com/coreos/go-systemd/v22 — systemd socket activation and journal integration (for rclone serve).
• github.com/shirou/gopsutil/v4 — System stats (CPU, memory) for rc/cache and rclone selfupdate.
• github.com/prometheus/client_golang — Prometheus metrics exported via the rc (remote control) HTTP server.
• github.com/anacrolix/log — Structured logging used by the DMS/DLNA backend.
• golang.org/x/sync — errgroup, singleflight, semaphore — heavily used for concurrent transfer management.
• golang.org/x/time — Rate limiting (bandwidth throttling).

Networking / Protocols#

The largest category, driven by the need to speak every protocol that a backend requires:

HTTP infrastructure:

• github.com/go-chi/chi/v5 — HTTP router for the rc (remote control) REST API and web GUI.
• github.com/abbot/go-http-auth — HTTP Basic and Digest authentication for rclone serve http/webdav.
• golang.org/x/net — WebDAV server primitives, HTTP/2, and network utilities.
• golang.org/x/oauth2 — OAuth2 flows for Google Drive, Dropbox, Box, OneDrive, and many other backends.

File transfer protocols:

• github.com/pkg/sftp — SFTP client library (SFTP backend) and server (for rclone serve sftp).
• github.com/jlaffaye/ftp — FTP client for the FTP backend.
• goftp.io/server/v2 — FTP server for rclone serve ftp.
• github.com/willscott/go-nfs — NFS server for rclone serve nfs.
• github.com/anacrolix/dms — DLNA/UPnP media server for rclone serve dlna.
• github.com/cloudsoda/go-smb2 — SMB2 client for the SMB backend.
• github.com/colinmarc/hdfs/v2 — HDFS client for the Hadoop backend.
• github.com/jcmturner/gokrb5/v8 — Kerberos5 support (used by HDFS and SMB for enterprise auth).

FUSE mounting:

• bazil.org/fuse — FUSE client library for rclone mount on Linux/macOS.
• github.com/hanwen/go-fuse/v2 — Alternative FUSE library (used for macOS FUSE via go-darwin/apfs).
• github.com/winfsp/cgofuse — Windows FUSE via WinFSP for rclone mount on Windows.
• github.com/go-darwin/apfs — macOS APFS/FUSE glue.

Crypto/auth protocols:

• golang.org/x/crypto — SSH protocol primitives (underlies pkg/sftp and xanzy/ssh-agent), bcrypt, scrypt.
• github.com/xanzy/ssh-agent — SSH agent communication for key-based SFTP auth.
• github.com/golang-jwt/jwt/v5 and /v4 — JWT token creation/validation (used by multiple backends).

Cloud provider SDKs#

The dependency list is dominated by vendor-specific cloud SDKs — one per major storage provider:

Data / Storage / Cryptography#

• go.etcd.io/bbolt — Embedded BoltDB key-value store used by the cache backend for persistent metadata caching.
• github.com/patrickmn/go-cache — In-memory TTL cache used throughout (e.g., dir cache).
• github.com/klauspost/compress — Comprehensive compression library (gzip, snappy, zstd, etc.); used by the Compress virtual backend and archive handling.
• github.com/mholt/archives — Multi-format archive support (zip, tar, 7z, rar, lzip, etc.) for the Archive virtual backend.
• github.com/rfjakob/eme — EME (wide-block cipher) encryption used by the Crypt virtual backend for filename encryption.
• github.com/ProtonMail/go-crypto — OpenPGP for Proton Drive’s end-to-end encryption.
• github.com/zeebo/blake3 + github.com/zeebo/xxh3 — Fast cryptographic and non-cryptographic hashing for file integrity verification.
• github.com/jzelinskie/whirlpool + github.com/Max-Sum/base32768 — Additional hash algorithms and encoding for the Crypt backend’s obscured filenames.
• github.com/lanrat/extsort — External (disk-based) sorting for handling very large directories.
• github.com/google/uuid — UUID generation.

Terminal / UI#

Rclone has a rich TUI for ncdu (interactive disk usage) and rclone explore:

• github.com/gdamore/tcell/v2 — Full terminal cell library powering the interactive TUI (ncdu browser).
• github.com/peterh/liner — GNU readline-like line editor for the REPL/rc shell.
• github.com/mattn/go-colorable + go-runewidth + go-isatty — Color output and Unicode-width-aware text for terminal display.
• github.com/muesli/reflow — Word-wrap and text reflow for progress output.
• github.com/a8m/tree — Directory tree rendering.
• github.com/atotto/clipboard — Clipboard access for copying auth codes.
• github.com/skratchdot/open-golang — Opens OAuth2 browser tabs during auth flows.

Auth / Security#

• github.com/pquerna/otp — TOTP/HOTP one-time passwords (used by some backends requiring 2FA).
• github.com/youmark/pkcs8 — PKCS#8 private key parsing for certificate-based authentication.
• github.com/gabriel-vasile/mimetype — Content-type sniffing for uploads where MIME type is required.

Testing#

• github.com/stretchr/testify — Primary assertion library. Used across all test files.
• github.com/rclone/gofakes3 — Fake S3 implementation used in integration tests to test the S3 backend without real AWS.
• github.com/pmezard/go-difflib — Unified diff output (pulled in by testify, also used directly).
• github.com/rogpeppe/go-internal — Test script runner for integration tests (testscript).

Other#

• github.com/mitchellh/go-homedir — Cross-platform home directory detection for config paths.
• github.com/google/uuid — UUIDs for temp filenames, multipart upload IDs.
• gopkg.in/yaml.v3 — YAML parsing (config and output).
• gopkg.in/validator.v2 — Struct validation for config structs.
• golang.org/x/mobile — Mobile (Android/iOS) build support for gomobile-based integrations.
• github.com/quasilyte/go-ruleguard/dsl — Static analysis linting rules (build-time only).
• github.com/josephspurrier/goversioninfo — Windows version info resource embedding.
• github.com/diskfs/go-diskfs — Disk image creation (for the ISO/virtual disk backend).

Stdlib reliance#

Rclone uses stdlib heavily and correctly. The most prominent stdlib packages across the codebase:

Rclone’s fs.Object and fs.Fs interfaces are deliberately designed around io.Reader/io.Writer, making stdlib the foundational layer. Third-party dependencies are added per-backend in isolation, so stdlib does the heavy lifting in core packages like fs/, lib/, and vfs/.

Shared dependencies#

Dependencies rclone shares with many other projects in the 50-project research set:

• github.com/spf13/cobra — The dominant Go CLI framework; used by kubectl, Helm, Vault, Consul, Nomad, Terraform, and most CLI tools.
• github.com/stretchr/testify — Nearly universal Go test library.
• gopkg.in/yaml.v3 — Standard YAML library; used by Kubernetes ecosystem tools.
• golang.org/x/oauth2 — Shared by any project integrating with Google/GitHub APIs.
• golang.org/x/crypto — Shared by any project doing SSH or extra crypto.
• golang.org/x/sync — errgroup and singleflight used across many concurrent Go programs.
• github.com/prometheus/client_golang — Standard metrics library for cloud-native tools.
• github.com/google/uuid — Very common across all cloud service tools.
• github.com/klauspost/compress — Shared with MinIO, etcd, and other high-throughput storage tools.
• github.com/aws/aws-sdk-go-v2 — Shared with any AWS-integrated tool (MinIO, Vault, Terraform).
• github.com/minio/minio-go/v7 — Shared with MinIO itself (rclone uses the MinIO client SDK for S3-compatible endpoints).

Vendoring#

Rclone does not vendor its dependencies (no vendor/ directory). It relies on Go module proxy and go.sum for reproducibility. This is consistent with a project that has ~107 direct deps (many of which are large vendor SDKs) where vendoring would create an enormous repository. The go.sum with 577 entries provides integrity guarantees without the maintenance overhead of vendoring.

Notable dependency decisions#

1. Backend-isolation prevents dependency bloat in core. Each cloud SDK is imported only by its corresponding backend package (e.g., backend/s3/ imports aws-sdk-go-v2). The core fs/ package imports none of the vendor SDKs. This is a deliberate architectural choice: adding a new backend doesn’t affect users who don’t use it, but it does inflate go.mod for everyone.

2. Three FUSE libraries for one feature. rclone mount requires three separate FUSE libraries (bazil.org/fuse, hanwen/go-fuse, winfsp/cgofuse) because there is no cross-platform FUSE abstraction in Go. Each targets a different OS. This is a platform tax, not a design flaw.

3. Own Proton SDK. Rclone maintains forks under github.com/rclone/Proton-API-Bridge and github.com/rclone/go-proton-api rather than using an upstream Proton library, likely because no stable public Proton Go SDK existed at the time of integration.

4. AWS SDK v2 migration. Rclone uses aws-sdk-go-v2 (the modern, context-aware SDK) rather than the legacy v1 (aws/aws-sdk-go), signaling a commitment to idiomatic Go and modern AWS API patterns.

5. Crypto backend uses low-level primitives. Rather than depending on a high-level encryption library, the Crypt backend assembles its own encryption from rfjakob/eme (wide-block cipher), golang.org/x/crypto (AES-CTR, Salsa20), and custom base32768 encoding. This gives fine-grained control over the file format but creates an unusual dependency footprint.

6. bbolt for cache persistence. Using an embedded database (go.etcd.io/bbolt) for the cache backend is a heavyweight choice for what is essentially a metadata store. It provides ACID guarantees and avoids managing a file format, but it’s worth noting as a dependency that exists only for one optional backend.

7. gofakes3 for self-contained S3 testing. Maintaining rclone/gofakes3 (a fork/extension of a fake S3 implementation) enables full S3 backend integration tests without any AWS account or network access — a significant investment that pays off in CI reliability.