HSYNC Common Library
hsync-common is the shared foundation that all other HSYNC projects build upon — data formats, compression, file exclusion rules, and security utilities. You don't install or run it directly; it's a library used by the client, server and desktop application.
It is also the single source of truth for the open, versioned wire protocol:
the shared models, JSON-Schema builders and committed fixtures live here
(hsync_common.protocol, docs/protocol.md, docs/p2p-protocol.md), so every
implementation speaks the same contract. The library sends no telemetry or
analytics anywhere.
👉 Operational Advisory: integrators are strongly advised to validate the library's behavior against their own data before relying on it in production.
Key modules
| Module | Purpose |
|---|---|
hsync_common.models |
Unified File, Dir, Symlink, Event, SyncAction, TombstoneStore, delta transfer models |
hsync_common.protocol |
Versioned wire protocol: versions, capabilities, WS auth, LAN election, pairing, JSON-Schema builders, fixtures |
hsync_common.delta |
Rsync-style delta transfer algorithm: rolling checksum, block matching, decision heuristics |
hsync_common.hashing |
SHA-256 computation, adaptive chunk sizing, hex digest validation |
hsync_common.compression |
Zstandard helpers, PRECOMPRESSED_EXTENSIONS, should_compress |
hsync_common.permissions |
Octal permission SSOT, remote permission sanitization |
hsync_common.ignore |
.hsyncignore gitignore-style matcher (IgnoreMatcher) |
hsync_common.path_validation |
Path safety helpers, remote-path validators |
hsync_common.constants |
Shared constants (HSYNCKEEP_FILENAME, HSYNCIGNORE_FILENAME, HSYNCFOLDER_FILENAME, …) |
hsync_common.ssl_utils |
Shared SSL primitives, cert fingerprinting |
hsync_common.logger |
BaseInterceptHandler, log rotation helpers |
hsync_common.clock |
NTP-style clock offset computation |
hsync_common.format |
Human-readable bytes/duration formatting |
hsync_common.env |
Environment-variable parsing helpers |
hsync_common.text |
Text utilities (e.g. escape_loguru_markup) |
hsync_common.labels |
ActionLabel enum, log-label colorization, two-level origin rule ([LOCAL …] / [REMOTE …]) |
hsync_common.runtime |
Container runtime detection (Docker, Podman, Kubernetes), TTY detection, cgroup resource limits |
hsync_common.exceptions |
HSyncError base class |
hsync_common.time_utils |
Timestamp formatting/parsing SSOT |
Benchmarks
Hot-path micro-benchmarks live in bench/ — L1 only (pure in-process
measurement), because the library has no process or transport of its own. Five
scripts cover hashing, compression, delta transfer, .hsyncignore matching and
model serialization; each accepts --count N and --json-out FILE.
cd hsync-common && .venv/bin/python bench/bench_hashing.py --count 2000
See bench/README.md for the scope of each script, the
shared helpers and the measurement methodology.
Documentation
The most-used guides are listed below; docs/README.md is the
complete documentation index.
| Document | What it covers |
|---|---|
| Usage | How to integrate hsync-common as a dependency |
| Models | Shared data models reference |
| Utilities | Cross-cutting utilities guide |
| Protocol | Versioned wire protocol reference |
| p2p Protocol | Authoritative p2p rendezvous, master-election, pairing and security specification |
| Rdv/1 Protocol | The rdv/1 rendezvous channel as mirrored for the client |
| Authentication | Shared authentication contracts: CID format, message schema, version negotiation |
| Ignore file | .hsyncignore syntax, IgnoreMatcher layers, and API |
| Android Mirroring | How Python models are mirrored in Kotlin |
| Internal Architecture | Shared models, utilities, and how they fit the HSYNC ecosystem |
| Architecture Decision Records | Why the stable, cross-project decisions were made |
| Contributing | Development setup and contribution guidelines |
| Report an issue | Open development and bug tracking |
| Security Policy | Supported versions and how to report vulnerabilities |
Associated Ecosystem Components
The other components of the HSYNC ecosystem:
- HSYNC Main — Umbrella repository and project overview.
- HSYNC Desktop — Desktop GUI front-end.
- HSYNC Client — Reference client agent: the
hsyncCLI and its sync engine. - HSYNC Server — Central sync hub: REST API, WebSocket relay, file storage.
- HSYNC Rendezvous — Optional Internet rendezvous node for P2P (
rdv/1, no-log, RAM-only). - HSYNC Android — Android client app. (in development)
Security & Vulnerability Reporting
To report a vulnerability, please use GitHub's Private Vulnerability Reporting:
🙋♂️ A note from the maintainer
This project was born out of the need for a system capable of replicating the contents of a folder from a PC or Android device to a NAS, primarily for backup purposes. Several solutions were already available, but I couldn't find one that met all my requirements. This led to the somewhat questionable decision to develop one from scratch, while also providing an opportunity to gain a deeper understanding of programming languages, algorithms, frameworks, and related technologies.
Originally conceived as a hobby project, HSYNC has been under continuous development ever since. I believe it has now evolved to the point where its capabilities are comparable to those of commercial solutions, while also offering some distinctive features. As a result, it may also be suitable for deployment in certain production environments.
HSYNC is a passion project that I primarily develop and maintain in my spare time. Please keep this in mind when interacting with the project: we're all doing our best to build something great together, but this is not a paid, full-time job for any of us.
Disclaimer
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. Although the author has implemented reasonable safety measures, IN NO EVENT SHALL THE AUTHOR OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY — including, without limitation, any direct, indirect, incidental, special, exemplary, or consequential damages, loss of data, or business interruption — WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
This disclaimer supplements, and does not replace, the warranty disclaimer and limitation of liability provisions of the BSD 3-Clause License, which govern this software.
License
Distributed under the BSD 3-Clause License.
Metadata
Release files for hsync-common 1.0.17
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| hsync_common-1.0.17.tar.gz | 216.6 kB | With provenance | Details for hsync_common-1.0.17.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| hsync_common-1.0.17-py3-none-any.whl | Python 3 | none | any | Details for hsync_common-1.0.17-py3-none-any.whl |
Total release size: 484.2 kB
Release files / hsync_common-1.0.17.tar.gz
| Download URL | hsync_common-1.0.17.tar.gz |
|---|---|
| Size | 216.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
df7d616d8540b51f1c7125e0aca4d04c7aa5cfb25e201fe3f3bd345c035c9a48
|
|
BLAKE2b-256 checksum How to use checksums |
0c1af467ade3fa79219127b57088db3fa9bbdad009337144300516f7c23ca434
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 3, 2026.
Transparency logRelease files / hsync_common-1.0.17-py3-none-any.whl
| Download URL | hsync_common-1.0.17-py3-none-any.whl |
|---|---|
| Size | 267.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
15b17072a9194fea5aa4f78ac0c3046db4c5b93ed5feaee6f0a3d5342055dde2
|
|
BLAKE2b-256 checksum How to use checksums |
ed7a54729fa4ecc539e618ee0b3a18e8a6c4c5c65784a026ba4a049abc07ca39
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 3, 2026.
Transparency logSecurity for hsync-common 1.0.17
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for hsync_common-1.0.17.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 3, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.