diff --git a/.mailmap b/.mailmap
index bc092300..0f7a8237 100644
--- a/.mailmap
+++ b/.mailmap
@@ -97,3 +97,4 @@ Nandini Tata <nandini.tata@intel.com> <nandini.tata.15@gmail.com>
 Flavio Percoco <flaper87@gmail.com>
 Timur Alperovich <timuralp@swiftstack.com> <timur@timuralp.com>
 Thiago da Silva <thiagodasilva@gmail.com> <thiago@redhat.com>
+DavHau <hsngrmpf@gmail.com> <hsngrmpf+github@gmail.com>
diff --git a/.zuul.yaml b/.zuul.yaml
index d38f37fa..e222ddcc 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -30,20 +30,41 @@
     templates:
       - check-requirements
       - lib-forward-testing-python3
-      - openstack-python3-zed-jobs
+      - openstack-python3-jobs
       - publish-openstack-docs-pti
       - release-notes-jobs-python3
+    experimental:
+      # on-demand pipeline used to test older (but still supported) versions of python,
+      # as well as intermediate releases that the openstack-python3-jobs might skip
+      jobs:
+        - openstack-tox-py37:
+            nodeset: ubuntu-jammy
+            vars:
+              python_use_pyenv: True
+        - openstack-tox-py38
+        - openstack-tox-py39
+        - openstack-tox-py311
+        - openstack-tox-py312
     check:
       jobs:
-        - swiftclient-swift-functional
-        - swiftclient-functional
-        - openstack-tox-py39:
+        - swiftclient-functional:
+            irrelevant-files: &functest-irrelevant-files
+              - ^(doc|releasenotes)/.*$
+              - ^test/unit/.*$
+              - ^(.gitreview|.mailmap|AUTHORS|ChangeLog|.*\.rst)$
+        - swiftclient-swift-functional:
+            irrelevant-files: *functest-irrelevant-files
+        - tempest-full-py3:
+            irrelevant-files: *functest-irrelevant-files
+        - openstack-tox-py313
+        - openstack-tox-py314:
             voting: true
     gate:
       jobs:
         - swiftclient-swift-functional
         - swiftclient-functional
-        - openstack-tox-py39:
+        - openstack-tox-py313
+        - openstack-tox-py314:
             voting: true
     post:
       jobs:
diff --git a/AUTHORS b/AUTHORS
index 165e9d07..01c2a8a2 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,3 +1,4 @@
+Aarni Koskela (akx@iki.fi)
 Alessandro Pilotti (ap@pilotti.it)
 Alex Gaynor (alex.gaynor@gmail.com)
 Alex Schultz (aschultz@redhat.com)
@@ -9,6 +10,7 @@ Andrew Welleck (awellec@us.ibm.com)
 Andy McCrae (andy.mccrae@gmail.com)
 Anh Tran (anhtt@vn.fujitsu.com)
 Anne Gentle (anne@openstack.org)
+Anthony Roussel (anthony@roussel.dev)
 Ben McCann (ben@benmccann.com)
 Cedric Brandily (zzelle@gmail.com)
 Chaozhe.Chen (chaozhe.chen@easystack.cn)
@@ -29,9 +31,11 @@ Corey Bryant (corey.bryant@canonical.com)
 Dan Prince (dprince@redhat.com)
 Daniel Wakefield (daniel.wakefield@hp.com)
 Darrell Bishop (darrell@swiftstack.com)
+DavHau (hsngrmpf@gmail.com)
 David Goetz (david.goetz@rackspace.com)
 David Kranz (david.kranz@qrclab.com)
 David Shrewsbury (shrewsbury.dave@gmail.com)
+David Svenson (davidsvenson@outlook.com)
 Davide Guerri (davide.guerri@hp.com)
 Dean Troyer (dtroyer@gmail.com)
 Dirk Mueller (dirk@dmllr.de)
@@ -43,6 +47,8 @@ Fabien Boucher (fabien.boucher@enovance.com)
 Feng Liu (mefengliu23@gmail.com)
 Flavio Percoco (flaper87@gmail.com)
 Florent Flament (florent.flament-ext@cloudwatt.com)
+fuzihao (fuzihao@inspur.com)
+Ghanshyam Mann (gmann@ghanshyammann.com)
 Greg Holt (gholt@rackspace.com)
 Greg Lange (greglange@gmail.com)
 groqez (groqez@yopmail.net)
@@ -54,6 +60,8 @@ Hiroshi Miura (miurahr@nttdata.co.jp)
 howardlee (lihongweibj@inspur.com)
 Hu Bing (hubingsh@cn.ibm.com)
 Ian Cordasco (ian.cordasco@rackspace.com)
+Ivan Anfimov (lazekteam@gmail.com)
+Ivan Kolodyazhny (e0ne@e0ne.info)
 jacky06 (zhang.min@99cloud.net)
 Jaivish Kothari (jaivish.kothari@nectechnologies.in)
 Jakub Krajcovic (jakub.krajcovic@gmail.com)
@@ -63,8 +71,10 @@ Jeremy Stanley (fungi@yuggoth.org)
 Ji-Wei (ji.wei3@zte.com.cn)
 Jian Zhang (jian.zhang@intel.com)
 Jing Liuqing (jing.liuqing@99cloud.net)
+jinyuanliu (liujinyuan@inspur.com)
 Jiří Suchomel (jsuchome@suse.cz)
 Joel Wright (joel.wright@sohonet.com)
+jonasdlindner (jonaslindner55@gmail.com)
 John Dickinson (me@not.mn)
 Jola Mirecka (jola.mirecka@hp.com)
 Josh Gachnang (josh@pcsforeducation.com)
@@ -88,6 +98,7 @@ Mark Washenberger (mark.washenberger@rackspace.com)
 Martin Geisler (martin@geisler.net)
 Matthew Oliver (matt@oliver.net.au)
 Matthieu Huin (mhu@enovance.com)
+Meuh (fabien+swift@bagard.xyz)
 Mike Widman (mwidman@endurancewindpower.com)
 Min Min Ren (rminmin@cn.ibm.com)
 mmcardle (mark.mcardle@sohonet.com)
@@ -101,8 +112,11 @@ Nguyen Hung Phuong (phuongnh@vn.fujitsu.com)
 Nick Craig-Wood (nick@craig-wood.com)
 Ondrej Novy (ondrej.novy@firma.seznam.cz)
 Pallavi (pallavi.s@nectechnologies.in)
+PAPAMICA (mickael@papamica.com)
+Pavel Abalikhin (anpavl@gmail.com)
 Paul Belanger (pabelanger@redhat.com)
 Paulo Ewerton (pauloewerton@lsd.ufcg.edu.br)
+Pawel Tetera (ptetera@redhat.com)
 pengyuesheng (pengyuesheng@gohighsec.com)
 Pete Zaitcev (zaitcev@kotori.zaitcev.us)
 Peter Lisak (peter.lisak@firma.seznam.cz)
@@ -119,6 +133,7 @@ SaiKiran (saikiranveeravarapu@gmail.com)
 Sam Morrison (sorrison@gmail.com)
 Samuel Merritt (sam@swiftstack.com)
 Sean Dague (sean@dague.net)
+Sean McGinnis (sean.mcginnis@gmail.com)
 Sébastien Blaisot (sebastien@blaisot.org)
 Sergey Gotliv (sgotliv@redhat.com)
 Sergio Cazzolato (sergio.j.cazzolato@intel.com)
@@ -129,6 +144,8 @@ Shashirekha Gundur (shashirekha.j.gundur@intel.com)
 shu-mutou (shu-mutou@rf.jp.nec.com)
 Stanislav Vitkovskiy (stas.vitkovsky@gmail.com)
 Stanislaw Pitucha (stanislaw.pitucha@hpe.com)
+Stephen Finucane (stephenfin@redhat.com)
+Steve Kowalik (steven@wedontsleep.org)
 Steve Martinelli (stevemar@ca.ibm.com)
 Steven Hardy (shardy@redhat.com)
 Stuart McLaren (stuart.mclaren@hpe.com)
@@ -136,6 +153,8 @@ sunjia (sunjia@inspur.com)
 Sushil Kumar (sushil.kumar2@globallogic.com)
 tanlin (lin.tan@intel.com)
 Taurus Cheung (Taurus.Cheung@harmonicinc.com)
+Takashi Kajinami (tkajinam@redhat.com)
+Takashi Natsume (takanattie@gmail.com)
 TheSriram (sriram@klusterkloud.com)
 Thiago da Silva (thiagodasilva@gmail.com)
 Thomas Goirand (thomas@goirand.fr)
@@ -156,8 +175,11 @@ wangxiyuan (wangxiyuan@huawei.com)
 wangzhenyu (wangzy@fiberhome.com)
 Wu Wenxiang (wu.wenxiang@99cloud.net)
 wu.chunyang (wu.chunyang@99cloud.net)
+wu.shiming (wushiming@yovole.com)
+Yan Xiao (yanxiao@nvidia.com)
 YangLei (yanglyy@cn.ibm.com)
 yangxurong (yangxurong@huawei.com)
+yangyawei (yangyawei@inspur.com)
 You Yamagata (bi.yamagata@gmail.com)
 Yuan Zhou (yuan.zhou@intel.com)
 Yushiro FURUKAWA (y.furukawa_2@jp.fujitsu.com)
@@ -166,6 +188,7 @@ yuyafei (yu.yafei@zte.com.cn)
 YUZAWA Takahiko (yuzawataka@intellilink.co.jp)
 Zack M. Davis (zdavis@swiftstack.com)
 zhang-jinnan (ben.os@99cloud.net)
+zhangboye (zhangboye@inspur.com)
 zhangyanxian (zhangyanxianmail@163.com)
 zheng yin (yin.zheng@easystack.cn)
 Zhenguo Niu (zhenguo@unitedstack.com)
diff --git a/ChangeLog b/ChangeLog
index cecee2da..4b8a8fea 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,216 @@
+4.10.0
+-----
+
+* The "v1password" plugin for keystoneauth now returns v3-compatible service
+  catalogs, fixing some issues seen when using v1 auth with openstackclient.
+
+* Now tested under Python 3.14.
+
+* Removed support for the provider-specific SERVICENET. Explicitly override
+  your storage URLs if you were previously using this feature.
+
+* Various other minor improvements.
+
+
+4.9.0
+-----
+
+* The ``timeout`` parameter is now included when creating Keystoneauth Sessions.
+
+* Various other minor improvements.
+
+
+4.8.0
+-----
+
+* Auth tokens are now truncated when running with `--debug`. Added
+  `--debug-with-secrets` flag to enable previous, less-secure behavior.
+
+* Dropped support for Python 3.6.
+
+* Now tested under Python 3.13.
+
+* Various other minor bug fixes and improvements.
+
+
+4.7.0
+-----
+
+* Various minor bug fixes and improvements.
+
+
+4.6.0
+-----
+
+* Transaction IDs are included with more errors.
+
+* Now tested under Python 3.12.
+
+* Various other minor bug fixes and improvements.
+
+
+4.5.0
+-----
+
+* `swift stat --lh` now prints account quotas (including per-policy quotas)
+  in human-readable units, similar to account usage values.
+
+* Modernized some aspects of packaging, allowing wheels to be built with more
+  (and more recent) tools.
+
+* Various other minor bug fixes and improvements.
+
+
+4.4.0
+-----
+
+* Now tested under Python 3.11.
+
+
+4.3.0
+-----
+
+* Static Large Objects will now be used by default for segmented uploads
+  to clusters that support them. The new `--use-dlo` option may be used to
+  create Dynamic Large Objects, as was the previous behavior without
+  `--use-slo`.
+
+* Uploads from stdin may now be Dynamic Large Objects by using the new
+  `--use-dlo` option.
+
+* The `--timeout` option may now include 's', 'm', and 'h' suffixes similar
+  to the `tempurl` `<time>` argument.
+
+* `499 Client Disconnect` responses are now retried in a manner similar to
+  `408 Request Timeout` responses.
+
+* Requests are retried for more SSL errors. Only certificate validation
+  errors will not be retried.
+
+* If downloaded content does not match the Content-Length from response
+  headers, the reported error will now highlight Content-Length rather than
+  ETag.
+
+* Transaction IDs are now included when downloaded content does not match
+  the expectations set by response headers.
+
+* Fix an import error for some distributions by using `importlib` rather than
+  `pkg_resources` when possible.
+
+* Various other minor bug fixes and improvements.
+
+
+4.2.0
+-----
+
+* The `tempurl` subcommand may now be used to sign admin `/info` requests.
+
+* Now tested under Python 3.10.
+
+* Various other minor bug fixes and improvements.
+
+
+4.1.0
+-----
+
+* Tempurl times may now include suffixes: 's', 'm', 'h', or 'd' to indicate
+  seconds, minutes, hours, or days respectively. Times with no suffix
+  continue to be interpretted as seconds.
+
+* Rate-limit responses (498, 429) are now retried.
+
+* Added a `--skip-container-put` option when uploading.
+
+
+4.0.1
+-----
+
+* Added a new `--digest` option to `swift tempurl` to select the signature
+  algorithm to use. Default is sha256, which has been supported by default
+  since Swift 2.17.0, though older clusters may require sha1 (the previous
+  default). Use `swift capabilities` to check the `allowed_digests`.
+
+
+4.0.0
+-----
+
+* Drop support for Python 2.
+
+* Added a `--timeout` option. By default, operations wait indefinitely.
+
+* Swiftclient no longer monkey-patches the requests library.
+
+
+3.13.1
+-----
+
+* This is the final release to support Python 2.
+
+* Fix some example code.
+
+
+3.13.0
+-----
+
+* Improve account-listing formatting when containers have billions of objects.
+
+* Include storage policy information in long-formatted account listings.
+
+* Fix aggregation when listings include more than 10,000 items.
+
+* Suppress traceback logging for 404s.
+
+
+3.12.0
+-----
+
+* Various minor bug fixes and improvements.
+
+
+3.11.1
+-----
+
+* Various minor bug fixes and improvements.
+
+
+3.11.0
+-----
+
+* Fixed a file descriptor leak on Python 2 that was introduced in 3.9.0.
+
+* Transaction IDs are now included in more exceptions.
+
+* Fixed a socket leak when using some module-level functions.
+
+* `swift delete --all` now implies `--versions` to delete all old versions
+  of objects as well.
+
+* Now tested under Python 3.9.
+
+
+3.10.1
+-----
+
+* Tolerate some password-based values for `OS_AUTH_TYPE`.
+
+* Added `max_backoff` and `starting_backoff` options in the `SwiftService` API.
+
+
+3.10.0
+-----
+
+* Added support for the new object-versioning API to the `list`, `stat`,
+  `delete`, and `download` subcommands. This optional API was introduced
+  in Swift 2.24.0; for more information on the API, see
+  https://docs.openstack.org/swift/latest/middleware.html#object-versioning-api
+
+* Added support for Keystone v3 application credentials using
+  `--os-auth-type v3applicationcredential`.
+
+* Fixed an issue with capabilities-endpoint discovery when Swift is exposed as
+  a subpath on the server.
+
+
 3.9.0
 -----
 
diff --git a/README.rst b/README.rst
index c9ae3d42..869a9de2 100644
--- a/README.rst
+++ b/README.rst
@@ -1,12 +1,3 @@
-========================
-Team and repository tags
-========================
-
-.. image:: https://governance.openstack.org/tc/badges/python-swiftclient.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-.. Change things from this point on
-
 Python bindings to the OpenStack Object Storage API
 ===================================================
 
diff --git a/bin/swift b/bin/swift
deleted file mode 100755
index 77102cfa..00000000
--- a/bin/swift
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/python
-# Copyright (c) 2014 Christian Schwede <christian.schwede@enovance.com>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-import sys
-
-from swiftclient.shell import main
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/bindep.txt b/bindep.txt
deleted file mode 100644
index 17c0cd56..00000000
--- a/bindep.txt
+++ /dev/null
@@ -1,6 +0,0 @@
-# This is a cross-platform list tracking distribution packages needed by tests;
-# see https://docs.openstack.org/infra/bindep/ for additional information.
-
-pypy [test !platform:fedora]
-pypy-dev [test platform:dpkg]
-pypy-devel [test platform:rpm !platform:fedora]
diff --git a/doc/manpages/swift.1 b/doc/manpages/swift.1
index 00e1440e..f4e9804d 100644
--- a/doc/manpages/swift.1
+++ b/doc/manpages/swift.1
@@ -177,7 +177,6 @@ For examples see swift auth \-\-help.
 .PD 0
 .IP "--version              Show program's version number and exit"
 .IP "-h, --help             Show this (or any subcommand if after command) help message and exit"
-.IP "-s, --snet             Use SERVICENET internal network"
 .IP "-v, --verbose          Print more info"
 .IP "-q, --quiet            Suppress status output"
 .IP "-A AUTH, --auth=AUTH   URL for obtaining an auth token "
diff --git a/doc/source/cli/index.rst b/doc/source/cli/index.rst
index 1762989b..13d20cf4 100644
--- a/doc/source/cli/index.rst
+++ b/doc/source/cli/index.rst
@@ -20,7 +20,7 @@ swift usage
 
 .. code-block:: console
 
-   Usage: swift [--version] [--help] [--os-help] [--snet] [--verbose]
+   Usage: swift [--version] [--help] [--os-help] [--verbose]
                 [--debug] [--info] [--quiet] [--auth <auth_url>]
                 [--auth-version <auth_version> |
                     --os-identity-api-version <auth_version> ]
@@ -95,9 +95,6 @@ swift optional arguments
 ``--os-help``
   Show OpenStack authentication options.
 
-``-s, --snet``
-  Use SERVICENET internal network.
-
 ``-v, --verbose``
   Print more info.
 
diff --git a/doc/source/swiftclient.rst b/doc/source/swiftclient.rst
index 108443ae..b352b1d6 100644
--- a/doc/source/swiftclient.rst
+++ b/doc/source/swiftclient.rst
@@ -4,6 +4,7 @@ swiftclient
 ==============
 
 .. automodule:: swiftclient
+   :inherited-members:
 
 swiftclient.authv1
 ==================
@@ -15,16 +16,19 @@ swiftclient.client
 ==================
 
 .. automodule:: swiftclient.client
+   :inherited-members:
 
 swiftclient.service
 ===================
 
 .. automodule:: swiftclient.service
+   :inherited-members:
 
 swiftclient.exceptions
 ======================
 
 .. automodule:: swiftclient.exceptions
+   :inherited-members:
 
 swiftclient.multithreading
 ==========================
@@ -35,3 +39,4 @@ swiftclient.utils
 =================
 
 .. automodule:: swiftclient.utils
+   :inherited-members:
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 00000000..e63322f9
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,3 @@
+[build-system]
+requires = ["pbr>=6.0.0", "setuptools>=64"]
+build-backend = "pbr.build"
diff --git a/releasenotes/notes/4_10_0_release-8370f0dcdb8a0e11.yaml b/releasenotes/notes/4_10_0_release-8370f0dcdb8a0e11.yaml
new file mode 100644
index 00000000..fa7eca6a
--- /dev/null
+++ b/releasenotes/notes/4_10_0_release-8370f0dcdb8a0e11.yaml
@@ -0,0 +1,17 @@
+---
+features:
+  - |
+    Now tested under Python 3.14.
+
+upgrade:
+  - |
+    Removed support for the provider-specific SERVICENET. Explicitly override
+    your storage URLs if you were previously using this feature.
+
+fixes:
+  - |
+    The "v1password" plugin for keystoneauth now returns v3-compatible service
+    catalogs, fixing some issues seen when using v1 auth with openstackclient.
+
+  - |
+    Various other minor improvements.
diff --git a/releasenotes/notes/4_3_0_release.yaml b/releasenotes/notes/4_3_0_release.yaml
new file mode 100644
index 00000000..6f56bbd1
--- /dev/null
+++ b/releasenotes/notes/4_3_0_release.yaml
@@ -0,0 +1,40 @@
+---
+features:
+  - |
+    Static Large Objects will now be used by default for segmented uploads
+    to clusters that support them. The new ``--use-dlo`` option may be used to
+    create Dynamic Large Objects, as was the previous behavior without
+    ``--use-slo``.
+
+  - |
+    Uploads from stdin may now be Dynamic Large Objects by using the new
+    ``--use-dlo`` option.
+
+  - |
+    The ``--timeout`` option may now include 's', 'm', and 'h' suffixes similar
+    to the ``tempurl`` ``<time>`` argument.
+
+fixes:
+  - |
+    ``499 Client Disconnect`` responses are now retried in a manner similar to
+    ``408 Request Timeout`` responses.
+
+  - |
+    Requests are retried for more SSL errors. Only certificate validation
+    errors will not be retried.
+
+  - |
+    If downloaded content does not match the Content-Length from response
+    headers, the reported error will now highlight Content-Length rather than
+    ETag.
+
+  - |
+    Transaction IDs are now included when downloaded content does not match
+    the expectations set by response headers.
+
+  - |
+    Fix an import error for some distributions by using ``importlib`` rather than
+    ``pkg_resources`` when possible.
+
+  - |
+    Various other minor bug fixes and improvements.
diff --git a/releasenotes/notes/4_4_0_release-d731bab5982c160b.yaml b/releasenotes/notes/4_4_0_release-d731bab5982c160b.yaml
new file mode 100644
index 00000000..4b20b7b5
--- /dev/null
+++ b/releasenotes/notes/4_4_0_release-d731bab5982c160b.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Now tested under Python 3.11.
diff --git a/releasenotes/notes/4_5_0_release-b315d25b889293f2.yaml b/releasenotes/notes/4_5_0_release-b315d25b889293f2.yaml
new file mode 100644
index 00000000..69ad629e
--- /dev/null
+++ b/releasenotes/notes/4_5_0_release-b315d25b889293f2.yaml
@@ -0,0 +1,12 @@
+---
+features:
+  - |
+    ``swift stat --lh`` now prints account quotas (including per-policy quotas)
+    in human-readable units, similar to account usage values.
+
+  - |
+    Modernized some aspects of packaging, allowing wheels to be built with more
+    (and more recent) tools.
+fixes:
+  - |
+    Various other minor bug fixes and improvements.
diff --git a/releasenotes/notes/4_6_0_release-92e466eb55b80225.yaml b/releasenotes/notes/4_6_0_release-92e466eb55b80225.yaml
new file mode 100644
index 00000000..71ad26e5
--- /dev/null
+++ b/releasenotes/notes/4_6_0_release-92e466eb55b80225.yaml
@@ -0,0 +1,11 @@
+---
+features:
+  - |
+    Now tested under Python 3.12.
+
+fixes:
+  - |
+    Transaction IDs are included with more errors.
+
+  - |
+    Various other minor bug fixes and improvements.
diff --git a/releasenotes/notes/4_8_0_release-41ba0852981191c3.yaml b/releasenotes/notes/4_8_0_release-41ba0852981191c3.yaml
new file mode 100644
index 00000000..461c2eb7
--- /dev/null
+++ b/releasenotes/notes/4_8_0_release-41ba0852981191c3.yaml
@@ -0,0 +1,16 @@
+---
+features:
+  - |
+    Now tested under Python 3.13.
+
+fixes:
+  - |
+    Auth tokens are now truncated when running with ``--debug``. Added
+    ``--debug-with-secrets`` flag to enable previous, less-secure behavior.
+
+  - |
+    Various other minor bug fixes and improvements.
+
+other:
+  - |
+    Dropped support for Python 3.6.
diff --git a/releasenotes/notes/4_9_0_release-b26426108163280d.yaml b/releasenotes/notes/4_9_0_release-b26426108163280d.yaml
new file mode 100644
index 00000000..956f7d0b
--- /dev/null
+++ b/releasenotes/notes/4_9_0_release-b26426108163280d.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    The ``timeout`` parameter is now included when creating Keystoneauth Sessions.
+
+  - |
+    Various other minor improvements.
diff --git a/releasenotes/source/2023.1.rst b/releasenotes/source/2023.1.rst
new file mode 100644
index 00000000..2c9a36fa
--- /dev/null
+++ b/releasenotes/source/2023.1.rst
@@ -0,0 +1,6 @@
+===========================
+2023.1 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: unmaintained/2023.1
diff --git a/releasenotes/source/2023.2.rst b/releasenotes/source/2023.2.rst
new file mode 100644
index 00000000..a4838d7d
--- /dev/null
+++ b/releasenotes/source/2023.2.rst
@@ -0,0 +1,6 @@
+===========================
+2023.2 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2023.2
diff --git a/releasenotes/source/2024.1.rst b/releasenotes/source/2024.1.rst
new file mode 100644
index 00000000..6896656b
--- /dev/null
+++ b/releasenotes/source/2024.1.rst
@@ -0,0 +1,6 @@
+===========================
+2024.1 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: unmaintained/2024.1
diff --git a/releasenotes/source/2024.2.rst b/releasenotes/source/2024.2.rst
new file mode 100644
index 00000000..aaebcbc8
--- /dev/null
+++ b/releasenotes/source/2024.2.rst
@@ -0,0 +1,6 @@
+===========================
+2024.2 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2024.2
diff --git a/releasenotes/source/2025.1.rst b/releasenotes/source/2025.1.rst
new file mode 100644
index 00000000..3add0e53
--- /dev/null
+++ b/releasenotes/source/2025.1.rst
@@ -0,0 +1,6 @@
+===========================
+2025.1 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2025.1
diff --git a/releasenotes/source/2025.2.rst b/releasenotes/source/2025.2.rst
new file mode 100644
index 00000000..4dae18d8
--- /dev/null
+++ b/releasenotes/source/2025.2.rst
@@ -0,0 +1,6 @@
+===========================
+2025.2 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2025.2
diff --git a/releasenotes/source/2026.1.rst b/releasenotes/source/2026.1.rst
new file mode 100644
index 00000000..3d286158
--- /dev/null
+++ b/releasenotes/source/2026.1.rst
@@ -0,0 +1,6 @@
+===========================
+2026.1 Series Release Notes
+===========================
+
+.. release-notes::
+   :branch: stable/2026.1
diff --git a/releasenotes/source/index.rst b/releasenotes/source/index.rst
index f1da9a60..f736698f 100644
--- a/releasenotes/source/index.rst
+++ b/releasenotes/source/index.rst
@@ -6,6 +6,14 @@
    :maxdepth: 1
 
    current
+   2026.1
+   2025.2
+   2025.1
+   2024.2
+   2024.1
+   2023.2
+   2023.1
+   zed
    yoga
    xena
    wallaby
diff --git a/releasenotes/source/victoria.rst b/releasenotes/source/victoria.rst
index 4efc7b6f..8ce93341 100644
--- a/releasenotes/source/victoria.rst
+++ b/releasenotes/source/victoria.rst
@@ -3,4 +3,4 @@ Victoria Series Release Notes
 =============================
 
 .. release-notes::
-   :branch: stable/victoria
+   :branch: unmaintained/victoria
diff --git a/releasenotes/source/wallaby.rst b/releasenotes/source/wallaby.rst
index d77b5659..bcf35c5f 100644
--- a/releasenotes/source/wallaby.rst
+++ b/releasenotes/source/wallaby.rst
@@ -3,4 +3,4 @@ Wallaby Series Release Notes
 ============================
 
 .. release-notes::
-   :branch: stable/wallaby
+   :branch: unmaintained/wallaby
diff --git a/releasenotes/source/xena.rst b/releasenotes/source/xena.rst
index 1be85be3..d19eda48 100644
--- a/releasenotes/source/xena.rst
+++ b/releasenotes/source/xena.rst
@@ -3,4 +3,4 @@ Xena Series Release Notes
 =========================
 
 .. release-notes::
-   :branch: stable/xena
+   :branch: unmaintained/xena
diff --git a/releasenotes/source/yoga.rst b/releasenotes/source/yoga.rst
index 7cd5e908..43cafdea 100644
--- a/releasenotes/source/yoga.rst
+++ b/releasenotes/source/yoga.rst
@@ -3,4 +3,4 @@ Yoga Series Release Notes
 =========================
 
 .. release-notes::
-   :branch: stable/yoga
+   :branch: unmaintained/yoga
diff --git a/releasenotes/source/zed.rst b/releasenotes/source/zed.rst
new file mode 100644
index 00000000..6cc2b155
--- /dev/null
+++ b/releasenotes/source/zed.rst
@@ -0,0 +1,6 @@
+========================
+Zed Series Release Notes
+========================
+
+.. release-notes::
+   :branch: unmaintained/zed
diff --git a/setup.cfg b/setup.cfg
index e429b12f..4780b0bb 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -3,11 +3,17 @@ name = python-swiftclient
 summary = OpenStack Object Storage API Client Library
 description_file =
     README.rst
+long_description_content_type = text/x-rst
 license = Apache License, Version 2.0
 author = OpenStack
 author_email = openstack-discuss@lists.openstack.org
 home_page = https://docs.openstack.org/python-swiftclient/latest/
-python_requires = >=3.6
+project_urls =
+    Bug Tracker = https://bugs.launchpad.net/python-swiftclient
+    Documentation = https://docs.openstack.org/python-swiftclient/latest/
+    Release Notes = https://opendev.org/openstack/python-swiftclient/src/branch/master/ChangeLog
+    Source Code = https://opendev.org/openstack/python-swiftclient
+python_requires = >=3.7
 classifier =
     Environment :: OpenStack
     Intended Audience :: Information Technology
@@ -17,17 +23,19 @@ classifier =
     Operating System :: Microsoft :: Windows
     Programming Language :: Python
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.6
     Programming Language :: Python :: 3.7
     Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
+    Programming Language :: Python :: 3.10
+    Programming Language :: Python :: 3.11
+    Programming Language :: Python :: 3.12
+    Programming Language :: Python :: 3.13
+    Programming Language :: Python :: 3.14
     Programming Language :: Python :: 3 :: Only
 
 [files]
 packages =
     swiftclient
-scripts =
-    bin/swift
 data_files =
     share/man/man1 = doc/manpages/swift.1
 
diff --git a/swiftclient/authv1.py b/swiftclient/authv1.py
index 84bc38ae..3edb68d2 100644
--- a/swiftclient/authv1.py
+++ b/swiftclient/authv1.py
@@ -37,6 +37,7 @@
 """
 
 import datetime
+from datetime import timezone
 import json
 import time
 
@@ -52,22 +53,6 @@
 from keystoneauth1.identity import base
 
 
-# stupid stdlib...
-class _UTC(datetime.tzinfo):
-    def utcoffset(self, dt):
-        return datetime.timedelta(0)
-
-    def tzname(self, dt):
-        return "UTC"
-
-    def dst(self, dt):
-        return datetime.timedelta(0)
-
-
-UTC = _UTC()
-del _UTC
-
-
 class ServiceCatalogV1:
     def __init__(self, auth_url, storage_url, account):
         self.auth_url = auth_url
@@ -85,13 +70,15 @@ def catalog(self):
         # openstackclient wants this for the `catalog list` and
         # `catalog show` commands
         endpoints = [{
+            'interface': 'public',
             'region': 'default',
-            'publicURL': self._storage_url,
+            'url': self._storage_url,
         }]
         if self.storage_url != self._storage_url:
             endpoints.insert(0, {
+                'interface': 'public',
                 'region': 'override',
-                'publicURL': self.storage_url,
+                'url': self.storage_url,
             })
 
         return [
@@ -104,8 +91,9 @@ def catalog(self):
                 'name': 'auth',
                 'type': 'identity',
                 'endpoints': [{
+                    'interface': 'public',
                     'region': 'default',
-                    'publicURL': self.auth_url,
+                    'url': self.auth_url,
                 }],
             }
         ]
@@ -166,16 +154,18 @@ def __init__(self, auth_url, storage_url, account, username, auth_token,
             self._expires = None
         # following is used by openstackclient
         self.project_id = None
+        self.domain_id = 'default'
+        self.system_scoped = False
 
     @property
     def expires(self):
         if self._expires is None:
             return None
-        return datetime.datetime.fromtimestamp(self._expires, UTC)
+        return datetime.datetime.fromtimestamp(self._expires, timezone.utc)
 
     @property
     def issued(self):
-        return datetime.datetime.fromtimestamp(self._issued, UTC)
+        return datetime.datetime.fromtimestamp(self._issued, timezone.utc)
 
     @property
     def user_id(self):
diff --git a/swiftclient/client.py b/swiftclient/client.py
index a9130ab5..df012f9f 100644
--- a/swiftclient/client.py
+++ b/swiftclient/client.py
@@ -19,11 +19,14 @@
 import socket
 import re
 import logging
+from urllib3.exceptions import HTTPError as urllib_http_error
+
 import warnings
 
 from requests.exceptions import RequestException, SSLError
 import http.client as http_client
-from urllib.parse import quote as _quote, unquote
+from requests.structures import CaseInsensitiveDict
+from urllib.parse import quote, unquote
 from urllib.parse import urljoin, urlparse, urlunparse
 from time import sleep, time
 
@@ -181,14 +184,6 @@ def parse_header_string(data):
     return unquoted
 
 
-def quote(value, safe='/'):
-    """
-    Patched version of urllib.quote that encodes utf8 strings before quoting.
-    On Python 3, call directly urllib.parse.quote().
-    """
-    return _quote(value, safe=safe)
-
-
 def encode_utf8(value):
     if type(value) in (int, float, bool):
         # As of requests 2.11.0, headers must be byte- or unicode-strings.
@@ -217,6 +212,15 @@ def encode_meta_headers(headers):
     return ret
 
 
+class LowerKeyCaseInsensitiveDict(CaseInsensitiveDict):
+    """
+    CaseInsensitiveDict returning lower case keys for items()
+    """
+
+    def __iter__(self):
+        return iter(self._store.keys())
+
+
 class _ObjectBody:
     """
     Readable and iterable object body response wrapper.
@@ -295,7 +299,7 @@ def read(self, length=None):
         try:
             buf = self.resp.read(length)
             self.bytes_read += len(buf)
-        except (socket.error, RequestException):
+        except (socket.error, urllib_http_error, RequestException):
             if self.conn.attempts > self.conn.retries:
                 raise
         if (not buf and self.bytes_read < self.expected_length and
@@ -437,7 +441,7 @@ def putrequest(self, full_path, data=None, headers=None, files=None):
     def getresponse(self):
         """Adapt requests response to httplib interface"""
         self.resp.status = self.resp.status_code
-        old_getheader = self.resp.raw.getheader
+        old_getheader = self.resp.headers.get
 
         def _decode_header(string):
             if string is None:
@@ -486,7 +490,7 @@ def http_connection(*arg, **kwarg):
     return conn.parsed_url, conn
 
 
-def get_auth_1_0(url, user, key, snet, **kwargs):
+def get_auth_1_0(url, user, key, **kwargs):
     cacert = kwargs.get('cacert', None)
     insecure = kwargs.get('insecure', False)
     cert = kwargs.get('cert')
@@ -510,12 +514,6 @@ def get_auth_1_0(url, user, key, snet, **kwargs):
     # if we don't have a x-storage-url header and if we get a body.
     if resp.status < 200 or resp.status >= 300 or (body and not url):
         raise ClientException.from_response(resp, 'Auth GET failed', body)
-    if snet:
-        parsed = list(urlparse(url))
-        # Second item in the list is the netloc
-        netloc = parsed[1]
-        parsed[1] = 'snet-' + netloc
-        url = urlunparse(parsed)
 
     token = resp.getheader('x-storage-token', resp.getheader('x-auth-token'))
     return url, token
@@ -573,7 +571,7 @@ def get_auth_keystone(auth_url, user, key, os_options, **kwargs):
 
     filter_kwargs = {}
     service_type = os_options.get('service_type') or 'object-store'
-    endpoint_type = os_options.get('endpoint_type') or 'publicURL'
+    endpoint_type = os_options.get('endpoint_type') or 'public'
     if os_options.get('region_name'):
         filter_kwargs['attr'] = 'region'
         filter_kwargs['filter_value'] = os_options['region_name']
@@ -597,7 +595,7 @@ def get_auth_keystone(auth_url, user, key, os_options, **kwargs):
                     'application_credential_secret'),
                 application_credential_id=os_options.get(
                     'application_credential_id'))
-            sess = ksa_session.Session(auth=auth)
+            sess = ksa_session.Session(auth=auth, timeout=timeout)
             token = sess.get_token()
         except ksauthexceptions.Unauthorized:
             msg = 'Unauthorized. Check application credential id and secret.'
@@ -667,12 +665,6 @@ def get_auth(auth_url, user, key, **kwargs):
     N.B. if the optional os_options parameter includes a non-empty
     'object_storage_url' key it will override the default storage url returned
     by the auth service.
-
-    The snet parameter is used for Rackspace's ServiceNet internal network
-    implementation. In this function, it simply adds *snet-* to the beginning
-    of the host name for the returned storage URL. With Rackspace Cloud Files,
-    use of this network path causes no bandwidth charges but requires the
-    client to be running on Rackspace's ServiceNet network.
     """
     session = kwargs.get('session', None)
     auth_version = kwargs.get('auth_version', '1')
@@ -696,7 +688,6 @@ def get_auth(auth_url, user, key, **kwargs):
         storage_url, token = get_auth_1_0(auth_url,
                                           user,
                                           key,
-                                          kwargs.get('snet'),
                                           cacert=cacert,
                                           insecure=insecure,
                                           cert=cert,
@@ -743,9 +734,9 @@ def get_auth(auth_url, user, key, **kwargs):
 
 
 def resp_header_dict(resp):
-    resp_headers = {}
+    resp_headers = LowerKeyCaseInsensitiveDict()
     for header, value in resp.getheaders():
-        header = parse_header_string(header).lower()
+        header = parse_header_string(header)
         resp_headers[header] = parse_header_string(value)
     return resp_headers
 
@@ -1650,11 +1641,11 @@ class Connection:
     """
 
     def __init__(self, authurl=None, user=None, key=None, retries=5,
-                 preauthurl=None, preauthtoken=None, snet=False,
+                 preauthurl=None, preauthtoken=None,
                  starting_backoff=1, max_backoff=64, tenant_name=None,
                  os_options=None, auth_version="1", cacert=None,
                  insecure=False, cert=None, cert_key=None,
-                 ssl_compression=True, retry_on_ratelimit=False,
+                 ssl_compression=True, retry_on_ratelimit=True,
                  timeout=None, session=None, force_auth_retry=False):
         """
         :param authurl: authentication URL
@@ -1665,7 +1656,6 @@ def __init__(self, authurl=None, user=None, key=None, retries=5,
         :param preauthtoken: authentication token (if you have already
                              authenticated) note authurl/user/key/tenant_name
                              are not required when specifying preauthtoken
-        :param snet: use SERVICENET internal network default is False
         :param starting_backoff: initial delay between retries (seconds)
         :param max_backoff: maximum delay between retries (seconds)
         :param auth_version: OpenStack auth version, default is 1.0
@@ -1686,9 +1676,9 @@ def __init__(self, authurl=None, user=None, key=None, retries=5,
                                 will be made. This may provide a performance
                                 increase for https upload/download operations.
         :param retry_on_ratelimit: by default, a ratelimited connection will
-                                   raise an exception to the caller. Setting
-                                   this parameter to True will cause a retry
-                                   after a backoff.
+                                   retry after a backoff. Setting this
+                                   parameter to False will cause an exception
+                                   to be raised to the caller.
         :param timeout: The connect timeout for the HTTP connection.
         :param session: A keystoneauth session object.
         :param force_auth_retry: reset auth info even if client got unexpected
@@ -1701,7 +1691,6 @@ def __init__(self, authurl=None, user=None, key=None, retries=5,
         self.retries = retries
         self.http_conn = None
         self.attempts = 0
-        self.snet = snet
         self.starting_backoff = starting_backoff
         self.max_backoff = max_backoff
         self.auth_version = auth_version
@@ -1736,7 +1725,7 @@ def close(self):
 
     def get_auth(self):
         self.url, self.token = get_auth(self.authurl, self.user, self.key,
-                                        session=self.session, snet=self.snet,
+                                        session=self.session,
                                         auth_version=self.auth_version,
                                         os_options=self.os_options,
                                         cacert=self.cacert,
@@ -1757,7 +1746,6 @@ def get_service_auth(self):
         service_key = opts.get('service_key', None)
         return get_auth(self.authurl, service_user, service_key,
                         session=self.session,
-                        snet=self.snet,
                         auth_version=self.auth_version,
                         os_options=service_options,
                         cacert=self.cacert,
@@ -1806,8 +1794,13 @@ def _retry(self, reset_func, func, *args, **kwargs):
                           service_token=self.service_token, **kwargs)
                 self._add_response_dict(caller_response_dict, kwargs)
                 return rv
-            except SSLError:
-                raise
+            except SSLError as e:
+                self._add_response_dict(caller_response_dict, kwargs)
+                if ('certificate verify' in str(e)) or \
+                        ('hostname' in str(e)) or \
+                        self.attempts > self.retries:
+                    raise
+                self.http_conn = None
             except (socket.error, RequestException):
                 self._add_response_dict(caller_response_dict, kwargs)
                 if self.attempts > self.retries:
@@ -1829,11 +1822,13 @@ def _retry(self, reset_func, func, *args, **kwargs):
                     retried_auth = True
                 elif self.attempts > self.retries or err.http_status is None:
                     raise
-                elif err.http_status == 408:
+                elif err.http_status in (408, 499):
+                    # Server hit a timeout, so HTTP request/response framing
+                    # are likely in a bad state; trash the connection
                     self.http_conn = None
                 elif 500 <= err.http_status <= 599:
                     pass
-                elif self.retry_on_ratelimit and err.http_status == 498:
+                elif self.retry_on_ratelimit and err.http_status in (498, 429):
                     pass
                 else:
                     raise
@@ -1927,6 +1922,7 @@ def get_object(self, container, obj, resp_chunk_size=None,
             is_not_range_request and resp_chunk_size and
             self.attempts <= self.retries and
             rheaders.get('transfer-encoding') is None)
+
         if retry_is_possible:
             body = _RetryBody(body.resp, self, container, obj,
                               resp_chunk_size=resp_chunk_size,
diff --git a/swiftclient/command_helpers.py b/swiftclient/command_helpers.py
index f37040f8..20310886 100644
--- a/swiftclient/command_helpers.py
+++ b/swiftclient/command_helpers.py
@@ -15,6 +15,7 @@
 
 
 POLICY_HEADER_PREFIX = 'x-account-storage-policy-'
+PER_POLICY_QUOTA_HEADER_PREFIX = 'x-account-quota-bytes-policy-'
 
 
 def stat_account(conn, options):
@@ -38,6 +39,10 @@ def stat_account(conn, options):
         ('Objects', object_count),
         ('Bytes', bytes_used),
     ])
+    if headers.get('x-account-meta-quota-bytes'):
+        quota_bytes = prt_bytes(headers.get('x-account-meta-quota-bytes'),
+                                options['human']).lstrip()
+        items.append(('Quota Bytes', quota_bytes))
 
     policies = set()
     for header_key, header_value in headers.items():
@@ -68,6 +73,10 @@ def stat_account(conn, options):
                  options['human']
              ).lstrip()),
         ))
+        policy_quota = headers.get(PER_POLICY_QUOTA_HEADER_PREFIX + policy)
+        if policy_quota:
+            items.append(('Quota Bytes for policy "' + policy + '"',
+                          prt_bytes(policy_quota, options['human']).lstrip()))
 
     return items, headers
 
@@ -75,7 +84,10 @@ def stat_account(conn, options):
 def print_account_stats(items, headers, output_manager):
     exclude_policy_headers = []
     for header_key, header_value in headers.items():
-        if header_key.lower().startswith(POLICY_HEADER_PREFIX):
+        if header_key.lower().startswith((
+                POLICY_HEADER_PREFIX,
+                PER_POLICY_QUOTA_HEADER_PREFIX,
+        )):
             exclude_policy_headers.append(header_key)
 
     items.extend(headers_to_items(
@@ -84,7 +96,8 @@ def print_account_stats(items, headers, output_manager):
             'content-length', 'date',
             'x-account-container-count',
             'x-account-object-count',
-            'x-account-bytes-used'] + exclude_policy_headers)))
+            'x-account-bytes-used',
+            'x-account-meta-quota-bytes'] + exclude_policy_headers)))
 
     # line up the items nicely
     offset = max(len(item) for item, value in items)
diff --git a/swiftclient/multithreading.py b/swiftclient/multithreading.py
index eaccec68..9659997c 100644
--- a/swiftclient/multithreading.py
+++ b/swiftclient/multithreading.py
@@ -89,6 +89,10 @@ def error(self, msg, *fmt_args):
             msg = msg % fmt_args
         self.error_print_pool.submit(self._print_error, msg)
 
+    def error_with_txn_id(self, swift_err):
+        self.error("{}\nFailed Transaction ID: {}".format(
+            swift_err.value, swift_err.transaction_id or 'unknown'))
+
     def get_error_count(self):
         return self.error_count
 
diff --git a/swiftclient/service.py b/swiftclient/service.py
index 9d9fc594..1d73d15d 100644
--- a/swiftclient/service.py
+++ b/swiftclient/service.py
@@ -32,6 +32,9 @@
 from threading import Thread
 from queue import Queue
 from queue import Empty as QueueEmpty
+from requests.exceptions import RequestException
+from socket import error as socket_error
+from urllib3.exceptions import HTTPError as urllib_http_error
 from urllib.parse import quote
 
 import json
@@ -68,12 +71,16 @@ def __next__(self):
 
 class SwiftError(Exception):
     def __init__(self, value, container=None, obj=None,
-                 segment=None, exc=None):
+                 segment=None, exc=None, transaction_id=None):
         self.value = value
         self.container = container
         self.obj = obj
         self.segment = segment
         self.exception = exc
+        if transaction_id is None:
+            self.transaction_id = getattr(exc, 'transaction_id', None)
+        else:
+            self.transaction_id = transaction_id
 
     def __str__(self):
         value = repr(self.value)
@@ -90,14 +97,26 @@ def __repr__(self):
 
 
 def process_options(options):
+    auth_types_to_versions = {
+        'v1password': '1.0',
+        'v2password': '2.0',
+        'v3password': '3',
+        'v3applicationcredential': '3',
+    }
+
+    version_from_type = auth_types_to_versions.get(options['os_auth_type'])
+    if version_from_type:
+        options['auth_version'] = version_from_type
+
     # tolerate sloppy auth_version
     if options.get('auth_version') == '3.0':
         options['auth_version'] = '3'
     elif options.get('auth_version') == '2':
         options['auth_version'] = '2.0'
 
-    if options.get('auth_version') not in ('2.0', '3') and not all(
-            options.get(key) for key in ('auth', 'user', 'key')):
+    if options.get('auth_version') not in ('2.0', '3') and \
+            options.get('os_auth_type') != 'v1password' and \
+            not all(options.get(key) for key in ('auth', 'user', 'key')):
         # Use keystone auth if any of the new-style args are present
         if any(options.get(k) for k in (
                 'os_user_domain_id',
@@ -109,9 +128,6 @@ def process_options(options):
         else:
             options['auth_version'] = '2.0'
 
-    if options.get('os_auth_type', None) == 'v3applicationcredential':
-        options['auth_version'] == '3'
-
     # Use new-style args if old ones not present
     if not options['auth'] and options['os_auth_url']:
         options['auth'] = options['os_auth_url']
@@ -122,31 +138,31 @@ def process_options(options):
 
     # Specific OpenStack options
     options['os_options'] = {
-        'user_id': options['os_user_id'],
-        'user_domain_id': options['os_user_domain_id'],
-        'user_domain_name': options['os_user_domain_name'],
-        'tenant_id': options['os_tenant_id'],
-        'tenant_name': options['os_tenant_name'],
-        'project_id': options['os_project_id'],
-        'project_name': options['os_project_name'],
-        'project_domain_id': options['os_project_domain_id'],
-        'project_domain_name': options['os_project_domain_name'],
-        'service_type': options['os_service_type'],
-        'endpoint_type': options['os_endpoint_type'],
-        'auth_token': options['os_auth_token'],
-        'object_storage_url': options['os_storage_url'],
-        'region_name': options['os_region_name'],
-        'auth_type': options['os_auth_type'],
-        'application_credential_id':
-        options['os_application_credential_id'],
-        'application_credential_secret':
-        options['os_application_credential_secret'],
+        opt: options['os_' + opt] for opt in (
+            'user_id',
+            'user_domain_id',
+            'user_domain_name',
+            'tenant_id',
+            'tenant_name',
+            'project_id',
+            'project_name',
+            'project_domain_id',
+            'project_domain_name',
+            'service_type',
+            'endpoint_type',
+            'auth_token',
+            'region_name',
+            'auth_type',
+            'application_credential_id',
+            'application_credential_secret',
+        )
     }
+    # this one doesn't follow the same convention
+    options['os_options']['object_storage_url'] = options['os_storage_url']
 
 
 def _build_default_global_options():
     return {
-        "snet": False,
         "verbose": 1,
         "debug": False,
         "info": False,
@@ -155,6 +171,7 @@ def _build_default_global_options():
         "user": environ.get('ST_USER'),
         "key": environ.get('ST_KEY'),
         "retries": 5,
+        "retry_on_ratelimit": True,
         "force_auth_retry": False,
         "os_username": environ.get('OS_USERNAME'),
         "os_user_id": environ.get('OS_USER_ID'),
@@ -195,12 +212,13 @@ def _build_default_global_options():
 _default_local_options = {
     'sync_to': None,
     'sync_key': None,
-    'use_slo': False,
+    'use_slo': None,
     'segment_size': None,
     'segment_container': None,
     'leave_segments': False,
     'changed': None,
     'skip_identical': False,
+    'skip_container_put': False,
     'version_id': None,
     'yes_all': False,
     'read_acl': None,
@@ -270,14 +288,15 @@ def get_conn(options):
     """
     Return a connection building it from the options.
     """
+    options = dict(_default_global_options, **options)
     return Connection(options['auth'],
                       options['user'],
                       options['key'],
                       timeout=options.get('timeout'),
+                      retry_on_ratelimit=options['retry_on_ratelimit'],
                       retries=options['retries'],
                       auth_version=options['auth_version'],
                       os_options=options['os_options'],
-                      snet=options['snet'],
                       cacert=options['os_cacert'],
                       insecure=options['insecure'],
                       cert=options['os_cert'],
@@ -415,6 +434,9 @@ class _SwiftReader:
     def __init__(self, path, body, headers, checksum=True):
         self._path = path
         self._body = body
+        self._txn_id = headers.get('x-openstack-request-id')
+        if self._txn_id is None:
+            self._txn_id = headers.get('x-trans-id')
         self._actual_read = 0
         self._content_length = None
         self._actual_md5 = None
@@ -442,7 +464,9 @@ def __init__(self, path, body, headers, checksum=True):
             try:
                 self._content_length = int(headers.get('content-length'))
             except ValueError:
-                raise SwiftError('content-length header must be an integer')
+                raise SwiftError(
+                    'content-length header must be an integer',
+                    transaction_id=self._txn_id)
 
     def __iter__(self):
         for chunk in self._body:
@@ -453,19 +477,22 @@ def __iter__(self):
         self._check_contents()
 
     def _check_contents(self):
+        if (self._content_length is not None and
+                self._actual_read != self._content_length):
+            raise SwiftError(
+                'Error downloading {0}: read_length != content_length, '
+                '{1:d} != {2:d} (txn: {3})'.format(
+                    self._path, self._actual_read, self._content_length,
+                    self._txn_id or 'unknown'))
+
         if self._actual_md5 and self._expected_md5:
             etag = self._actual_md5.hexdigest()
             if etag != self._expected_md5:
-                raise SwiftError('Error downloading {0}: md5sum != etag, '
-                                 '{1} != {2}'.format(
-                                     self._path, etag, self._expected_md5))
-
-        if (self._content_length is not None and
-                self._actual_read != self._content_length):
-            raise SwiftError('Error downloading {0}: read_length != '
-                             'content_length, {1:d} != {2:d}'.format(
-                                 self._path, self._actual_read,
-                                 self._content_length))
+                raise SwiftError(
+                    'Error downloading {0}: md5sum != etag, '
+                    '{1} != {2} (txn: {3})'.format(
+                        self._path, etag, self._expected_md5,
+                        self._txn_id or 'unknown'))
 
     def bytes_read(self):
         return self._actual_read
@@ -1286,9 +1313,15 @@ def _download_object_job(self, conn, container, obj, options):
                             else:
                                 pseudodir = True
 
-                for chunk in obj_body:
-                    if fp is not None:
-                        fp.write(chunk)
+                try:
+                    for chunk in obj_body:
+                        if fp is not None:
+                            fp.write(chunk)
+                except (socket_error,
+                        urllib_http_error,
+                        RequestException) as err:
+                    raise ClientException(
+                        str(err), http_response_headers=headers)
 
                 finish_time = time()
 
@@ -1457,11 +1490,12 @@ def upload(self, container, objects, options=None):
                                 'meta': [],
                                 'header': [],
                                 'segment_size': None,
-                                'use_slo': False,
+                                'use_slo': True,
                                 'segment_container': None,
                                 'leave_segments': False,
                                 'changed': None,
                                 'skip_identical': False,
+                                'skip_container_put': False,
                                 'fail_fast': False,
                                 'dir_marker': False  # Only for None sources
                             }
@@ -1482,59 +1516,74 @@ def upload(self, container, objects, options=None):
         except ValueError:
             raise SwiftError('Segment size should be an integer value')
 
+        if segment_size and options['use_slo'] is None:
+            try:
+                cap_result = self.capabilities()
+            except ClientException:
+                # pre-info swift, maybe? assume no slo middleware
+                options['use_slo'] = False
+            else:
+                if not cap_result['success']:
+                    options['use_slo'] = False
+                else:
+                    options['use_slo'] = 'slo' in cap_result['capabilities']
+
         # Incase we have a psudeo-folder path for <container> arg, derive
         # the container name from the top path and prepend the rest to
         # the object name. (same as passing --object-name).
         container, _sep, pseudo_folder = container.partition('/')
 
-        # Try to create the container, just in case it doesn't exist. If this
-        # fails, it might just be because the user doesn't have container PUT
-        # permissions, so we'll ignore any error. If there's really a problem,
-        # it'll surface on the first object PUT.
-        policy_header = {}
-        _header = split_headers(options["header"])
-        if POLICY in _header:
-            policy_header[POLICY] = \
-                _header[POLICY]
-        create_containers = [
-            self.thread_manager.container_pool.submit(
-                self._create_container_job, container, headers=policy_header)
-        ]
+        if not options['skip_container_put']:
+            # Try to create the container, just in case it doesn't exist. If
+            # this fails, it might just be because the user doesn't have
+            # container PUT permissions, so we'll ignore any error. If there's
+            # really a problem, it'll surface on the first object PUT.
+            policy_header = {}
+            _header = split_headers(options["header"])
+            if POLICY in _header:
+                policy_header[POLICY] = \
+                    _header[POLICY]
+            create_containers = [
+                self.thread_manager.container_pool.submit(
+                    self._create_container_job, container,
+                    headers=policy_header)
+            ]
 
-        # wait for first container job to complete before possibly attempting
-        # segment container job because segment container job may attempt
-        # to HEAD the first container
-        for r in interruptable_as_completed(create_containers):
-            res = r.result()
-            yield res
+            # wait for first container job to complete before possibly
+            # attempting segment container job because segment container job
+            # may attempt to HEAD the first container
+            for r in interruptable_as_completed(create_containers):
+                res = r.result()
+                yield res
 
-        if segment_size:
-            seg_container = container + '_segments'
-            if options['segment_container']:
-                seg_container = options['segment_container']
-            if seg_container != container:
-                if not policy_header:
-                    # Since no storage policy was specified on the command
-                    # line, rather than just letting swift pick the default
-                    # storage policy, we'll try to create the segments
-                    # container with the same policy as the upload container
-                    create_containers = [
-                        self.thread_manager.container_pool.submit(
-                            self._create_container_job, seg_container,
-                            policy_source=container
-                        )
-                    ]
-                else:
-                    create_containers = [
-                        self.thread_manager.container_pool.submit(
-                            self._create_container_job, seg_container,
-                            headers=policy_header
-                        )
-                    ]
+            if segment_size:
+                seg_container = container + '_segments'
+                if options['segment_container']:
+                    seg_container = options['segment_container']
+                if seg_container != container:
+                    if not policy_header:
+                        # Since no storage policy was specified on the command
+                        # line, rather than just letting swift pick the default
+                        # storage policy, we'll try to create the segments
+                        # container with the same policy as the upload
+                        # container
+                        create_containers = [
+                            self.thread_manager.container_pool.submit(
+                                self._create_container_job, seg_container,
+                                policy_source=container
+                            )
+                        ]
+                    else:
+                        create_containers = [
+                            self.thread_manager.container_pool.submit(
+                                self._create_container_job, seg_container,
+                                headers=policy_header
+                            )
+                        ]
 
-                for r in interruptable_as_completed(create_containers):
-                    res = r.result()
-                    yield res
+                    for r in interruptable_as_completed(create_containers):
+                        res = r.result()
+                        yield res
 
         # We maintain a results queue here and a separate thread to monitor
         # the futures because we want to get results back from potential
@@ -2034,11 +2083,6 @@ def _upload_slo_manifest(conn, segment_results, container, obj, headers):
         if headers is None:
             headers = {}
         segment_results.sort(key=lambda di: di['segment_index'])
-        for seg in segment_results:
-            seg_loc = seg['segment_location'].lstrip('/')
-            if isinstance(seg_loc, str):
-                seg_loc = seg_loc.encode('utf-8')
-
         manifest_data = json.dumps([
             {
                 'path': d['segment_location'],
diff --git a/swiftclient/shell.py b/swiftclient/shell.py
index b4721fe4..0cf9dba0 100755
--- a/swiftclient/shell.py
+++ b/swiftclient/shell.py
@@ -19,6 +19,7 @@
 import io
 import json
 import logging
+from shlex import quote
 import signal
 import socket
 import warnings
@@ -31,7 +32,7 @@
 
 from swiftclient import RequestException
 from swiftclient.utils import config_true_value, generate_temp_url, \
-    prt_bytes, JSONableIterable
+    prt_bytes, parse_timeout, JSONableIterable
 from swiftclient.multithreading import OutputManager
 from swiftclient.exceptions import ClientException
 from swiftclient import __version__ as client_version
@@ -42,11 +43,6 @@
 from swiftclient.command_helpers import print_account_stats, \
     print_container_stats, print_object_stats
 
-try:
-    from shlex import quote as sh_quote
-except ImportError:
-    from pipes import quote as sh_quote
-
 BASENAME = 'swift'
 commands = ('delete', 'download', 'list', 'post', 'copy', 'stat', 'upload',
             'capabilities', 'info', 'tempurl', 'auth', 'bash_completion')
@@ -227,7 +223,7 @@ def st_delete(parser, args, output_manager, return_parser=False):
                         output_manager.error('Error Deleting: {0}: {1}'
                                              .format(p, r['error']))
         except SwiftError as err:
-            output_manager.error(err.value)
+            output_manager.error_with_txn_id(err)
 
 
 st_download_options = '''[--all] [--marker <marker>] [--prefix <prefix>]
@@ -484,11 +480,13 @@ def st_download(parser, args, output_manager, return_parser=False):
                                     "Object '%s/%s' not found", container, obj)
                                 continue
                         output_manager.error(
-                            "Error downloading object '%s/%s': %s",
-                            container, obj, error)
+                            "Error downloading object '%s/%s': %s\n"
+                            "Failed Transaction ID: %s",
+                            container, obj, error,
+                            getattr(error, 'transaction_id', 'unknown'))
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
         except Exception as e:
             output_manager.error(e)
 
@@ -670,7 +668,7 @@ def listing(stats_parts_gen=stats_parts_gen):
                         prt_bytes(totals['bytes'], human))
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_stat_options = '''[--lh] [--header <header:value>]
@@ -754,21 +752,21 @@ def st_stat(parser, args, output_manager, return_parser=False):
                                     items, headers, output_manager
                                 )
                             else:
-                                raise(stat_result["error"])
+                                raise stat_result["error"]
                     else:
                         output_manager.error(
                             'Usage: %s stat %s\n%s', BASENAME,
                             st_stat_options, st_stat_help)
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_post_options = '''[--read-acl <acl>] [--write-acl <acl>] [--sync-to <sync-to>]
                   [--sync-key <sync-key>] [--meta <name:value>]
                   [--header <header>]
                   [<container> [<object>]]
-'''
+'''  # noqa
 
 st_post_help = '''
 Updates meta information for the account, container, or object.
@@ -864,10 +862,10 @@ def st_post(parser, args, output_manager, return_parser=False):
                 else:
                     result = swift.post(container=container)
             if not result["success"]:
-                raise(result["error"])
+                raise result["error"]
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_copy_options = '''[--destination </container/object>] [--fresh-metadata]
@@ -972,14 +970,15 @@ def st_copy(parser, args, output_manager, return_parser=False):
                 return
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_upload_options = '''[--changed] [--skip-identical] [--segment-size <size>]
                     [--segment-container <container>] [--leave-segments]
                     [--object-threads <thread>] [--segment-threads <threads>]
                     [--meta <name:value>] [--header <header>] [--use-slo]
-                    [--ignore-checksum] [--object-name <object-name>]
+                    [--use-dlo] [--ignore-checksum] [--skip-container-put]
+                    [--object-name <object-name>]
                     <container> <file_or_directory> [<file_or_directory>] [...]
 '''
 
@@ -1023,13 +1022,18 @@ def st_copy(parser, args, output_manager, return_parser=False):
                         repeated. Example: -H "content-type:text/plain"
                          -H "Content-Length: 4000".
   --use-slo             When used in conjunction with --segment-size it will
-                        create a Static Large Object instead of the default
-                        Dynamic Large Object.
+                        create a Static Large Object. Deprecated; this is now
+                        the default behavior when the cluster supports it.
+  --use-dlo             When used in conjunction with --segment-size it will
+                        create a Dynamic Large Object. May be useful with old
+                        swift clusters.
+  --ignore-checksum     Turn off checksum validation for uploads.
+  --skip-container-put  Assume all necessary containers already exist; don't
+                        automatically try to create them.
   --object-name <object-name>
                         Upload file and name object to <object-name> or upload
                         dir and use <object-name> as object prefix instead of
                         folder name.
-  --ignore-checksum     Turn off checksum validation for uploads.
 '''.strip('\n')
 
 
@@ -1044,6 +1048,10 @@ def st_upload(parser, args, output_manager, return_parser=False):
         '--skip-identical', action='store_true', dest='skip_identical',
         default=False, help='Skip uploading files that are identical on '
         'both sides.')
+    parser.add_argument(
+        '--skip-container-put', action='store_true', dest='skip_container_put',
+        default=False, help='Assume all necessary containers already exist; '
+        "don't automatically try to create them.")
     parser.add_argument(
         '-S', '--segment-size', dest='segment_size', help='Upload files '
         'in segments no larger than <size> (in Bytes) and then create a '
@@ -1080,10 +1088,13 @@ def st_upload(parser, args, output_manager, return_parser=False):
         ' This option may be repeated. Example: -H "content-type:text/plain" '
         '-H "Content-Length: 4000"')
     parser.add_argument(
-        '--use-slo', action='store_true', default=False,
+        '--use-slo', action='store_true', default=None,
         help='When used in conjunction with --segment-size, it will '
-        'create a Static Large Object instead of the default '
-        'Dynamic Large Object.')
+        'create a Static Large Object.')
+    parser.add_argument(
+        '--use-dlo', action='store_false', dest="use_slo", default=None,
+        help='When used in conjunction with --segment-size, it will '
+        'create a Dynamic Large Object.')
     parser.add_argument(
         '--object-name', dest='object_name',
         help='Upload file and name object to <object-name> or upload dir and '
@@ -1155,7 +1166,7 @@ def st_upload(parser, args, output_manager, return_parser=False):
         return
 
     if from_stdin:
-        if not options['use_slo']:
+        if options['use_slo'] is None:
             options['use_slo'] = True
         if not options['segment_size']:
             options['segment_size'] = DEFAULT_STDIN_SEGMENT
@@ -1257,7 +1268,7 @@ def st_upload(parser, args, output_manager, return_parser=False):
                                 "to chunk the object")
 
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_capabilities_options = '''[--json] [<proxy_url>]
@@ -1319,7 +1330,7 @@ def _print_compo_cap(name, capabilities):
                 del capabilities['swift']
                 _print_compo_cap('Additional middleware', capabilities)
         except SwiftError as e:
-            output_manager.error(e.value)
+            output_manager.error_with_txn_id(e)
 
 
 st_info = st_capabilities
@@ -1350,24 +1361,24 @@ def st_auth(parser, args, thread_manager, return_parser=False):
     (options, args) = parse_args(parser, args)
     if options['verbose'] > 1:
         if options['auth_version'] in ('1', '1.0'):
-            print('export ST_AUTH=%s' % sh_quote(options['auth']))
-            print('export ST_USER=%s' % sh_quote(options['user']))
-            print('export ST_KEY=%s' % sh_quote(options['key']))
+            print('export ST_AUTH=%s' % quote(options['auth']))
+            print('export ST_USER=%s' % quote(options['user']))
+            print('export ST_KEY=%s' % quote(options['key']))
         else:
-            print('export OS_IDENTITY_API_VERSION=%s' % sh_quote(
+            print('export OS_IDENTITY_API_VERSION=%s' % quote(
                 options['auth_version']))
-            print('export OS_AUTH_VERSION=%s' % sh_quote(
+            print('export OS_AUTH_VERSION=%s' % quote(
                 options['auth_version']))
-            print('export OS_AUTH_URL=%s' % sh_quote(options['auth']))
+            print('export OS_AUTH_URL=%s' % quote(options['auth']))
             for k, v in sorted(options.items()):
                 if v and k.startswith('os_') and \
                         k not in ('os_auth_url', 'os_options'):
-                    print('export %s=%s' % (k.upper(), sh_quote(v)))
+                    print('export %s=%s' % (k.upper(), quote(v)))
     else:
         conn = get_conn(options)
         url, token = conn.get_auth()
-        print('export OS_STORAGE_URL=%s' % sh_quote(url))
-        print('export OS_AUTH_TOKEN=%s' % sh_quote(token))
+        print('export OS_STORAGE_URL=%s' % quote(url))
+        print('export OS_AUTH_TOKEN=%s' % quote(token))
 
 
 st_tempurl_options = '''[--absolute] [--prefix-based] [--iso8601]
@@ -1381,14 +1392,16 @@ def st_auth(parser, args, thread_manager, return_parser=False):
   <method>              An HTTP method to allow for this temporary URL.
                         Usually 'GET' or 'PUT'.
   <time>                The amount of time the temporary URL will be
-                        valid. The time can be specified in two ways:
-                        an integer representing the time in seconds or an
-                        ISO 8601 timestamp in a specific format.
-                        If --absolute is passed and time
-                        is an integer, the seconds are intepreted as the Unix
-                        timestamp when the temporary URL will expire. The ISO
-                        8601 timestamp can be specified in one of following
-                        formats:
+                        valid. The time can be specified in three ways:
+                        an integer representing the time in seconds;
+                        a number with a 's', 'm', 'h', or 'd' suffix to specify
+                        the time in seconds, minutes, hours, or days; or
+                        an ISO 8601 timestamp in a specific format.
+                        If --absolute is passed and time is an integer, the
+                        seconds are intepreted as the Unix timestamp when the
+                        temporary URL will expire.
+                        The ISO 8601 timestamp can be specified in one of
+                        following formats:
 
                         i) Complete date: YYYY-MM-DD (eg 1997-07-16)
 
@@ -1505,7 +1518,7 @@ def st_tempurl(parser, args, thread_manager, return_parser=False):
 
 Optional positional arguments:
   <command>           Swift client command to filter the flags by.
-'''.strip('\n')
+'''.strip('\n')  # noqa
 
 
 st_bash_completion_options = '''[command]
@@ -1516,7 +1529,6 @@ def st_bash_completion(parser, args, thread_manager, return_parser=False):
     if return_parser:
         return parser
 
-    global commands
     com = args[1] if len(args) > 1 else None
 
     if com:
@@ -1621,14 +1633,17 @@ def prompt_for_password():
 def parse_args(parser, args, enforce_requires=True):
     options, args = parser.parse_known_args(args or ['-h'])
     options = vars(options)
-    if enforce_requires and (options.get('debug') or options.get('info')):
+    if enforce_requires and (options.get('debug') or
+                             options.get('debug_with_secrets') or
+                             options.get('info')):
         logging.getLogger("swiftclient")
-        if options.get('debug'):
+        if options.get('debug') or options.get('debug_with_secrets'):
             logging.basicConfig(level=logging.DEBUG)
             logging.getLogger('iso8601').setLevel(logging.WARNING)
-            client_logger_settings['redact_sensitive_headers'] = False
         elif options.get('info'):
             logging.basicConfig(level=logging.INFO)
+    client_logger_settings['redact_sensitive_headers'] = not (
+        enforce_requires and options.get('debug_with_secrets'))
 
     if args and options.get('help'):
         _help = globals().get('st_%s_help' % args[0])
@@ -1707,14 +1722,17 @@ def add_default_args(parser):
                         help='Show OpenStack authentication options.')
     parser.add_argument('--os_help', action='store_true',
                         help=argparse.SUPPRESS)
-    parser.add_argument('-s', '--snet', action='store_true', dest='snet',
-                        default=False, help='Use SERVICENET internal network.')
     parser.add_argument('-v', '--verbose', action='count', dest='verbose',
                         default=1, help='Print more info.')
     parser.add_argument('--debug', action='store_true', dest='debug',
                         default=False, help='Show the curl commands and '
                         'results of all http queries regardless of result '
                         'status.')
+    parser.add_argument('--debug-with-secrets', action='store_true',
+                        dest='debug_with_secrets', default=False,
+                        help='Show the curl commands and '
+                        'results of all http queries regardless of result '
+                        'status (without truncating auth tokens).')
     parser.add_argument('--info', action='store_true', dest='info',
                         default=False, help='Show the curl commands and '
                         'results of all http queries which return an error.')
@@ -1737,7 +1755,7 @@ def add_default_args(parser):
     parser.add_argument('-K', '--key', dest='key',
                         default=environ.get('ST_KEY'),
                         help='Key for obtaining an auth token.')
-    parser.add_argument('-T', '--timeout', type=int, dest='timeout',
+    parser.add_argument('-T', '--timeout', type=parse_timeout, dest='timeout',
                         default=None,
                         help='Timeout in seconds to wait for response.')
     parser.add_argument('-R', '--retries', type=int, default=5, dest='retries',
@@ -1938,13 +1956,11 @@ def add_default_args(parser):
 def main(arguments=None):
     argv = sys_argv if arguments is None else arguments
 
-    argv = [a if isinstance(a, str) else a.decode('utf-8') for a in argv]
-
     parser = argparse.ArgumentParser(
         add_help=False, formatter_class=HelpFormatter, usage='''
-%(prog)s [--version] [--help] [--os-help] [--snet] [--verbose]
-             [--debug] [--info] [--quiet] [--auth <auth_url>]
-             [--auth-version <auth_version> |
+%(prog)s [--version] [--help] [--os-help] [--verbose]
+             [--debug] [--debug-with-secrets] [--info] [--quiet]
+             [--auth <auth_url>] [--auth-version <auth_version> |
                  --os-identity-api-version <auth_version> ]
              [--user <username>]
              [--key <api_key>] [--retries <num_retries>]
diff --git a/swiftclient/utils.py b/swiftclient/utils.py
index c865d273..39481e49 100644
--- a/swiftclient/utils.py
+++ b/swiftclient/utils.py
@@ -70,40 +70,21 @@ def prt_bytes(num_bytes, human_flag):
         return '%.1f%s' % (num, suffix)
 
 
-def generate_temp_url(path, seconds, key, method, absolute=False,
-                      prefix=False, iso8601=False, ip_range=None,
-                      digest='sha256'):
-    """Generates a temporary URL that gives unauthenticated access to the
-    Swift object.
-
-    :param path: The full path to the Swift object or prefix if
-        a prefix-based temporary URL should be generated. Example:
-        /v1/AUTH_account/c/o or /v1/AUTH_account/c/prefix.
-    :param seconds: time in seconds or ISO 8601 timestamp.
-        If absolute is False and this is the string representation of an
-        integer, then this specifies the amount of time in seconds for which
-        the temporary URL will be valid.
-        If absolute is True then this specifies an absolute time at which the
-        temporary URL will expire.
-    :param key: The secret temporary URL key set on the Swift
-        cluster. To set a key, run 'swift post -m
-        "Temp-URL-Key: <substitute tempurl key here>"'
-    :param method: A HTTP method, typically either GET or PUT, to allow
-        for this temporary URL.
-    :param absolute: if True then the seconds parameter is interpreted as a
-        Unix timestamp, if seconds represents an integer.
-    :param prefix: if True then a prefix-based temporary URL will be generated.
-    :param iso8601: if True, a URL containing an ISO 8601 UTC timestamp
-        instead of a UNIX timestamp will be created.
-    :param ip_range: if a valid ip range, restricts the temporary URL to the
-        range of ips.
-    :param digest: digest algorithm to use. Must be one of ``sha1``,
-                   ``sha256``, or ``sha512``.
-    :raises ValueError: if timestamp or path is not in valid format,
-                        or if digest is not one of ``sha1``, ``sha256``, or
-                        ``sha512``.
-    :return: the path portion of a temporary URL
-    """
+def parse_timeout(value):
+    for suffix, multiplier in (
+        ('s', 1),
+        ('m', 60),
+        ('min', 60),
+        ('h', 60 * 60),
+        ('hr', 60 * 60),
+        ('d', 24 * 60 * 60),
+    ):
+        if value.endswith(suffix):
+            return multiplier * float(value[:-len(suffix)])
+    return float(value)
+
+
+def parse_timestamp(seconds, absolute=False):
     try:
         try:
             timestamp = float(seconds)
@@ -127,6 +108,20 @@ def generate_temp_url(path, seconds, key, method, absolute=False,
                     absolute = True
                     break
 
+            if t is None and not absolute:
+                for suffix, multiplier in (
+                    ('s', 1),
+                    ('m', 60),
+                    ('min', 60),
+                    ('h', 60 * 60),
+                    ('hr', 60 * 60),
+                    ('d', 24 * 60 * 60),
+                ):
+                    if seconds.endswith(suffix):
+                        timestamp = t = int(
+                            multiplier * float(seconds[:-len(suffix)]))
+                        break
+
             if t is None:
                 raise ValueError()
         else:
@@ -137,6 +132,46 @@ def generate_temp_url(path, seconds, key, method, absolute=False,
                 raise ValueError()
     except ValueError:
         raise ValueError(TIME_ERRMSG)
+    return timestamp, absolute
+
+
+def generate_temp_url(path, seconds, key, method, absolute=False,
+                      prefix=False, iso8601=False, ip_range=None,
+                      digest='sha256'):
+    """Generates a temporary URL that gives unauthenticated access to the
+    Swift object.
+
+    :param path: The full path to the Swift object or prefix if
+        a prefix-based temporary URL should be generated. Example:
+        /v1/AUTH_account/c/o or /v1/AUTH_account/c/prefix.
+    :param seconds: time in seconds or ISO 8601 timestamp.
+        If absolute is False and this is the string representation of an
+        integer, then this specifies the amount of time in seconds for which
+        the temporary URL will be valid. This may include a suffix to scale
+        the value: 's' for seconds, 'm' (or 'min') for minutes,
+        'h' (or 'hr') for hours, or 'd' for days.
+        If absolute is True then this specifies an absolute time at which the
+        temporary URL will expire.
+    :param key: The secret temporary URL key set on the Swift
+        cluster. To set a key, run 'swift post -m
+        "Temp-URL-Key: <substitute tempurl key here>"'
+    :param method: A HTTP method, typically either GET or PUT, to allow
+        for this temporary URL.
+    :param absolute: if True then the seconds parameter is interpreted as a
+        Unix timestamp, if seconds represents an integer.
+    :param prefix: if True then a prefix-based temporary URL will be generated.
+    :param iso8601: if True, a URL containing an ISO 8601 UTC timestamp
+        instead of a UNIX timestamp will be created.
+    :param ip_range: if a valid ip range, restricts the temporary URL to the
+        range of ips.
+    :param digest: digest algorithm to use. Must be one of ``sha1``,
+                   ``sha256``, or ``sha512``.
+    :raises ValueError: if timestamp or path is not in valid format,
+                        or if digest is not one of ``sha1``, ``sha256``, or
+                        ``sha512``.
+    :return: the path portion of a temporary URL
+    """
+    timestamp, absolute = parse_timestamp(seconds, absolute)
 
     if isinstance(path, bytes):
         try:
@@ -152,7 +187,11 @@ def generate_temp_url(path, seconds, key, method, absolute=False,
         raise ValueError('digest must be one of sha1, sha256, or sha512')
 
     parts = path_for_body.split('/', 4)
-    if len(parts) != 5 or parts[0] or not all(parts[1:(4 if prefix else 5)]):
+    if path_for_body == '/info':
+        # /info signatures do not support prefixes or ip ranges
+        prefix = False
+        ip_range = None
+    elif len(parts) != 5 or parts[0] or not all(parts[1:(4 if prefix else 5)]):
         if prefix:
             raise ValueError('path must at least contain /v1/a/c/')
         else:
@@ -199,8 +238,12 @@ def generate_temp_url(path, seconds, key, method, absolute=False,
         expiration = time.strftime(
             EXPIRES_ISO8601_FORMAT, time.gmtime(expiration))
 
-    temp_url = '{path}?temp_url_sig={sig}&temp_url_expires={exp}'.format(
-        path=path_for_body, sig=sig, exp=expiration)
+    if path_for_body == '/info':
+        temp_url = '{path}?swiftinfo_sig={sig}&swiftinfo_expires={exp}'.format(
+            path=path_for_body, sig=sig, exp=expiration)
+    else:
+        temp_url = '{path}?temp_url_sig={sig}&temp_url_expires={exp}'.format(
+            path=path_for_body, sig=sig, exp=expiration)
 
     if ip_range:
         temp_url += '&temp_url_ip_range={}'.format(ip_range)
diff --git a/swiftclient/version.py b/swiftclient/version.py
index 6f01f369..4a03ce98 100644
--- a/swiftclient/version.py
+++ b/swiftclient/version.py
@@ -12,16 +12,30 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import pkg_resources
+version_string = None
 
+# First, try to get our version out of PKG-INFO. If we're installed,
+# this'll let us find our version without pulling in pbr. After all, if
+# we're installed on a system, we're not in a Git-managed source tree, so
+# pbr doesn't really buy us anything.
 try:
-    # First, try to get our version out of PKG-INFO. If we're installed,
-    # this will let us find our version without pulling in pbr. After all, if
-    # we're installed on a system, we're not in a Git-managed source tree, so
-    # pbr doesn't really buy us anything.
-    version_string = pkg_resources.get_provider(
-        pkg_resources.Requirement.parse('python-swiftclient')).version
-except pkg_resources.DistributionNotFound:
+    import importlib.metadata
+except ImportError:
+    # python < 3.8
+    import pkg_resources
+    try:
+        version_string = pkg_resources.get_provider(
+            pkg_resources.Requirement.parse('python-swiftclient')).version
+    except pkg_resources.DistributionNotFound:
+        pass
+else:
+    try:
+        version_string = importlib.metadata.distribution(
+            'python-swiftclient').version
+    except importlib.metadata.PackageNotFoundError:
+        pass
+
+if version_string is None:
     # No PKG-INFO? We're probably running from a checkout, then. Let pbr do
     # its thing to figure out a version number.
     import pbr.version
diff --git a/test-requirements.txt b/test-requirements.txt
index b0633eb9..11969102 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,8 @@
-hacking>=1.1.0,<1.2.0;python_version<'3.0' # Apache-2.0
-hacking>=3.2.0,<3.3.0;python_version>='3.0' # Apache-2.0
+hacking>=3.2.0,<8.2.0 # Apache-2.0
 
-coverage!=4.4,>=4.0 # Apache-2.0
+coverage!=4.4,>=4.0   # Apache-2.0
+python-keystoneclient>=0.7.0
 keystoneauth1>=3.4.0  # Apache-2.0
 stestr>=2.0.0,!=3.0.0 # Apache-2.0
-openstacksdk>=0.11.0 # Apache-2.0
+openstacksdk>=0.11.0  # Apache-2.0
+python-openstackclient>=3.12.0  # Apache-2.0
diff --git a/test/functional/test_openstackclient.py b/test/functional/test_openstackclient.py
new file mode 100644
index 00000000..14574251
--- /dev/null
+++ b/test/functional/test_openstackclient.py
@@ -0,0 +1,62 @@
+# Copyright (c) 2025 NVIDIA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import subprocess
+import unittest
+
+from . import TEST_CONFIG
+
+
+class TestOpenStackClient(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        # NB: Only runs for v1 auth, to exercise our keystoneauth plugin
+        cls.skip_tests = (TEST_CONFIG is None or
+                          TEST_CONFIG['auth_version'] != '1')
+        cls.env = {
+            'OS_AUTH_TYPE': 'v1password',
+            'OS_AUTH_URL': TEST_CONFIG['auth_url'] or '',
+            'OS_USERNAME': TEST_CONFIG['account_username'] or '',
+            'OS_PASSWORD': TEST_CONFIG['password'] or '',
+            'OS_CACERT': TEST_CONFIG['cacert'] or '',
+        }
+        if 'PATH' in os.environ:
+            cls.env['PATH'] = os.environ['PATH']
+
+    def setUp(self):
+        if self.skip_tests:
+            raise unittest.SkipTest('SKIPPING V1-AUTH TESTS')
+
+    def _run(self, *args):
+        subprocess.run(args, env=self.env, check=True)
+
+    def test_token_issue(self):
+        self._run('openstack', 'token', 'issue')
+
+    def test_catalog_list(self):
+        self._run('openstack', 'catalog', 'list')
+
+    def test_catalog_show(self):
+        self._run('openstack', 'catalog', 'show', 'swift')
+        self._run('openstack', 'catalog', 'show', 'object-store')
+        self._run('openstack', 'catalog', 'show', 'auth')
+
+    def test_account_show(self):
+        self._run('openstack', 'object', 'store', 'account', 'show')
+        # If account show works and the openstacksdk tests work, presumably
+        # container/object commands work, too
+
+    # service list? endpoint list?
diff --git a/test/functional/test_swiftclient.py b/test/functional/test_swiftclient.py
index 91e31af0..a5c1211c 100644
--- a/test/functional/test_swiftclient.py
+++ b/test/functional/test_swiftclient.py
@@ -332,7 +332,7 @@ def test_download_object_retry_chunked(self):
                                           resp_chunk_size=resp_chunk_size)
         data = next(body)
         self.assertEqual(self.test_data[:resp_chunk_size], data)
-        self.assertTrue(1, self.conn.attempts)
+        self.assertEqual(1, self.conn.attempts)
         for chunk in body.resp:
             # Flush remaining data from underlying response
             # (simulate a dropped connection)
@@ -369,13 +369,13 @@ def test_download_object_non_chunked(self):
         hdrs, body = self.conn.get_object(self.containername, self.objectname)
         data = body
         self.assertEqual(self.test_data, data)
-        self.assertTrue(1, self.conn.attempts)
+        self.assertEqual(1, self.conn.attempts)
 
         hdrs, body = self.conn.get_object(self.containername, self.objectname,
                                           resp_chunk_size=0)
         data = body
         self.assertEqual(self.test_data, data)
-        self.assertTrue(1, self.conn.attempts)
+        self.assertEqual(1, self.conn.attempts)
 
     def test_post_account(self):
         self.conn.post_account({'x-account-meta-data': 'Something'})
diff --git a/test/sample.conf b/test/sample.conf
index 04dfdd9a..bdffcdb7 100644
--- a/test/sample.conf
+++ b/test/sample.conf
@@ -1,10 +1,8 @@
 [func_test]
 # sample config
 auth_uri = http://127.0.0.1:8080/auth/v1.0/
-## sample config for Swift with Keystone v2 API
-# For keystone v3 change auth_version to 3 and auth_prefix to /v3/
-#auth_version = 2
-#auth_uri = http://localhost:5000/v2.0/
+# sample config for Swift with Keystone API v3
+#auth_uri = http://localhost:5000/v3/
 
 # You may want to run tests against endpoints that use development certs
 # without installing the CA system-wide. Use this to trust an extra set
diff --git a/test/unit/test_authv1.py b/test/unit/test_authv1.py
index b4de7e0f..363ec039 100644
--- a/test/unit/test_authv1.py
+++ b/test/unit/test_authv1.py
@@ -16,10 +16,13 @@
 import json
 import unittest
 from unittest import mock
-from keystoneauth1 import plugin
-from keystoneauth1 import loading
-from keystoneauth1 import exceptions
-from swiftclient import authv1
+try:
+    from keystoneauth1 import plugin
+    from keystoneauth1 import loading
+    from keystoneauth1 import exceptions
+    from swiftclient import authv1
+except ImportError:
+    plugin = loading = exceptions = authv1 = None
 
 
 class TestDataNoAccount:
@@ -44,6 +47,10 @@ class TestDataWithAccount:
 
 
 class TestPluginLoading(TestDataNoAccount, unittest.TestCase):
+    def setUp(self):
+        if authv1 is None:
+            raise unittest.SkipTest('keystoneauth1 is not available')
+
     def test_can_load(self):
         loader = loading.get_plugin_loader('v1password')
         self.assertIsInstance(loader, authv1.PasswordLoader)
@@ -120,6 +127,8 @@ class TestPluginLoadingWithAccount(TestDataWithAccount, TestPluginLoading):
 
 class TestPlugin(TestDataNoAccount, unittest.TestCase):
     def setUp(self):
+        if authv1 is None:
+            raise unittest.SkipTest('keystoneauth1 is not available')
         self.mock_session = mock.MagicMock()
         self.mock_response = self.mock_session.get.return_value
         self.mock_response.status_code = 200
@@ -154,7 +163,7 @@ def test_get_access(self):
         self.assertEqual('object-store', catalog[0].get('type'))
         self.assertIn('endpoints', catalog[0])
         self.assertIn(self.storage_url, [
-            e.get('publicURL') for e in catalog[0]['endpoints']])
+            e.get('url') for e in catalog[0]['endpoints']])
 
     def test_get_access_with_expiry(self):
         auth_plugin = authv1.PasswordPlugin(**self.options)
diff --git a/test/unit/test_command_helpers.py b/test/unit/test_command_helpers.py
index 3e51aa90..f2846d22 100644
--- a/test/unit/test_command_helpers.py
+++ b/test/unit/test_command_helpers.py
@@ -18,6 +18,7 @@
 from unittest import mock
 
 from swiftclient import command_helpers as h
+from swiftclient.client import LowerKeyCaseInsensitiveDict
 from swiftclient.multithreading import OutputManager
 
 
@@ -245,5 +246,32 @@ def test_stat_object_verbose(self):
             ETag: 68b329da9893e34099c7d8ad5cb9c940
       Meta Color: blue
 Content-Encoding: gzip
+"""
+        self.assertOut(expected)
+
+    def test_stat_object_case_insensitive_headers(self):
+        self.options['verbose'] += 1
+        # stub head object request
+        stub_headers = LowerKeyCaseInsensitiveDict({
+            'content-length': 2 ** 20,
+            'x-object-meta-color': 'blue',
+            'ETag': '68b329da9893e34099c7d8ad5cb9c940',
+            'content-encoding': 'gzip',
+        })
+        self.conn.head_object.return_value = stub_headers
+        args = ('c', 'o')
+        with self.output_manager as output_manager:
+            items, headers = h.stat_object(self.conn, self.options, *args)
+            h.print_object_stats(items, headers, output_manager)
+        expected = """
+             URL: http://storage/v1/a/c/o
+      Auth Token: tk12345
+         Account: a
+       Container: c
+          Object: o
+  Content Length: 1048576
+            ETag: 68b329da9893e34099c7d8ad5cb9c940
+      Meta Color: blue
+Content-Encoding: gzip
 """
         self.assertOut(expected)
diff --git a/test/unit/test_multithreading.py b/test/unit/test_multithreading.py
index d51bfb7c..8237d829 100644
--- a/test/unit/test_multithreading.py
+++ b/test/unit/test_multithreading.py
@@ -216,12 +216,11 @@ def test_printers(self):
         # The threads should have been cleaned up
         self.assertEqual(starting_thread_count, threading.active_count())
 
-        over_the = "over the '\u062a\u062a'\n"
         self.assertEqual(''.join([
             'one-argument\n',
             'one fish, 88 fish\n',
             'some\n', 'where\n',
-            over_the,
+            "over the '\u062a\u062a'\n",
             'some raw bytes: \u062a\u062a',
             '           key: value\n',
             '        object: O\u0308bject\n'
diff --git a/test/unit/test_service.py b/test/unit/test_service.py
index 1176a1f8..a6f1ab73 100644
--- a/test/unit/test_service.py
+++ b/test/unit/test_service.py
@@ -31,7 +31,9 @@
 
 import swiftclient
 import swiftclient.utils as utils
-from swiftclient.client import Connection, ClientException
+from swiftclient.client import (
+    Connection, ClientException, LowerKeyCaseInsensitiveDict
+)
 from swiftclient.service import (
     SwiftService, SwiftError, SwiftUploadObject, SwiftDeleteObject
 )
@@ -167,8 +169,10 @@ def test_create_with_content_length(self):
         self.assertIsNone(sr._actual_md5)
 
         # Check Contentlength raises error if it isn't an integer
-        self.assertRaises(SwiftError, self.sr, 'path', 'body',
-                          {'content-length': 'notanint'})
+        with self.assertRaises(SwiftError) as cm:
+            self.sr('path', 'body', {'content-length': 'notanint'})
+        self.assertEqual("'content-length header must be an integer'",
+                         str(cm.exception))
 
     def test_iterator_usage(self):
         def _consume(sr):
@@ -196,8 +200,36 @@ def _consume(sr):
 
         # Check error is raised if SwiftReader doesn't read the same length
         # as the content length it is created with
-        sr = self.sr('path', BytesIO(b'body'), {'content-length': 5})
-        self.assertRaises(SwiftError, _consume, sr)
+        sr = self.sr('path', BytesIO(b'body'), {'content-length': 5,
+                                                'etag': 'bad etag'})
+        with self.assertRaises(SwiftError) as cm:
+            _consume(sr)
+        self.assertEqual(
+            "'Error downloading path: read_length != content_length, "
+            "4 != 5 (txn: unknown)'",
+            str(cm.exception))
+
+        # Check error includes txn id if available
+        sr = self.sr('path', BytesIO(b'body'), {'content-length': 5,
+                                                'etag': 'bad etag',
+                                                'x-trans-id': 'uuid'})
+        with self.assertRaises(SwiftError) as cm:
+            _consume(sr)
+        self.assertEqual(
+            "'Error downloading path: read_length != content_length, "
+            "4 != 5 (txn: uuid)'",
+            str(cm.exception))
+
+        # Check error is raised if SwiftReader doesn't calculate the expected
+        # hash
+        sr = self.sr('path', BytesIO(b'body'), {'content-length': 4,
+                                                'etag': 'bad etag'})
+        with self.assertRaises(SwiftError) as cm:
+            _consume(sr)
+        self.assertEqual(
+            "'Error downloading path: md5sum != etag, "
+            "841a2d689ad86bd1611447453c22c6fc != bad etag (txn: unknown)'",
+            str(cm.exception))
 
         sr = self.sr('path', BytesIO(b'body'), {'content-length': 4})
         _consume(sr)
@@ -211,6 +243,26 @@ def _consume(sr):
         self.assertEqual(sr._actual_md5.hexdigest(),
                          md5('abc'.encode() * 3).hexdigest())
 
+    def test_swift_reader_knows_slo_etag_is_not_md5(self):
+        segment_bodies = [b'abc', b'def', b'ghi']
+        # slo etag is md5 of the sum of md5 of segments
+        slo_etag = md5(b''.join(
+            md5(b).hexdigest().encode()
+            for b in segment_bodies
+        )).hexdigest()
+        headers = LowerKeyCaseInsensitiveDict({
+            'Content-Length': len(b''.join(segment_bodies)),
+            'X-Static-Large-Object': 'true',
+            'ETag': '"%s"' % slo_etag
+        })
+        sr = self.sr('path', segment_bodies, headers)
+        # x-static-large-object; so no exception is raised!
+        actual_md5 = md5(b''.join(sr)).hexdigest()
+        self.assertEqual(sr._actual_read, 9)
+        self.assertIsNone(sr._actual_md5)
+        self.assertEqual(actual_md5,
+                         md5(b''.join(segment_bodies)).hexdigest())
+
 
 class _TestServiceBase(unittest.TestCase):
     def _get_mock_connection(self, attempts=2):
@@ -625,6 +677,7 @@ def test_empty_swifterror_creation(self):
         self.assertIsNone(se.exception)
 
         self.assertEqual(str(se), '5')
+        self.assertNotIn(str(se), 'Transaction ID')
 
     def test_swifterror_creation(self):
         test_exc = Exception('test exc')
@@ -637,6 +690,25 @@ def test_swifterror_creation(self):
         self.assertEqual(se.exception, test_exc)
 
         self.assertEqual(str(se), '5 container:con object:obj segment:seg')
+        self.assertNotIn(str(se), 'Transaction ID')
+
+    def test_swifterror_clientexception_creation(self):
+        test_exc = ClientException(
+            Exception('test exc'),
+            http_response_headers=LowerKeyCaseInsensitiveDict({
+                'x-trans-id': 'someTransId'})
+        )
+        se = SwiftError(5, 'con', 'obj', 'seg', test_exc)
+
+        self.assertEqual(se.value, 5)
+        self.assertEqual(se.container, 'con')
+        self.assertEqual(se.obj, 'obj')
+        self.assertEqual(se.segment, 'seg')
+        self.assertEqual(se.exception, test_exc)
+
+        self.assertEqual('someTransId', se.transaction_id)
+        self.assertNotIn('someTransId', str(se))
+        self.assertIn('5 container:con object:obj segment:seg', str(se))
 
 
 class TestServiceUtils(unittest.TestCase):
@@ -1302,7 +1374,7 @@ def test_upload_stream(self, mock_conn):
             options)
         responses = [x for x in resp_iter]
         for resp in responses:
-            self.assertFalse('error' in resp)
+            self.assertNotIn('error', resp)
             self.assertTrue(resp['success'])
         self.assertEqual(5, len(responses))
         container_resp, segment_container_resp = responses[0:2]
@@ -1382,7 +1454,7 @@ def open_wrapper(*a, **kw):
             self.assertTrue(fp.closed,
                             'Failed to close open(%s)' % formatted_args)
 
-    def test_upload_object_job_file_with_unicode_path(self):
+    def test_upload_dlo_job_file_with_unicode_path(self):
         # Uploading a file results in the file object being wrapped in a
         # LengthWrapper. This test sets the options in such a way that much
         # of _upload_object_job is skipped bringing the critical path down
@@ -1443,6 +1515,84 @@ def test_upload_object_job_file_with_unicode_path(self):
                                                     headers={},
                                                     response_dict={})
 
+    def test_upload_slo_job_file_with_unicode_path(self):
+        # Uploading a file results in the file object being wrapped in a
+        # LengthWrapper. This test sets the options in such a way that much
+        # of _upload_object_job is skipped bringing the critical path down
+        # to around 60 lines to ease testing.
+        with tempfile.NamedTemporaryFile() as f:
+            f.write(b'a' * 30)
+            f.flush()
+            expected_r = {
+                'action': 'upload_object',
+                'attempts': 2,
+                'container': 'test_c',
+                'headers': {},
+                'large_object': True,
+                'object': 'テスト/dummy.dat',
+                'manifest_response_dict': {},
+                'segment_results': [
+                    {'action': 'upload_segment',
+                     'success': True,
+                     'segment_index': i,
+                     'segment_location': 'test_c+segments/slo/%d' % i,
+                     'segment_etag': 'part-etag',
+                     'segment_size': 1000 + i}
+                    for i in range(3)],
+                'status': 'uploaded',
+                'success': True,
+            }
+            expected_mtime = '%f' % os.path.getmtime(f.name)
+
+            mock_conn = mock.Mock()
+            mock_conn.put_object.return_value = ''
+            type(mock_conn).attempts = mock.PropertyMock(return_value=2)
+
+            s = SwiftService()
+            with mock.patch.object(s, '_upload_segment_job') as mock_job:
+                mock_job.side_effect = [
+                    {'action': 'upload_segment',
+                     'success': True,
+                     'segment_index': i,
+                     'segment_location': 'test_c+segments/slo/%d' % i,
+                     'segment_etag': 'part-etag',
+                     'segment_size': 1000 + i}
+                    for i in range(3)]
+
+                r = s._upload_object_job(conn=mock_conn,
+                                         container='test_c',
+                                         source=f.name,
+                                         obj='テスト/dummy.dat',
+                                         options=dict(s._options,
+                                                      segment_size=10,
+                                                      leave_segments=True,
+                                                      use_slo=True))
+
+            mtime = r['headers']['x-object-meta-mtime']
+            self.assertEqual(expected_mtime, mtime)
+            del r['headers']['x-object-meta-mtime']
+
+            self.assertEqual(r['path'], f.name)
+            del r['path']
+
+            self.assertEqual(r, expected_r)
+            self.assertEqual(mock_conn.put_object.call_count, 1)
+            mock_conn.put_object.assert_called_with(
+                'test_c',
+                'テスト/dummy.dat',
+                ' '.join([
+                    '[{"path": "test_c+segments/slo/0",',
+                    '"etag": "part-etag", "size_bytes": 1000},',
+                    '{"path": "test_c+segments/slo/1",',
+                    '"etag": "part-etag", "size_bytes": 1001},',
+                    '{"path": "test_c+segments/slo/2",',
+                    '"etag": "part-etag", "size_bytes": 1002}]',
+                ]),
+                query_string='multipart-manifest=put',
+                headers={},
+                response_dict={},
+            )
+
     def test_upload_segment_job(self):
         with tempfile.NamedTemporaryFile() as f:
             f.write(b'a' * 10)
diff --git a/test/unit/test_shell.py b/test/unit/test_shell.py
index db0d66c3..e097ad68 100644
--- a/test/unit/test_shell.py
+++ b/test/unit/test_shell.py
@@ -15,6 +15,7 @@
 
 import io
 import contextlib
+import socket
 from genericpath import getmtime
 import getpass
 import hashlib
@@ -26,8 +27,11 @@
 from unittest import mock
 import textwrap
 from time import localtime, mktime, strftime, strptime
+from requests.exceptions import RequestException
+from urllib3.exceptions import HTTPError
 
 import swiftclient
+from swiftclient.client import LowerKeyCaseInsensitiveDict
 from swiftclient.service import SwiftError
 import swiftclient.shell
 import swiftclient.utils
@@ -159,6 +163,34 @@ def test_stat_account(self, connection):
                              '   Objects: 2\n'
                              '     Bytes: 3\n')
 
+    @mock.patch('swiftclient.service.Connection')
+    def test_stat_account_with_quota(self, connection):
+        argv = ["", "stat", "--lh"]
+        return_headers = {
+            'x-account-container-count': '2000',
+            'x-account-object-count': '3000',
+            'x-account-bytes-used': '4000000',
+            'x-account-storage-policy-gold-bytes-used': '4000',
+            'x-account-meta-quota-bytes': '5000000',
+            'x-account-quota-bytes-policy-gold': '5000',
+            'content-length': 0,
+            'date': ''}
+        connection.return_value.head_account.return_value = return_headers
+        connection.return_value.url = 'http://127.0.0.1/v1/AUTH_account'
+        with CaptureOutput() as output:
+            swiftclient.shell.main(argv)
+
+            self.assertEqual(
+                output.out,
+                '                      Account: AUTH_account\n'
+                '                   Containers: 2000\n'
+                '                      Objects: 2.9K\n'
+                '                        Bytes: 3.8M\n'
+                '                  Quota Bytes: 4.8M\n'
+                '     Objects in policy "gold": 0\n'
+                '       Bytes in policy "gold": 3.9K\n'
+                'Quota Bytes for policy "gold": 4.9K\n')
+
     @mock.patch('swiftclient.service.Connection')
     def test_stat_account_with_headers(self, connection):
         argv = ["", "stat", "-H", "Skip-Middleware: Test"]
@@ -207,6 +239,28 @@ def test_stat_container(self, connection):
                              '  Sync To: other\n'
                              ' Sync Key: secret\n')
 
+    @mock.patch('swiftclient.service.Connection')
+    def test_stat_container_not_found(self, connection):
+        connection.return_value.head_container.side_effect = \
+            swiftclient.ClientException(
+                'test',
+                http_status=404,
+                http_response_headers=LowerKeyCaseInsensitiveDict({
+                    'x-trans-id': 'someTransId'})
+            )
+        argv = ["", "stat", "container"]
+
+        with CaptureOutput() as output:
+            with self.assertRaises(SystemExit):
+                swiftclient.shell.main(argv)
+                connection.return_value.head_container.assert_called_with(
+                    'container', headers={}, resp_chunk_size=65536,
+                    response_dict={})
+
+            self.assertIn('Container \'container\' not found\n'
+                          'Failed Transaction ID: someTransId',
+                          output.err)
+
     @mock.patch('swiftclient.service.Connection')
     def test_stat_container_with_headers(self, connection):
         return_headers = {
@@ -285,6 +339,27 @@ def test_stat_object(self, connection):
                              '          ETag: md5\n'
                              '      Manifest: manifest\n')
 
+    @mock.patch('swiftclient.service.Connection')
+    def test_stat_object_not_found(self, connection):
+        connection.return_value.head_object.side_effect = \
+            swiftclient.ClientException(
+                'test', http_status=404,
+                http_response_headers=LowerKeyCaseInsensitiveDict({
+                    'x-trans-id': 'someTransId'})
+            )
+        argv = ["", "stat", "container", "object"]
+
+        with CaptureOutput() as output:
+            with self.assertRaises(SystemExit):
+                swiftclient.shell.main(argv)
+                connection.return_value.head_object.assert_called_with(
+                    'container', 'object', headers={}, resp_chunk_size=65536,
+                    response_dict={})
+
+            self.assertIn('test: 404\n'
+                          'Failed Transaction ID: someTransId',
+                          output.err)
+
     @mock.patch('swiftclient.service.Connection')
     def test_stat_object_with_headers(self, connection):
         return_headers = {
@@ -707,11 +782,122 @@ def test_download(self, connection, makedirs):
             swiftclient.shell.main(argv)
             self.assertEqual('objcontent', output.out)
 
+    def _do_test_download_clientexception(self, exc):
+        retry_calls = []
+
+        def _fake_retry(conn, *args, **kwargs):
+            retry_calls.append((args, kwargs))
+            conn.attempts += 1
+
+            body = mock.MagicMock()
+            body.resp.read.side_effect = RequestException('test_exc')
+            return (LowerKeyCaseInsensitiveDict({
+                'content-type': 'text/plain',
+                'etag': '2cbbfe139a744d6abbe695e17f3c1991',
+                'x-trans-id': 'someTransId'}),
+                body)
+
+        argv = ["", "download", "container", "object", "--retries", "1"]
+        with CaptureOutput() as output:
+            with mock.patch(BUILTIN_OPEN) as mock_open:
+                with mock.patch("swiftclient.service.Connection._retry",
+                                _fake_retry):
+                    with self.assertRaises(SystemExit):
+                        swiftclient.shell.main(argv)
+                    mock_open.assert_called_with('object', 'wb', 65536)
+            self.assertEqual([
+                ((None, swiftclient.client.get_object, 'container', 'object'),
+                 {'headers': {},
+                  'query_string': None,
+                  'resp_chunk_size': 65536,
+                  'response_dict': {}}),
+                ((None, swiftclient.client.get_object, 'container', 'object'),
+                 {'attempts': 1,
+                  'headers': {'If-Match': mock.ANY, 'Range': 'bytes=0-'},
+                  'query_string': None,
+                  'resp_chunk_size': 65536,
+                  'response_dict': {}})],
+                retry_calls)
+            self.assertIn('Error downloading object \'container/object\': '
+                          'test_exc',
+                          str(output.err))
+            self.assertIn('someTransId', str(output.err))
+
+    def test_download_request_exception(self):
+        self._do_test_download_clientexception(RequestException('text_exc'))
+
+    def test_download_socket_error(self):
+        self._do_test_download_clientexception(socket.error())
+
+    def test_download_http_error(self):
+        self._do_test_download_clientexception(HTTPError)
+
+    def test_download_request_exception_retries_0(self):
+        retry_calls = []
+
+        def _fake_retry(conn, *args, **kwargs):
+            retry_calls.append((args, kwargs))
+            conn.attempts += 1
+
+            body = mock.MagicMock()
+            body.__iter__.side_effect = RequestException('test_exc')
+            return (LowerKeyCaseInsensitiveDict({
+                'content-type': 'text/plain',
+                'etag': '2cbbfe139a744d6abbe695e17f3c1991',
+                'x-trans-id': 'someTransId'}),
+                body)
+
+        argv = ["", "download", "container", "object", "--retries", "0"]
+        with CaptureOutput() as output:
+            with mock.patch(BUILTIN_OPEN) as mock_open:
+                with mock.patch("swiftclient.service.Connection._retry",
+                                _fake_retry):
+                    with self.assertRaises(SystemExit):
+                        swiftclient.shell.main(argv)
+                    mock_open.assert_called_with('object', 'wb', 65536)
+            self.assertEqual([
+                ((None, swiftclient.client.get_object, 'container', 'object'),
+                 {'headers': {},
+                  'query_string': None,
+                  'resp_chunk_size': 65536,
+                  'response_dict': {}}), ],
+                retry_calls)
+            self.assertIn('Error downloading object \'container/object\': '
+                          'test_exc',
+                          str(output.err))
+            self.assertIn('someTransId', str(output.err))
+
+    @mock.patch('swiftclient.service.Connection')
+    def test_download_bad_content_length(self, connection):
+        objcontent = io.BytesIO(b'objcontent')
+        connection.return_value.get_object.side_effect = [
+            (LowerKeyCaseInsensitiveDict({
+                'content-type': 'text/plain',
+                'content-length': 'BAD',
+                'etag': '2cbbfe139a744d6abbe695e17f3c1991',
+                'x-trans-id': 'someTransId'}),
+             objcontent)
+        ]
+        with CaptureOutput() as output:
+            with self.assertRaises(SystemExit):
+                with mock.patch(BUILTIN_OPEN) as mock_open:
+                    argv = ["", "download", "container", "object"]
+                    swiftclient.shell.main(argv)
+                connection.return_value.get_object.assert_called_with(
+                    'container', 'object', headers={}, resp_chunk_size=65536,
+                    response_dict={})
+                mock_open.assert_called_with('object', 'wb', 65536)
+
+            self.assertIn("Error downloading object \'container/object\': "
+                          "'content-length header must be an integer'"
+                          "\nFailed Transaction ID: someTransId",
+                          str(output.err))
+
     @mock.patch('swiftclient.service.shuffle')
     @mock.patch('swiftclient.service.Connection')
     def test_download_shuffle(self, connection, mock_shuffle):
         # Test that the container and object lists are shuffled
-        mock_shuffle.side_effect = lambda l: l
+        mock_shuffle.side_effect = lambda to_shuffle: to_shuffle
         connection.return_value.get_object.return_value = [
             {'content-type': 'text/plain',
              'etag': EMPTY_ETAG},
@@ -861,17 +1047,19 @@ def test_upload(self, connection, walk):
         # Upload in segments
         connection.return_value.head_container.return_value = {
             'x-storage-policy': 'one'}
-        argv = ["", "upload", "container", self.tmpfile, "-S", "10"]
+        argv = ["", "upload", "container", self.tmpfile,
+                "-S", "10", "--use-dlo"]
         with open(self.tmpfile, "wb") as fh:
             fh.write(b'12345678901234567890')
         swiftclient.shell.main(argv)
         expected_calls = [mock.call('container',
-                                    {'X-Storage-Policy': mock.ANY},
+                                    {'X-Storage-Policy': 'one'},
                                     response_dict={}),
                           mock.call('container_segments',
-                                    {'X-Storage-Policy': mock.ANY},
+                                    {'X-Storage-Policy': 'one'},
                                     response_dict={})]
-        connection.return_value.put_container.has_calls(expected_calls)
+        connection.return_value.put_container.assert_has_calls(expected_calls,
+                                                               any_order=True)
         connection.return_value.put_object.assert_called_with(
             'container',
             self.tmpfile.lstrip('/'),
@@ -907,6 +1095,104 @@ def test_upload(self, connection, walk):
             query_string='multipart-manifest=put',
             response_dict=mock.ANY)
 
+        # detect no SLO
+        connection.reset_mock()
+        connection.return_value.head_container.return_value = {
+            'x-storage-policy': 'one'}
+        argv = ["", "upload", "container/pseudo-folder/nested",
+                self.tmpfile, "-S", "10"]
+        with open(self.tmpfile, "wb") as fh:
+            fh.write(b'12345678901234567890')
+        connection.return_value.get_capabilities.return_value = {}
+        swiftclient.shell.main(argv)
+        expected_calls = [mock.call('container',
+                                    {},
+                                    response_dict={}),
+                          mock.call('container_segments',
+                                    {'X-Storage-Policy': 'one'},
+                                    response_dict={})]
+        connection.return_value.put_container.assert_has_calls(expected_calls)
+        connection.return_value.put_object.assert_called_with(
+            'container',
+            'pseudo-folder/nested' + self.tmpfile,
+            '',
+            content_length=0,
+            headers={'x-object-manifest': mock.ANY,
+                     'x-object-meta-mtime': mock.ANY},
+            response_dict={})
+
+        # detect SLO
+        connection.reset_mock()
+        connection.return_value.head_container.return_value = {
+            'x-storage-policy': 'one'}
+        argv = ["", "upload", "container/pseudo-folder/nested",
+                self.tmpfile, "-S", "10"]
+        with open(self.tmpfile, "wb") as fh:
+            fh.write(b'12345678901234567890')
+        connection.return_value.get_capabilities.return_value = {
+            'slo': {},
+        }
+        swiftclient.shell.main(argv)
+        expected_calls = [mock.call('container',
+                                    {},
+                                    response_dict={}),
+                          mock.call('container_segments',
+                                    {'X-Storage-Policy': 'one'},
+                                    response_dict={})]
+        print(connection.return_value.mock_calls)
+        connection.return_value.put_container.assert_has_calls(expected_calls)
+        connection.return_value.put_object.assert_called_with(
+            'container',
+            'pseudo-folder/nested' + self.tmpfile,
+            mock.ANY,
+            headers={
+                'x-object-meta-mtime': mock.ANY,
+            },
+            query_string='multipart-manifest=put',
+            response_dict=mock.ANY)
+
+    @mock.patch('swiftclient.shell.walk')
+    @mock.patch('swiftclient.service.Connection')
+    def test_upload_skip_container_put(self, connection, walk):
+        connection.return_value.head_object.return_value = {
+            'content-length': '0'}
+        connection.return_value.put_object.return_value = EMPTY_ETAG
+        connection.return_value.attempts = 0
+        argv = ["", "upload", "container", "--skip-container-put",
+                self.tmpfile, "-H", "X-Storage-Policy:one",
+                "--meta", "Color:Blue"]
+        swiftclient.shell.main(argv)
+        connection.return_value.put_container.assert_not_called()
+
+        connection.return_value.put_object.assert_called_with(
+            'container',
+            self.tmpfile.lstrip('/'),
+            mock.ANY,
+            content_length=0,
+            headers={'x-object-meta-mtime': mock.ANY,
+                     'X-Storage-Policy': 'one',
+                     'X-Object-Meta-Color': 'Blue'},
+            response_dict={})
+
+        # Upload in segments
+        connection.return_value.head_container.return_value = {
+            'x-storage-policy': 'one'}
+        argv = ["", "upload", "container", "--skip-container-put",
+                self.tmpfile, "-S", "10", "--use-dlo"]
+        with open(self.tmpfile, "wb") as fh:
+            fh.write(b'12345678901234567890')
+        swiftclient.shell.main(argv)
+        # Both base and segments container are assumed to exist already
+        connection.return_value.put_container.assert_not_called()
+        connection.return_value.put_object.assert_called_with(
+            'container',
+            self.tmpfile.lstrip('/'),
+            '',
+            content_length=0,
+            headers={'x-object-manifest': mock.ANY,
+                     'x-object-meta-mtime': mock.ANY},
+            response_dict={})
+
     @mock.patch('swiftclient.service.SwiftService.upload')
     def test_upload_object_with_account_readonly(self, upload):
         argv = ["", "upload", "container", self.tmpfile]
@@ -1145,7 +1431,7 @@ def test_upload_segments_to_same_container(self, connection):
         connection.return_value.attempts = 0
         connection.return_value.put_object.return_value = EMPTY_ETAG
         argv = ["", "upload", "container", self.tmpfile, "-S", "10",
-                "-C", "container"]
+                "-C", "container", "--use-dlo"]
         with open(self.tmpfile, "wb") as fh:
             fh.write(b'12345678901234567890')
         swiftclient.shell.main(argv)
@@ -1622,7 +1908,7 @@ def test_delete_verbose_output_utf8(self):
         with mock.patch('swiftclient.shell.SwiftService.delete') as mock_func:
             with CaptureOutput() as out:
                 mock_func.return_value = [res]
-                swiftclient.shell.main(base_argv + [container.encode('utf-8')])
+                swiftclient.shell.main(base_argv + [container])
 
                 mock_func.assert_called_once_with(container=container)
                 self.assertTrue(out.out.find(
@@ -1635,7 +1921,7 @@ def test_delete_verbose_output_utf8(self):
         with mock.patch('swiftclient.shell.SwiftService.delete') as mock_func:
             with CaptureOutput() as out:
                 mock_func.return_value = [res]
-                swiftclient.shell.main(base_argv + [container.encode('utf-8')])
+                swiftclient.shell.main(base_argv + [container])
 
                 mock_func.assert_called_once_with(container=container)
                 self.assertTrue(out.out.find(
@@ -1802,7 +2088,9 @@ def test_post_account_not_found(self, connection):
             with self.assertRaises(SystemExit):
                 swiftclient.shell.main(argv)
 
-            self.assertEqual(output.err, 'Account not found\n')
+            self.assertEqual(
+                output.err,
+                'Account not found\nFailed Transaction ID: unknown\n')
 
     @mock.patch('swiftclient.service.Connection')
     def test_post_container(self, connection):
@@ -1994,7 +2282,8 @@ def test_copy_two_objects_bad_destination(self, connection):
             self.assertEqual(
                 output.err,
                 'Combination of multiple objects and destination '
-                'including object is invalid\n')
+                'including object is invalid\n'
+                'Failed Transaction ID: unknown\n')
 
     @mock.patch('swiftclient.service.Connection')
     def test_copy_object_bad_auth(self, connection):
@@ -2037,6 +2326,14 @@ def test_temp_url(self, temp_url):
             '/v1/AUTH_account/c/o', "60", 'secret_key', 'GET', absolute=False,
             iso8601=False, prefix=False, ip_range=None, digest='sha256')
 
+        # sanity check that suffixes will just pass through to utils.py
+        argv = ["", "tempurl", "GET", "2d", "/v1/AUTH_account/c/o",
+                "secret_key"]
+        swiftclient.shell.main(argv)
+        temp_url.assert_called_with(
+            '/v1/AUTH_account/c/o', "2d", 'secret_key', 'GET', absolute=False,
+            iso8601=False, prefix=False, ip_range=None, digest='sha256')
+
     @mock.patch('swiftclient.shell.generate_temp_url', return_value='')
     def test_temp_url_prefix_based(self, temp_url):
         argv = ["", "tempurl", "GET", "60", "/v1/AUTH_account/c/",
@@ -2350,10 +2647,23 @@ def test_option_after_posarg(self, connection, mock_logging):
         argv = ["", "stat", "--info"]
         swiftclient.shell.main(argv)
         mock_logging.assert_called_with(level=logging.INFO)
+        self.assertTrue(
+            swiftclient.logger_settings.get('redact_sensitive_headers')
+        )
 
         argv = ["", "stat", "--debug"]
         swiftclient.shell.main(argv)
         mock_logging.assert_called_with(level=logging.DEBUG)
+        self.assertTrue(
+            swiftclient.logger_settings.get('redact_sensitive_headers')
+        )
+
+        argv = ["", "stat", "--debug-with-secrets"]
+        swiftclient.shell.main(argv)
+        mock_logging.assert_called_with(level=logging.DEBUG)
+        self.assertFalse(
+            swiftclient.logger_settings.get('redact_sensitive_headers')
+        )
 
     @mock.patch('logging.basicConfig')
     @mock.patch('swiftclient.service.Connection')
@@ -2363,7 +2673,13 @@ def test_debug_trumps_info(self, connection, mock_logging):
                           ["", "--info", "stat", "--debug"],
                           ["", "--debug", "stat", "--info"],
                           ["", "--info", "--debug", "stat"],
-                          ["", "--debug", "--info", "stat"])
+                          ["", "--debug", "--info", "stat"],
+                          ["", "stat", "--info", "--debug-with-secrets"],
+                          ["", "stat", "--debug-with-secrets", "--info"],
+                          ["", "--info", "stat", "--debug-with-secrets"],
+                          ["", "--debug-with-secrets", "stat", "--info"],
+                          ["", "--info", "--debug-with-secrets", "stat"],
+                          ["", "--debug-with-secrets", "--info", "stat"])
         for argv in argv_scenarios:
             mock_logging.reset_mock()
             swiftclient.shell.main(argv)
@@ -2374,6 +2690,27 @@ def test_debug_trumps_info(self, connection, mock_logging):
                           % (mock_logging.call_args_list, argv))
 
 
+@mock.patch.dict(os.environ, mocked_os_environ)
+class TestTimeoutOption(unittest.TestCase):
+    @mock.patch('swiftclient.service.Connection')
+    def test_timeout_parsing(self, connection):
+        for timeout, expected in (
+            ("12", 12),
+            ("12.3", 12.3),
+            ("5s", 5),
+            ("25.6s", 25.6),
+            ("2m", 120),
+            ("2.5min", 150),
+            ("1h", 3600),
+            (".5hr", 1800),
+        ):
+            connection.reset_mock()
+            with self.subTest(timeout=timeout):
+                swiftclient.shell.main(["", "stat", "--timeout", timeout])
+                self.assertEqual(connection.mock_calls[0][2]['timeout'],
+                                 expected)
+
+
 class TestBase(unittest.TestCase):
     """
     Provide some common methods to subclasses
@@ -2631,6 +2968,92 @@ def test_os_identity_api_version(self):
                 swiftclient.shell.main(args)
         self._verify_opts(result[0], expected_opts, expected_os_opts, {})
 
+    def test_os_auth_type_password_implies_version(self):
+        args = ["", "stat"]
+        env = {
+            'OS_AUTH_URL': 'http://example.com/auth',
+            'OS_AUTH_TYPE': 'v1password',
+            'OS_USERNAME': 'user',
+            'OS_PASSWORD': 'secret',
+        }
+        result = [None, None]
+        fake_command = self._make_fake_command(result)
+        with mock.patch.dict(os.environ, env):
+            with mock.patch('swiftclient.shell.st_stat', fake_command):
+                swiftclient.shell.main(args)
+        self._verify_opts(result[0], {
+            'auth_version': '1.0',
+            'user': 'user',
+            'key': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v1password',
+            'username': 'user',
+            'password': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v1password',
+            'username': 'user',
+            'password': 'secret',
+            'identity_api_version': '1.0',
+        })
+
+        env = {
+            'OS_AUTH_URL': 'http://example.com/auth',
+            'OS_AUTH_TYPE': 'v2password',
+            'OS_USERNAME': 'user',
+            'OS_PASSWORD': 'secret',
+        }
+        result = [None, None]
+        fake_command = self._make_fake_command(result)
+        with mock.patch.dict(os.environ, env):
+            with mock.patch('swiftclient.shell.st_stat', fake_command):
+                swiftclient.shell.main(args)
+        self._verify_opts(result[0], {
+            'auth_version': '2.0',
+            'user': 'user',
+            'key': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v2password',
+            'username': 'user',
+            'password': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v2password',
+            'username': 'user',
+            'password': 'secret',
+            'identity_api_version': '2.0',
+        })
+
+        env = {
+            'OS_AUTH_URL': 'http://example.com/auth',
+            'OS_AUTH_TYPE': 'v3password',
+            'OS_USERNAME': 'user',
+            'OS_PASSWORD': 'secret',
+        }
+        result = [None, None]
+        fake_command = self._make_fake_command(result)
+        with mock.patch.dict(os.environ, env):
+            with mock.patch('swiftclient.shell.st_stat', fake_command):
+                swiftclient.shell.main(args)
+        self._verify_opts(result[0], {
+            'auth_version': '3',
+            'user': 'user',
+            'key': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v3password',
+            'username': 'user',
+            'password': 'secret',
+        }, {
+            'auth_url': 'http://example.com/auth',
+            'auth_type': 'v3password',
+            'username': 'user',
+            'password': 'secret',
+            'identity_api_version': '3',
+        })
+
     def test_args_v3(self):
         opts = {"auth_version": "3"}
         os_opts = {"password": "secret",
@@ -2942,7 +3365,7 @@ class TestKeystoneOptions(MockHttpTest):
     # options that are given default values in code if missing from CLI
     defaults = {'auth-version': '2.0',
                 'service-type': 'object-store',
-                'endpoint-type': 'publicURL'}
+                'endpoint-type': 'public'}
 
     def _build_os_opts(self, keys):
         os_opts = {}
@@ -3510,6 +3933,7 @@ def test_segment_upload_with_write_only_access(self):
 
         args, env = self._make_cmd('upload',
                                    cmd_args=[self.cont, self.obj,
+                                             '--use-dlo',
                                              '--leave-segments',
                                              '--segment-size=10',
                                              '--segment-container=%s'
@@ -3550,6 +3974,7 @@ def test_segment_upload_with_write_only_access_segments_container(self):
 
         args, env = self._make_cmd('upload',
                                    cmd_args=[self.cont, self.obj,
+                                             '--use-dlo',
                                              '--leave-segments',
                                              '--segment-size=10'])
         with mock.patch('swiftclient.client.ksclient_v3', self.fake_ks):
diff --git a/test/unit/test_swiftclient.py b/test/unit/test_swiftclient.py
index ad2af50c..5a306608 100644
--- a/test/unit/test_swiftclient.py
+++ b/test/unit/test_swiftclient.py
@@ -25,7 +25,7 @@
 import tempfile
 from hashlib import md5
 from urllib.parse import urlparse
-from requests.exceptions import RequestException
+from requests.exceptions import RequestException, SSLError
 
 from .utils import (MockHttpTest, fake_get_auth_keystone, StubResponse,
                     FakeKeystone)
@@ -579,7 +579,10 @@ def test_auth_v3_with_tenant_name(self):
         self.assertTrue(token)
 
     def test_auth_v3applicationcredential(self):
-        from keystoneauth1 import exceptions as ksauthexceptions
+        try:
+            from keystoneauth1 import exceptions as ksauthexceptions
+        except ImportError:
+            raise unittest.SkipTest('keystoneauth1 is not available')
 
         os_options = {
             "auth_type": "v3applicationcredential",
@@ -591,8 +594,11 @@ class FakeEndpointData:
 
         class FakeKeystoneuth1v3Session:
 
-            def __init__(self, auth):
+            def __init__(self, auth, timeout=None):
                 self.auth = auth
+                self.timeout = None
+                if timeout is not None:
+                    self.timeout = float(timeout)
                 self.token = 'token'
 
             def get_token(self):
@@ -1114,6 +1120,25 @@ def test_response_headers(self):
         self.assertEqual('t\xe9st', headers.get('x-utf-8-header', ''))
         self.assertEqual('%ff', headers.get('x-non-utf-8-header', ''))
         self.assertEqual('%FF', headers.get('x-binary-header', ''))
+        for k, v in headers.items():
+            # N.B. k is always lower case!
+            self.assertTrue(k.islower())
+        for k in headers.keys():
+            # N.B. k is always lower case!
+            self.assertTrue(k.islower())
+        self.assertTrue(set([
+            'x-utf-8-header',
+            'x-non-utf-8-header',
+            'x-binary-header',
+        ]).intersection(headers))
+
+        self.assertEqual('t\xe9st', headers.get('X-Utf-8-Header', ''))
+        self.assertEqual('%ff', headers.get('X-Non-Utf-8-Header', ''))
+        self.assertEqual('%FF', headers.get('X-Binary-Header', ''))
+
+        self.assertEqual('t\xe9st', headers.get('X-UTF-8-HEADER', ''))
+        self.assertEqual('%ff', headers.get('X-NON-UTF-8-HEADER', ''))
+        self.assertEqual('%FF', headers.get('X-BINARY-HEADER', ''))
 
     def test_chunk_size_read_method(self):
         conn = c.Connection('http://auth.url/', 'some_user', 'some_key')
@@ -1978,6 +2003,7 @@ def test_response_headers(self):
         self.assertEqual(
             '\u062a-value', resp.getheader('\u062a-UNICODE'))
         self.assertEqual('', resp.getheader('empty-header'))
+        self.assertEqual('"%s"' % EMPTY_ETAG, resp.getheader('etag'))
         self.assertEqual(
             dict([('\u062a-unicode', '\u062a-value'),
                   ('empty-header', ''),
@@ -1997,7 +2023,7 @@ def test_instance_kwargs(self):
                 'authurl': 'http://www.test.com',
                 'tenant_name': 'atenant'}
         conn = c.Connection(**args)
-        self.assertEqual(type(conn), c.Connection)
+        self.assertIsInstance(conn, c.Connection)
 
     def test_instance_kwargs_token(self):
         args = {'preauthtoken': 'atoken123',
@@ -2130,30 +2156,37 @@ def quick_sleep(*args):
             pass
         c.sleep = quick_sleep
 
-        # test retries
-        conn = c.Connection('http://www.test.com/auth/v1.0', 'asdf', 'asdf',
-                            retry_on_ratelimit=True)
-        code_iter = [200] + [498] * (conn.retries + 1)
-        auth_resp_headers = {
-            'x-auth-token': 'asdf',
-            'x-storage-url': 'http://storage/v1/test',
-        }
-        c.http_connection = self.fake_http_connection(
-            *code_iter, headers=auth_resp_headers)
-        with self.assertRaises(c.ClientException) as exc_context:
-            conn.head_account()
-        self.assertIn('Account HEAD failed', str(exc_context.exception))
-        self.assertEqual(conn.attempts, conn.retries + 1)
+        def test_status_code(code):
+            # test retries
+            conn = c.Connection('http://www.test.com/auth/v1.0',
+                                'asdf', 'asdf', retry_on_ratelimit=True)
+            code_iter = [200] + [code] * (conn.retries + 1)
+            auth_resp_headers = {
+                'x-auth-token': 'asdf',
+                'x-storage-url': 'http://storage/v1/test',
+            }
+            c.http_connection = self.fake_http_connection(
+                *code_iter, headers=auth_resp_headers)
+            with self.assertRaises(c.ClientException) as exc_context:
+                conn.head_account()
+            self.assertIn('Account HEAD failed', str(exc_context.exception))
+            self.assertEqual(code, exc_context.exception.http_status)
+            self.assertEqual(conn.attempts, conn.retries + 1)
 
-        # test default no-retry
-        c.http_connection = self.fake_http_connection(
-            200, 498,
-            headers=auth_resp_headers)
-        conn = c.Connection('http://www.test.com/auth/v1.0', 'asdf', 'asdf')
-        with self.assertRaises(c.ClientException) as exc_context:
-            conn.head_account()
-        self.assertIn('Account HEAD failed', str(exc_context.exception))
-        self.assertEqual(conn.attempts, 1)
+            # test default no-retry
+            c.http_connection = self.fake_http_connection(
+                200, code,
+                headers=auth_resp_headers)
+            conn = c.Connection('http://www.test.com/auth/v1.0',
+                                'asdf', 'asdf', retry_on_ratelimit=False)
+            with self.assertRaises(c.ClientException) as exc_context:
+                conn.head_account()
+            self.assertIn('Account HEAD failed', str(exc_context.exception))
+            self.assertEqual(code, exc_context.exception.http_status)
+            self.assertEqual(conn.attempts, 1)
+
+        test_status_code(498)
+        test_status_code(429)
 
     def test_retry_with_socket_error(self):
         def quick_sleep(*args):
@@ -2169,6 +2202,62 @@ def quick_sleep(*args):
         self.assertEqual(mock_auth.call_count, 1)
         self.assertEqual(conn.attempts, conn.retries + 1)
 
+    def test_no_retry_with_cert_sslerror(self):
+        def quick_sleep(*args):
+            pass
+        c.sleep = quick_sleep
+        for err in (
+            # Taken from real testing (requests==2.25.1, urllib3==1.26.5,
+            # pyOpenSSL==21.0.0) but note that these are actually way more
+            # messy/wrapped up in other exceptions
+            SSLError(
+                '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: '
+                'certificate has expired (_ssl.c:997)'),
+            SSLError(
+                "hostname 'wrong.host.badssl.com' doesn't match either of "
+                "'*.badssl.com', 'badssl.com'"),
+            SSLError(
+                '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: '
+                'self-signed certificate (_ssl.c:997)'),
+            SSLError(
+                '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: '
+                'self-signed certificate in certificate chain (_ssl.c:997)'),
+            SSLError(
+                '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: '
+                'unable to get local issuer certificate (_ssl.c:997)'),
+            SSLError(
+                '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: '
+                'CA signature digest algorithm too weak (_ssl.c:997)'),
+        ):
+            conn = c.Connection('http://www.test.com', 'asdf', 'asdf')
+            with self.subTest(err=err), mock.patch(
+                    'swiftclient.client.http_connection') as \
+                    fake_http_connection, \
+                    mock.patch('swiftclient.client.get_auth_1_0') as mock_auth:
+                mock_auth.return_value = ('http://mock.com', 'mock_token')
+                fake_http_connection.side_effect = err
+                self.assertRaises(socket.error, conn.head_account)
+                self.assertEqual(mock_auth.call_count, 1)
+                self.assertEqual(conn.attempts, 1)
+
+    def test_retry_with_non_cert_sslerror(self):
+        def quick_sleep(*args):
+            pass
+        c.sleep = quick_sleep
+        conn = c.Connection('http://www.test.com', 'asdf', 'asdf')
+        with mock.patch('swiftclient.client.http_connection') as \
+                fake_http_connection, \
+                mock.patch('swiftclient.client.get_auth_1_0') as mock_auth:
+            mock_auth.return_value = ('http://mock.com', 'mock_token')
+            fake_http_connection.side_effect = SSLError(
+                "HTTPSConnectionPool(host='example.com', port=443): "
+                "Max retries exceeded with url: /v1/AUTH_test (Caused by "
+                "SSLError(SSLZeroReturnError(6, 'TLS/SSL connection has "
+                "been closed (EOF) (_ssl.c:997)')))")
+            self.assertRaises(socket.error, conn.head_account)
+        self.assertEqual(mock_auth.call_count, 1)
+        self.assertEqual(conn.attempts, conn.retries + 1)
+
     def test_retry_with_force_auth_retry_exceptions(self):
         def quick_sleep(*args):
             pass
@@ -2217,6 +2306,7 @@ def mock_http_connection(*args, **kwargs):
         do_test(401, 2)
         # others will be tried until retry limits
         do_test(408, 6)
+        do_test(499, 6)
         do_test(500, 6)
         do_test(503, 6)
 
@@ -2989,7 +3079,7 @@ def test_close_ok(self):
         conn = c.Connection(url, 'asdf', 'asdf')
         self.assertIsNone(conn.http_conn)
         conn.http_conn = c.http_connection(url)
-        self.assertEqual(type(conn.http_conn), tuple)
+        self.assertIsInstance(conn.http_conn, tuple)
         self.assertEqual(len(conn.http_conn), 2)
         http_conn_obj = conn.http_conn[1]
         self.assertIsInstance(http_conn_obj, c.HTTPConnection)
diff --git a/test/unit/test_utils.py b/test/unit/test_utils.py
index 129208d5..deb38579 100644
--- a/test/unit/test_utils.py
+++ b/test/unit/test_utils.py
@@ -122,6 +122,43 @@ def test_overflow(self):
         self.assertEqual('1024Y', u.prt_bytes(bytes_, True).lstrip())
 
 
+class TestParseTimestamp(unittest.TestCase):
+    def test_int(self):
+        self.assertEqual((1234, False), u.parse_timestamp(1234, False))
+        self.assertEqual((3600, False), u.parse_timestamp('3600', False))
+
+    def test_suffixed(self):
+        self.assertEqual((54, False), u.parse_timestamp('54.321s', False))
+        self.assertEqual((int(54.321 * 60), False),
+                         u.parse_timestamp('54.321m', False))
+        self.assertEqual((900, False),
+                         u.parse_timestamp('15min', False))
+        self.assertEqual((int(54.321 * 60 * 60), False),
+                         u.parse_timestamp('54.321h', False))
+        self.assertEqual((7200, False),
+                         u.parse_timestamp('2hr', False))
+        self.assertEqual((60 * 60 * 24, False), u.parse_timestamp('1d', False))
+
+    def test_str(self):
+        self.assertEqual((1615852800, True),
+                         u.parse_timestamp('2021-03-16T00:00:00Z', False))
+
+    def test_absolute(self):
+        self.assertEqual((1234, True), u.parse_timestamp(1234, True))
+        self.assertEqual((1615852800, True),
+                         u.parse_timestamp('2021-03-16T00:00:00Z', True))
+
+    def test_error(self):
+        with self.assertRaises(ValueError):
+            u.parse_timestamp('asdf', False)
+        with self.assertRaises(ValueError):
+            u.parse_timestamp(12.34, False)
+        with self.assertRaises(ValueError):
+            u.parse_timestamp('54.321', True)
+        with self.assertRaises(ValueError):
+            u.parse_timestamp(-1, False)
+
+
 class TestTempURL(unittest.TestCase):
     url = '/v1/AUTH_account/c/o'
     seconds = 3600
@@ -422,6 +459,7 @@ def test_generate_temp_url_bad_path(self):
 class TestTempURLUnicodePathAndKey(TestTempURL):
     url = '/v1/\u00e4/c/\u00f3'
     key = 'k\u00e9y'
+    seconds = '1hr'
     expected_body = '\n'.join([
         'GET',
         '1400003600',
@@ -432,6 +470,7 @@ class TestTempURLUnicodePathAndKey(TestTempURL):
 class TestTempURLUnicodePathBytesKey(TestTempURL):
     url = '/v1/\u00e4/c/\u00f3'
     key = 'k\u00e9y'.encode('utf-8')
+    seconds = '60m'
     expected_body = '\n'.join([
         'GET',
         '1400003600',
@@ -469,6 +508,32 @@ class TestTempURLBytesPathAndNonUtf8Key(TestTempURL):
     ])
 
 
+class TestTempURLInfoPath(TestTempURL):
+    url = '/info'.encode('utf-8')
+    expected_body = b'\n'.join([
+        b'GET',
+        b'1400003600',
+        url,
+    ])
+
+    @property
+    def expected_url(self):
+        if isinstance(self.url, bytes):
+            return self.url + (b'?swiftinfo_sig=temp_url_signature'
+                               b'&swiftinfo_expires=1400003600')
+        return self.url + (u'?swiftinfo_sig=temp_url_signature'
+                           u'&swiftinfo_expires=1400003600')
+
+    @property
+    def expected_sha512_url(self):
+        if isinstance(self.url, bytes):
+            return self.url + (
+                b'?swiftinfo_sig=sha512:dGVtcF91cmxfc2lnbmF0dXJl'
+                b'&swiftinfo_expires=1400003600')
+        return self.url + (u'?swiftinfo_sig=sha512:dGVtcF91cmxfc2lnbmF0dXJl'
+                           u'&swiftinfo_expires=1400003600')
+
+
 class TestReadableToIterable(unittest.TestCase):
 
     def test_iter(self):
diff --git a/tox.ini b/tox.ini
index e1e679d2..897ad0d3 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,29 +1,35 @@
 [tox]
 envlist = py3,pep8
 minversion = 3.18.0
-skipsdist = True
 
 [testenv]
+skipsdist = True
 usedevelop = True
 list_dependencies_command = python -m pip freeze
 setenv =
   LANG=en_US.utf-8
   VIRTUAL_ENV={envdir}
 
-deps = -r{toxinidir}/requirements.txt
+deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+       -r{toxinidir}/requirements.txt
        -r{toxinidir}/test-requirements.txt
-       .[keystone]
 commands = sh -c '(find . -not \( -type d -name .?\* -prune \) \
            \( -type d -name "__pycache__" -or -type f -name "*.py[co]" \) \
            -print0) | xargs -0 rm -rf'
            stestr run {posargs}
 allowlist_externals = sh
-passenv = SWIFT_* *_proxy
+passenv = SWIFT_*
 
 [testenv:pep8]
 commands =
     python -m flake8 swiftclient test
 
+[testenv:{py37,py38,py39}]
+# Drop the use of constraints; most dependencies have dropped support for
+# these versions already, and have updated their metadata to reflect that
+deps = -r{toxinidir}/requirements.txt
+       -r{toxinidir}/test-requirements.txt
+
 [testenv:venv]
 commands = {posargs}
 
@@ -69,10 +75,12 @@ commands=
 # H404: multi line docstring should start without a leading new line
 # H405: multi line docstring summary not separated with an empty line
 # W504: line break after binary operator
-ignore = H101,H301,H306,H401,H403,H404,H405,W504
+# F811: Redefinition of unused name from line n
+ignore = H101,H301,H306,H401,H403,H404,H405,W504,F811
 # H106: Don’t put vim configuration in source files
 # H203: Use assertIs(Not)None to check for None
-enable-extensions=H106,H203
+# H904: Delay string interpolations at logging calls.
+enable-extensions=H106,H203,H904
 show-source = True
 exclude = .venv,.tox,dist,doc,*egg
 
@@ -87,8 +95,7 @@ commands = bindep test
 
 [testenv:releasenotes]
 usedevelop = False
-deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
-       -r{toxinidir}/doc/requirements.txt
+deps = {[testenv:docs]deps}
 commands = sphinx-build -a -W -E -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
 [testenv:pdf-docs]