- [EK](#ek): An external secret key - either the SSE-C client-provided key or a secret key generated by the KMS.

#### Content Encryption

}

// Version returns version information about the KMS.
//
// TODO(aead): refactor this API call since it does not account
// for multiple KMS/KES servers.
func (k *KMS) Version(ctx context.Context) (string, error) {
	return k.conn.Version(ctx)
}

// APIs returns a list of KMS server APIs.
//
// TODO(aead): remove this API since it's hardly useful.

	golang.org/x/sys v0.25.0
	golang.org/x/term v0.24.0
	golang.org/x/time v0.6.0
	google.golang.org/api v0.194.0
	gopkg.in/yaml.v2 v2.4.0
	gopkg.in/yaml.v3 v3.0.1
)

require (
	aead.dev/mem v0.2.0 // indirect
	aead.dev/minisign v0.3.0 // indirect
	cloud.google.com/go v0.115.1 // indirect
	cloud.google.com/go/auth v0.9.1 // indirect
	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect

	MD5, err := hex.DecodeString(md5Hex)
	if err != nil {
		return nil, BadDigest{ // TODO(aead): Return an error that indicates that an invalid ETag has been specified
			ExpectedMD5:   md5Hex,
			CalculatedMD5: "",
		}
	}
	SHA256, err := hex.DecodeString(sha256Hex)
	if err != nil {
		return nil, SHA256Mismatch{ // TODO(aead): Return an error that indicates that an invalid Content-SHA256 has been specified

// IsEncrypted reports whether the ETag is encrypted.
func (e ETag) IsEncrypted() bool {
	// An encrypted ETag must be at least 32 bytes long.
	// It contains the encrypted ETag value + an authentication
	// code generated by the AEAD cipher.
	//
	// Here is an incorrect implementation of IsEncrypted:
	//
	//   return len(e) > 16 && !bytes.ContainsRune(e, '-')
	//
	// An encrypted ETag may contain some random bytes - e.g.

	MTime                time.Time // Is only set in POST/PUT operations
	Expires              time.Time // Is only used in POST/PUT operations

	DeleteMarker            bool // Is only set in DELETE operations for delete marker replication
	CheckDMReplicationReady bool // Is delete marker ready to be replicated - set only during HEAD

pkg crypto/cipher, func NewGCMWithTagSize(Block, int) (AEAD, error)
pkg crypto/rsa, method (*PrivateKey) Size() int
pkg crypto/rsa, method (*PublicKey) Size() int
pkg crypto/tls, method (*ConnectionState) ExportKeyingMaterial(string, []uint8, int) ([]uint8, error)
pkg database/sql, method (IsolationLevel) String() string
pkg database/sql, type DBStats struct, Idle int
pkg database/sql, type DBStats struct, InUse int

pkg crypto, type Decrypter interface, Public() PublicKey
pkg crypto, type DecrypterOpts interface {}
pkg crypto/cipher, func NewGCMWithNonceSize(Block, int) (AEAD, error)
pkg crypto/elliptic, type CurveParams struct, Name string
pkg crypto/rsa, method (*PrivateKey) Decrypt(io.Reader, []uint8, crypto.DecrypterOpts) ([]uint8, error)
pkg crypto/rsa, type OAEPOptions struct

                "id": 999,
                "name": "Dead Pond",
                "age": 30,
                "secret_name": "Dive Wilson",
            },
        )
        assert response.status_code == 200, response.text
        assert response.json() == snapshot(
            {"age": 30, "secret_name": "Dive Wilson", "id": 999, "name": "Dead Pond"}
        )

        # Read a hero
        hero_id = response.json()["id"]

    Node<K, V> head;
    Node<K, V> tail;
    int count;

    KeyList(Node<K, V> firstNode) {
      this.head = firstNode;
      this.tail = firstNode;
      firstNode.previousSibling = null;
      firstNode.nextSibling = null;
      this.count = 1;
    }
  }

  @CheckForNull private transient Node<K, V> head; // the head for all keys