}

// UnsealETag unseals the etag using the provided object key.
// It does not try to decrypt the ETag if len(etag) == 16
// because such ETags indicate that the S3 client hasn't sent
// an ETag = MD5(object) and the backend has picked an ETag value.
func (key ObjectKey) UnsealETag(etag []byte) ([]byte, error) {
	if !IsETagSealed(etag) {
		return etag, nil
	}
	mac := hmac.New(sha256.New, key[:])

	if r.Index == 0 {
		internalLogIf(ctx, fmt.Errorf("license not found in response from %s", url))
		return
	}

	lic := r.String()
	if lic == globalSubnetConfig.License {
		// license hasn't changed.
		return
	}

	kv := "subnet license=" + lic
	result, err := setConfigKV(ctx, objectAPI, []byte(kv))
	if err != nil {
		internalLogIf(ctx, fmt.Errorf("error setting subnet license config: %w", err))

func genTransitionObjName(bucket string) (string, error) {
	u, err := uuid.NewRandom()
	if err != nil {
		return "", err
	}
	us := u.String()
	hash := xxh3.HashString(pathJoin(globalDeploymentID(), bucket))
	obj := fmt.Sprintf("%s/%s/%s/%s", strconv.FormatUint(hash, 16), us[0:2], us[2:4], us)
	return obj, nil
}

// transition object to target specified by the transition ARN. When an object is transitioned to another

	if m.status == scanStateStarted && update.status != scanStateStarted {
		m.status = update.status
	}

	if m.status == scanStateStarted && time.Since(m.lastHandout) > metacacheMaxClientWait {
		// Drop if client hasn't been seen for 3 minutes.
		m.status = scanStateError
		m.error = "client not seen"
	}

	if m.error == "" && update.error != "" {
		m.error = update.error
		m.status = scanStateError
		m.ended = UTCNow()

						return nil
					} else if err != nil {
						return err
					}
				}
			}

			// If we've explicitly asked for all namespaces, blank the selectedNamespace var out
			// If the user hasn't specified a namespace, use the default namespace
			if allNamespaces {
				selectedNamespace = ""
			} else if selectedNamespace == "" {
				selectedNamespace = metav1.NamespaceDefault
			}

	expectedMax int64

	size       int64
	actualSize int64

	checksum      etag.ETag
	contentSHA256 []byte

	// Content checksum
	contentHash   Checksum
	contentHasher hash.Hash
	disableMD5    bool

	trailer http.Header

	sha256 hash.Hash
}

// Options are optional arguments to NewReaderWithOpts, Options
// simply converts positional arguments to NewReader() into a

package cmd

import (
	"context"
	"errors"
	"testing"

	"github.com/minio/minio/internal/crypto"
	"github.com/minio/minio/internal/hash"
)

var toAPIErrorTests = []struct {
	err     error
	errCode APIErrorCode
}{
	{err: hash.BadDigest{}, errCode: ErrBadDigest},
	{err: hash.SHA256Mismatch{}, errCode: ErrContentSHA256Mismatch},
	{err: IncompleteBody{}, errCode: ErrIncompleteBody},

			h.Reset()
		}
	}

	metaHashCountMap := make(map[string]int)
	for _, hash := range metaHashes {
		if hash == "" {
			continue
		}
		metaHashCountMap[hash]++
	}

	maxHash := ""
	maxCount := 0
	for hash, count := range metaHashCountMap {
		if count > maxCount {
			maxCount = count
			maxHash = hash
		}
	}

	if maxCount < quorum {

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package zip

import (
	"bufio"
	"encoding/binary"
	"errors"
	"hash"
	"hash/crc32"
	"internal/godebug"
	"io"
	"io/fs"
	"os"
	"path"
	"path/filepath"
	"sort"
	"strings"
	"sync"
	"time"
)

var zipinsecurepath = godebug.New("zipinsecurepath")

var (

	// This test uses two FileInfo values that represent the same object but
	// have different parities. They occur in equal number of drives, but only
	// one has read quorum. commonParity should pick the parity corresponding to
	// the FileInfo which has read quorum.
	fi1 := FileInfo{
		Volume:         "mybucket",
		Name:           "myobject",
		VersionID:      "",
		IsLatest:       true,
		Deleted:        false,