return nil, errAuthentication
		}
	}

	copts := map[string]string{
		"AccessKey": ui.Credentials.AccessKey,
		"SecretKey": ui.Credentials.SecretKey,
	}
	if ui.Credentials.IsTemp() {
		copts["SessionToken"] = ui.Credentials.SessionToken
	}

	return &ssh.Permissions{
		CriticalOptions: copts,
		Extensions:      make(map[string]string),
	}, nil
}

}

func (s3 *warmBackendS3) Get(ctx context.Context, object string, rv remoteVersionID, opts WarmBackendGetOpts) (io.ReadCloser, error) {
	gopts := minio.GetObjectOptions{}

	if rv != "" {
		gopts.VersionID = string(rv)
	}
	if opts.startOffset >= 0 && opts.length > 0 {
		if err := gopts.SetRange(opts.startOffset, opts.startOffset+opts.length-1); err != nil {
			return nil, s3.ToObjectError(err, object)
		}
	}

			TargetArn: opts.arn,
		})
	if len(tgtArns) != 1 {
		replLogIf(ctx, fmt.Errorf("replication resync failed for %s - arn specified %s is missing in the replication config", opts.bucket, opts.arn))
		return
	}
	tgt := globalBucketTargetSys.GetRemoteTargetClient(opts.bucket, opts.arn)
	if tgt == nil {
		replLogIf(ctx, fmt.Errorf("replication resync failed for %s - target could not be created for arn %s", opts.bucket, opts.arn))
		return

	downloadsCtx, downloadsCancel := context.WithTimeout(ctx, opts.duration)
	defer downloadsCancel()

	gopts := minio.GetObjectOptions{}
	gopts.Set(globalObjectPerfUserMetadata, "true") // Bypass S3 API freeze

	var downloadTimes madmin.TimeDurations
	var downloadTTFB madmin.TimeDurations
	wg.Add(opts.concurrency)

	c := minio.Core{Client: clnt}
	for i := 0; i < opts.concurrency; i++ {
		go func(i int) {
			defer wg.Done()

		ReplicationWorkersWait: opts.ReplicationWorkersWait,
		KeyRotationWorkersWait: opts.KeyRotationWorkersWait,
		ExpirationWorkersWait:  opts.ExpirationWorkersWait,
	}
}

// Update updates opts with nopts
func (opts *Config) Update(nopts Config) {
	configMu.Lock()
	defer configMu.Unlock()

	opts.ReplicationWorkersWait = nopts.ReplicationWorkersWait
	opts.KeyRotationWorkersWait = nopts.KeyRotationWorkersWait

func (opts Config) GetWorkers() int {
	configMutex.RLock()
	defer configMutex.RUnlock()
	return opts.DriveWorkers
}

// Update updates opts with nopts
func (opts *Config) Update(nopts Config) {
	configMutex.Lock()
	defer configMutex.Unlock()

	opts.Bitrot = nopts.Bitrot
	opts.IOCount = nopts.IOCount
	opts.Sleep = nopts.Sleep
	opts.DriveWorkers = nopts.DriveWorkers

				return
			default:
			}

			sopts := speedTestOpts{
				objectSize:      opts.objectSize,
				concurrency:     concurrency,
				duration:        opts.duration,
				storageClass:    opts.storageClass,
				bucketName:      opts.bucketName,
				enableSha256:    opts.enableSha256,
				enableMultipart: opts.enableMultipart,
				creds:           opts.creds,
			}

			if err != nil {
				errs[idx] = err
				return
			}

			userDefined[xhttp.AmzObjectTagging] = tgs.String()

			if opts.Kind != nil {
				encrd, objectEncryptionKey, err := newEncryptReader(ctx, hr, opts.Kind, opts.KeyID, opts.Key, bucket, req.Key, userDefined, opts.KmsCtx)
				if err != nil {
					errs[idx] = err
					return
				}

				// do not try to verify encrypted content/

		return ObjectInfo{}, err
	}
	ctx = lkctx.Context()
	defer lk.Unlock(lkctx)

	if opts.DeletePrefix {
		return ObjectInfo{}, z.deletePrefix(ctx, bucket, object)
	}

	gopts := opts
	gopts.NoLock = true

	pinfo, noReadQuorumPools, err := z.getPoolInfoExistingWithOpts(ctx, bucket, object, gopts)
	if err != nil {
		if _, ok := err.(InsufficientReadQuorum); ok {

		if err != nil {
			return ObjectInfo{}, err
		}
		if dsc.ReplicateAny() {
			opts.SetDeleteReplicationState(dsc, opts.VersionID)
			goi.replicationDecision = opts.DeleteReplication.ReplicateDecisionStr
		}
	}

	if opts.EvalRetentionBypassFn != nil {
		if err := opts.EvalRetentionBypassFn(goi, gerr); err != nil {
			return ObjectInfo{}, err
		}
	}