req.Trailer.Add(key, "")
		}
	} else {
		req.Trailer = nil
	}
	return &s3UnsignedChunkedReader{
		trailers: req.Trailer,
		reader:   bufio.NewReader(req.Body),
		buffer:   make([]byte, 64*1024),
	}, ErrNone
}

// Represents the overall state that is required for decoding a
// AWS Signature V4 chunked reader.
type s3UnsignedChunkedReader struct {
	reader   *bufio.Reader
	trailers http.Header

	buffer []byte

func newSignV4ChunkedReader(req *http.Request, trailer bool) (io.ReadCloser, APIErrorCode) {
	cred, seedSignature, region, seedDate, errCode := calculateSeedSignature(req, trailer)
	if errCode != ErrNone {
		return nil, errCode
	}

	if trailer {
		// Discard anything unsigned.
		req.Trailer = make(http.Header)
		trailers := req.Header.Values(awsTrailerHeader)
		for _, key := range trailers {
			req.Trailer.Add(key, "")
		}

    @DisplayName("writeWireFormat should write header and trailer")
    void testWriteWireFormat() {
        packet.type = SessionServicePacket.SESSION_MESSAGE;
        packet.trailerLength = 10; // Mock trailer will write 10 bytes

        byte[] dst = new byte[50];
        int totalWritten = packet.writeWireFormat(dst, 0);

        assertEquals(14, totalWritten); // 4 header + 10 trailer

		return FormatUnknown
	}

	// Guess the magic values.
	magic := string(b.toUSTAR().magic())
	version := string(b.toUSTAR().version())
	trailer := string(b.toSTAR().trailer())
	switch {
	case magic == magicUSTAR && trailer == trailerSTAR:
		return formatSTAR
	case magic == magicUSTAR:
		return FormatUSTAR | FormatPAX
	case magic == magicGNU && version == versionGNU:
		return FormatGNU

   *
   * Note that this method may be called a second time for a single HTTP response if the response
   * includes a trailer. For this obscure HTTP feature, [cookies] contains only the trailer's
   * cookies.
   */
  fun saveFromResponse(
    url: HttpUrl,
    cookies: List<Cookie>,
  )

  /**

const unsignedPayload = "UNSIGNED-PAYLOAD"

// http Header "x-amz-content-sha256" == "STREAMING-UNSIGNED-PAYLOAD-TRAILER" indicates that the
// client did not calculate sha256 of the payload and there is a trailer.
const unsignedPayloadTrailer = "STREAMING-UNSIGNED-PAYLOAD-TRAILER"

// skipContentSha256Cksum returns true if caller needs to skip
// payload checksum, false if not.

   * Timing-Allow-Origin}</a> header field name.
   *
   * @since 15.0
   */
  public static final String TIMING_ALLOW_ORIGIN = "Timing-Allow-Origin";

  /** The HTTP {@code Trailer} header field name. */
  public static final String TRAILER = "Trailer";

  /** The HTTP {@code Transfer-Encoding} header field name. */
  public static final String TRANSFER_ENCODING = "Transfer-Encoding";

	return r.Header.Get(xhttp.AmzContentSha256) == streamingContentSHA256Trailer &&
		r.Method == http.MethodPut
}

// Verify if the request has AWS Streaming Signature Version '4', with unsigned content and trailer.
func isRequestUnsignedTrailerV4(r *http.Request) bool {
	return r.Header.Get(xhttp.AmzContentSha256) == unsignedPayloadTrailer &&
		r.Method == http.MethodPut
}

// Authorization type.
//

// then this returns an error.
func (tw *Writer) Close() error {
	if tw.err == ErrWriteAfterClose {
		return nil
	}
	if tw.err != nil {
		return tw.err
	}

	// Trailer: two zero blocks.
	err := tw.Flush()
	for i := 0; i < 2 && err == nil; i++ {
		_, err = tw.w.Write(zeroBlock[:])
	}

	// Ensure all future actions are invalid.
	tw.err = ErrWriteAfterClose

	req, err := http.NewRequest(http.MethodPut, getPutObjectURL(s.endPoint, bucketName, "test-cve-object.txt"), nil)
	c.Assert(err, nil)

	req.Body = io.NopCloser(bytes.NewReader([]byte("foobar!\n")))
	req.Trailer = http.Header{}
	req.Trailer.Set("x-amz-checksum-crc32", "rK0DXg==")

	now := UTCNow()

	req = signer.StreamingUnsignedV4(req, "", 8, now)

	maliciousHeaders := http.Header{