return
			}
		case "Created":
			z.Created, err = dc.ReadTime()
			if err != nil {
				err = msgp.WrapError(err, "Created")
				return
			}
		case "LockEnabled":
			z.LockEnabled, err = dc.ReadBool()
			if err != nil {
				err = msgp.WrapError(err, "LockEnabled")
				return
			}
		case "PolicyConfigJSON":
			z.PolicyConfigJSON, err = dc.ReadBytes(z.PolicyConfigJSON)
			if err != nil {

		bucketTargetsFile,
		objectLockConfig,
	}

	configs := make(map[string][]byte, len(legacyConfigs))

	// Handle migration from lockEnabled to newer format.
	if b.LockEnabled {
		configs[objectLockConfig] = enabledBucketObjectLockConfig
		b.LockEnabled = false // legacy value unset it
		// we are only interested in b.ObjectLockConfigXML or objectLockConfig value
	}

	for _, legacyFile := range legacyConfigs {

		field, bts, err = msgp.ReadMapKeyZC(bts)
		if err != nil {
			err = msgp.WrapError(err)
			return
		}
		switch msgp.UnsafeString(field) {
		case "LockEnabled":
			z.LockEnabled, bts, err = msgp.ReadBoolBytes(bts)
			if err != nil {
				err = msgp.WrapError(err, "LockEnabled")
				return
			}
		case "VersioningEnabled":
			z.VersioningEnabled, bts, err = msgp.ReadBoolBytes(bts)
			if err != nil {

					Bucket: "dest-bucket",
				},
			},
		},
	}
	lr := objectlock.Retention{
		Mode:        objectlock.RetCompliance,
		Validity:    12 * time.Hour,
		LockEnabled: true,
	}

	expiryWorker := func(wg *sync.WaitGroup, readyCh chan<- struct{}, taskCh <-chan expiryOp, gotExpired *[]ObjectToDelete) {
		defer wg.Done()

		createdAt, cerr := time.Parse(time.RFC3339Nano, strings.TrimSpace(r.Form.Get("createdAt")))
		if cerr != nil {
			createdAt = timeSentinel
		}

		opts := MakeBucketOptions{
			LockEnabled:       r.Form.Get("lockEnabled") == "true",
			VersioningEnabled: r.Form.Get("versioningEnabled") == "true",
			ForceCreate:       r.Form.Get("forceCreate") == "true",
			CreatedAt:         createdAt,
		}

		return time.Now().UTC(), nil
	}
	return ntp.Time(ntpServer)
}

// Retention - bucket level retention configuration.
type Retention struct {
	Mode        RetMode
	Validity    time.Duration
	LockEnabled bool
}

// Retain - check whether given date is retainable by validity time.
func (r Retention) Retain(created time.Time) bool {
	t, err := UTCNowNTP()
	if err != nil {
		lockLogIf(context.Background(), err)

		goi            ObjectInfo
		gerr           error
	)
	replicateDeletes := hasReplicationRules(ctx, bucket, deleteObjectsReq.Objects)
	if rcfg, _ := globalBucketObjectLockSys.Get(bucket); rcfg.LockEnabled {
		hasLockEnabled = true
	}

	type deleteResult struct {
		delInfo DeletedObject
		errInfo DeleteError
	}

	deleteResults := make([]deleteResult, len(deleteObjectsReq.Objects))

	RestoreRequest *RestoreObjectRequest
	RestoreExpiry  time.Time
	ExpireRestored bool
}

// MakeBucketOptions represents bucket options for ObjectLayer bucket operations
type MakeBucketOptions struct {
	LockEnabled       bool
	VersioningEnabled bool
	ForceCreate       bool      // Create buckets even if they are already created.
	CreatedAt         time.Time // only for site replication

	opts, err := delOpts(ctx, r, bucket, object)
	if err != nil {
		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
		return
	}

	rcfg, _ := globalBucketObjectLockSys.Get(bucket)
	if rcfg.LockEnabled && opts.DeletePrefix {
		apiErr := toAPIError(ctx, errInvalidArgument)
		apiErr.Description = "force-delete is forbidden on Object Locking enabled buckets"
		writeErrorResponse(ctx, w, apiErr, r.URL)
		return
	}

		                        </Rule>
		                      </LifecycleConfiguration>`,
			expectedParsingErr:    nil,
			expectedValidationErr: errLifecycleBucketLocked,
			lr: lock.Retention{
				LockEnabled: true,
			},
		},
		{ // Using DelMarkerExpiration action with an object locked bucket
			inputConfig: `<LifecycleConfiguration>
                                        <Rule>