return nil, errors.New("MasterKeyID contains unsupported characters")
			}
		}
	}

	if config.XMLNS == "" {
		config.XMLNS = xmlNS
	}
	return &config, nil
}

// ApplyOptions ask for specific features to be enabled,
// when bucketSSEConfig is empty.
type ApplyOptions struct {
	AutoEncrypt bool
}

// Apply applies the SSE bucket configuration on the given HTTP headers and

	globalTrace = pubsub.New[madmin.TraceInfo, madmin.TraceType](8)

	// global Listen system to send S3 API events to registered listeners
	globalHTTPListen = pubsub.New[event.Event, pubsub.Mask](0)

	// global console system to send console logs to
	// registered listeners
	globalConsoleSys *HTTPConsoleLoggerSys

	// All unique drives for this deployment
	globalEndpoints EndpointServerPools

			return pinfo, z.poolsWithObject(poolObjInfos, opts), nil
		}

		if isErrReadQuorum(pinfo.Err) && !opts.MetadataChg {
			// read quorum is returned when the object is visibly
			// present but its unreadable, we simply ask the writes to
			// schedule to this pool instead. If there is no quorum
			// it will fail anyways, however if there is quorum available
			// with enough disks online but sufficiently inconsistent to

	disks, _ := set.getOnlineDisksWithHealing(false)
	if len(disks) == 0 {
		return fmt.Errorf("no online drives found for set with endpoints %s", set.getEndpoints())
	}

	// However many we ask, versions must exist on ~50%
	listingQuorum := (set.setDriveCount + 1) / 2

	// How to resolve partial results.
	resolver := metadataResolutionParams{
		dirQuorum: listingQuorum, // make sure to capture all quorum ratios

	disks := er.getDisks()

	ropts := ReadOptions{
		ReadData: readData,
		Healing:  false,
	}

	mrfCheck := make(chan FileInfo)
	defer xioutil.SafeClose(mrfCheck)

	var rw sync.Mutex

	// Ask for all disks first;
	go func() {
		ctx, cancel := context.WithCancel(ctx)
		defer cancel()

		wg := sync.WaitGroup{}
		for i, disk := range disks {
			if disk == nil {
				done <- false
				continue

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>keychain-access-groups</key>
	<array><string>` + appID + `</string></array>
	<key>get-task-allow</key>
	<true/>
	<key>application-identifier</key>
	<string>` + appID + `</string>
	<key>com.apple.developer.team-identifier</key>
	<string>` + teamID + `</string>
</dict>
</plist>
`
}

	"math"
	"math/bits"
)

// Mask allows filtering by a bitset mask.
type Mask uint64

const (
	// MaskAll is the mask for all entries.
	MaskAll Mask = math.MaxUint64
)

// MaskFromMaskable extracts mask from an interface.
func MaskFromMaskable(m Maskable) Mask {
	return Mask(m.Mask())
}

// Contains returns whether *all* flags in other is present in t.
func (t Mask) Contains(other Mask) bool {
	return t&other == other

	sub := &Sub[T]{ch: subCh, types: Mask(mask.Mask()), filter: filter}
	ps.subs = append(ps.subs, sub)

	// We hold a lock, so we are safe to update
	combined := Mask(atomic.LoadUint64(&ps.types))
	combined.Merge(Mask(mask.Mask()))
	atomic.StoreUint64(&ps.types, uint64(combined))

	go func() {
		<-doneCh

		ps.Lock()
		defer ps.Unlock()
		var remainTypes Mask
		for i, s := range ps.subs {
			if s == sub {

	S3                Metadata          `json:"s3"`
	Source            Source            `json:"source"`
	Type              madmin.TraceType  `json:"-"`
}

// Mask returns the type as mask.
func (e Event) Mask() uint64 {
	return e.EventName.Mask()
}

// Log represents event information for some event targets.
type Log struct {
	EventName Name
	Key       string
	Records   []Event

import (
	"context"
	"os"
	"path"
	"syscall"
	"testing"
)

// Based on `man getumask` a vaporware GNU extension to glibc.
// returns file mode creation mask.
func getUmask() int {
	mask := syscall.Umask(0)
	syscall.Umask(mask)
	return mask
}

// Tests if the directory and file creations happen with proper umask.
func TestIsValidUmaskVol(t *testing.T) {
	tmpPath := t.TempDir()
	testCases := []struct {