conditions["object-lock-mode"] = []string{string(retMode)}
	conditions["object-lock-retain-until-date"] = []string{retDate.UTC().Format(time.RFC3339)}
	if retDays > 0 {
		conditions["object-lock-remaining-retention-days"] = []string{strconv.Itoa(retDays)}
	}
	if retMode == objectlock.RetGovernance && byPassSet {
		byPassSet = globalIAMSys.IsAllowed(policy.Args{
			AccountName:     cred.AccessKey,
			Groups:          cred.Groups,

         * check).
         *
         * We *would* just check such functions redundantly, but kotlinc emits its nullness
         * annotations in the form of JetBrains annotations, which have only class retention and
         * thus are invisible at runtime. Thus, we conclude that the parameter types are
         * *non*-nullable, even when they are declared as `Foo?`.
         */
        || hasAutomaticNullChecksFromKotlin(member);

	ctx = logger.SetReqInfo(ctx, &logger.ReqInfo{})

	var vc *versioning.Versioning
	var lc *lifecycle.Lifecycle
	var lr objectlock.Retention
	var rcfg *replication.Config
	if bucket != minioMetaBucket {
		vc, err = globalBucketVersioningSys.Get(bucket)
		if err != nil {
			return err
		}

         * check).
         *
         * We *would* just check such functions redundantly, but kotlinc emits its nullness
         * annotations in the form of JetBrains annotations, which have only class retention and
         * thus are invisible at runtime. Thus, we conclude that the parameter types are
         * *non*-nullable, even when they are declared as `Foo?`.
         */
        || hasAutomaticNullChecksFromKotlin(member);

		return complMultipartUpload.Parts[i].PartNumber < complMultipartUpload.Parts[j].PartNumber
	}) {
		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrInvalidPartOrder), r.URL)
		return
	}

	// Reject retention or governance headers if set, CompleteMultipartUpload spec
	// does not use these headers, and should not be passed down to checkPutObjectLockAllowed

		// object used for the test.
		objectNames = append(objectNames, objectName)
	}

	contentBytes := []byte("hello")
	for _, name := range []string{"private/object", "public/object"} {
		// Uploading the object with retention enabled
		_, err = obj.PutObject(GlobalContext, bucketName, name, mustGetPutObjReader(t, bytes.NewReader(contentBytes), int64(len(contentBytes)), "", sha256sum), ObjectOptions{})
		// if object upload fails stop the test.

// There are some caveats regarding the following:
// 1. object lock config - object lock should have been specified at time of bucket creation. Only default retention settings are imported here.
// 2. Replication config - is omitted from import as remote target credentials are not available from exported data for security reasons.

	if !opts.NoAuditLog {
		auditObjectErasureSet(ctx, "DeleteObject", object, &er)
	}

	var lc *lifecycle.Lifecycle
	var rcfg lock.Retention
	var replcfg *replication.Config
	if opts.Expiration.Expire {
		// Check if the current bucket has a configured lifecycle policy
		lc, err = globalLifecycleSys.Get(bucket)

			if err == nil || objInfo.IsLatest && objInfo.DeleteMarker {
				if opts.Lifecycle != nil {
					evt := evalActionFromLifecycle(ctx, *opts.Lifecycle, opts.Retention, opts.Replication.Config, objInfo)
					if evt.Action.Delete() {
						globalExpiryState.enqueueByDays(objInfo, evt, lcEventSrc_s3ListObjects)
						if !evt.Action.DeleteRestored() {

	TaggingTimestamp = "tagging-timestamp"
	// ObjectLockRetentionTimestamp - the last time a object lock metadata modification happened on this cluster for this object version
	ObjectLockRetentionTimestamp = "objectlock-retention-timestamp"
	// ObjectLockLegalHoldTimestamp - the last time a legal hold metadata modification happened on this cluster for this object version
	ObjectLockLegalHoldTimestamp = "objectlock-legalhold-timestamp"