byte[] labelBytes = label.getBytes(java.nio.charset.StandardCharsets.UTF_8);
        byte[] input = new byte[baseKey.length + labelBytes.length + (context != null ? context.length : 0)];

        int pos = 0;
        System.arraycopy(baseKey, 0, input, pos, baseKey.length);
        pos += baseKey.length;
        System.arraycopy(labelBytes, 0, input, pos, labelBytes.length);
        pos += labelBytes.length;

    @Test
    public void testDeriveKey() throws Exception {
        byte[] baseKey = new byte[16];
        new SecureRandom().nextBytes(baseKey);

        byte[] derived1 = keyManager.deriveKey(baseKey, "label1", null, 32);
        byte[] derived2 = keyManager.deriveKey(baseKey, "label2", null, 32);
        byte[] derived3 = keyManager.deriveKey(baseKey, "label1", new byte[] { 1, 2, 3 }, 32);

// multi-part PUT request. It derives an unique encryption key from
// the partID and the object key.
func EncryptMultiPart(r io.Reader, partID int, key ObjectKey) io.Reader {
	partKey := key.DerivePartKey(uint32(partID))
	return EncryptSinglePart(r, ObjectKey(partKey))
}

// DecryptSinglePart decrypts an io.Writer which must an object
// uploaded with the single-part PUT API. The offset and length
// specify the requested range.

      new Predicate<Entry<String, Integer>>() {
        @Override
        public boolean apply(Entry<String, Integer> entry) {
          return !Objects.equals(entry.getKey(), "badkey") && entry.getValue() != 55556;
        }
      };

  public MultimapsFilterEntriesAsMapTest() {
    super(true, true, false);
  }

  private Multimap<String, Integer> createMultimap() {

			return c, err
		}

		arnKey := p.roleArn
		if p.RolePolicy == "" {
			arnKey = DummyRoleARN
			// Ensure that at most one JWT policy claim based provider may be
			// defined.
			if _, ok := c.arnProviderCfgsMap[DummyRoleARN]; ok {
				return c, errSingleProvider
			}
		}

		c.arnProviderCfgsMap[arnKey] = &p
		c.ProviderCfgs[cfgName] = &p

		return 0, nil
	}
	o.debugln("searching for ", search)
	var tmp metacacheBlock
	json := jsoniter.ConfigCompatibleWithStandardLibrary
	i := 0
	for {
		partKey := fmt.Sprintf("%s-metacache-part-%d", ReservedMetadataPrefixLower, i)
		v, ok := fi.Metadata[partKey]
		if !ok {
			o.debugln("no match in metadata, waiting")
			return -1, io.ErrUnexpectedEOF
		}
		err := json.Unmarshal([]byte(v), &tmp)
		if !ok {

			info.ETag = getDecryptedETag(headers, *info, false)
		}
	}

	return encrypted, nil
}

type (
	objectMetaEncryptFn func(baseKey string, data []byte) []byte
	objectMetaDecryptFn func(baseKey string, data []byte) ([]byte, error)
)

// metadataEncrypter returns a function that will read data from input,
// encrypt it using the provided key and return the result.

                .toString())
        .isEqualTo("ad262969c53bc16032f160081c4a07a0");
  }

  public void testBadKey_emptyKey() throws Exception {
    SecretKey badKey =
        new SecretKey() {
          @Override
          public String getAlgorithm() {
            return "HmacMD5";
          }

          @Override
          public byte @Nullable [] getEncoded() {

				exp.As = exp.As[1 : len(exp.As)-1]
			}
		}
	}
	return stmt, err
}

func validateTableName(from *TableExpression) error {
	if !strings.EqualFold(from.Table.BaseKey.String(), baseTableName) {
		return errBadTableName(errors.New("table name must be `s3object`"))
	}

	if len(from.Table.PathExpr) > 0 {
		if !from.Table.PathExpr[0].ArrayWildcard {

	ArrayWildcard  bool       `parser:"| @\"[*]\""`         // [*] form
}

// JSONPath represents a keypath.
// Instances should be treated idempotent and not change once created.
type JSONPath struct {
	BaseKey  *Identifier        `parser:" @@"`
	PathExpr []*JSONPathElement `parser:"(@@)*"`

	// Cached values:
	pathString         string
	strippedTableAlias string
	strippedPathExpr   []*JSONPathElement
}