if err != nil {
				return nil, err
			}
		}

		client, err := kms.NewClient(&kms.Config{
			Endpoints: endpoints,
			APIKey:    key,
			TLS: &tls.Config{
				MinVersion:         tls.VersionTLS12,
				ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
				RootCAs:            rootCAs,
			},
		})
		if err != nil {
			return nil, err
		}

}

// EncryptSinglePart encrypts an io.Reader which must be the
// body of a single-part PUT request.
func EncryptSinglePart(r io.Reader, key ObjectKey) io.Reader {
	r, err := sio.EncryptReader(r, sio.Config{MinVersion: sio.Version20, Key: key[:]})
	if err != nil {
		logger.CriticalIf(context.Background(), errors.New("Unable to encrypt io.Reader using object key"))
	}
	return r
}

	if err != nil {
		host = ldapServer
	}

	l.LDAP = ldap.Config{
		ServerAddr:    ldapServer,
		SRVRecordName: getCfgVal(SRVRecordName),
		TLS: &tls.Config{
			ServerName:         host,
			MinVersion:         tls.VersionTLS12,
			NextProtos:         []string{"h2", "http/1.1"},
			ClientSessionCache: tls.NewLRUClientSessionCache(100),
			CipherSuites:       crypto.TLSCiphersBackwardCompatible(), // Contains RSA key exchange

check_untyped_defs = true

[[tool.mypy.overrides]]
module = "docs_src.*"
disallow_incomplete_defs = false
disallow_untyped_defs = false
disallow_untyped_calls = false

[tool.pytest]
minversion = "9.0"
addopts = [
  "--strict-config",
  "--strict-markers",
  "--ignore=docs_src",
]
strict_xfail = true
filterwarnings = [
    "error",
]
timeout = "20"

[tool.coverage.run]

	crypto.S3.CreateMetadata(metadata, key.KeyID, key.Ciphertext, sealedKey)
	_, err = sio.Encrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20})
	if err != nil {
		return output, metabytes, err
	}
	metabytes, err = json.Marshal(metadata)
	if err != nil {
		return output, metabytes, err
	}
	return outbuf.Bytes(), metabytes, nil

                assertNotNull(upgrade.artifactId(), "Plugin upgrade should have artifactId");
                assertNotNull(upgrade.minVersion(), "Plugin upgrade should have minVersion");
                // configuration can be null for some plugins
            }
        }
    }

    @Nested
    @DisplayName("Error Handling")
    class ErrorHandlingTests {

        // Default to SMB2 minimum for security - SMB1 is deprecated and insecure
        this.minVersion = min != null ? min : DialectVersion.SMB202;
        this.maxVersion = max != null ? max : DialectVersion.SMB311;

        if (this.minVersion.atLeast(this.maxVersion)) {
            this.maxVersion = this.minVersion;
        }
    }

    /**

    void testDialectVersionProperties() throws CIFSException {
        // Given
        Properties props = new Properties();
        props.setProperty("jcifs.smb.client.minVersion", "SMB1");
        props.setProperty("jcifs.smb.client.maxVersion", "SMB311");

        // When
        PropertyConfiguration testConfig = new PropertyConfiguration(props);

        // Then

}

func newTLSConfig(getCert certs.GetCertificateFunc) *tls.Config {
	if getCert == nil {
		return nil
	}

	tlsConfig := &tls.Config{
		PreferServerCipherSuites: true,
		MinVersion:               tls.VersionTLS12,
		NextProtos:               []string{"http/1.1", "h2"},
		GetCertificate:           getCert,
		ClientSessionCache:       tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
	}

jcifs.smb.client.responseTimeout=30000

# Authentication
jcifs.smb.client.domain=WORKGROUP
jcifs.smb.client.username=guest
jcifs.smb.client.password=

# Protocol versions (SMB1 to SMB 3.1.1)
jcifs.smb.client.minVersion=SMB1
jcifs.smb.client.maxVersion=SMB311

# Security
jcifs.smb.client.signingPreferred=false
jcifs.smb.client.signingEnforced=false
jcifs.smb.client.encryptionEnforced=false