//                                                                        Small Helper
    //                                                                        ============
    /**
     * Verifies that the CRUD mode matches the expected mode.
     *
     * @param crudMode the actual CRUD mode
     * @param expectedMode the expected CRUD mode
     */
    protected void verifyCrudMode(final int crudMode, final int expectedMode) {

        // Verify signature is zeroed out (16 bytes of zeros)
        for (int i = 4; i < 20; i++) {
            assertEquals(0, aad[i], "Signature bytes should be zero in AAD");
        }

        // Verify nonce matches at position 20
        for (int i = 0; i < 16; i++) {
            assertEquals(testNonce[i], aad[20 + i], "Nonce should match at position " + (20 + i));
        }
    }

    @Test

By default, MinIO supports path-style requests that are of the format <http://mydomain.com/bucket/object>. `MINIO_DOMAIN` environment variable is used to enable virtual-host-style requests. If the request `Host` header matches with `(.+).mydomain.com` then the matched pattern `$1` is used as bucket and the path is used as object. Read more about path-style and virtual-host-style [here](http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAPI.html).

Example:

```sh

   * given predicate, if such an element exists.
   *
   * <p><b>Warning:</b> avoid using a {@code predicate} that matches {@code null}. If {@code null}
   * is matched in {@code iterable}, a NullPointerException will be thrown.
   *
   * <p><b>{@code Stream} equivalent:</b> {@code stream.filter(predicate).findFirst()}
   *
   * @since 11.0
   */

@GwtIncompatible
@J2ktIncompatible
@J2ObjCIncompatible // com.google.common.reflect.ClassPath
public abstract class AbstractPackageSanityTests extends TestCase {

  /**
   * A predicate that matches classes with an underscore in the class name. This can be used with
   * {@link #ignoreClasses} to exclude generated classes, such as the {@code AutoValue_Foo} classes

Using the **SNI extension** discussed above, the TLS Termination Proxy would check which of the TLS (HTTPS) certificates available it should use for this connection, using the one that matches the domain expected by the client.

In this case, it would use the certificate for `someapp.example.com`.

<img src="/img/deployment/https/https03.drawio.svg">

			continue
		}
		if !meta.IsValid() {
			inconsistent++
			continue
		}
		if meta.XLV1 != fi.XLV1 {
			inconsistent++
			continue
		}
		// check if erasure distribution order matches the index
		// position if this is not correct we discard the disk
		// and move to collect others
		if distribution[i] != meta.Erasure.Index {
			inconsistent++ // keep track of inconsistent entries
			continue
		}

	retStr := "{"
	retStr = retStr + expirationStr + ","
	retStr += conditionStr
	retStr += "}"

	return []byte(retStr)
}

// newPostPolicyBytesV4 - creates a bare bones postpolicy string with key and bucket matches.
func newPostPolicyBytesV4(credential, bucketName, objectKey string, expiration time.Time) []byte {
	t := UTCNow()
	// Add the expiration date.

     * transient query params, or has a canonical URL possibly for a CDN.
     *
     * Note that POST requests will not be sent to the server if this URL is set
     * and matches a cached response.
     */
    fun cacheUrlOverride(cacheUrlOverride: HttpUrl?) =
      apply {
        this.cacheUrlOverride = cacheUrlOverride
      }

    /**

    //                                                                        ============

    /**
     * Verifies that the current CRUD mode matches the expected mode, throwing a validation error if not.
     *
     * @param crudMode   the actual CRUD mode value
     * @param expectedMode the expected CRUD mode value
     */