return nil, err
		}
	default:
		return nil, ErrDecrypt
	}

	associatedData, _ := req.AssociatedData.MarshalText()
	plaintext, err := aead.Open(nil, nonce, ciphertext, associatedData)
	if err != nil {
		return nil, ErrDecrypt
	}
	return plaintext, nil
}

func (secretKey) MAC(context.Context, *MACRequest) ([]byte, error) {
	return nil, ErrNotSupported
}

		{"test-getobjectinfo", "Asia/asiapics.jpg", resultCases[0], nil, true},
		{"test-getobjectinfo", "Asia/empty-dir/", resultCases[1], nil, true},
	}
	for i, testCase := range testCases {
		result, err := obj.GetObjectInfo(context.Background(), testCase.bucketName, testCase.objectName, opts)
		if err != nil && testCase.shouldPass {

	}

	if p.adminURL == "" {
		return nil, errors.New("Admin URL cannot be empty")
	}

	_, err := url.Parse(p.adminURL)
	if err != nil {
		return nil, fmt.Errorf("Unable to parse the adminURL %s: %w", p.adminURL, err)
	}

	if p.client.Transport == nil {
		p.client.Transport = http.DefaultTransport
	}

	if p.oeConfig.TokenEndpoint == "" {
		return nil, errors.New("missing OpenID token endpoint")
	}

	//
	// The "right" way to do this is:
	// if err == nl.IPSetError(nl.IPSET_ERR_EXIST) {
	// 	log.Debugf("ignoring ipset err")
	// 	return nil
	// }
	// but that doesn't actually work, so strings.Contains the error.
	if err != nil && strings.Contains(err.Error(), "exists") {
		return nil
	}
	return err
}

func (m *realDeps) destroySet(name string) error {
	err := netlink.IpsetDestroy(name)
	return err
}

func init() {
	var err error
	if DB, err = OpenTestConnection(&gorm.Config{}); err != nil {
		log.Printf("failed to connect database, got error %v", err)
		os.Exit(1)
	} else {
		sqlDB, err := DB.DB()
		if err != nil {
			log.Printf("failed to connect database, got error %v", err)
			os.Exit(1)
		}

		err = sqlDB.Ping()
		if err != nil {
			log.Printf("failed to ping sqlDB, got error %v", err)
			os.Exit(1)
		}

	if err != nil {
		return nil, err
	}

	hold = &ObjectLegalHold{}
	if err = xml.NewDecoder(bytes.NewReader(buf)).Decode(hold); err != nil {
		return nil, err
	}

	if !hold.Status.Valid() {
		return nil, ErrMalformedXML
	}
	return
}

// FilterObjectLockMetadata filters object lock metadata if s3:GetObjectRetention permission is denied or if isCopy flag set.

	if err := e.EncodeToken(start); err != nil {
		return err
	}

	switch {
	case !f.And.isEmpty():
		if err := e.EncodeElement(f.And, xml.StartElement{Name: xml.Name{Local: "And"}}); err != nil {
			return err
		}
	case !f.Tag.IsEmpty():
		if err := e.EncodeElement(f.Tag, xml.StartElement{Name: xml.Name{Local: "Tag"}}); err != nil {
			return err
		}
	default:

			return nil, s3.ToObjectError(err, object)
		}
	}
	c := &minio.Core{Client: s3.client}
	// Important to use core primitives here to pass range get options as is.
	r, _, _, err := c.GetObject(ctx, s3.Bucket, s3.getDest(object), gopts)
	if err != nil {
		return nil, s3.ToObjectError(err, object)
	}
	return r, nil
}

	if !flags.Write {
		// sanity check
		return nil, os.ErrInvalid
	}

	bucket, object := path2BucketObject(r.Filepath)
	if bucket == "" {
		return nil, errors.New("bucket name cannot be empty")
	}

	clnt, err := f.getMinIOClient()
	if err != nil {
		return nil, err
	}
	ok, err := clnt.BucketExists(r.Context(), bucket)
	if err != nil {
		return nil, err
	}
	if !ok {
		return nil, os.ErrNotExist

func loadClusterUsageObjectMetrics(ctx context.Context, m MetricValues, c *metricsCache) error {
	dataUsageInfo, err := c.dataUsageInfo.Get()
	if err != nil {
		metricsLogIf(ctx, err)
		return nil
	}

	// data usage has not captured any data yet.
	if dataUsageInfo.LastUpdate.IsZero() {
		return nil
	}

	var (
		clusterSize               uint64
		clusterBuckets            uint64
		clusterObjectsCount       uint64