return key, ErrMissingCustomerKeyMD5
	}

	clientKey, err := base64.StdEncoding.DecodeString(h.Get(xhttp.AmzServerSideEncryptionCustomerKey))
	if err != nil || len(clientKey) != 32 { // The client key must be 256 bits long
		return key, ErrInvalidCustomerKey
	}
	keyMD5, err := base64.StdEncoding.DecodeString(h.Get(xhttp.AmzServerSideEncryptionCustomerKeyMD5))
	if md5Sum := md5.Sum(clientKey); err != nil || !bytes.Equal(md5Sum[:], keyMD5) {

	}
	dst = dst[:skip]
	if skip > 0 {
		n, err := io.ReadFull(r.buf, dst)
		if err != nil && err != io.ErrUnexpectedEOF {
			// If an EOF happens after reading some but not all the bytes,
			// ReadFull returns ErrUnexpectedEOF.
			return dst[:n], err
		}
		dst = dst[:n]
		if err == io.ErrUnexpectedEOF {
			return dst, io.EOF
		}
	}
	// Read until next line.
	in, err := r.buf.ReadBytes('\n')
	dst = append(dst, in...)

		// Read tokens from the XML document in a stream.
		t, err := d.Token()
		if err != nil {
			if err == io.EOF {
				break
			}
			return err
		}

		if se, ok := t.(xml.StartElement); ok {
			tagName := se.Name.Local
			switch tagName {
			case "AllowQuotedRecordDelimiter":
				var b bool
				if err = d.DecodeElement(&b, &se); err != nil {
					return err
				}
				args.AllowQuotedRecordDelimiter = b
			default:

		for _, portStr := range splitPorts(portsString) {
			port, err := parsePort(portStr)
			if err != nil {
				return nil, err
			}
			ports = append(ports, int(port))
		}
	}
	return ports, nil
}

func validatePortList(ports string) error {
	if _, err := parsePorts(ports); err != nil {
		return fmt.Errorf("portList %q invalid: %v", ports, err)
	}
	return nil
}

  istioctl x internal-debug syncz --xds-label istio.io/rev=default
`,
		RunE: func(c *cobra.Command, args []string) error {
			kubeClient, err := ctx.CLIClientWithRevision(opts.Revision)
			if err != nil {
				return err
			}
			if len(args) == 0 {
				return util.CommandParseError{
					Err: fmt.Errorf("debug type is required"),
				}
			}
			var xdsRequest discovery.DiscoveryRequest
			var namespace, serviceAccount string

	certPEMBlock, err := os.ReadFile(certFile)
	if err != nil {
		return tls.Certificate{}, ErrTLSReadError(nil).Msgf("Unable to read the public key: %s", err)
	}
	keyPEMBlock, err := os.ReadFile(keyFile)
	if err != nil {
		return tls.Certificate{}, ErrTLSReadError(nil).Msgf("Unable to read the private key: %s", err)
	}
	key, rest := pem.Decode(keyPEMBlock)
	if len(rest) > 0 {

		t.Run("", func(t *testing.T) {
			tmpfile, err := os.CreateTemp("", "testfile")
			if err != nil {
				t.Error(err)
			}
			tmpfile.WriteString(testCase.stat)
			tmpfile.Sync()
			tmpfile.Close()

			iostats, err := readDriveStats(tmpfile.Name())
			if err != nil && !testCase.expectErr {
				t.Fatalf("unexpected err; %v", err)
			}
			if testCase.expectErr && err == nil {

				Version:        c.k8sMinorVersion,
			})
			client, err := ctx.CLIClient()
			if err != nil {
				tt.Fatalf("failed to create client: %v", err)
			}
			got, _, err := CreateRemoteSecret(client, opts)
			if c.wantErrStr != "" {
				if err == nil {
					tt.Fatalf("wanted error including %q but got none", c.wantErrStr)
				} else if !strings.Contains(err.Error(), c.wantErrStr) {

			z.Volume, err = dc.ReadString()
			if err != nil {
				err = msgp.WrapError(err, "Volume")
				return
			}
		case "fp":
			z.FilePath, err = dc.ReadString()
			if err != nil {
				err = msgp.WrapError(err, "FilePath")
				return
			}
		case "fi":
			err = z.FI.DecodeMsg(dc)
			if err != nil {
				err = msgp.WrapError(err, "FI")
				return
			}
		default:
			err = dc.Skip()

			err = z.Filter.DecodeMsg(dc)
			if err != nil {
				err = msgp.WrapError(err, "Filter")
				return
			}
		case "Notify":
			err = z.Notify.DecodeMsg(dc)
			if err != nil {
				err = msgp.WrapError(err, "Notify")
				return
			}
		case "Retry":
			err = z.Retry.DecodeMsg(dc)
			if err != nil {
				err = msgp.WrapError(err, "Retry")
				return
			}
		default:
			err = dc.Skip()