exclude permissions like "s3:ReplicateDelete", "s3:GetBucketObjectLockConfiguration" etc depending on whether delete replication rules are set up or if object locking is disabled on `destbucket`. The above policies assume that replication of objects, tags and delete marker replication are all enabled on object lock enabled buckets. A sample script to setup replication is provided [here](https://github.com/minio/minio/blob/master/docs/bucket/replication/setup_replication.sh)

To set up replication...

// array position can be safely represented inside a JSON string, embedded
// inside of HTML <script> tags, without any additional escaping.
//
// All values are true except for the ASCII control characters (0-31), the
// double quote ("), the backslash character ("\"), HTML opening and closing
// tags ("<" and ">"), and the ampersand ("&").
var htmlSafeSet = [utf8.RuneSelf]bool{
	' ':      true,
	'!':      true,

	API := "SYSTEM"
	switch {
	case req.API != "":
		API = req.API
	case subsystem != "":
		API += "." + subsystem
	}

	// Copy tags. We hold read lock already.
	tags := make(map[string]interface{}, len(req.tags))
	for _, entry := range req.tags {
		tags[entry.Key] = entry.Val
	}

	// Get the cause for the Error
	deploymentID := req.DeploymentID
	if req.DeploymentID == "" {

			}
			traceFn := globalLifecycleSys.trace(oi)
			// Note: NewerNoncurrentVersions action is performed only scanner today
			tags := newLifecycleAuditEvent(lcEventSrc_Scanner, lcEvent).Tags()

			// Send audit for the lifecycle delete operation
			auditLogLifecycle(
				ctx,
				oi,
				ILMExpiry, tags, traceFn)

			evArgs := eventArgs{
				EventName:  event.ObjectRemovedDelete,
				BucketName: bucket,

	entry.API.Status = opts.Status
	entry.Tags = make(map[string]interface{}, len(opts.Tags))
	for k, v := range opts.Tags {
		entry.Tags[k] = v
	}

	// Merge tag information if found - this is currently needed for tags
	// set during decommissioning.
	if reqInfo := logger.GetReqInfo(ctx); reqInfo != nil {
		reqInfo.PopulateTagsMap(entry.Tags)
	}
	ctx = logger.SetAuditEntry(ctx, &entry)

#!/bin/bash

sudo sysctl net.ipv6.conf.all.disable_ipv6=0

release=$(git describe --abbrev=0 --tags)

docker buildx build --push --no-cache \
	--build-arg RELEASE="${release}" \
	-t "minio/minio:latest" \
	-t "quay.io/minio/minio:latest" \
	-t "minio/minio:${release}" \
	-t "quay.io/minio/minio:${release}" \
	--platform=linux/arm64,linux/amd64,linux/ppc64le,linux/s390x \
	-f Dockerfile.release .

docker buildx prune -f

}

// GetTaggingConfig returns configured tagging config
// The returned object may not be modified.
func (sys *BucketMetadataSys) GetTaggingConfig(bucket string) (*tags.Tags, time.Time, error) {
	meta, _, err := sys.GetConfig(GlobalContext, bucket)
	if err != nil {
		if errors.Is(err, errConfigNotFound) {
			return nil, time.Time{}, BucketTaggingNotFound{Bucket: bucket}
		}

		hasRules bool
	}{
		{ // Delete marker shouldn't match filter without tags
			lc: Lifecycle{
				Rules: []Rule{
					rules[0],
				},
			},
			opts: ObjectOpts{
				DeleteMarker: true,
				IsLatest:     true,
				Name:         "obj-1",
			},
			hasRules: false,
		},
		{ // PUT version with no matching tags
			lc: Lifecycle{
				Rules: []Rule{
					rules[0],
				},

	lifecycleConfig        *lifecycle.Lifecycle
	objectLockConfig       *objectlock.Config
	versioningConfig       *versioning.Versioning
	sseConfig              *bucketsse.BucketSSEConfig
	taggingConfig          *tags.Tags
	quotaConfig            *madmin.BucketQuota
	replicationConfig      *replication.Config
	bucketTargetConfig     *madmin.BucketTargets
	bucketTargetConfigMeta map[string]string
}

}

// PutObjectTags - replace or add tags to an existing object
func (s *erasureSets) PutObjectTags(ctx context.Context, bucket, object string, tags string, opts ObjectOptions) (ObjectInfo, error) {
	er := s.getHashedSet(object)
	return er.PutObjectTags(ctx, bucket, object, tags, opts)
}

// DeleteObjectTags - delete object tags from an existing object