"x-amz-object-lock-mode":              "governance",
				"x-amz-object-lock-retain-until-date": "2020-02-01",
			},
			expected:        map[string]string{},
			filterRetention: true,
			filterLegalHold: true,
		},
		{
			metadata: map[string]string{
				"x-amz-object-lock-legal-hold":        "on",
				"x-amz-object-lock-mode":              "governance",

	return paxHdrs, nil
}

// readHeader reads the next block header and assumes that the underlying reader
// is already aligned to a block boundary. It returns the raw block of the
// header in case further processing is required.
//
// The err will be set to io.EOF only when one of the following occurs:
//   - Exactly 0 bytes are read and EOF is hit.
//   - Exactly 1 block of zeros is read and EOF is hit.

					return ObjectLocked{}
				}

				if !ret.RetainUntilDate.Before(t) {
					return ObjectLocked{}
				}
				return nil
			}
			// https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes
			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention, the operation will succeed.

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1712896733 +0000

	CreatedAt         time.Time // only for site replication
	NoLock            bool      // does not lock the make bucket call if set to 'true'
}

// DeleteBucketOptions provides options for DeleteBucket calls.
type DeleteBucketOptions struct {
	NoLock     bool             // does not lock the delete bucket call if set to 'true'
	NoRecreate bool             // do not recreate bucket on delete failures

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1712896733 +0000

/*
 * Copyright (C) 2022 Block, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1712896733 +0000

dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1712896733 +0000

			API:       "SYSTEM",
			RequestID: fmt.Sprintf("%X", time.Now().UTC().UnixNano()),
		}
	}
	req.RLock()
	defer req.RUnlock()

	API := "SYSTEM"
	switch {
	case req.API != "":
		API = req.API
	case subsystem != "":
		API += "." + subsystem
	}

	// Copy tags. We hold read lock already.
	tags := make(map[string]interface{}, len(req.tags))
	for _, entry := range req.tags {