if ((n != byteCount) && (LogStream.level >= 5)) {
                log.println("byteCount=" + byteCount + " but readBytesWireFormat returned " + n);
            }
            // Don't think we can rely on n being correct here. Must use byteCount.
            // Last paragraph of section 3.13.3 eludes to this.

            bufferIndex += byteCount;
        }

        length = bufferIndex - start;
        return length;

		return errSftpCertWithoutPrincipals
	}

	// Verify that certificate provided by user is issued by trusted CA,
	// username in authentication request matches to identities in certificate
	// and that certificate type is correct.
	checker := ssh.CertChecker{}
	checker.IsUserAuthority = func(k ssh.PublicKey) bool {
		return subtle.ConstantTimeCompare(globalSFTPTrustedCAPubkey.Marshal(), k.Marshal()) == 1
	}

   */
  protected abstract I newTargetIterator();

  /**
   * Override this to verify anything after running a list of Stimuli.
   *
   * <p>For example, verify that calls to remove() actually removed the correct elements.
   *
   * @param elements the expected elements passed to the constructor, as mutated by {@code
   *     remove()}, {@code set()}, and {@code add()} calls
   */
  protected void verify(List<E> elements) {}

   * ```
   *
   * But this chain is wrong because the attackerSwitch certificate is being used in a CA role even
   * though it is not a CA certificate. There are pinned certificates in the chain! The correct
   * chain is much shorter because it skips the non-CA certificate.
   *
   * ```
   *   attackerCa
   *     -> attackerIntermediate
   *         -> phonyVictim
   * ```
   *

    return file(new File(first), more);
  }

  /** Returns a {@code File} object for the given path parts. */
  private static File file(File first, String... more) {
    // not very efficient, but should definitely be correct
    File file = first;
    for (String name : more) {
      file = new File(file, name);
    }
    return file;
  }

	BytesDone   uint64
	BytesFailed uint64

	// Last object scanned.
	Bucket string `json:"-"`
	Object string `json:"-"`

	// Numbers when current bucket started healing,
	// for resuming with correct numbers.
	ResumeItemsHealed  uint64 `json:"-"`
	ResumeItemsFailed  uint64 `json:"-"`
	ResumeItemsSkipped uint64 `json:"-"`
	ResumeBytesDone    uint64 `json:"-"`
	ResumeBytesFailed  uint64 `json:"-"`

			}
			m.addErrorNonBlockingClose(errResp, context.Cause(m.ctx))
			return
		case <-pingTimer:
			errState = !m.doPing(errResp)
		}
	}
}

// checkSeq will check if sequence number is correct and increment it by 1.
func (m *muxClient) checkSeq(seq uint32) (ok bool) {
	if seq != m.RecvSeq {
		if debugPrint {
			fmt.Printf("MuxID: %d client, expected sequence %d, got %d\n", m.MuxID, m.RecvSeq, seq)
		}

            logger.warn("Failed to get object tags: bucket={}, path={}", bucketName, path, e);
        }
        return null;
    }

    /**
     * Preprocesses a URI to ensure it has the correct S3 protocol prefix.
     * @param uri the URI to preprocess
     * @return the preprocessed URI with s3:// prefix
     * @throws CrawlerSystemException if the URI is empty
     */

   */
  protected abstract I newTargetIterator();

  /**
   * Override this to verify anything after running a list of Stimuli.
   *
   * <p>For example, verify that calls to remove() actually removed the correct elements.
   *
   * @param elements the expected elements passed to the constructor, as mutated by {@code
   *     remove()}, {@code set()}, and {@code add()} calls
   */
  protected void verify(List<E> elements) {}

        VersionRange range2 = VersionRange.createFromVersionSpec("1.1");
        VersionRange mergedRange = range1.restrict(range2);
        // TODO current policy is to retain the original version - is this correct, do we need strategies or is that
        // handled elsewhere?
        //        assertEquals( "1.1", mergedRange.getRecommendedVersion().toString(), CHECK_VERSION_RECOMMENDATION );