// must be provided. On success the ObjectKey contains the decrypted sealed key.
func (key *ObjectKey) Unseal(extKey []byte, sealedKey SealedKey, domain, bucket, object string) error {
	var unsealConfig sio.Config
	switch sealedKey.Algorithm {
	default:
		return Errorf("The sealing algorithm '%s' is not supported", sealedKey.Algorithm)
	case SealAlgorithm:
		mac := hmac.New(sha256.New, extKey)
		mac.Write(sealedKey.IV[:])

	}

	if err := scanner.Err(); err != nil {
		return nil, err
	}

	return result, nil
}

func getDiskUUIDMap() (map[string]string, error) {
	result := make(map[string]string)
	err := filepath.Walk("/dev/disk/by-uuid/",
		func(path string, info os.FileInfo, err error) error {
			if err != nil {
				return err
			}
			realPath, err := filepath.EvalSymlinks(path)
			if err != nil {
				return err
			}

	}
	return keyInfos, resp.ContinueAt, nil
}

func (c *kmsConn) CreateKey(ctx context.Context, req *CreateKeyRequest) error {
	if err := c.client.CreateKey(ctx, c.enclave, &kms.CreateKeyRequest{
		Name: req.Name,
	}); err != nil {
		if errors.Is(err, kms.ErrKeyExists) {
			return ErrKeyExists
		}
		if errors.Is(err, kms.ErrPermission) {
			return ErrPermission
		}
		return errKeyCreationFailed(err)
	}
	return nil

			return ErrBucketConflict(Error{bucket, errors.New(errorString)})
		}
		return newError(bucket, fmt.Errorf("service create for bucket %s, failed with status %s, error %s", bucket, resp.Status, errorString))
	}
	return nil
}

func newError(bucket string, err error) error {
	e := Error{bucket, err}
	if strings.Contains(err.Error(), "invalid bucket name") {
		return ErrInvalidBucketName(e)
	}

// It may return the (non-nil) error from the same call or return the error (and n == 0) from a subsequent call.
// Callers should always process the n > 0 bytes returned before considering the error err.
// Doing so correctly handles I/O errors that happen after reading some bytes and also both of the allowed EOF behaviors.
func (r *RingBuffer) Read(p []byte) (n int, err error) {
	if len(p) == 0 {
		return 0, r.readErr(false)
	}

	r.mu.Lock()

	lockSource := getSource(2)
	start := UTCNow()

	newCtx, cancel := context.WithCancel(ctx)
	if !di.rwMutex.GetRLock(ctx, cancel, di.opsID, lockSource, dsync.Options{
		Timeout:       timeout.Timeout(),
		RetryInterval: timeout.RetryInterval(),
	}) {
		timeout.LogFailure()
		defer cancel()
		if errors.Is(newCtx.Err(), context.Canceled) {

	for _, testCase := range testCases {
		t.Run(testCase.timeStr, func(t *testing.T) {
			gott, goterr := Parse(testCase.timeStr)
			if !errors.Is(goterr, testCase.expectedErr) {
				t.Errorf("expected %v, got %v", testCase.expectedErr, goterr)
			}
			if !gott.Equal(testCase.expectedTime) {
				t.Errorf("expected %v, got %v", testCase.expectedTime, gott)
			}
		})
	}

            if (errors.isEmpty()) {
                fw.println("All clear!");
                return;
            }
            for (Map.Entry<File, List<Error>> e : errors.entrySet()) {
                File file = e.getKey();
                List<Error> errorsForFile = e.getValue();

                StringBuilder sb = new StringBuilder();
                for (Error error : errorsForFile) {

	w.Write(buf)
}

func checkDiskFatalErrs(errs []error) error {
	// This returns a common error if all errors are
	// same errors, then there is no point starting
	// the server.
	if countErrs(errs, errUnsupportedDisk) == len(errs) {
		return errUnsupportedDisk
	}

	if countErrs(errs, errDiskAccessDenied) == len(errs) {
		return errDiskAccessDenied
	}

	}
	defer r.closeRespFn(resp.Body)
	if resp.StatusCode != http.StatusOK {
		return errors.New(resp.Status)
	}

	return r.pubKeys.parseAndAdd(resp.Body)
}

// ErrTokenExpired - error token expired
var (
	ErrTokenExpired = errors.New("token expired")
)

func updateClaimsExpiry(dsecs string, claims map[string]any) error {
	expStr := claims["exp"]
	if expStr == "" {
		return ErrTokenExpired
	}