Etcd Snapshot/Restore to/from S3 Compatible Backends (#2902)

go.mod

@@ -88,6 +88,7 @@ require (
 	github.com/kubernetes-sigs/cri-tools v0.0.0-00010101000000-000000000000
 	github.com/lib/pq v1.8.0
 	github.com/mattn/go-sqlite3 v1.14.4
+	github.com/minio/minio-go/v7 v7.0.7
 	github.com/natefinch/lumberjack v2.0.0+incompatible
 	github.com/opencontainers/runc v1.0.0-rc92
 	github.com/opencontainers/selinux v1.6.0

go.sum

@@ -131,6 +131,7 @@ github.com/chai2010/gettext-go v0.0.0-20160711120539-c6fed771bfd5/go.mod h1:/iP1
 github.com/checkpoint-restore/go-criu/v4 v4.1.0 h1:WW2B2uxx9KWF6bGlHqhm8Okiafwwx7Y2kcpn8lCpjgo=
 github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
 github.com/cheekybits/genny v0.0.0-20170328200008-9127e812e1e9/go.mod h1:+tQajlRqAUrPI7DOSpB0XAqZYtQakVtB7wXkRAgjxjQ=
+github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -257,6 +258,7 @@ github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d/go.mod h1:ZZM
 github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
@@ -425,6 +427,7 @@ github.com/googleapis/gnostic v0.4.1 h1:DLJCy1n/vrD4HPjOvYcT8aYQXpPIzoRZONaYwyyc
 github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
 github.com/gophercloud/gophercloud v0.1.0 h1:P/nh25+rzXouhytV2pUHBb65fnds26Ghl8/391+sT5o=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
@@ -503,6 +506,7 @@ github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
@@ -581,6 +585,9 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.7 h1:0hzRabrMN4tSTvMfnL3SCv1ZGeAP23ynzodBgaHeMeg=
 github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
+github.com/klauspost/cpuid v1.2.3/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
+github.com/klauspost/cpuid v1.3.1 h1:5JNjFYYQrZeKRJ0734q51WCEEn2huer72Dc7K+R/b6s=
+github.com/klauspost/cpuid v1.3.1/go.mod h1:bYW4mA6ZgKPob1/Dlai2LviZJO7KGI3uoWLd42rAQw4=
 github.com/knative/build v0.6.0/go.mod h1:/sU74ZQkwlYA5FwYDJhYTy61i/Kn+5eWfln2jDbw3Qo=
 github.com/knative/pkg v0.0.0-20190514205332-5e4512dcb2ca/go.mod h1:7Ijfhw7rfB+H9VtosIsDYvZQ+qYTz7auK3fHW/5z4ww=
 github.com/knative/serving v0.6.1/go.mod h1:ljvMfwQy2qanaM/8xnBSK4Mz3Vv2NawC2fo5kFRJS1A=
@@ -622,9 +629,13 @@ github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
 github.com/marten-seemann/qtls v0.2.3/go.mod h1:xzjG7avBwGGbdZ8dTGxlBnLArsVKLvwmjgmPuiQEcYk=
 github.com/mattbaird/jsonpatch v0.0.0-20171005235357-81af80346b1a/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-sqlite3 v1.14.4 h1:4rQjbDxdu9fSgI/r3KN72G3c2goxknAqHHgPWWs8UlI=
 github.com/mattn/go-sqlite3 v1.14.4/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
@@ -638,10 +649,18 @@ github.com/miekg/dns v1.1.4 h1:rCMZsU2ScVSYcAsOXgmC6+AKOK+6pmQTOcw03nfwYV0=
 github.com/miekg/dns v1.1.4/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/mindprince/gonvml v0.0.0-20190828220739-9ebdce4bb989 h1:PS1dLCGtD8bb9RPKJrc8bS7qHL6JnW1CZvwzH9dPoUs=
 github.com/mindprince/gonvml v0.0.0-20190828220739-9ebdce4bb989/go.mod h1:2eu9pRWp8mo84xCg6KswZ+USQHjwgRhNp06sozOdsTY=
+github.com/minio/md5-simd v1.1.0 h1:QPfiOqlZH+Cj9teu0t9b1nTBfPbyTl16Of5MeuShdK4=
+github.com/minio/md5-simd v1.1.0/go.mod h1:XpBqgZULrMYD3R+M28PcmP0CkI7PEMzB3U77ZrKZ0Gw=
+github.com/minio/minio-go/v7 v7.0.7 h1:Qld/xb8C1Pwbu0jU46xAceyn9xXKCMW+3XfNbpmTB70=
+github.com/minio/minio-go/v7 v7.0.7/go.mod h1:pEZBUa+L2m9oECoIA6IcSK8bv/qggtQVLovjeKK5jYc=
+github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
+github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
+github.com/minio/sio v0.2.1/go.mod h1:8b0yPp2avGThviy/+OCJBI6OMpvxoUuiLvE6F1lebhw=
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible h1:aKW/4cBs+yK6gpqU3K/oIwk9Q/XICqd3zOX/UFuvqmk=
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-wordwrap v1.0.0 h1:6GlHJ/LTGMrIJbwgdqdl2eEH8o+Exx/0m8ir9Gns0u4=
@@ -790,6 +809,8 @@ github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6So
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rootless-containers/rootlesskit v0.10.0 h1:62HHP8s8qYYcolEtAsuo4GU6qau6pWmcQ1Te+TZTFds=
 github.com/rootless-containers/rootlesskit v0.10.0/go.mod h1:OZQfuRPb+2MA1p+hmjHmSmDRv9SdTzlQ3taNA/0d7XM=
+github.com/rs/xid v1.2.1 h1:mhH9Nq+C1fY2l1XIpgxIiUOfNpRBYH1kKcr+qfKgjRc=
+github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021 h1:if3/24+h9Sq6eDx8UUz1SO9cT9tizyIsATfB7b4D3tc=
 github.com/rubiojr/go-vhd v0.0.0-20200706105327-02e210299021/go.mod h1:DM5xW0nvfNNm2uytzsvhI3OnX8uzaRAg8UX/CnDqbto=
 github.com/russross/blackfriday v0.0.0-20170610170232-067529f716f4/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
@@ -815,7 +836,10 @@ github.com/sirupsen/logrus v1.6.0 h1:UBcNElsrwanuuMsnGSlYmtmgbb23qDR5dG+6X6Oo89I
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4 h1:0HKaf1o97UwFjHH9o5XsHUOF+tqmdA7KEzXLpiyaw0E=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
@@ -1084,6 +1108,8 @@ gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKW
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.57.0 h1:9unxIsFcTt4I55uWluz+UmL95q4kdJ0buvQ1ZIqVQww=
+gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/mcuadros/go-syslog.v2 v2.2.1/go.mod h1:l5LPIyOOyIdQquNg+oU6Z3524YwrcqEm0aKH+5zpt2U=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
 gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=

pkg/agent/config/config.go

@@ -26,7 +26,7 @@ import (
 	"github.com/rancher/k3s/pkg/cli/cmds"
 	"github.com/rancher/k3s/pkg/clientaccess"
 	"github.com/rancher/k3s/pkg/daemons/config"
-	"github.com/rancher/k3s/pkg/daemons/control"
+	"github.com/rancher/k3s/pkg/daemons/control/deps"
 	"github.com/rancher/k3s/pkg/version"
 	"github.com/sirupsen/logrus"
 	"k8s.io/apimachinery/pkg/util/json"
@@ -375,7 +375,7 @@ func get(envInfo *cmds.Agent, proxy proxy.Proxy) (*config.Node, error) {
 	}
 
 	kubeconfigKubelet := filepath.Join(envInfo.DataDir, "agent", "kubelet.kubeconfig")
-	if err := control.KubeConfig(kubeconfigKubelet, proxy.APIServerURL(), serverCAFile, clientKubeletCert, clientKubeletKey); err != nil {
+	if err := deps.KubeConfig(kubeconfigKubelet, proxy.APIServerURL(), serverCAFile, clientKubeletCert, clientKubeletKey); err != nil {
 		return nil, err
 	}
 
@@ -386,7 +386,7 @@ func get(envInfo *cmds.Agent, proxy proxy.Proxy) (*config.Node, error) {
 	}
 
 	kubeconfigKubeproxy := filepath.Join(envInfo.DataDir, "agent", "kubeproxy.kubeconfig")
-	if err := control.KubeConfig(kubeconfigKubeproxy, proxy.APIServerURL(), serverCAFile, clientKubeProxyCert, clientKubeProxyKey); err != nil {
+	if err := deps.KubeConfig(kubeconfigKubeproxy, proxy.APIServerURL(), serverCAFile, clientKubeProxyCert, clientKubeProxyKey); err != nil {
 		return nil, err
 	}
 
@@ -397,7 +397,7 @@ func get(envInfo *cmds.Agent, proxy proxy.Proxy) (*config.Node, error) {
 	}
 
 	kubeconfigK3sController := filepath.Join(envInfo.DataDir, "agent", version.Program+"controller.kubeconfig")
-	if err := control.KubeConfig(kubeconfigK3sController, proxy.APIServerURL(), serverCAFile, clientK3sControllerCert, clientK3sControllerKey); err != nil {
+	if err := deps.KubeConfig(kubeconfigK3sController, proxy.APIServerURL(), serverCAFile, clientK3sControllerCert, clientK3sControllerKey); err != nil {
 		return nil, err
 	}
 

pkg/cli/cmds/etcd_snapshot.go

@@ -34,6 +34,55 @@ func NewEtcdSnapshotCommand(action func(*cli.Context) error) cli.Command {
 				Usage:       "(db) Directory to save etcd on-demand snapshot. (default: ${data-dir}/db/snapshots)",
 				Destination: &ServerConfig.EtcdSnapshotDir,
 			},
+			&cli.BoolFlag{
+				Name:        "s3",
+				Usage:       "(db) Enable backup to S3",
+				Destination: &ServerConfig.EtcdS3,
+			},
+			&cli.StringFlag{
+				Name:        "s3-endpoint",
+				Usage:       "(db) S3 endpoint url",
+				Destination: &ServerConfig.EtcdS3Endpoint,
+				Value:       "s3.amazonaws.com",
+			},
+			&cli.StringFlag{
+				Name:        "s3-endpoint-ca",
+				Usage:       "(db) S3 custom CA cert to connect to S3 endpoint",
+				Destination: &ServerConfig.EtcdS3EndpointCA,
+			},
+			&cli.BoolFlag{
+				Name:        "s3-skip-ssl-verify",
+				Usage:       "(db) Disables S3 SSL certificate validation",
+				Destination: &ServerConfig.EtcdS3SkipSSLVerify,
+			},
+			&cli.StringFlag{
+				Name:        "s3-access-key",
+				Usage:       "(db) S3 access key",
+				EnvVar:      "AWS_ACCESS_KEY_ID",
+				Destination: &ServerConfig.EtcdS3AccessKey,
+			},
+			&cli.StringFlag{
+				Name:        "s3-secret-key",
+				Usage:       "(db) S3 secret key",
+				EnvVar:      "AWS_SECRET_ACCESS_KEY",
+				Destination: &ServerConfig.EtcdS3SecretKey,
+			},
+			&cli.StringFlag{
+				Name:        "s3-bucket",
+				Usage:       "(db) S3 bucket name",
+				Destination: &ServerConfig.EtcdS3BucketName,
+			},
+			&cli.StringFlag{
+				Name:        "s3-region",
+				Usage:       "(db) S3 region / bucket location (optional)",
+				Destination: &ServerConfig.EtcdS3Region,
+				Value:       "us-east-1",
+			},
+			&cli.StringFlag{
+				Name:        "s3-folder",
+				Usage:       "(db) S3 folder",
+				Destination: &ServerConfig.EtcdS3Folder,
+			},
 		},
 	}
 }

pkg/cli/cmds/server.go

@@ -69,6 +69,15 @@ type Server struct {
 	EtcdSnapshotDir          string
 	EtcdSnapshotCron         string
 	EtcdSnapshotRetention    int
+	EtcdS3                   bool
+	EtcdS3Endpoint           string
+	EtcdS3EndpointCA         string
+	EtcdS3SkipSSLVerify      bool
+	EtcdS3AccessKey          string
+	EtcdS3SecretKey          string
+	EtcdS3BucketName         string
+	EtcdS3Region             string
+	EtcdS3Folder             string
 }
 
 var ServerConfig Server
@@ -255,6 +264,55 @@ func NewServerCommand(action func(*cli.Context) error) cli.Command {
 				Usage:       "(db) Directory to save db snapshots. (Default location: ${data-dir}/db/snapshots)",
 				Destination: &ServerConfig.EtcdSnapshotDir,
 			},
+			&cli.BoolFlag{
+				Name:        "etcd-s3",
+				Usage:       "(db) Enable backup to S3",
+				Destination: &ServerConfig.EtcdS3,
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-endpoint",
+				Usage:       "(db) S3 endpoint url",
+				Destination: &ServerConfig.EtcdS3Endpoint,
+				Value:       "s3.amazonaws.com",
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-endpoint-ca",
+				Usage:       "(db) S3 custom CA cert to connect to S3 endpoint",
+				Destination: &ServerConfig.EtcdS3EndpointCA,
+			},
+			&cli.BoolFlag{
+				Name:        "etcd-s3-skip-ssl-verify",
+				Usage:       "(db) Disables S3 SSL certificate validation",
+				Destination: &ServerConfig.EtcdS3SkipSSLVerify,
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-access-key",
+				Usage:       "(db) S3 access key",
+				EnvVar:      "AWS_ACCESS_KEY_ID",
+				Destination: &ServerConfig.EtcdS3AccessKey,
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-secret-key",
+				Usage:       "(db) S3 secret key",
+				EnvVar:      "AWS_SECRET_ACCESS_KEY",
+				Destination: &ServerConfig.EtcdS3SecretKey,
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-bucket",
+				Usage:       "(db) S3 bucket name",
+				Destination: &ServerConfig.EtcdS3BucketName,
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-region",
+				Usage:       "(db) S3 region / bucket location (optional)",
+				Destination: &ServerConfig.EtcdS3Region,
+				Value:       "us-east-1",
+			},
+			&cli.StringFlag{
+				Name:        "etcd-s3-folder",
+				Usage:       "(db) S3 folder",
+				Destination: &ServerConfig.EtcdS3Folder,
+			},
 			cli.StringFlag{
 				Name:        "default-local-storage-path",
 				Usage:       "(storage) Default local storage path for local provisioner storage class",

pkg/cli/etcdsnapshot/etcd_snapshot.go

@@ -37,6 +37,15 @@ func run(app *cli.Context, cfg *cmds.Server) error {
 	serverConfig.ControlConfig.EtcdSnapshotName = cfg.EtcdSnapshotName
 	serverConfig.ControlConfig.EtcdSnapshotDir = cfg.EtcdSnapshotDir
 	serverConfig.ControlConfig.EtcdSnapshotRetention = 0 // disable retention check
+	serverConfig.ControlConfig.EtcdS3 = cfg.EtcdS3
+	serverConfig.ControlConfig.EtcdS3Endpoint = cfg.EtcdS3Endpoint
+	serverConfig.ControlConfig.EtcdS3EndpointCA = cfg.EtcdS3EndpointCA
+	serverConfig.ControlConfig.EtcdS3SkipSSLVerify = cfg.EtcdS3SkipSSLVerify
+	serverConfig.ControlConfig.EtcdS3AccessKey = cfg.EtcdS3AccessKey
+	serverConfig.ControlConfig.EtcdS3SecretKey = cfg.EtcdS3SecretKey
+	serverConfig.ControlConfig.EtcdS3BucketName = cfg.EtcdS3BucketName
+	serverConfig.ControlConfig.EtcdS3Region = cfg.EtcdS3Region
+	serverConfig.ControlConfig.EtcdS3Folder = cfg.EtcdS3Folder
 	serverConfig.ControlConfig.Runtime = &config.ControlRuntime{}
 	serverConfig.ControlConfig.Runtime.ETCDServerCA = filepath.Join(dataDir, "tls", "etcd", "server-ca.crt")
 	serverConfig.ControlConfig.Runtime.ClientETCDCert = filepath.Join(dataDir, "tls", "etcd", "client.crt")

pkg/cli/server/server.go

@@ -133,11 +133,30 @@ func run(app *cli.Context, cfg *cmds.Server, leaderControllers server.CustomCont
 	serverConfig.ControlConfig.EtcdSnapshotRetention = cfg.EtcdSnapshotRetention
 	serverConfig.ControlConfig.EtcdDisableSnapshots = cfg.EtcdDisableSnapshots
 	serverConfig.ControlConfig.EtcdExposeMetrics = cfg.EtcdExposeMetrics
+	serverConfig.ControlConfig.EtcdS3 = cfg.EtcdS3
+	serverConfig.ControlConfig.EtcdS3Endpoint = cfg.EtcdS3Endpoint
+	serverConfig.ControlConfig.EtcdS3EndpointCA = cfg.EtcdS3EndpointCA
+	serverConfig.ControlConfig.EtcdS3SkipSSLVerify = cfg.EtcdS3SkipSSLVerify
+	serverConfig.ControlConfig.EtcdS3AccessKey = cfg.EtcdS3AccessKey
+	serverConfig.ControlConfig.EtcdS3SecretKey = cfg.EtcdS3SecretKey
+	serverConfig.ControlConfig.EtcdS3BucketName = cfg.EtcdS3BucketName
+	serverConfig.ControlConfig.EtcdS3Region = cfg.EtcdS3Region
+	serverConfig.ControlConfig.EtcdS3Folder = cfg.EtcdS3Folder
 
 	if cfg.ClusterResetRestorePath != "" && !cfg.ClusterReset {
 		return errors.New("invalid flag use. --cluster-reset required with --cluster-reset-restore-path")
 	}
 
+	// make sure components are disabled so we only perform a restore
+	// and bail out
+	if cfg.ClusterResetRestorePath != "" && cfg.ClusterReset {
+		serverConfig.ControlConfig.ClusterInit = true
+		serverConfig.ControlConfig.DisableAPIServer = true
+		serverConfig.ControlConfig.DisableControllerManager = true
+		serverConfig.ControlConfig.DisableScheduler = true
+		serverConfig.ControlConfig.DisableCCM = true
+	}
+
 	serverConfig.ControlConfig.ClusterReset = cfg.ClusterReset
 	serverConfig.ControlConfig.ClusterResetRestorePath = cfg.ClusterResetRestorePath
 

pkg/cluster/managed.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -48,6 +49,53 @@ func (c *Cluster) testClusterDB(ctx context.Context) (<-chan struct{}, error) {
 	return result, nil
 }
 
+// cleanCerts removes existing certificatates previously
+// generated for use by the cluster.
+func (c *Cluster) cleanCerts() {
+	certs := []string{filepath.Join(c.config.DataDir, "tls", "client-ca.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-ca.key"),
+		filepath.Join(c.config.DataDir, "tls", "server-ca.crt"),
+		filepath.Join(c.config.DataDir, "tls", "server-ca.key"),
+		filepath.Join(c.config.DataDir, "tls", "request-header-ca.crt"),
+		filepath.Join(c.config.DataDir, "tls", "request-header-ca.key"),
+		filepath.Join(c.config.DataDir, "tls", "service.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-admin.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-admin.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-controller.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-controller.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-cloud-controller.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-cloud-controller.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-scheduler.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-scheduler.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-kube-apiserver.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-kube-apiserver.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-kube-proxy.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-kube-proxy.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-"+version.Program+"-controller.crt"),
+		filepath.Join(c.config.DataDir, "tls", "client-"+version.Program+"-controller.key"),
+		filepath.Join(c.config.DataDir, "tls", "serving-kube-apiserver.crt"),
+		filepath.Join(c.config.DataDir, "tls", "serving-kube-apiserver.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-kubelet.key"),
+		filepath.Join(c.config.DataDir, "tls", "serving-kubelet.key"),
+		filepath.Join(c.config.DataDir, "tls", "serving-kubelet.key"),
+		filepath.Join(c.config.DataDir, "tls", "client-auth-proxy.key"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "server-ca.crt"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "server-ca.key"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "peer-ca.crt"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "peer-ca.key"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "server-client.crt"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "server-client.key"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "peer-server-client.crt"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "peer-server-client.key"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "client.crt"),
+		filepath.Join(c.config.DataDir, "tls", "etcd", "client.key"),
+	}
+
+	for _, cert := range certs {
+		os.Remove(cert)
+	}
+}
+
 // start starts the database, unless a cluster reset has been requested, in which case
 // it does that instead.
 func (c *Cluster) start(ctx context.Context) error {
@@ -64,7 +112,13 @@ func (c *Cluster) start(ctx context.Context) error {
 		} else {
 			return fmt.Errorf("cluster-reset was successfully performed, please remove the cluster-reset flag and start %s normally, if you need to perform another cluster reset, you must first manually delete the %s file", version.Program, resetFile)
 		}
-		return c.managedDB.Reset(ctx)
+
+		rebootstrap := func() error {
+			return c.storageBootstrap(ctx)
+		}
+		if err := c.managedDB.Reset(ctx, rebootstrap, c.cleanCerts); err != nil {
+			return err
+		}
 	}
 	// removing the reset file and ignore error if the file doesn't exist
 	os.Remove(resetFile)

pkg/cluster/managed/drivers.go

@@ -16,7 +16,7 @@ var (
 type Driver interface {
 	IsInitialized(ctx context.Context, config *config.Control) (bool, error)
 	Register(ctx context.Context, config *config.Control, handler http.Handler) (http.Handler, error)
-	Reset(ctx context.Context) error
+	Reset(ctx context.Context, reboostrap func() error, cleanCerts func()) error
 	Start(ctx context.Context, clientAccessInfo *clientaccess.Info) error
 	Test(ctx context.Context) error
 	Restore(ctx context.Context) error

pkg/daemons/config/types.go

@@ -144,6 +144,15 @@ type Control struct {
 	EtcdSnapshotDir          string
 	EtcdSnapshotCron         string
 	EtcdSnapshotRetention    int
+	EtcdS3                   bool
+	EtcdS3Endpoint           string
+	EtcdS3EndpointCA         string
+	EtcdS3SkipSSLVerify      bool
+	EtcdS3AccessKey          string
+	EtcdS3SecretKey          string
+	EtcdS3BucketName         string
+	EtcdS3Region             string
+	EtcdS3Folder             string
 
 	BindAddress string
 	SANs        []string

pkg/etcd/etcd.go

@@ -22,6 +22,7 @@ import (
 	certutil "github.com/rancher/dynamiclistener/cert"
 	"github.com/rancher/k3s/pkg/clientaccess"
 	"github.com/rancher/k3s/pkg/daemons/config"
+	"github.com/rancher/k3s/pkg/daemons/control/deps"
 	"github.com/rancher/k3s/pkg/daemons/executor"
 	"github.com/rancher/k3s/pkg/version"
 	"github.com/robfig/cron/v3"
@@ -41,6 +42,7 @@ type ETCD struct {
 	runtime *config.ControlRuntime
 	address string
 	cron    *cron.Cron
+	s3      *s3
 }
 
 type learnerProgress struct {
@@ -135,12 +137,12 @@ func walDir(config *config.Control) string {
 	return filepath.Join(etcdDBDir(config), "member", "wal")
 }
 
-// nameFile returns the path to etcdDBDir/name
+// nameFile returns the path to etcdDBDir/name.
 func nameFile(config *config.Control) string {
 	return filepath.Join(etcdDBDir(config), "name")
 }
 
-// ResetFile returns the path to etcdDBDir/reset-flag
+// ResetFile returns the path to etcdDBDir/reset-flag.
 func ResetFile(config *config.Control) string {
 	return filepath.Join(config.DataDir, "db", "reset-flag")
 }
@@ -159,7 +161,7 @@ func (e *ETCD) IsInitialized(ctx context.Context, config *config.Control) (bool,
 }
 
 // Reset resets an etcd node
-func (e *ETCD) Reset(ctx context.Context) error {
+func (e *ETCD) Reset(ctx context.Context, rebootstrap func() error, cleanCerts func()) error {
 	// Wait for etcd to come up as a new single-node cluster, then exit
 	go func() {
 		t := time.NewTicker(5 * time.Second)
@@ -171,6 +173,18 @@ func (e *ETCD) Reset(ctx context.Context) error {
 					continue
 				}
 
+				// storageBootstrap() - runtime structure has been written with correct certificate data
+				if err := rebootstrap(); err != nil {
+					logrus.Fatal(err)
+				}
+
+				cleanCerts()
+
+				// call functions to rewrite them from daemons/control/server.go (prepare())
+				if err := deps.GenServerDeps(e.config, e.runtime); err != nil {
+					logrus.Fatal(err)
+				}
+
 				if len(members.Members) == 1 && members.Members[0].Name == e.name {
 					logrus.Infof("Etcd is running, restart without --cluster-reset flag now. Backup and delete ${datadir}/server/db on each peer etcd server and rejoin the nodes")
 					os.Exit(0)
@@ -181,6 +195,21 @@ func (e *ETCD) Reset(ctx context.Context) error {
 
 	// If asked to restore from a snapshot, do so
 	if e.config.ClusterResetRestorePath != "" {
+		if e.config.EtcdS3 {
+			if e.s3 == nil {
+				s3, err := newS3(ctx, e.config)
+				if err != nil {
+					return err
+				}
+				e.s3 = s3
+			}
+			logrus.Infof("Retrieving etcd snapshot %s from S3", e.config.ClusterResetRestorePath)
+			if err := e.s3.download(ctx); err != nil {
+				return err
+			}
+			logrus.Infof("S3 download complete for %s", e.config.ClusterResetRestorePath)
+		}
+
 		info, err := os.Stat(e.config.ClusterResetRestorePath)
 		if os.IsNotExist(err) {
 			return fmt.Errorf("etcd: snapshot path does not exist: %s", e.config.ClusterResetRestorePath)
@@ -798,6 +827,29 @@ func (e *ETCD) Snapshot(ctx context.Context, config *config.Control) error {
 		return errors.Wrap(err, "failed to save snapshot")
 	}
 
+	if e.config.EtcdS3 {
+		logrus.Infof("Saving etcd snapshot %s to S3", snapshotName)
+		if e.s3 == nil {
+			s3, err := newS3(ctx, config)
+			if err != nil {
+				return err
+			}
+			e.s3 = s3
+		}
+		if err := e.s3.upload(ctx, snapshotPath); err != nil {
+			return err
+		}
+		logrus.Infof("S3 upload complete for %s", snapshotName)
+
+		if e.config.EtcdSnapshotRetention >= 1 {
+			if err := e.s3.snapshotRetention(ctx); err != nil {
+				return errors.Wrap(err, "failed to apply s3 snapshot retention")
+			}
+		}
+
+		return nil
+	}
+
 	// check if we need to perform a retention check
 	if e.config.EtcdSnapshotRetention >= 1 {
 		if err := snapshotRetention(e.config.EtcdSnapshotRetention, snapshotDir); err != nil {
@@ -870,7 +922,15 @@ func snapshotRetention(retention int, snapshotDir string) error {
 	sort.Slice(snapshotFiles, func(i, j int) bool {
 		return snapshotFiles[i].Name() < snapshotFiles[j].Name()
 	})
-	return os.Remove(filepath.Join(snapshotDir, snapshotFiles[0].Name()))
+
+	delCount := len(snapshotFiles) - retention
+	for _, df := range snapshotFiles[:delCount] {
+		if err := os.Remove(filepath.Join(snapshotDir, df.Name())); err != nil {
+			return err
+		}
+	}
+
+	return nil
 }
 
 // backupDirWithRetention will move the dir to a backup dir

pkg/etcd/s3.go

+package etcd
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+	"github.com/pkg/errors"
+	"github.com/rancher/k3s/pkg/daemons/config"
+	"github.com/sirupsen/logrus"
+)
+
+// s3 maintains state for S3 functionality.
+type s3 struct {
+	config *config.Control
+	client *minio.Client
+}
+
+// newS3 creates a new value of type s3 pointer with a
+// copy of the config.Control pointer and initializes
+// a new Minio client.
+func newS3(ctx context.Context, config *config.Control) (*s3, error) {
+	tr := http.DefaultTransport
+	if config.EtcdS3EndpointCA != "" {
+		trCA, err := setTransportCA(tr, config.EtcdS3EndpointCA, config.EtcdS3SkipSSLVerify)
+		if err != nil {
+			return nil, err
+		}
+		tr = trCA
+	}
+
+	var creds *credentials.Credentials
+	if len(config.EtcdS3AccessKey) == 0 && len(config.EtcdS3SecretKey) == 0 {
+		creds = credentials.NewIAM("") // for running on ec2 instance
+	} else {
+		creds = credentials.NewStaticV4(config.EtcdS3AccessKey, config.EtcdS3SecretKey, "")
+	}
+
+	opt := minio.Options{
+		Creds:        creds,
+		Secure:       true,
+		Region:       config.EtcdS3Region,
+		Transport:    tr,
+		BucketLookup: bucketLookupType(config.EtcdS3Endpoint),
+	}
+	c, err := minio.New(config.EtcdS3Endpoint, &opt)
+	if err != nil {
+		return nil, err
+	}
+
+	logrus.Infof("Checking if S3 bucket %s exists", config.EtcdS3BucketName)
+	exists, err := c.BucketExists(ctx, config.EtcdS3BucketName)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("bucket: %s does not exist", config.EtcdS3BucketName)
+	}
+	logrus.Infof("S3 bucket %s exists", config.EtcdS3BucketName)
+
+	return &s3{
+		config: config,
+		client: c,
+	}, nil
+}
+
+// upload uploads the given snapshot to the configured S3
+// compatible backend.
+func (s *s3) upload(ctx context.Context, snapshot string) error {
+	basename := filepath.Base(snapshot)
+	var snapshotFileName string
+	if s.config.EtcdS3Folder != "" {
+		snapshotFileName = filepath.Join(s.config.EtcdS3Folder, basename)
+	} else {
+		snapshotFileName = basename
+	}
+
+	opts := minio.PutObjectOptions{
+		ContentType: "application/zip",
+		NumThreads:  2,
+	}
+	if _, err := s.client.FPutObject(ctx, s.config.EtcdS3BucketName, snapshotFileName, snapshot, opts); err != nil {
+		logrus.Errorf("Error received in attempt to upload snapshot to S3: %s", err)
+	}
+
+	return nil
+}
+
+// download downloads the given snapshot from the configured S3
+// compatible backend.
+func (s *s3) download(ctx context.Context) error {
+	var remotePath string
+	if s.config.EtcdS3Folder != "" {
+		remotePath = filepath.Join(s.config.EtcdS3Folder, s.config.ClusterResetRestorePath)
+	} else {
+		remotePath = s.config.ClusterResetRestorePath
+	}
+
+	logrus.Debugf("retrieving snapshot: %s", remotePath)
+	r, err := s.client.GetObject(ctx, s.config.EtcdS3BucketName, remotePath, minio.GetObjectOptions{})
+	if err != nil {
+		return nil
+	}
+	defer r.Close()
+
+	snapshotDir, err := snapshotDir(s.config)
+	if err != nil {
+		return errors.Wrap(err, "failed to get the snapshot dir")
+	}
+
+	fullSnapshotPath := filepath.Join(snapshotDir, s.config.ClusterResetRestorePath)
+	sf, err := os.Create(fullSnapshotPath)
+	if err != nil {
+		return err
+	}
+	defer sf.Close()
+
+	stat, err := r.Stat()
+	if err != nil {
+		return err
+	}
+
+	if _, err := io.CopyN(sf, r, stat.Size); err != nil {
+		return err
+	}
+
+	s.config.ClusterResetRestorePath = fullSnapshotPath
+
+	return os.Chmod(fullSnapshotPath, 0600)
+}
+
+// snapshotRetention deletes the given snapshot from the configured S3
+// compatible backend.
+func (s *s3) snapshotRetention(ctx context.Context) error {
+	var snapshotFiles []minio.ObjectInfo
+
+	var prefix string
+	if s.config.EtcdS3Folder != "" {
+		prefix = filepath.Join(s.config.EtcdS3Folder, snapshotPrefix)
+	} else {
+		prefix = snapshotPrefix
+	}
+
+	loo := minio.ListObjectsOptions{
+		Recursive: true,
+		Prefix:    prefix,
+	}
+	for info := range s.client.ListObjects(ctx, s.config.EtcdS3BucketName, loo) {
+		if info.Err != nil {
+			return info.Err
+		}
+		snapshotFiles = append(snapshotFiles, info)
+	}
+
+	if len(snapshotFiles) <= s.config.EtcdSnapshotRetention {
+		return nil
+	}
+
+	sort.Slice(snapshotFiles, func(i, j int) bool {
+		return snapshotFiles[i].Key < snapshotFiles[j].Key
+	})
+
+	delCount := len(snapshotFiles) - s.config.EtcdSnapshotRetention
+	for _, df := range snapshotFiles[:delCount] {
+		logrus.Debugf("Removing snapshot: %s", df.Key)
+		if err := s.client.RemoveObject(ctx, s.config.EtcdS3BucketName, df.Key, minio.RemoveObjectOptions{}); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func readS3EndpointCA(endpointCA string) ([]byte, error) {
+	ca, err := base64.StdEncoding.DecodeString(endpointCA)
+	if err != nil {
+		return ioutil.ReadFile(endpointCA)
+	}
+	return ca, nil
+}
+
+func setTransportCA(tr http.RoundTripper, endpointCA string, insecureSkipVerify bool) (http.RoundTripper, error) {
+	ca, err := readS3EndpointCA(endpointCA)
+	if err != nil {
+		return tr, err
+	}
+	if !isValidCertificate(ca) {
+		return tr, errors.New("endpoint-ca is not a valid x509 certificate")
+	}
+
+	certPool := x509.NewCertPool()
+	certPool.AppendCertsFromPEM(ca)
+
+	tr.(*http.Transport).TLSClientConfig = &tls.Config{
+		RootCAs:            certPool,
+		InsecureSkipVerify: insecureSkipVerify,
+	}
+
+	return tr, nil
+}
+
+// isValidCertificate checks to see if the given
+// byte slice is a valid x509 certificate.
+func isValidCertificate(c []byte) bool {
+	p, _ := pem.Decode(c)
+	if p == nil {
+		return false
+	}
+	if _, err := x509.ParseCertificates(p.Bytes); err != nil {
+		return false
+	}
+	return true
+}
+
+func bucketLookupType(endpoint string) minio.BucketLookupType {
+	if strings.Contains(endpoint, "aliyun") { // backwards compt with RKE1
+		return minio.BucketLookupDNS
+	}
+	return minio.BucketLookupAuto
+}

vendor/github.com/klauspost/cpuid/.gitignore

+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof

vendor/github.com/klauspost/cpuid/.travis.yml

+language: go
+
+os:
+  - linux
+  - osx
+  - windows
+
+arch:
+  - amd64
+  - arm64
+
+go:
+  - 1.12.x
+  - 1.13.x
+  - 1.14.x
+  - master
+
+script:
+  - go vet ./...
+  - go test -race ./...
+  - go test -tags=noasm ./...
+
+stages:
+  - gofmt
+  - test
+
+matrix:
+  allow_failures:
+    - go: 'master'
+  fast_finish: true
+  include:
+    - stage: gofmt
+      go: 1.14.x
+      os: linux
+      arch: amd64
+      script:
+        - diff <(gofmt -d .) <(printf "")
+        - diff <(gofmt -d ./private) <(printf "")
+        - go install github.com/klauspost/asmfmt/cmd/asmfmt
+        - diff <(asmfmt -d .) <(printf "")
+    - stage: i386
+      go: 1.14.x
+      os: linux
+      arch: amd64
+      script:
+        - GOOS=linux GOARCH=386 go test .

vendor/github.com/klauspost/cpuid/CONTRIBUTING.txt

+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2015- Klaus Post & Contributors.
+Email: klauspost@gmail.com
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

vendor/github.com/klauspost/cpuid/LICENSE

+The MIT License (MIT)
+
+Copyright (c) 2015 Klaus Post
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

vendor/github.com/klauspost/cpuid/README.md

+# cpuid
+Package cpuid provides information about the CPU running the current program.
+
+CPU features are detected on startup, and kept for fast access through the life of the application.
+Currently x86 / x64 (AMD64/i386) and ARM (ARM64) is supported, and no external C (cgo) code is used, which should make the library very easy to use.
+
+You can access the CPU information by accessing the shared CPU variable of the cpuid library.
+
+Package home: https://github.com/klauspost/cpuid
+
+[![GoDoc][1]][2] [![Build Status][3]][4]
+
+[1]: https://godoc.org/github.com/klauspost/cpuid?status.svg
+[2]: https://godoc.org/github.com/klauspost/cpuid
+[3]: https://travis-ci.org/klauspost/cpuid.svg?branch=master
+[4]: https://travis-ci.org/klauspost/cpuid
+
+# features
+
+## x86 CPU Instructions
+*  **CMOV** (i686 CMOV)
+*  **NX** (NX (No-Execute) bit)
+*  **AMD3DNOW** (AMD 3DNOW)
+*  **AMD3DNOWEXT** (AMD 3DNowExt)
+*  **MMX** (standard MMX)
+*  **MMXEXT** (SSE integer functions or AMD MMX ext)
+*  **SSE** (SSE functions)
+*  **SSE2** (P4 SSE functions)
+*  **SSE3** (Prescott SSE3 functions)
+*  **SSSE3** (Conroe SSSE3 functions)
+*  **SSE4** (Penryn SSE4.1 functions)
+*  **SSE4A** (AMD Barcelona microarchitecture SSE4a instructions)
+*  **SSE42** (Nehalem SSE4.2 functions)
+*  **AVX** (AVX functions)
+*  **AVX2** (AVX2 functions)
+*  **FMA3** (Intel FMA 3)
+*  **FMA4** (Bulldozer FMA4 functions)
+*  **XOP** (Bulldozer XOP functions)
+*  **F16C** (Half-precision floating-point conversion)
+*  **BMI1** (Bit Manipulation Instruction Set 1)
+*  **BMI2** (Bit Manipulation Instruction Set 2)
+*  **TBM** (AMD Trailing Bit Manipulation)
+*  **LZCNT** (LZCNT instruction)
+*  **POPCNT** (POPCNT instruction)
+*  **AESNI** (Advanced Encryption Standard New Instructions)
+*  **CLMUL** (Carry-less Multiplication)
+*  **HTT** (Hyperthreading (enabled))
+*  **HLE** (Hardware Lock Elision)
+*  **RTM** (Restricted Transactional Memory)
+*  **RDRAND** (RDRAND instruction is available)
+*  **RDSEED** (RDSEED instruction is available)
+*  **ADX** (Intel ADX (Multi-Precision Add-Carry Instruction Extensions))
+*  **SHA** (Intel SHA Extensions)
+*  **AVX512F** (AVX-512 Foundation)
+*  **AVX512DQ** (AVX-512 Doubleword and Quadword Instructions)
+*  **AVX512IFMA** (AVX-512 Integer Fused Multiply-Add Instructions)
+*  **AVX512PF** (AVX-512 Prefetch Instructions)
+*  **AVX512ER** (AVX-512 Exponential and Reciprocal Instructions)
+*  **AVX512CD** (AVX-512 Conflict Detection Instructions)
+*  **AVX512BW** (AVX-512 Byte and Word Instructions)
+*  **AVX512VL** (AVX-512 Vector Length Extensions)
+*  **AVX512VBMI** (AVX-512 Vector Bit Manipulation Instructions)
+*  **AVX512VBMI2** (AVX-512 Vector Bit Manipulation Instructions, Version 2)
+*  **AVX512VNNI** (AVX-512 Vector Neural Network Instructions)
+*  **AVX512VPOPCNTDQ** (AVX-512 Vector Population Count Doubleword and Quadword)
+*  **GFNI** (Galois Field New Instructions)
+*  **VAES** (Vector AES)
+*  **AVX512BITALG** (AVX-512 Bit Algorithms)
+*  **VPCLMULQDQ** (Carry-Less Multiplication Quadword)
+*  **AVX512BF16** (AVX-512 BFLOAT16 Instructions)
+*  **AVX512VP2INTERSECT** (AVX-512 Intersect for D/Q)
+*  **MPX** (Intel MPX (Memory Protection Extensions))
+*  **ERMS** (Enhanced REP MOVSB/STOSB)
+*  **RDTSCP** (RDTSCP Instruction)
+*  **CX16** (CMPXCHG16B Instruction)
+*  **SGX** (Software Guard Extensions, with activation details)
+*  **VMX** (Virtual Machine Extensions)
+
+## Performance
+*  **RDTSCP()** Returns current cycle count. Can be used for benchmarking.
+*  **SSE2SLOW** (SSE2 is supported, but usually not faster)
+*  **SSE3SLOW** (SSE3 is supported, but usually not faster)
+*  **ATOM** (Atom processor, some SSSE3 instructions are slower)
+*  **Cache line** (Probable size of a cache line).
+*  **L1, L2, L3 Cache size** on newer Intel/AMD CPUs.
+
+## ARM CPU features
+
+# ARM FEATURE DETECTION DISABLED!
+
+See [#52](https://github.com/klauspost/cpuid/issues/52).
+ 
+Currently only `arm64` platforms are implemented. 
+
+*  **FP**  Single-precision and double-precision floating point
+*  **ASIMD**  Advanced SIMD
+*  **EVTSTRM**  Generic timer
+*  **AES**  AES instructions
+*  **PMULL**  Polynomial Multiply instructions (PMULL/PMULL2)
+*  **SHA1**  SHA-1 instructions (SHA1C, etc)
+*  **SHA2**      SHA-2 instructions (SHA256H, etc)
+*  **CRC32**   CRC32/CRC32C instructions
+*  **ATOMICS**   Large System Extensions (LSE)
+*  **FPHP** Half-precision floating point
+*  **ASIMDHP**  Advanced SIMD half-precision floating point
+*  **ARMCPUID**  Some CPU ID registers readable at user-level
+*  **ASIMDRDM**  Rounding Double Multiply Accumulate/Subtract (SQRDMLAH/SQRDMLSH)
+*  **JSCVT** Javascript-style double->int convert (FJCVTZS)
+*  **FCMA**  Floating point complex number addition and multiplication
+*  **LRCPC**  Weaker release consistency (LDAPR, etc)
+*  **DCPOP**  Data cache clean to Point of Persistence (DC CVAP)
+*  **SHA3**  SHA-3 instructions (EOR3, RAXI, XAR, BCAX)
+*  **SM3** SM3 instructions
+*  **SM4**  SM4 instructions
+*  **ASIMDDP**  SIMD Dot Product
+*  **SHA512**  SHA512 instructions
+*  **SVE** Scalable Vector Extension
+*  **GPA**  Generic Pointer Authentication
+
+## Cpu Vendor/VM
+* **Intel**
+* **AMD**
+* **VIA**
+* **Transmeta**
+* **NSC**
+* **KVM**  (Kernel-based Virtual Machine)
+* **MSVM** (Microsoft Hyper-V or Windows Virtual PC)
+* **VMware**
+* **XenHVM**
+* **Bhyve**
+* **Hygon**
+
+# installing
+
+```go get github.com/klauspost/cpuid```
+
+# example
+
+```Go
+package main
+
+import (
+	"fmt"
+	"github.com/klauspost/cpuid"
+)
+
+func main() {
+	// Print basic CPU information:
+	fmt.Println("Name:", cpuid.CPU.BrandName)
+	fmt.Println("PhysicalCores:", cpuid.CPU.PhysicalCores)
+	fmt.Println("ThreadsPerCore:", cpuid.CPU.ThreadsPerCore)
+	fmt.Println("LogicalCores:", cpuid.CPU.LogicalCores)
+	fmt.Println("Family", cpuid.CPU.Family, "Model:", cpuid.CPU.Model)
+	fmt.Println("Features:", cpuid.CPU.Features)
+	fmt.Println("Cacheline bytes:", cpuid.CPU.CacheLine)
+	fmt.Println("L1 Data Cache:", cpuid.CPU.Cache.L1D, "bytes")
+	fmt.Println("L1 Instruction Cache:", cpuid.CPU.Cache.L1D, "bytes")
+	fmt.Println("L2 Cache:", cpuid.CPU.Cache.L2, "bytes")
+	fmt.Println("L3 Cache:", cpuid.CPU.Cache.L3, "bytes")
+
+	// Test if we have a specific feature:
+	if cpuid.CPU.SSE() {
+		fmt.Println("We have Streaming SIMD Extensions")
+	}
+}
+```
+
+Sample output:
+```
+>go run main.go
+Name: Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz
+PhysicalCores: 2
+ThreadsPerCore: 2
+LogicalCores: 4
+Family 6 Model: 42
+Features: CMOV,MMX,MMXEXT,SSE,SSE2,SSE3,SSSE3,SSE4.1,SSE4.2,AVX,AESNI,CLMUL
+Cacheline bytes: 64
+We have Streaming SIMD Extensions
+```
+
+# private package
+
+In the "private" folder you can find an autogenerated version of the library you can include in your own packages.
+
+For this purpose all exports are removed, and functions and constants are lowercased.
+
+This is not a recommended way of using the library, but provided for convenience, if it is difficult for you to use external packages.
+
+# license
+
+This code is published under an MIT license. See LICENSE file for more information.

vendor/github.com/klauspost/cpuid/cpuid_386.s

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build 386,!gccgo,!noasm,!appengine
+
+// func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
+TEXT ·asmCpuid(SB), 7, $0
+	XORL CX, CX
+	MOVL op+0(FP), AX
+	CPUID
+	MOVL AX, eax+4(FP)
+	MOVL BX, ebx+8(FP)
+	MOVL CX, ecx+12(FP)
+	MOVL DX, edx+16(FP)
+	RET
+
+// func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
+TEXT ·asmCpuidex(SB), 7, $0
+	MOVL op+0(FP), AX
+	MOVL op2+4(FP), CX
+	CPUID
+	MOVL AX, eax+8(FP)
+	MOVL BX, ebx+12(FP)
+	MOVL CX, ecx+16(FP)
+	MOVL DX, edx+20(FP)
+	RET
+
+// func xgetbv(index uint32) (eax, edx uint32)
+TEXT ·asmXgetbv(SB), 7, $0
+	MOVL index+0(FP), CX
+	BYTE $0x0f; BYTE $0x01; BYTE $0xd0 // XGETBV
+	MOVL AX, eax+4(FP)
+	MOVL DX, edx+8(FP)
+	RET
+
+// func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
+TEXT ·asmRdtscpAsm(SB), 7, $0
+	BYTE $0x0F; BYTE $0x01; BYTE $0xF9 // RDTSCP
+	MOVL AX, eax+0(FP)
+	MOVL BX, ebx+4(FP)
+	MOVL CX, ecx+8(FP)
+	MOVL DX, edx+12(FP)
+	RET

vendor/github.com/klauspost/cpuid/cpuid_amd64.s

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build amd64,!gccgo,!noasm,!appengine
+
+// func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
+TEXT ·asmCpuid(SB), 7, $0
+	XORQ CX, CX
+	MOVL op+0(FP), AX
+	CPUID
+	MOVL AX, eax+8(FP)
+	MOVL BX, ebx+12(FP)
+	MOVL CX, ecx+16(FP)
+	MOVL DX, edx+20(FP)
+	RET
+
+// func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
+TEXT ·asmCpuidex(SB), 7, $0
+	MOVL op+0(FP), AX
+	MOVL op2+4(FP), CX
+	CPUID
+	MOVL AX, eax+8(FP)
+	MOVL BX, ebx+12(FP)
+	MOVL CX, ecx+16(FP)
+	MOVL DX, edx+20(FP)
+	RET
+
+// func asmXgetbv(index uint32) (eax, edx uint32)
+TEXT ·asmXgetbv(SB), 7, $0
+	MOVL index+0(FP), CX
+	BYTE $0x0f; BYTE $0x01; BYTE $0xd0 // XGETBV
+	MOVL AX, eax+8(FP)
+	MOVL DX, edx+12(FP)
+	RET
+
+// func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
+TEXT ·asmRdtscpAsm(SB), 7, $0
+	BYTE $0x0F; BYTE $0x01; BYTE $0xF9 // RDTSCP
+	MOVL AX, eax+0(FP)
+	MOVL BX, ebx+4(FP)
+	MOVL CX, ecx+8(FP)
+	MOVL DX, edx+12(FP)
+	RET

vendor/github.com/klauspost/cpuid/cpuid_arm64.s

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build arm64,!gccgo
+
+// See https://www.kernel.org/doc/Documentation/arm64/cpu-feature-registers.txt
+
+// func getMidr
+TEXT ·getMidr(SB), 7, $0
+	WORD $0xd5380000    // mrs x0, midr_el1         /* Main ID Register */
+	MOVD R0, midr+0(FP)
+	RET
+
+// func getProcFeatures
+TEXT ·getProcFeatures(SB), 7, $0
+	WORD $0xd5380400            // mrs x0, id_aa64pfr0_el1  /* Processor Feature Register 0 */
+	MOVD R0, procFeatures+0(FP)
+	RET
+
+// func getInstAttributes
+TEXT ·getInstAttributes(SB), 7, $0
+	WORD $0xd5380600            // mrs x0, id_aa64isar0_el1 /* Instruction Set Attribute Register 0 */
+	WORD $0xd5380621            // mrs x1, id_aa64isar1_el1 /* Instruction Set Attribute Register 1 */
+	MOVD R0, instAttrReg0+0(FP)
+	MOVD R1, instAttrReg1+8(FP)
+	RET
+

vendor/github.com/klauspost/cpuid/detect_arm64.go

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build arm64,!gccgo,!noasm,!appengine
+
+package cpuid
+
+func getMidr() (midr uint64)
+func getProcFeatures() (procFeatures uint64)
+func getInstAttributes() (instAttrReg0, instAttrReg1 uint64)
+
+func initCPU() {
+	cpuid = func(uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
+	cpuidex = func(x, y uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
+	xgetbv = func(uint32) (a, b uint32) { return 0, 0 }
+	rdtscpAsm = func() (a, b, c, d uint32) { return 0, 0, 0, 0 }
+}
+
+func addInfo(c *CPUInfo) {
+	// ARM64 disabled for now.
+	if true {
+		return
+	}
+	// 	midr := getMidr()
+
+	// MIDR_EL1 - Main ID Register
+	//  x--------------------------------------------------x
+	//  | Name                         |  bits   | visible |
+	//  |--------------------------------------------------|
+	//  | Implementer                  | [31-24] |    y    |
+	//  |--------------------------------------------------|
+	//  | Variant                      | [23-20] |    y    |
+	//  |--------------------------------------------------|
+	//  | Architecture                 | [19-16] |    y    |
+	//  |--------------------------------------------------|
+	//  | PartNum                      | [15-4]  |    y    |
+	//  |--------------------------------------------------|
+	//  | Revision                     | [3-0]   |    y    |
+	//  x--------------------------------------------------x
+
+	// 	fmt.Printf(" implementer:  0x%02x\n", (midr>>24)&0xff)
+	// 	fmt.Printf("     variant:   0x%01x\n", (midr>>20)&0xf)
+	// 	fmt.Printf("architecture:   0x%01x\n", (midr>>16)&0xf)
+	// 	fmt.Printf("    part num: 0x%03x\n", (midr>>4)&0xfff)
+	// 	fmt.Printf("    revision:   0x%01x\n", (midr>>0)&0xf)
+
+	procFeatures := getProcFeatures()
+
+	// ID_AA64PFR0_EL1 - Processor Feature Register 0
+	// x--------------------------------------------------x
+	// | Name                         |  bits   | visible |
+	// |--------------------------------------------------|
+	// | DIT                          | [51-48] |    y    |
+	// |--------------------------------------------------|
+	// | SVE                          | [35-32] |    y    |
+	// |--------------------------------------------------|
+	// | GIC                          | [27-24] |    n    |
+	// |--------------------------------------------------|
+	// | AdvSIMD                      | [23-20] |    y    |
+	// |--------------------------------------------------|
+	// | FP                           | [19-16] |    y    |
+	// |--------------------------------------------------|
+	// | EL3                          | [15-12] |    n    |
+	// |--------------------------------------------------|
+	// | EL2                          | [11-8]  |    n    |
+	// |--------------------------------------------------|
+	// | EL1                          | [7-4]   |    n    |
+	// |--------------------------------------------------|
+	// | EL0                          | [3-0]   |    n    |
+	// x--------------------------------------------------x
+
+	var f ArmFlags
+	// if procFeatures&(0xf<<48) != 0 {
+	// 	fmt.Println("DIT")
+	// }
+	if procFeatures&(0xf<<32) != 0 {
+		f |= SVE
+	}
+	if procFeatures&(0xf<<20) != 15<<20 {
+		f |= ASIMD
+		if procFeatures&(0xf<<20) == 1<<20 {
+			// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64pfr0_el1
+			// 0b0001 --> As for 0b0000, and also includes support for half-precision floating-point arithmetic.
+			f |= FPHP
+			f |= ASIMDHP
+		}
+	}
+	if procFeatures&(0xf<<16) != 0 {
+		f |= FP
+	}
+
+	instAttrReg0, instAttrReg1 := getInstAttributes()
+
+	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
+	//
+	// ID_AA64ISAR0_EL1 - Instruction Set Attribute Register 0
+	// x--------------------------------------------------x
+	// | Name                         |  bits   | visible |
+	// |--------------------------------------------------|
+	// | TS                           | [55-52] |    y    |
+	// |--------------------------------------------------|
+	// | FHM                          | [51-48] |    y    |
+	// |--------------------------------------------------|
+	// | DP                           | [47-44] |    y    |
+	// |--------------------------------------------------|
+	// | SM4                          | [43-40] |    y    |
+	// |--------------------------------------------------|
+	// | SM3                          | [39-36] |    y    |
+	// |--------------------------------------------------|
+	// | SHA3                         | [35-32] |    y    |
+	// |--------------------------------------------------|
+	// | RDM                          | [31-28] |    y    |
+	// |--------------------------------------------------|
+	// | ATOMICS                      | [23-20] |    y    |
+	// |--------------------------------------------------|
+	// | CRC32                        | [19-16] |    y    |
+	// |--------------------------------------------------|
+	// | SHA2                         | [15-12] |    y    |
+	// |--------------------------------------------------|
+	// | SHA1                         | [11-8]  |    y    |
+	// |--------------------------------------------------|
+	// | AES                          | [7-4]   |    y    |
+	// x--------------------------------------------------x
+
+	// if instAttrReg0&(0xf<<52) != 0 {
+	// 	fmt.Println("TS")
+	// }
+	// if instAttrReg0&(0xf<<48) != 0 {
+	// 	fmt.Println("FHM")
+	// }
+	if instAttrReg0&(0xf<<44) != 0 {
+		f |= ASIMDDP
+	}
+	if instAttrReg0&(0xf<<40) != 0 {
+		f |= SM4
+	}
+	if instAttrReg0&(0xf<<36) != 0 {
+		f |= SM3
+	}
+	if instAttrReg0&(0xf<<32) != 0 {
+		f |= SHA3
+	}
+	if instAttrReg0&(0xf<<28) != 0 {
+		f |= ASIMDRDM
+	}
+	if instAttrReg0&(0xf<<20) != 0 {
+		f |= ATOMICS
+	}
+	if instAttrReg0&(0xf<<16) != 0 {
+		f |= CRC32
+	}
+	if instAttrReg0&(0xf<<12) != 0 {
+		f |= SHA2
+	}
+	if instAttrReg0&(0xf<<12) == 2<<12 {
+		// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
+		// 0b0010 --> As 0b0001, plus SHA512H, SHA512H2, SHA512SU0, and SHA512SU1 instructions implemented.
+		f |= SHA512
+	}
+	if instAttrReg0&(0xf<<8) != 0 {
+		f |= SHA1
+	}
+	if instAttrReg0&(0xf<<4) != 0 {
+		f |= AES
+	}
+	if instAttrReg0&(0xf<<4) == 2<<4 {
+		// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar0_el1
+		// 0b0010 --> As for 0b0001, plus PMULL/PMULL2 instructions operating on 64-bit data quantities.
+		f |= PMULL
+	}
+
+	// https://developer.arm.com/docs/ddi0595/b/aarch64-system-registers/id_aa64isar1_el1
+	//
+	// ID_AA64ISAR1_EL1 - Instruction set attribute register 1
+	// x--------------------------------------------------x
+	// | Name                         |  bits   | visible |
+	// |--------------------------------------------------|
+	// | GPI                          | [31-28] |    y    |
+	// |--------------------------------------------------|
+	// | GPA                          | [27-24] |    y    |
+	// |--------------------------------------------------|
+	// | LRCPC                        | [23-20] |    y    |
+	// |--------------------------------------------------|
+	// | FCMA                         | [19-16] |    y    |
+	// |--------------------------------------------------|
+	// | JSCVT                        | [15-12] |    y    |
+	// |--------------------------------------------------|
+	// | API                          | [11-8]  |    y    |
+	// |--------------------------------------------------|
+	// | APA                          | [7-4]   |    y    |
+	// |--------------------------------------------------|
+	// | DPB                          | [3-0]   |    y    |
+	// x--------------------------------------------------x
+
+	// if instAttrReg1&(0xf<<28) != 0 {
+	// 	fmt.Println("GPI")
+	// }
+	if instAttrReg1&(0xf<<28) != 24 {
+		f |= GPA
+	}
+	if instAttrReg1&(0xf<<20) != 0 {
+		f |= LRCPC
+	}
+	if instAttrReg1&(0xf<<16) != 0 {
+		f |= FCMA
+	}
+	if instAttrReg1&(0xf<<12) != 0 {
+		f |= JSCVT
+	}
+	// if instAttrReg1&(0xf<<8) != 0 {
+	// 	fmt.Println("API")
+	// }
+	// if instAttrReg1&(0xf<<4) != 0 {
+	// 	fmt.Println("APA")
+	// }
+	if instAttrReg1&(0xf<<0) != 0 {
+		f |= DCPOP
+	}
+	c.Arm = f
+}

vendor/github.com/klauspost/cpuid/detect_intel.go

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build 386,!gccgo,!noasm amd64,!gccgo,!noasm,!appengine
+
+package cpuid
+
+func asmCpuid(op uint32) (eax, ebx, ecx, edx uint32)
+func asmCpuidex(op, op2 uint32) (eax, ebx, ecx, edx uint32)
+func asmXgetbv(index uint32) (eax, edx uint32)
+func asmRdtscpAsm() (eax, ebx, ecx, edx uint32)
+
+func initCPU() {
+	cpuid = asmCpuid
+	cpuidex = asmCpuidex
+	xgetbv = asmXgetbv
+	rdtscpAsm = asmRdtscpAsm
+}
+
+func addInfo(c *CPUInfo) {
+	c.maxFunc = maxFunctionID()
+	c.maxExFunc = maxExtendedFunction()
+	c.BrandName = brandName()
+	c.CacheLine = cacheLine()
+	c.Family, c.Model = familyModel()
+	c.Features = support()
+	c.SGX = hasSGX(c.Features&SGX != 0, c.Features&SGXLC != 0)
+	c.ThreadsPerCore = threadsPerCore()
+	c.LogicalCores = logicalCores()
+	c.PhysicalCores = physicalCores()
+	c.VendorID, c.VendorString = vendorID()
+	c.Hz = hertz(c.BrandName)
+	c.cacheSize()
+}

vendor/github.com/klauspost/cpuid/detect_ref.go

+// Copyright (c) 2015 Klaus Post, released under MIT License. See LICENSE file.
+
+//+build !amd64,!386,!arm64 gccgo noasm appengine
+
+package cpuid
+
+func initCPU() {
+	cpuid = func(uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
+	cpuidex = func(x, y uint32) (a, b, c, d uint32) { return 0, 0, 0, 0 }
+	xgetbv = func(uint32) (a, b uint32) { return 0, 0 }
+	rdtscpAsm = func() (a, b, c, d uint32) { return 0, 0, 0, 0 }
+}
+
+func addInfo(info *CPUInfo) {}

vendor/github.com/klauspost/cpuid/go.mod

+module github.com/klauspost/cpuid
+
+go 1.12

vendor/github.com/minio/md5-simd/block-generic.go

+// Copyright 2013 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Code generated by go run gen.go -output md5block.go; DO NOT EDIT.
+
+package md5simd
+
+import (
+	"encoding/binary"
+	"math/bits"
+)
+
+type digest struct {
+	s   [4]uint32
+	x   [BlockSize]byte
+	nx  int
+	len uint64
+}
+
+func blockGeneric(dig *digest, p []byte) {
+	// load state
+	a, b, c, d := dig.s[0], dig.s[1], dig.s[2], dig.s[3]
+
+	for i := 0; i <= len(p)-BlockSize; i += BlockSize {
+		// eliminate bounds checks on p
+		q := p[i:]
+		q = q[:BlockSize:BlockSize]
+
+		// save current state
+		aa, bb, cc, dd := a, b, c, d
+
+		// load input block
+		x0 := binary.LittleEndian.Uint32(q[4*0x0:])
+		x1 := binary.LittleEndian.Uint32(q[4*0x1:])
+		x2 := binary.LittleEndian.Uint32(q[4*0x2:])
+		x3 := binary.LittleEndian.Uint32(q[4*0x3:])
+		x4 := binary.LittleEndian.Uint32(q[4*0x4:])
+		x5 := binary.LittleEndian.Uint32(q[4*0x5:])
+		x6 := binary.LittleEndian.Uint32(q[4*0x6:])
+		x7 := binary.LittleEndian.Uint32(q[4*0x7:])
+		x8 := binary.LittleEndian.Uint32(q[4*0x8:])
+		x9 := binary.LittleEndian.Uint32(q[4*0x9:])
+		xa := binary.LittleEndian.Uint32(q[4*0xa:])
+		xb := binary.LittleEndian.Uint32(q[4*0xb:])
+		xc := binary.LittleEndian.Uint32(q[4*0xc:])
+		xd := binary.LittleEndian.Uint32(q[4*0xd:])
+		xe := binary.LittleEndian.Uint32(q[4*0xe:])
+		xf := binary.LittleEndian.Uint32(q[4*0xf:])
+
+		// round 1
+		a = b + bits.RotateLeft32((((c^d)&b)^d)+a+x0+0xd76aa478, 7)
+		d = a + bits.RotateLeft32((((b^c)&a)^c)+d+x1+0xe8c7b756, 12)
+		c = d + bits.RotateLeft32((((a^b)&d)^b)+c+x2+0x242070db, 17)
+		b = c + bits.RotateLeft32((((d^a)&c)^a)+b+x3+0xc1bdceee, 22)
+		a = b + bits.RotateLeft32((((c^d)&b)^d)+a+x4+0xf57c0faf, 7)
+		d = a + bits.RotateLeft32((((b^c)&a)^c)+d+x5+0x4787c62a, 12)
+		c = d + bits.RotateLeft32((((a^b)&d)^b)+c+x6+0xa8304613, 17)
+		b = c + bits.RotateLeft32((((d^a)&c)^a)+b+x7+0xfd469501, 22)
+		a = b + bits.RotateLeft32((((c^d)&b)^d)+a+x8+0x698098d8, 7)
+		d = a + bits.RotateLeft32((((b^c)&a)^c)+d+x9+0x8b44f7af, 12)
+		c = d + bits.RotateLeft32((((a^b)&d)^b)+c+xa+0xffff5bb1, 17)
+		b = c + bits.RotateLeft32((((d^a)&c)^a)+b+xb+0x895cd7be, 22)
+		a = b + bits.RotateLeft32((((c^d)&b)^d)+a+xc+0x6b901122, 7)
+		d = a + bits.RotateLeft32((((b^c)&a)^c)+d+xd+0xfd987193, 12)
+		c = d + bits.RotateLeft32((((a^b)&d)^b)+c+xe+0xa679438e, 17)
+		b = c + bits.RotateLeft32((((d^a)&c)^a)+b+xf+0x49b40821, 22)
+
+		// round 2
+		a = b + bits.RotateLeft32((((b^c)&d)^c)+a+x1+0xf61e2562, 5)
+		d = a + bits.RotateLeft32((((a^b)&c)^b)+d+x6+0xc040b340, 9)
+		c = d + bits.RotateLeft32((((d^a)&b)^a)+c+xb+0x265e5a51, 14)
+		b = c + bits.RotateLeft32((((c^d)&a)^d)+b+x0+0xe9b6c7aa, 20)
+		a = b + bits.RotateLeft32((((b^c)&d)^c)+a+x5+0xd62f105d, 5)
+		d = a + bits.RotateLeft32((((a^b)&c)^b)+d+xa+0x02441453, 9)
+		c = d + bits.RotateLeft32((((d^a)&b)^a)+c+xf+0xd8a1e681, 14)
+		b = c + bits.RotateLeft32((((c^d)&a)^d)+b+x4+0xe7d3fbc8, 20)
+		a = b + bits.RotateLeft32((((b^c)&d)^c)+a+x9+0x21e1cde6, 5)
+		d = a + bits.RotateLeft32((((a^b)&c)^b)+d+xe+0xc33707d6, 9)
+		c = d + bits.RotateLeft32((((d^a)&b)^a)+c+x3+0xf4d50d87, 14)
+		b = c + bits.RotateLeft32((((c^d)&a)^d)+b+x8+0x455a14ed, 20)
+		a = b + bits.RotateLeft32((((b^c)&d)^c)+a+xd+0xa9e3e905, 5)
+		d = a + bits.RotateLeft32((((a^b)&c)^b)+d+x2+0xfcefa3f8, 9)
+		c = d + bits.RotateLeft32((((d^a)&b)^a)+c+x7+0x676f02d9, 14)
+		b = c + bits.RotateLeft32((((c^d)&a)^d)+b+xc+0x8d2a4c8a, 20)
+
+		// round 3
+		a = b + bits.RotateLeft32((b^c^d)+a+x5+0xfffa3942, 4)
+		d = a + bits.RotateLeft32((a^b^c)+d+x8+0x8771f681, 11)
+		c = d + bits.RotateLeft32((d^a^b)+c+xb+0x6d9d6122, 16)
+		b = c + bits.RotateLeft32((c^d^a)+b+xe+0xfde5380c, 23)
+		a = b + bits.RotateLeft32((b^c^d)+a+x1+0xa4beea44, 4)
+		d = a + bits.RotateLeft32((a^b^c)+d+x4+0x4bdecfa9, 11)
+		c = d + bits.RotateLeft32((d^a^b)+c+x7+0xf6bb4b60, 16)
+		b = c + bits.RotateLeft32((c^d^a)+b+xa+0xbebfbc70, 23)
+		a = b + bits.RotateLeft32((b^c^d)+a+xd+0x289b7ec6, 4)
+		d = a + bits.RotateLeft32((a^b^c)+d+x0+0xeaa127fa, 11)
+		c = d + bits.RotateLeft32((d^a^b)+c+x3+0xd4ef3085, 16)
+		b = c + bits.RotateLeft32((c^d^a)+b+x6+0x04881d05, 23)
+		a = b + bits.RotateLeft32((b^c^d)+a+x9+0xd9d4d039, 4)
+		d = a + bits.RotateLeft32((a^b^c)+d+xc+0xe6db99e5, 11)
+		c = d + bits.RotateLeft32((d^a^b)+c+xf+0x1fa27cf8, 16)
+		b = c + bits.RotateLeft32((c^d^a)+b+x2+0xc4ac5665, 23)
+
+		// round 4
+		a = b + bits.RotateLeft32((c^(b|^d))+a+x0+0xf4292244, 6)
+		d = a + bits.RotateLeft32((b^(a|^c))+d+x7+0x432aff97, 10)
+		c = d + bits.RotateLeft32((a^(d|^b))+c+xe+0xab9423a7, 15)
+		b = c + bits.RotateLeft32((d^(c|^a))+b+x5+0xfc93a039, 21)
+		a = b + bits.RotateLeft32((c^(b|^d))+a+xc+0x655b59c3, 6)
+		d = a + bits.RotateLeft32((b^(a|^c))+d+x3+0x8f0ccc92, 10)
+		c = d + bits.RotateLeft32((a^(d|^b))+c+xa+0xffeff47d, 15)
+		b = c + bits.RotateLeft32((d^(c|^a))+b+x1+0x85845dd1, 21)
+		a = b + bits.RotateLeft32((c^(b|^d))+a+x8+0x6fa87e4f, 6)
+		d = a + bits.RotateLeft32((b^(a|^c))+d+xf+0xfe2ce6e0, 10)
+		c = d + bits.RotateLeft32((a^(d|^b))+c+x6+0xa3014314, 15)
+		b = c + bits.RotateLeft32((d^(c|^a))+b+xd+0x4e0811a1, 21)
+		a = b + bits.RotateLeft32((c^(b|^d))+a+x4+0xf7537e82, 6)
+		d = a + bits.RotateLeft32((b^(a|^c))+d+xb+0xbd3af235, 10)
+		c = d + bits.RotateLeft32((a^(d|^b))+c+x2+0x2ad7d2bb, 15)
+		b = c + bits.RotateLeft32((d^(c|^a))+b+x9+0xeb86d391, 21)
+
+		// add saved state
+		a += aa
+		b += bb
+		c += cc
+		d += dd
+	}
+
+	// save state
+	dig.s[0], dig.s[1], dig.s[2], dig.s[3] = a, b, c, d
+}

vendor/github.com/minio/md5-simd/block16_amd64.s

+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+// This is the AVX512 implementation of the MD5 block function (16-way parallel)
+
+#define prep(index) \
+	KMOVQ	   kmask, ktmp					    \
+	VPGATHERDD index*4(base)(ptrs*1), ktmp, mem
+
+#define ROUND1(a, b, c, d, index, const, shift) \
+	VXORPS  c, tmp, tmp            \
+	VPADDD  64*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	VPTERNLOGD $0x6C, b, d, tmp    \
+	prep(index)                    \
+	VPADDD  tmp, a, a              \
+	VPROLD $shift, a, a            \
+	VMOVAPD c, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND1noload(a, b, c, d, const, shift) \
+	VXORPS  c, tmp, tmp            \
+	VPADDD  64*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	VPTERNLOGD $0x6C, b, d, tmp    \
+	VPADDD  tmp, a, a              \
+	VPROLD $shift, a, a            \
+	VMOVAPD c, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND2(a, b, c, d, zreg, const, shift) \
+	VPADDD  64*const(consts), a, a \
+	VPADDD  zreg, a, a             \
+	VANDNPS c, tmp, tmp            \
+	VPTERNLOGD $0xEC, b, tmp, tmp2 \
+	VMOVAPD c, tmp                 \
+	VPADDD  tmp2, a, a             \
+	VMOVAPD c, tmp2                \
+	VPROLD $shift, a, a            \
+	VPADDD  b, a, a
+
+#define ROUND3(a, b, c, d, zreg, const, shift) \
+	VPADDD  64*const(consts), a, a \
+	VPADDD  zreg, a, a             \
+	VPTERNLOGD $0x96, b, d, tmp    \
+	VPADDD  tmp, a, a              \
+	VPROLD $shift, a, a            \
+	VMOVAPD b, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND4(a, b, c, d, zreg, const, shift) \
+	VPADDD 64*const(consts), a, a \
+	VPADDD zreg, a, a             \
+	VPTERNLOGD $0x36, b, c, tmp   \
+	VPADDD tmp, a, a              \
+	VPROLD $shift, a, a           \
+	VXORPS c, ones, tmp           \
+	VPADDD b, a, a
+
+TEXT ·block16(SB),4,$0-40
+
+    MOVQ  state+0(FP), BX
+    MOVQ  base+8(FP), SI
+    MOVQ  ptrs+16(FP), AX
+    KMOVQ mask+24(FP), K1
+    MOVQ  n+32(FP), DX
+    MOVQ  ·avx512md5consts+0(SB), DI
+
+#define a Z0
+#define b Z1
+#define c Z2
+#define d Z3
+
+#define sa Z4
+#define sb Z5
+#define sc Z6
+#define sd Z7
+
+#define tmp       Z8
+#define tmp2      Z9
+#define ptrs     Z10
+#define ones     Z12
+#define mem      Z15
+
+#define kmask  K1
+#define ktmp   K3
+
+// ----------------------------------------------------------
+// Registers Z16 through to Z31 are used for caching purposes
+// ----------------------------------------------------------
+
+
+#define dig    BX
+#define count  DX
+#define base   SI
+#define consts DI
+
+	// load digest into state registers
+	VMOVUPD (dig), a
+	VMOVUPD 0x40(dig), b
+	VMOVUPD 0x80(dig), c
+	VMOVUPD 0xc0(dig), d
+
+	// load source pointers
+	VMOVUPD 0x00(AX), ptrs
+
+	MOVQ $-1, AX
+	VPBROADCASTQ AX, ones
+
+loop:
+	VMOVAPD a, sa
+	VMOVAPD b, sb
+	VMOVAPD c, sc
+	VMOVAPD d, sd
+
+	prep(0)
+	VMOVAPD d, tmp
+	VMOVAPD mem, Z16
+
+	ROUND1(a,b,c,d, 1,0x00, 7)
+	VMOVAPD mem, Z17
+	ROUND1(d,a,b,c, 2,0x01,12)
+	VMOVAPD mem, Z18
+	ROUND1(c,d,a,b, 3,0x02,17)
+	VMOVAPD mem, Z19
+	ROUND1(b,c,d,a, 4,0x03,22)
+	VMOVAPD mem, Z20
+	ROUND1(a,b,c,d, 5,0x04, 7)
+	VMOVAPD mem, Z21
+	ROUND1(d,a,b,c, 6,0x05,12)
+	VMOVAPD mem, Z22
+	ROUND1(c,d,a,b, 7,0x06,17)
+	VMOVAPD mem, Z23
+	ROUND1(b,c,d,a, 8,0x07,22)
+	VMOVAPD mem, Z24
+	ROUND1(a,b,c,d, 9,0x08, 7)
+	VMOVAPD mem, Z25
+	ROUND1(d,a,b,c,10,0x09,12)
+	VMOVAPD mem, Z26
+	ROUND1(c,d,a,b,11,0x0a,17)
+	VMOVAPD mem, Z27
+	ROUND1(b,c,d,a,12,0x0b,22)
+	VMOVAPD mem, Z28
+	ROUND1(a,b,c,d,13,0x0c, 7)
+	VMOVAPD mem, Z29
+	ROUND1(d,a,b,c,14,0x0d,12)
+	VMOVAPD mem, Z30
+	ROUND1(c,d,a,b,15,0x0e,17)
+	VMOVAPD mem, Z31
+
+	ROUND1noload(b,c,d,a, 0x0f,22)
+
+	VMOVAPD d, tmp
+	VMOVAPD d, tmp2
+
+	ROUND2(a,b,c,d, Z17,0x10, 5)
+	ROUND2(d,a,b,c, Z22,0x11, 9)
+	ROUND2(c,d,a,b, Z27,0x12,14)
+	ROUND2(b,c,d,a, Z16,0x13,20)
+	ROUND2(a,b,c,d, Z21,0x14, 5)
+	ROUND2(d,a,b,c, Z26,0x15, 9)
+	ROUND2(c,d,a,b, Z31,0x16,14)
+	ROUND2(b,c,d,a, Z20,0x17,20)
+	ROUND2(a,b,c,d, Z25,0x18, 5)
+	ROUND2(d,a,b,c, Z30,0x19, 9)
+	ROUND2(c,d,a,b, Z19,0x1a,14)
+	ROUND2(b,c,d,a, Z24,0x1b,20)
+	ROUND2(a,b,c,d, Z29,0x1c, 5)
+	ROUND2(d,a,b,c, Z18,0x1d, 9)
+	ROUND2(c,d,a,b, Z23,0x1e,14)
+	ROUND2(b,c,d,a, Z28,0x1f,20)
+
+	VMOVAPD c, tmp
+
+	ROUND3(a,b,c,d, Z21,0x20, 4)
+	ROUND3(d,a,b,c, Z24,0x21,11)
+	ROUND3(c,d,a,b, Z27,0x22,16)
+	ROUND3(b,c,d,a, Z30,0x23,23)
+	ROUND3(a,b,c,d, Z17,0x24, 4)
+	ROUND3(d,a,b,c, Z20,0x25,11)
+	ROUND3(c,d,a,b, Z23,0x26,16)
+	ROUND3(b,c,d,a, Z26,0x27,23)
+	ROUND3(a,b,c,d, Z29,0x28, 4)
+	ROUND3(d,a,b,c, Z16,0x29,11)
+	ROUND3(c,d,a,b, Z19,0x2a,16)
+	ROUND3(b,c,d,a, Z22,0x2b,23)
+	ROUND3(a,b,c,d, Z25,0x2c, 4)
+	ROUND3(d,a,b,c, Z28,0x2d,11)
+	ROUND3(c,d,a,b, Z31,0x2e,16)
+	ROUND3(b,c,d,a, Z18,0x2f,23)
+
+	VXORPS d, ones, tmp
+
+	ROUND4(a,b,c,d, Z16,0x30, 6)
+	ROUND4(d,a,b,c, Z23,0x31,10)
+	ROUND4(c,d,a,b, Z30,0x32,15)
+	ROUND4(b,c,d,a, Z21,0x33,21)
+	ROUND4(a,b,c,d, Z28,0x34, 6)
+	ROUND4(d,a,b,c, Z19,0x35,10)
+	ROUND4(c,d,a,b, Z26,0x36,15)
+	ROUND4(b,c,d,a, Z17,0x37,21)
+	ROUND4(a,b,c,d, Z24,0x38, 6)
+	ROUND4(d,a,b,c, Z31,0x39,10)
+	ROUND4(c,d,a,b, Z22,0x3a,15)
+	ROUND4(b,c,d,a, Z29,0x3b,21)
+	ROUND4(a,b,c,d, Z20,0x3c, 6)
+	ROUND4(d,a,b,c, Z27,0x3d,10)
+	ROUND4(c,d,a,b, Z18,0x3e,15)
+	ROUND4(b,c,d,a, Z25,0x3f,21)
+
+	VPADDD sa, a, a
+	VPADDD sb, b, b
+	VPADDD sc, c, c
+	VPADDD sd, d, d
+
+	LEAQ 64(base), base
+	SUBQ $64, count
+	JNE  loop
+
+	VMOVUPD a, (dig)
+	VMOVUPD b, 0x40(dig)
+	VMOVUPD c, 0x80(dig)
+	VMOVUPD d, 0xc0(dig)
+
+	VZEROUPPER
+	RET

vendor/github.com/minio/md5-simd/block8_amd64.s

+// Copyright (c) 2018 Igneous Systems
+//   MIT License
+//
+//   Permission is hereby granted, free of charge, to any person obtaining a copy
+//   of this software and associated documentation files (the "Software"), to deal
+//   in the Software without restriction, including without limitation the rights
+//   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+//   copies of the Software, and to permit persons to whom the Software is
+//   furnished to do so, subject to the following conditions:
+//
+//   The above copyright notice and this permission notice shall be included in all
+//   copies or substantial portions of the Software.
+//
+//   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+//   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+//   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+//   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+//   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+//   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+//   SOFTWARE.
+
+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+//   Use of this source code is governed by a license that can be
+//   found in the LICENSE file.
+
+// This is the AVX2 implementation of the MD5 block function (8-way parallel)
+
+// block8(state *uint64, base uintptr, bufs *int32, cache *byte, n int)
+TEXT ·block8(SB), 4, $0-40
+	MOVQ state+0(FP), BX
+	MOVQ base+8(FP), SI
+	MOVQ bufs+16(FP), AX
+	MOVQ cache+24(FP), CX
+	MOVQ n+32(FP), DX
+	MOVQ ·avx256md5consts+0(SB), DI
+
+	// Align cache (which is stack allocated by the compiler)
+	// to a 256 bit boundary (ymm register alignment)
+	// The cache8 type is deliberately oversized to permit this.
+	ADDQ $31, CX
+	ANDB $-32, CL
+
+#define a Y0
+#define b Y1
+#define c Y2
+#define d Y3
+
+#define sa Y4
+#define sb Y5
+#define sc Y6
+#define sd Y7
+
+#define tmp  Y8
+#define tmp2 Y9
+
+#define mask Y10
+#define off  Y11
+
+#define ones Y12
+
+#define rtmp1  Y13
+#define rtmp2  Y14
+
+#define mem   Y15
+
+#define dig    BX
+#define cache  CX
+#define count  DX
+#define base   SI
+#define consts DI
+
+#define prepmask \
+	VXORPS   mask, mask, mask \
+	VPCMPGTD mask, off, mask
+
+#define prep(index) \
+	VMOVAPD    mask, rtmp2                      \
+	VPGATHERDD rtmp2, index*4(base)(off*1), mem
+
+#define load(index) \
+	VMOVAPD index*32(cache), mem
+
+#define store(index) \
+	VMOVAPD mem, index*32(cache)
+
+#define roll(shift, a) \
+	VPSLLD $shift, a, rtmp1 \
+	VPSRLD $32-shift, a, a  \
+	VORPS  rtmp1, a, a
+
+#define ROUND1(a, b, c, d, index, const, shift) \
+	VXORPS  c, tmp, tmp            \
+	VPADDD  32*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	VANDPS  b, tmp, tmp            \
+	VXORPS  d, tmp, tmp            \
+	prep(index)                    \
+	VPADDD  tmp, a, a              \
+	roll(shift,a)                  \
+	VMOVAPD c, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND1load(a, b, c, d, index, const, shift) \
+	VXORPS  c, tmp, tmp            \
+	VPADDD  32*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	VANDPS  b, tmp, tmp            \
+	VXORPS  d, tmp, tmp            \
+	load(index)                    \
+	VPADDD  tmp, a, a              \
+	roll(shift,a)                  \
+	VMOVAPD c, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND2(a, b, c, d, index, const, shift) \
+	VPADDD  32*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	VANDPS  b, tmp2, tmp2          \
+	VANDNPS c, tmp, tmp            \
+	load(index)                    \
+	VORPS   tmp, tmp2, tmp2        \
+	VMOVAPD c, tmp                 \
+	VPADDD  tmp2, a, a             \
+	VMOVAPD c, tmp2                \
+	roll(shift,a)                  \
+	VPADDD  b, a, a
+
+#define ROUND3(a, b, c, d, index, const, shift) \
+	VPADDD  32*const(consts), a, a \
+	VPADDD  mem, a, a              \
+	load(index)                    \
+	VXORPS  d, tmp, tmp            \
+	VXORPS  b, tmp, tmp            \
+	VPADDD  tmp, a, a              \
+	roll(shift,a)                  \
+	VMOVAPD b, tmp                 \
+	VPADDD  b, a, a
+
+#define ROUND4(a, b, c, d, index, const, shift) \
+	VPADDD 32*const(consts), a, a \
+	VPADDD mem, a, a              \
+	VORPS  b, tmp, tmp            \
+	VXORPS c, tmp, tmp            \
+	VPADDD tmp, a, a              \
+	load(index)                   \
+	roll(shift,a)                 \
+	VXORPS c, ones, tmp           \
+	VPADDD b, a, a
+
+	// load digest into state registers
+	VMOVUPD (dig), a
+	VMOVUPD 32(dig), b
+	VMOVUPD 64(dig), c
+	VMOVUPD 96(dig), d
+
+	// load source buffer offsets
+	VMOVUPD (AX), off
+
+	prepmask
+	VPCMPEQD ones, ones, ones
+
+loop:
+	VMOVAPD a, sa
+	VMOVAPD b, sb
+	VMOVAPD c, sc
+	VMOVAPD d, sd
+
+	prep(0)
+	VMOVAPD d, tmp
+	store(0)
+
+	ROUND1(a,b,c,d, 1,0x00, 7)
+	store(1)
+	ROUND1(d,a,b,c, 2,0x01,12)
+	store(2)
+	ROUND1(c,d,a,b, 3,0x02,17)
+	store(3)
+	ROUND1(b,c,d,a, 4,0x03,22)
+	store(4)
+	ROUND1(a,b,c,d, 5,0x04, 7)
+	store(5)
+	ROUND1(d,a,b,c, 6,0x05,12)
+	store(6)
+	ROUND1(c,d,a,b, 7,0x06,17)
+	store(7)
+	ROUND1(b,c,d,a, 8,0x07,22)
+	store(8)
+	ROUND1(a,b,c,d, 9,0x08, 7)
+	store(9)
+	ROUND1(d,a,b,c,10,0x09,12)
+	store(10)
+	ROUND1(c,d,a,b,11,0x0a,17)
+	store(11)
+	ROUND1(b,c,d,a,12,0x0b,22)
+	store(12)
+	ROUND1(a,b,c,d,13,0x0c, 7)
+	store(13)
+	ROUND1(d,a,b,c,14,0x0d,12)
+	store(14)
+	ROUND1(c,d,a,b,15,0x0e,17)
+	store(15)
+	ROUND1load(b,c,d,a, 1,0x0f,22)
+
+	VMOVAPD d, tmp
+	VMOVAPD d, tmp2
+
+	ROUND2(a,b,c,d, 6,0x10, 5)
+	ROUND2(d,a,b,c,11,0x11, 9)
+	ROUND2(c,d,a,b, 0,0x12,14)
+	ROUND2(b,c,d,a, 5,0x13,20)
+	ROUND2(a,b,c,d,10,0x14, 5)
+	ROUND2(d,a,b,c,15,0x15, 9)
+	ROUND2(c,d,a,b, 4,0x16,14)
+	ROUND2(b,c,d,a, 9,0x17,20)
+	ROUND2(a,b,c,d,14,0x18, 5)
+	ROUND2(d,a,b,c, 3,0x19, 9)
+	ROUND2(c,d,a,b, 8,0x1a,14)
+	ROUND2(b,c,d,a,13,0x1b,20)
+	ROUND2(a,b,c,d, 2,0x1c, 5)
+	ROUND2(d,a,b,c, 7,0x1d, 9)
+	ROUND2(c,d,a,b,12,0x1e,14)
+	ROUND2(b,c,d,a, 0,0x1f,20)
+
+	load(5)
+	VMOVAPD c, tmp
+
+	ROUND3(a,b,c,d, 8,0x20, 4)
+	ROUND3(d,a,b,c,11,0x21,11)
+	ROUND3(c,d,a,b,14,0x22,16)
+	ROUND3(b,c,d,a, 1,0x23,23)
+	ROUND3(a,b,c,d, 4,0x24, 4)
+	ROUND3(d,a,b,c, 7,0x25,11)
+	ROUND3(c,d,a,b,10,0x26,16)
+	ROUND3(b,c,d,a,13,0x27,23)
+	ROUND3(a,b,c,d, 0,0x28, 4)
+	ROUND3(d,a,b,c, 3,0x29,11)
+	ROUND3(c,d,a,b, 6,0x2a,16)
+	ROUND3(b,c,d,a, 9,0x2b,23)
+	ROUND3(a,b,c,d,12,0x2c, 4)
+	ROUND3(d,a,b,c,15,0x2d,11)
+	ROUND3(c,d,a,b, 2,0x2e,16)
+	ROUND3(b,c,d,a, 0,0x2f,23)
+
+	load(0)
+	VXORPS d, ones, tmp
+
+	ROUND4(a,b,c,d, 7,0x30, 6)
+	ROUND4(d,a,b,c,14,0x31,10)
+	ROUND4(c,d,a,b, 5,0x32,15)
+	ROUND4(b,c,d,a,12,0x33,21)
+	ROUND4(a,b,c,d, 3,0x34, 6)
+	ROUND4(d,a,b,c,10,0x35,10)
+	ROUND4(c,d,a,b, 1,0x36,15)
+	ROUND4(b,c,d,a, 8,0x37,21)
+	ROUND4(a,b,c,d,15,0x38, 6)
+	ROUND4(d,a,b,c, 6,0x39,10)
+	ROUND4(c,d,a,b,13,0x3a,15)
+	ROUND4(b,c,d,a, 4,0x3b,21)
+	ROUND4(a,b,c,d,11,0x3c, 6)
+	ROUND4(d,a,b,c, 2,0x3d,10)
+	ROUND4(c,d,a,b, 9,0x3e,15)
+	ROUND4(b,c,d,a, 0,0x3f,21)
+
+	VPADDD sa, a, a
+	VPADDD sb, b, b
+	VPADDD sc, c, c
+	VPADDD sd, d, d
+
+	LEAQ 64(base), base
+	SUBQ $64, count
+	JNE  loop
+
+	VMOVUPD a, (dig)
+	VMOVUPD b, 32(dig)
+	VMOVUPD c, 64(dig)
+	VMOVUPD d, 96(dig)
+
+	VZEROUPPER
+	RET

vendor/github.com/minio/md5-simd/block_amd64.go

+//+build !noasm,!appengine,gc
+
+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+package md5simd
+
+import (
+	"fmt"
+	"math"
+	"sync"
+	"unsafe"
+
+	"github.com/klauspost/cpuid"
+)
+
+var hasAVX512 bool
+
+//go:noescape
+func block8(state *uint32, base uintptr, bufs *int32, cache *byte, n int)
+
+//go:noescape
+func block16(state *uint32, base uintptr, ptrs *int32, mask uint64, n int)
+
+// 8-way 4x uint32 digests in 4 ymm registers
+// (ymm0, ymm1, ymm2, ymm3)
+type digest8 struct {
+	v0, v1, v2, v3 [8]uint32
+}
+
+// Stack cache for 8x64 byte md5.BlockSize bytes.
+// Must be 32-byte aligned, so allocate 512+32 and
+// align upwards at runtime.
+type cache8 [512 + 32]byte
+
+// MD5 magic numbers for one lane of hashing; inflated
+// 8x below at init time.
+var md5consts = [64]uint32{
+	0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee,
+	0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
+	0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be,
+	0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
+	0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa,
+	0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
+	0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed,
+	0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
+	0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c,
+	0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
+	0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05,
+	0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
+	0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039,
+	0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
+	0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1,
+	0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,
+}
+
+// inflate the consts 8-way for 8x md5 (256 bit ymm registers)
+var avx256md5consts = func(c []uint32) []uint32 {
+	inf := make([]uint32, 8*len(c))
+	for i := range c {
+		for j := 0; j < 8; j++ {
+			inf[(i*8)+j] = c[i]
+		}
+	}
+	return inf
+}(md5consts[:])
+
+// 16-way 4x uint32 digests in 4 zmm registers
+type digest16 struct {
+	v0, v1, v2, v3 [16]uint32
+}
+
+// inflate the consts 16-way for 16x md5 (512 bit zmm registers)
+var avx512md5consts = func(c []uint32) []uint32 {
+	inf := make([]uint32, 16*len(c))
+	for i := range c {
+		for j := 0; j < 16; j++ {
+			inf[(i*16)+j] = c[i]
+		}
+	}
+	return inf
+}(md5consts[:])
+
+func init() {
+	hasAVX512 = cpuid.CPU.AVX512F()
+}
+
+// Interface function to assembly code
+func (s *md5Server) blockMd5_x16(d *digest16, input [16][]byte, half bool) {
+	if hasAVX512 {
+		blockMd5_avx512(d, input, s.allBufs, &s.maskRounds16)
+	} else {
+		d8a, d8b := digest8{}, digest8{}
+		for i := range d8a.v0 {
+			j := i + 8
+			d8a.v0[i], d8a.v1[i], d8a.v2[i], d8a.v3[i] = d.v0[i], d.v1[i], d.v2[i], d.v3[i]
+			if !half {
+				d8b.v0[i], d8b.v1[i], d8b.v2[i], d8b.v3[i] = d.v0[j], d.v1[j], d.v2[j], d.v3[j]
+			}
+		}
+
+		i8 := [2][8][]byte{}
+		for i := range i8[0] {
+			i8[0][i], i8[1][i] = input[i], input[8+i]
+		}
+		if half {
+			blockMd5_avx2(&d8a, i8[0], s.allBufs, &s.maskRounds8a)
+		} else {
+			wg := sync.WaitGroup{}
+			wg.Add(2)
+			go func() { blockMd5_avx2(&d8a, i8[0], s.allBufs, &s.maskRounds8a); wg.Done() }()
+			go func() { blockMd5_avx2(&d8b, i8[1], s.allBufs, &s.maskRounds8b); wg.Done() }()
+			wg.Wait()
+		}
+
+		for i := range d8a.v0 {
+			j := i + 8
+			d.v0[i], d.v1[i], d.v2[i], d.v3[i] = d8a.v0[i], d8a.v1[i], d8a.v2[i], d8a.v3[i]
+			if !half {
+				d.v0[j], d.v1[j], d.v2[j], d.v3[j] = d8b.v0[i], d8b.v1[i], d8b.v2[i], d8b.v3[i]
+			}
+		}
+	}
+}
+
+// Interface function to AVX512 assembly code
+func blockMd5_avx512(s *digest16, input [16][]byte, base []byte, maskRounds *[16]maskRounds) {
+	baseMin := uint64(uintptr(unsafe.Pointer(&(base[0]))))
+	ptrs := [16]int32{}
+
+	for i := range ptrs {
+		if len(input[i]) > 0 {
+			if len(input[i]) > internalBlockSize {
+				panic(fmt.Sprintf("Sanity check fails for lane %d: maximum input length cannot exceed internalBlockSize", i))
+			}
+
+			off := uint64(uintptr(unsafe.Pointer(&(input[i][0])))) - baseMin
+			if off > math.MaxUint32 {
+				panic(fmt.Sprintf("invalid buffer sent with offset %x", off))
+			}
+			ptrs[i] = int32(off)
+		}
+	}
+
+	sdup := *s // create copy of initial states to receive intermediate updates
+
+	rounds := generateMaskAndRounds16(input, maskRounds)
+
+	for r := 0; r < rounds; r++ {
+		m := maskRounds[r]
+
+		block16(&sdup.v0[0], uintptr(baseMin), &ptrs[0], m.mask, int(64*m.rounds))
+
+		for j := 0; j < len(ptrs); j++ {
+			ptrs[j] += int32(64 * m.rounds) // update pointers for next round
+			if m.mask&(1<<j) != 0 {         // update digest if still masked as active
+				(*s).v0[j], (*s).v1[j], (*s).v2[j], (*s).v3[j] = sdup.v0[j], sdup.v1[j], sdup.v2[j], sdup.v3[j]
+			}
+		}
+	}
+}
+
+// Interface function to AVX2 assembly code
+func blockMd5_avx2(s *digest8, input [8][]byte, base []byte, maskRounds *[8]maskRounds) {
+	baseMin := uint64(uintptr(unsafe.Pointer(&(base[0])))) - 4
+	ptrs := [8]int32{}
+
+	for i := range ptrs {
+		if len(input[i]) > 0 {
+			if len(input[i]) > internalBlockSize {
+				panic(fmt.Sprintf("Sanity check fails for lane %d: maximum input length cannot exceed internalBlockSize", i))
+			}
+
+			off := uint64(uintptr(unsafe.Pointer(&(input[i][0])))) - baseMin
+			if off > math.MaxUint32 {
+				panic(fmt.Sprintf("invalid buffer sent with offset %x", off))
+			}
+			ptrs[i] = int32(off)
+		}
+	}
+
+	sdup := *s // create copy of initial states to receive intermediate updates
+
+	rounds := generateMaskAndRounds8(input, maskRounds)
+
+	for r := 0; r < rounds; r++ {
+		m := maskRounds[r]
+		var cache cache8 // stack storage for block8 tmp state
+		block8(&sdup.v0[0], uintptr(baseMin), &ptrs[0], &cache[0], int(64*m.rounds))
+
+		for j := 0; j < len(ptrs); j++ {
+			ptrs[j] += int32(64 * m.rounds) // update pointers for next round
+			if m.mask&(1<<j) != 0 {         // update digest if still masked as active
+				(*s).v0[j], (*s).v1[j], (*s).v2[j], (*s).v3[j] = sdup.v0[j], sdup.v1[j], sdup.v2[j], sdup.v3[j]
+			}
+		}
+	}
+}

vendor/github.com/minio/md5-simd/go.mod

+module github.com/minio/md5-simd
+
+go 1.14
+
+require (
+	github.com/klauspost/cpuid v1.2.3
+)

vendor/github.com/minio/md5-simd/go.sum

+github.com/klauspost/cpuid v1.2.3 h1:CCtW0xUnWGVINKvE/WWOYKdsPV6mawAtvQuSl8guwQs=
+github.com/klauspost/cpuid v1.2.3/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=

vendor/github.com/minio/md5-simd/md5-digest_amd64.go

+//+build !noasm,!appengine,gc
+
+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+package md5simd
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"sync/atomic"
+)
+
+// md5Digest - Type for computing MD5 using either AVX2 or AVX512
+type md5Digest struct {
+	uid         uint64
+	blocksCh    chan blockInput
+	cycleServer chan uint64
+	x           [BlockSize]byte
+	nx          int
+	len         uint64
+	buffers     <-chan []byte
+}
+
+// NewHash - initialize instance for Md5 implementation.
+func (s *md5Server) NewHash() Hasher {
+	uid := atomic.AddUint64(&s.uidCounter, 1)
+	blockCh := make(chan blockInput, buffersPerLane)
+	s.newInput <- newClient{
+		uid:   uid,
+		input: blockCh,
+	}
+	return &md5Digest{
+		uid:         uid,
+		buffers:     s.buffers,
+		blocksCh:    blockCh,
+		cycleServer: s.cycle,
+	}
+}
+
+// Size - Return size of checksum
+func (d *md5Digest) Size() int { return Size }
+
+// BlockSize - Return blocksize of checksum
+func (d md5Digest) BlockSize() int { return BlockSize }
+
+func (d *md5Digest) Reset() {
+	if d.blocksCh == nil {
+		panic("reset after close")
+	}
+	d.nx = 0
+	d.len = 0
+	d.sendBlock(blockInput{uid: d.uid, reset: true}, false)
+}
+
+// write to digest
+func (d *md5Digest) Write(p []byte) (nn int, err error) {
+	if d.blocksCh == nil {
+		return 0, errors.New("md5Digest closed")
+	}
+
+	// break input into chunks of maximum internalBlockSize size
+	for {
+		l := len(p)
+		if l > internalBlockSize {
+			l = internalBlockSize
+		}
+		nnn, err := d.write(p[:l])
+		if err != nil {
+			return nn, err
+		}
+		nn += nnn
+		p = p[l:]
+
+		if len(p) == 0 {
+			break
+		}
+
+	}
+	return
+}
+
+func (d *md5Digest) write(p []byte) (nn int, err error) {
+
+	nn = len(p)
+	d.len += uint64(nn)
+	if d.nx > 0 {
+		n := copy(d.x[d.nx:], p)
+		d.nx += n
+		if d.nx == BlockSize {
+			// Create a copy of the overflow buffer in order to send it async over the channel
+			// (since we will modify the overflow buffer down below with any access beyond multiples of 64)
+			tmp := <-d.buffers
+			tmp = tmp[:BlockSize]
+			copy(tmp, d.x[:])
+			d.sendBlock(blockInput{uid: d.uid, msg: tmp}, len(p)-n < BlockSize)
+			d.nx = 0
+		}
+		p = p[n:]
+	}
+	if len(p) >= BlockSize {
+		n := len(p) &^ (BlockSize - 1)
+		buf := <-d.buffers
+		buf = buf[:n]
+		copy(buf, p)
+		d.sendBlock(blockInput{uid: d.uid, msg: buf}, len(p)-n < BlockSize)
+		p = p[n:]
+	}
+	if len(p) > 0 {
+		d.nx = copy(d.x[:], p)
+	}
+	return
+}
+
+func (d *md5Digest) Close() {
+	if d.blocksCh != nil {
+		close(d.blocksCh)
+		d.blocksCh = nil
+	}
+}
+
+// Sum - Return MD5 sum in bytes
+func (d *md5Digest) Sum(in []byte) (result []byte) {
+	if d.blocksCh == nil {
+		panic("sum after close")
+	}
+
+	trail := <-d.buffers
+	trail = append(trail[:0], d.x[:d.nx]...)
+
+	length := d.len
+	// Padding.  Add a 1 bit and 0 bits until 56 bytes mod 64.
+	var tmp [64]byte
+	tmp[0] = 0x80
+	if length%64 < 56 {
+		trail = append(trail, tmp[0:56-length%64]...)
+	} else {
+		trail = append(trail, tmp[0:64+56-length%64]...)
+	}
+
+	// Length in bits.
+	length <<= 3
+	binary.LittleEndian.PutUint64(tmp[:], length) // append length in bits
+
+	trail = append(trail, tmp[0:8]...)
+	if len(trail)%BlockSize != 0 {
+		panic(fmt.Errorf("internal error: sum block was not aligned. len=%d, nx=%d", len(trail), d.nx))
+	}
+	sumCh := make(chan sumResult, 1)
+	d.sendBlock(blockInput{uid: d.uid, msg: trail, sumCh: sumCh}, true)
+
+	sum := <-sumCh
+
+	return append(in, sum.digest[:]...)
+}
+
+// sendBlock will send a block for processing.
+// If cycle is true we will block on cycle, otherwise we will only block
+// if the block channel is full.
+func (d *md5Digest) sendBlock(bi blockInput, cycle bool) {
+	if cycle {
+		select {
+		case d.blocksCh <- bi:
+			d.cycleServer <- d.uid
+		}
+		return
+	}
+	// Only block on cycle if we filled the buffer
+	select {
+	case d.blocksCh <- bi:
+		return
+	default:
+		d.cycleServer <- d.uid
+		d.blocksCh <- bi
+	}
+}

vendor/github.com/minio/md5-simd/md5-server_amd64.go

+//+build !noasm,!appengine,gc
+
+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+package md5simd
+
+import (
+	"encoding/binary"
+	"fmt"
+	"runtime"
+
+	"github.com/klauspost/cpuid"
+)
+
+// MD5 initialization constants
+const (
+	// Lanes is the number of concurrently calculated hashes.
+	Lanes = 16
+
+	init0 = 0x67452301
+	init1 = 0xefcdab89
+	init2 = 0x98badcfe
+	init3 = 0x10325476
+)
+
+// md5ServerUID - Does not start at 0 but next multiple of 16 so as to be able to
+// differentiate with default initialisation value of 0
+const md5ServerUID = Lanes
+
+const buffersPerLane = 3
+
+// Message to send across input channel
+type blockInput struct {
+	uid   uint64
+	msg   []byte
+	sumCh chan sumResult
+	reset bool
+}
+
+type sumResult struct {
+	digest [Size]byte
+}
+
+type lanesInfo [Lanes]blockInput
+
+// md5Server - Type to implement parallel handling of MD5 invocations
+type md5Server struct {
+	uidCounter   uint64
+	cycle        chan uint64           // client with uid has update.
+	newInput     chan newClient        // Add new client.
+	digests      map[uint64][Size]byte // Map of uids to (interim) digest results
+	maskRounds16 [16]maskRounds        // Pre-allocated static array for max 16 rounds
+	maskRounds8a [8]maskRounds         // Pre-allocated static array for max 8 rounds (1st AVX2 core)
+	maskRounds8b [8]maskRounds         // Pre-allocated static array for max 8 rounds (2nd AVX2 core)
+	allBufs      []byte                // Preallocated buffer.
+	buffers      chan []byte           // Preallocated buffers, sliced from allBufs.
+}
+
+// NewServer - Create new object for parallel processing handling
+func NewServer() Server {
+	if !cpuid.CPU.AVX2() {
+		return &fallbackServer{}
+	}
+	md5srv := &md5Server{}
+	md5srv.digests = make(map[uint64][Size]byte)
+	md5srv.newInput = make(chan newClient, Lanes)
+	md5srv.cycle = make(chan uint64, Lanes*10)
+	md5srv.uidCounter = md5ServerUID - 1
+	md5srv.allBufs = make([]byte, 32+buffersPerLane*Lanes*internalBlockSize)
+	md5srv.buffers = make(chan []byte, buffersPerLane*Lanes)
+	// Fill buffers.
+	for i := 0; i < buffersPerLane*Lanes; i++ {
+		s := 32 + i*internalBlockSize
+		md5srv.buffers <- md5srv.allBufs[s : s+internalBlockSize : s+internalBlockSize]
+	}
+
+	// Start a single thread for reading from the input channel
+	go md5srv.process(md5srv.newInput)
+	return md5srv
+}
+
+type newClient struct {
+	uid   uint64
+	input chan blockInput
+}
+
+// process - Sole handler for reading from the input channel.
+func (s *md5Server) process(newClients chan newClient) {
+	// To fill up as many lanes as possible:
+	//
+	// 1. Wait for a cycle id.
+	// 2. If not already in a lane, add, otherwise leave on channel
+	// 3. Start timer
+	// 4. Check if lanes is full, if so, goto 10 (process).
+	// 5. If timeout, goto 10.
+	// 6. Wait for new id (goto 2)  or timeout (goto 10).
+	// 10. Process.
+	// 11. Check all input if there is already input, if so add to lanes.
+	// 12. Goto 1
+
+	// lanes contains the lanes.
+	var lanes lanesInfo
+	// lanesFilled contains the number of filled lanes for current cycle.
+	var lanesFilled int
+	// clients contains active clients
+	var clients = make(map[uint64]chan blockInput, Lanes)
+
+	addToLane := func(uid uint64) {
+		cl, ok := clients[uid]
+		if !ok {
+			// Unknown client. Maybe it was already removed.
+			return
+		}
+		// Check if we already have it.
+		for _, lane := range lanes[:lanesFilled] {
+			if lane.uid == uid {
+				return
+			}
+		}
+		// Continue until we get a block or there is nothing on channel
+		for {
+			select {
+			case block, ok := <-cl:
+				if !ok {
+					// Client disconnected
+					delete(clients, block.uid)
+					return
+				}
+				if block.uid != uid {
+					panic(fmt.Errorf("uid mismatch, %d (block) != %d (client)", block.uid, uid))
+				}
+				// If reset message, reset and we're done
+				if block.reset {
+					delete(s.digests, uid)
+					continue
+				}
+
+				// If requesting sum, we will need to maintain state.
+				if block.sumCh != nil {
+					var dig digest
+					d, ok := s.digests[uid]
+					if ok {
+						dig.s[0] = binary.LittleEndian.Uint32(d[0:4])
+						dig.s[1] = binary.LittleEndian.Uint32(d[4:8])
+						dig.s[2] = binary.LittleEndian.Uint32(d[8:12])
+						dig.s[3] = binary.LittleEndian.Uint32(d[12:16])
+					} else {
+						dig.s[0], dig.s[1], dig.s[2], dig.s[3] = init0, init1, init2, init3
+					}
+
+					sum := sumResult{}
+					// Add end block to current digest.
+					blockGeneric(&dig, block.msg)
+
+					binary.LittleEndian.PutUint32(sum.digest[0:], dig.s[0])
+					binary.LittleEndian.PutUint32(sum.digest[4:], dig.s[1])
+					binary.LittleEndian.PutUint32(sum.digest[8:], dig.s[2])
+					binary.LittleEndian.PutUint32(sum.digest[12:], dig.s[3])
+					block.sumCh <- sum
+					if block.msg != nil {
+						s.buffers <- block.msg
+					}
+					continue
+				}
+				if len(block.msg) == 0 {
+					continue
+				}
+				lanes[lanesFilled] = block
+				lanesFilled++
+				return
+			default:
+				return
+			}
+		}
+	}
+	addNewClient := func(cl newClient) {
+		if _, ok := clients[cl.uid]; ok {
+			panic("internal error: duplicate client registration")
+		}
+		clients[cl.uid] = cl.input
+	}
+
+	allLanesFilled := func() bool {
+		return lanesFilled == Lanes || lanesFilled >= len(clients)
+	}
+
+	for {
+		// Step 1.
+		for lanesFilled == 0 {
+			select {
+			case cl, ok := <-newClients:
+				if !ok {
+					return
+				}
+				addNewClient(cl)
+				// Check if it already sent a payload.
+				addToLane(cl.uid)
+				continue
+			case uid := <-s.cycle:
+				addToLane(uid)
+			}
+		}
+
+	fillLanes:
+		for !allLanesFilled() {
+			select {
+			case cl, ok := <-newClients:
+				if !ok {
+					return
+				}
+				addNewClient(cl)
+
+			case uid := <-s.cycle:
+				addToLane(uid)
+			default:
+				// Nothing more queued...
+				break fillLanes
+			}
+		}
+
+		// If we did not fill all lanes, check if there is more waiting
+		if !allLanesFilled() {
+			runtime.Gosched()
+			for uid := range clients {
+				addToLane(uid)
+				if allLanesFilled() {
+					break
+				}
+			}
+		}
+		if false {
+			if !allLanesFilled() {
+				fmt.Println("Not all lanes filled", lanesFilled, "of", len(clients))
+				//pprof.Lookup("goroutine").WriteTo(os.Stdout, 1)
+			} else if true {
+				fmt.Println("all lanes filled")
+			}
+		}
+		// Process the lanes we could collect
+		s.blocks(lanes[:lanesFilled])
+
+		// Clear lanes...
+		lanesFilled = 0
+		// Add all current queued
+		for uid := range clients {
+			addToLane(uid)
+			if allLanesFilled() {
+				break
+			}
+		}
+	}
+}
+
+func (s *md5Server) Close() {
+	if s.newInput != nil {
+		close(s.newInput)
+		s.newInput = nil
+	}
+}
+
+// Invoke assembly and send results back
+func (s *md5Server) blocks(lanes []blockInput) {
+	inputs := [16][]byte{}
+	for i := range lanes {
+		inputs[i] = lanes[i].msg
+	}
+
+	// Collect active digests...
+	state := s.getDigests(lanes)
+	// Process all lanes...
+	s.blockMd5_x16(&state, inputs, len(lanes) <= 8)
+
+	for i, lane := range lanes {
+		uid := lane.uid
+		dig := [Size]byte{}
+		binary.LittleEndian.PutUint32(dig[0:], state.v0[i])
+		binary.LittleEndian.PutUint32(dig[4:], state.v1[i])
+		binary.LittleEndian.PutUint32(dig[8:], state.v2[i])
+		binary.LittleEndian.PutUint32(dig[12:], state.v3[i])
+
+		s.digests[uid] = dig
+		if lane.msg != nil {
+			s.buffers <- lane.msg
+		}
+		lanes[i] = blockInput{}
+	}
+}
+
+func (s *md5Server) getDigests(lanes []blockInput) (d digest16) {
+	for i, lane := range lanes {
+		a, ok := s.digests[lane.uid]
+		if ok {
+			d.v0[i] = binary.LittleEndian.Uint32(a[0:4])
+			d.v1[i] = binary.LittleEndian.Uint32(a[4:8])
+			d.v2[i] = binary.LittleEndian.Uint32(a[8:12])
+			d.v3[i] = binary.LittleEndian.Uint32(a[12:16])
+		} else {
+			d.v0[i] = init0
+			d.v1[i] = init1
+			d.v2[i] = init2
+			d.v3[i] = init3
+		}
+	}
+	return
+}

vendor/github.com/minio/md5-simd/md5-server_fallback.go

+//+build !amd64 appengine !gc noasm
+
+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+package md5simd
+
+// NewServer - Create new object for parallel processing handling
+func NewServer() *fallbackServer {
+	return &fallbackServer{}
+}

vendor/github.com/minio/md5-simd/md5-util_amd64.go

+// Copyright (c) 2020 MinIO Inc. All rights reserved.
+// Use of this source code is governed by a license that can be
+// found in the LICENSE file.
+
+package md5simd
+
+import (
+	"sort"
+)
+
+// Helper struct for sorting blocks based on length
+type lane struct {
+	len uint
+	pos uint
+}
+
+// Helper struct for generating number of rounds in combination with mask for valid lanes
+type maskRounds struct {
+	mask   uint64
+	rounds uint64
+}
+
+func generateMaskAndRounds8(input [8][]byte, mr *[8]maskRounds) (rounds int) {
+	// Sort on blocks length small to large
+	var sorted [8]lane
+	for c, inpt := range input {
+		sorted[c] = lane{uint(len(inpt)), uint(c)}
+	}
+	sort.Slice(sorted[:], func(i, j int) bool { return sorted[i].len < sorted[j].len })
+
+	// Create mask array including 'rounds' (of processing blocks of 64 bytes) between masks
+	m, round := uint64(0xff), uint64(0)
+
+	for _, s := range sorted {
+		if s.len > 0 {
+			if uint64(s.len)>>6 > round {
+				mr[rounds] = maskRounds{m, (uint64(s.len) >> 6) - round}
+				rounds++
+			}
+			round = uint64(s.len) >> 6
+		}
+		m = m & ^(1 << uint(s.pos))
+	}
+	return
+}
+
+func generateMaskAndRounds16(input [16][]byte, mr *[16]maskRounds) (rounds int) {
+
+	// Sort on blocks length small to large
+	var sorted [16]lane
+	for c, inpt := range input {
+		sorted[c] = lane{uint(len(inpt)), uint(c)}
+	}
+	sort.Slice(sorted[:], func(i, j int) bool { return sorted[i].len < sorted[j].len })
+
+	// Create mask array including 'rounds' (of processing blocks of 64 bytes) between masks
+	m, round := uint64(0xffff), uint64(0)
+
+	for _, s := range sorted {
+		if s.len > 0 {
+			if uint64(s.len)>>6 > round {
+				mr[rounds] = maskRounds{m, (uint64(s.len) >> 6) - round}
+				rounds++
+			}
+			round = uint64(s.len) >> 6
+		}
+		m = m & ^(1 << uint(s.pos))
+	}
+	return
+}

vendor/github.com/minio/md5-simd/md5.go

+package md5simd
+
+import (
+	"crypto/md5"
+	"hash"
+	"sync"
+)
+
+const (
+	// The blocksize of MD5 in bytes.
+	BlockSize = 64
+
+	// The size of an MD5 checksum in bytes.
+	Size = 16
+
+	// internalBlockSize is the internal block size.
+	internalBlockSize = 32 << 10
+)
+
+type Server interface {
+	NewHash() Hasher
+	Close()
+}
+
+type Hasher interface {
+	hash.Hash
+	Close()
+}
+
+// md5Wrapper is a wrapper around the builtin hasher.
+type md5Wrapper struct {
+	hash.Hash
+}
+
+var md5Pool = sync.Pool{New: func() interface{} {
+	return md5.New()
+}}
+
+// fallbackServer - Fallback when no assembly is available.
+type fallbackServer struct {
+}
+
+// NewHash -- return regular Golang md5 hashing from crypto
+func (s *fallbackServer) NewHash() Hasher {
+	return &md5Wrapper{Hash: md5Pool.New().(hash.Hash)}
+}
+
+func (s *fallbackServer) Close() {
+}
+
+func (m *md5Wrapper) Close() {
+	if m.Hash != nil {
+		m.Reset()
+		md5Pool.Put(m.Hash)
+		m.Hash = nil
+	}
+}

vendor/github.com/minio/minio-go/v7/.gitignore

+*~
+*.test
+validator
+golangci-lint
\ No newline at end of file

vendor/github.com/minio/minio-go/v7/.golangci.yml

+linters-settings:
+  misspell:
+    locale: US
+
+linters:
+  disable-all: true
+  enable:
+    - typecheck
+    - goimports
+    - misspell
+    - govet
+    - golint
+    - ineffassign
+    - gosimple
+    - deadcode
+    - structcheck

vendor/github.com/minio/minio-go/v7/CNAME

+minio-go.min.io
\ No newline at end of file

vendor/github.com/minio/minio-go/v7/CONTRIBUTING.md

+
+###  Developer Guidelines
+
+``minio-go`` welcomes your contribution. To make the process as seamless as possible, we ask for the following:
+
+* Go ahead and fork the project and make your changes. We encourage pull requests to discuss code changes.
+    - Fork it
+    - Create your feature branch (git checkout -b my-new-feature)
+    - Commit your changes (git commit -am 'Add some feature')
+    - Push to the branch (git push origin my-new-feature)
+    - Create new Pull Request
+
+* When you're ready to create a pull request, be sure to:
+    - Have test cases for the new code. If you have questions about how to do it, please ask in your pull request.
+    - Run `go fmt`
+    - Squash your commits into a single commit. `git rebase -i`. It's okay to force update your pull request.
+    - Make sure `go test -race ./...` and `go build` completes.
+      NOTE: go test runs functional tests and requires you to have a AWS S3 account. Set them as environment variables
+      ``ACCESS_KEY`` and ``SECRET_KEY``. To run shorter version of the tests please use ``go test -short -race ./...``
+
+* Read [Effective Go](https://github.com/golang/go/wiki/CodeReviewComments) article from Golang project
+    - `minio-go` project is strictly conformant with Golang style
+    - if you happen to observe offending code, please feel free to send a pull request

vendor/github.com/minio/minio-go/v7/MAINTAINERS.md

+# For maintainers only
+
+## Responsibilities
+
+Please go through this link [Maintainer Responsibility](https://gist.github.com/abperiasamy/f4d9b31d3186bbd26522)
+
+### Making new releases
+Tag and sign your release commit, additionally this step requires you to have access to MinIO's trusted private key.
+```sh
+$ export GNUPGHOME=/media/${USER}/minio/trusted
+$ git tag -s 4.0.0
+$ git push
+$ git push --tags
+```
+
+### Update version
+Once release has been made update `libraryVersion` constant in `api.go` to next to be released version.
+
+```sh
+$ grep libraryVersion api.go
+      libraryVersion = "4.0.1"
+```
+
+Commit your changes
+```
+$ git commit -a -m "Update version for next release" --author "MinIO Trusted <trusted@min.io>"
+```
+
+### Announce
+Announce new release by adding release notes at https://github.com/minio/minio-go/releases from `trusted@min.io` account. Release notes requires two sections `highlights` and `changelog`. Highlights is a bulleted list of salient features in this release and Changelog contains list of all commits since the last release.
+
+To generate `changelog`
+```sh
+$ git log --no-color --pretty=format:'-%d %s (%cr) <%an>' <last_release_tag>..<latest_release_tag>
+```

vendor/github.com/minio/minio-go/v7/Makefile

+GOPATH := $(shell go env GOPATH)
+TMPDIR := $(shell mktemp -d)
+
+all: checks
+
+.PHONY: examples docs
+
+checks: lint vet test examples functional-test
+
+lint:
+	@mkdir -p ${GOPATH}/bin
+	@which golangci-lint 1>/dev/null || (echo "Installing golangci-lint" && curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin v1.27.0)
+	@echo "Running $@ check"
+	@GO111MODULE=on ${GOPATH}/bin/golangci-lint cache clean
+	@GO111MODULE=on ${GOPATH}/bin/golangci-lint run --timeout=5m --config ./.golangci.yml
+
+vet:
+	@GO111MODULE=on go vet ./...
+
+test:
+	@GO111MODULE=on SERVER_ENDPOINT=localhost:9000 ACCESS_KEY=minio SECRET_KEY=minio123 ENABLE_HTTPS=1 MINT_MODE=full go test -race -v ./...
+
+examples:
+	@$(foreach v,$(wildcard examples/s3/*), go build -o ${TMPDIR}/$(basename $(v)) $(v) || exit 1;)
+
+functional-test:
+	@GO111MODULE=on SERVER_ENDPOINT=localhost:9000 ACCESS_KEY=minio SECRET_KEY=minio123 ENABLE_HTTPS=1 MINT_MODE=full go run functional_tests.go
+
+clean:
+	@echo "Cleaning up all the generated files"
+	@find . -name '*.test' | xargs rm -fv
+	@find . -name '*~' | xargs rm -fv

vendor/github.com/minio/minio-go/v7/NOTICE

+MinIO Cloud Storage, (C) 2014-2020 MinIO, Inc.
+
+This product includes software developed at MinIO, Inc.
+(https://min.io/).
+
+The MinIO project contains unmodified/modified subcomponents too with
+separate copyright notices and license terms. Your use of the source
+code for these subcomponents is subject to the terms and conditions
+of Apache License Version 2.0

vendor/github.com/minio/minio-go/v7/api-bucket-encryption.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+	"github.com/minio/minio-go/v7/pkg/sse"
+)
+
+// SetBucketEncryption sets the default encryption configuration on an existing bucket.
+func (c Client) SetBucketEncryption(ctx context.Context, bucketName string, config *sse.Configuration) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	if config == nil {
+		return errInvalidArgument("configuration cannot be empty")
+	}
+
+	buf, err := xml.Marshal(config)
+	if err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("encryption", "")
+
+	// Content-length is mandatory to set a default encryption configuration
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      bytes.NewReader(buf),
+		contentLength:    int64(len(buf)),
+		contentMD5Base64: sumMD5Base64(buf),
+	}
+
+	// Execute PUT to upload a new bucket default encryption configuration.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return httpRespToErrorResponse(resp, bucketName, "")
+	}
+	return nil
+}
+
+// RemoveBucketEncryption removes the default encryption configuration on a bucket with a context to control cancellations and timeouts.
+func (c Client) RemoveBucketEncryption(ctx context.Context, bucketName string) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("encryption", "")
+
+	// DELETE default encryption configuration on a bucket.
+	resp, err := c.executeMethod(ctx, http.MethodDelete, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		return httpRespToErrorResponse(resp, bucketName, "")
+	}
+	return nil
+}
+
+// GetBucketEncryption gets the default encryption configuration
+// on an existing bucket with a context to control cancellations and timeouts.
+func (c Client) GetBucketEncryption(ctx context.Context, bucketName string) (*sse.Configuration, error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return nil, err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("encryption", "")
+
+	// Execute GET on bucket to get the default encryption configuration.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:  bucketName,
+		queryValues: urlValues,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, httpRespToErrorResponse(resp, bucketName, "")
+	}
+
+	encryptionConfig := &sse.Configuration{}
+	if err = xmlDecoder(resp.Body, encryptionConfig); err != nil {
+		return nil, err
+	}
+
+	return encryptionConfig, nil
+}

vendor/github.com/minio/minio-go/v7/api-bucket-lifecycle.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+
+	"github.com/minio/minio-go/v7/pkg/lifecycle"
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// SetBucketLifecycle set the lifecycle on an existing bucket.
+func (c Client) SetBucketLifecycle(ctx context.Context, bucketName string, config *lifecycle.Configuration) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// If lifecycle is empty then delete it.
+	if config.Empty() {
+		return c.removeBucketLifecycle(ctx, bucketName)
+	}
+
+	buf, err := xml.Marshal(config)
+	if err != nil {
+		return err
+	}
+
+	// Save the updated lifecycle.
+	return c.putBucketLifecycle(ctx, bucketName, buf)
+}
+
+// Saves a new bucket lifecycle.
+func (c Client) putBucketLifecycle(ctx context.Context, bucketName string, buf []byte) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("lifecycle", "")
+
+	// Content-length is mandatory for put lifecycle request
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      bytes.NewReader(buf),
+		contentLength:    int64(len(buf)),
+		contentMD5Base64: sumMD5Base64(buf),
+	}
+
+	// Execute PUT to upload a new bucket lifecycle.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp != nil {
+		if resp.StatusCode != http.StatusOK {
+			return httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+	return nil
+}
+
+// Remove lifecycle from a bucket.
+func (c Client) removeBucketLifecycle(ctx context.Context, bucketName string) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("lifecycle", "")
+
+	// Execute DELETE on objectName.
+	resp, err := c.executeMethod(ctx, http.MethodDelete, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetBucketLifecycle fetch bucket lifecycle configuration
+func (c Client) GetBucketLifecycle(ctx context.Context, bucketName string) (*lifecycle.Configuration, error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return nil, err
+	}
+
+	bucketLifecycle, err := c.getBucketLifecycle(ctx, bucketName)
+	if err != nil {
+		return nil, err
+	}
+
+	config := lifecycle.NewConfiguration()
+	if err = xml.Unmarshal(bucketLifecycle, config); err != nil {
+		return nil, err
+	}
+	return config, nil
+}
+
+// Request server for current bucket lifecycle.
+func (c Client) getBucketLifecycle(ctx context.Context, bucketName string) ([]byte, error) {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("lifecycle", "")
+
+	// Execute GET on bucket to get lifecycle.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:  bucketName,
+		queryValues: urlValues,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp != nil {
+		if resp.StatusCode != http.StatusOK {
+			return nil, httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+
+	return ioutil.ReadAll(resp.Body)
+}

vendor/github.com/minio/minio-go/v7/api-bucket-notification.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2017-2020 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+	"time"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/minio/minio-go/v7/pkg/notification"
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// SetBucketNotification saves a new bucket notification with a context to control cancellations and timeouts.
+func (c Client) SetBucketNotification(ctx context.Context, bucketName string, config notification.Configuration) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("notification", "")
+
+	notifBytes, err := xml.Marshal(&config)
+	if err != nil {
+		return err
+	}
+
+	notifBuffer := bytes.NewReader(notifBytes)
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      notifBuffer,
+		contentLength:    int64(len(notifBytes)),
+		contentMD5Base64: sumMD5Base64(notifBytes),
+		contentSHA256Hex: sum256Hex(notifBytes),
+	}
+
+	// Execute PUT to upload a new bucket notification.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp != nil {
+		if resp.StatusCode != http.StatusOK {
+			return httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+	return nil
+}
+
+// RemoveAllBucketNotification - Remove bucket notification clears all previously specified config
+func (c Client) RemoveAllBucketNotification(ctx context.Context, bucketName string) error {
+	return c.SetBucketNotification(ctx, bucketName, notification.Configuration{})
+}
+
+// GetBucketNotification returns current bucket notification configuration
+func (c Client) GetBucketNotification(ctx context.Context, bucketName string) (bucketNotification notification.Configuration, err error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return notification.Configuration{}, err
+	}
+	return c.getBucketNotification(ctx, bucketName)
+}
+
+// Request server for notification rules.
+func (c Client) getBucketNotification(ctx context.Context, bucketName string) (notification.Configuration, error) {
+	urlValues := make(url.Values)
+	urlValues.Set("notification", "")
+
+	// Execute GET on bucket to list objects.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return notification.Configuration{}, err
+	}
+	return processBucketNotificationResponse(bucketName, resp)
+
+}
+
+// processes the GetNotification http response from the server.
+func processBucketNotificationResponse(bucketName string, resp *http.Response) (notification.Configuration, error) {
+	if resp.StatusCode != http.StatusOK {
+		errResponse := httpRespToErrorResponse(resp, bucketName, "")
+		return notification.Configuration{}, errResponse
+	}
+	var bucketNotification notification.Configuration
+	err := xmlDecoder(resp.Body, &bucketNotification)
+	if err != nil {
+		return notification.Configuration{}, err
+	}
+	return bucketNotification, nil
+}
+
+// ListenNotification listen for all events, this is a MinIO specific API
+func (c Client) ListenNotification(ctx context.Context, prefix, suffix string, events []string) <-chan notification.Info {
+	return c.ListenBucketNotification(ctx, "", prefix, suffix, events)
+}
+
+// ListenBucketNotification listen for bucket events, this is a MinIO specific API
+func (c Client) ListenBucketNotification(ctx context.Context, bucketName, prefix, suffix string, events []string) <-chan notification.Info {
+	notificationInfoCh := make(chan notification.Info, 1)
+	const notificationCapacity = 4 * 1024 * 1024
+	notificationEventBuffer := make([]byte, notificationCapacity)
+	// Only success, start a routine to start reading line by line.
+	go func(notificationInfoCh chan<- notification.Info) {
+		defer close(notificationInfoCh)
+
+		// Validate the bucket name.
+		if bucketName != "" {
+			if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+				select {
+				case notificationInfoCh <- notification.Info{
+					Err: err,
+				}:
+				case <-ctx.Done():
+				}
+				return
+			}
+		}
+
+		// Check ARN partition to verify if listening bucket is supported
+		if s3utils.IsAmazonEndpoint(*c.endpointURL) || s3utils.IsGoogleEndpoint(*c.endpointURL) {
+			select {
+			case notificationInfoCh <- notification.Info{
+				Err: errAPINotSupported("Listening for bucket notification is specific only to `minio` server endpoints"),
+			}:
+			case <-ctx.Done():
+			}
+			return
+		}
+
+		// Continuously run and listen on bucket notification.
+		// Create a done channel to control 'ListObjects' go routine.
+		retryDoneCh := make(chan struct{}, 1)
+
+		// Indicate to our routine to exit cleanly upon return.
+		defer close(retryDoneCh)
+
+		// Prepare urlValues to pass into the request on every loop
+		urlValues := make(url.Values)
+		urlValues.Set("prefix", prefix)
+		urlValues.Set("suffix", suffix)
+		urlValues["events"] = events
+
+		// Wait on the jitter retry loop.
+		for range c.newRetryTimerContinous(time.Second, time.Second*30, MaxJitter, retryDoneCh) {
+			// Execute GET on bucket to list objects.
+			resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+				bucketName:       bucketName,
+				queryValues:      urlValues,
+				contentSHA256Hex: emptySHA256Hex,
+			})
+			if err != nil {
+				select {
+				case notificationInfoCh <- notification.Info{
+					Err: err,
+				}:
+				case <-ctx.Done():
+				}
+				return
+			}
+
+			// Validate http response, upon error return quickly.
+			if resp.StatusCode != http.StatusOK {
+				errResponse := httpRespToErrorResponse(resp, bucketName, "")
+				select {
+				case notificationInfoCh <- notification.Info{
+					Err: errResponse,
+				}:
+				case <-ctx.Done():
+				}
+				return
+			}
+
+			// Initialize a new bufio scanner, to read line by line.
+			bio := bufio.NewScanner(resp.Body)
+
+			// Use a higher buffer to support unexpected
+			// caching done by proxies
+			bio.Buffer(notificationEventBuffer, notificationCapacity)
+			var json = jsoniter.ConfigCompatibleWithStandardLibrary
+
+			// Unmarshal each line, returns marshaled values.
+			for bio.Scan() {
+				var notificationInfo notification.Info
+				if err = json.Unmarshal(bio.Bytes(), &notificationInfo); err != nil {
+					// Unexpected error during json unmarshal, send
+					// the error to caller for actionable as needed.
+					select {
+					case notificationInfoCh <- notification.Info{
+						Err: err,
+					}:
+					case <-ctx.Done():
+						return
+					}
+					closeResponse(resp)
+					continue
+				}
+				// Send notificationInfo
+				select {
+				case notificationInfoCh <- notificationInfo:
+				case <-ctx.Done():
+					closeResponse(resp)
+					return
+				}
+			}
+
+			if err = bio.Err(); err != nil {
+				select {
+				case notificationInfoCh <- notification.Info{
+					Err: err,
+				}:
+				case <-ctx.Done():
+					return
+				}
+			}
+
+			// Close current connection before looping further.
+			closeResponse(resp)
+
+		}
+	}(notificationInfoCh)
+
+	// Returns the notification info channel, for caller to start reading from.
+	return notificationInfoCh
+}

vendor/github.com/minio/minio-go/v7/api-bucket-policy.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"context"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// SetBucketPolicy sets the access permissions on an existing bucket.
+func (c Client) SetBucketPolicy(ctx context.Context, bucketName, policy string) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// If policy is empty then delete the bucket policy.
+	if policy == "" {
+		return c.removeBucketPolicy(ctx, bucketName)
+	}
+
+	// Save the updated policies.
+	return c.putBucketPolicy(ctx, bucketName, policy)
+}
+
+// Saves a new bucket policy.
+func (c Client) putBucketPolicy(ctx context.Context, bucketName, policy string) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("policy", "")
+
+	reqMetadata := requestMetadata{
+		bucketName:    bucketName,
+		queryValues:   urlValues,
+		contentBody:   strings.NewReader(policy),
+		contentLength: int64(len(policy)),
+	}
+
+	// Execute PUT to upload a new bucket policy.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp != nil {
+		if resp.StatusCode != http.StatusNoContent {
+			return httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+	return nil
+}
+
+// Removes all policies on a bucket.
+func (c Client) removeBucketPolicy(ctx context.Context, bucketName string) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("policy", "")
+
+	// Execute DELETE on objectName.
+	resp, err := c.executeMethod(ctx, http.MethodDelete, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetBucketPolicy returns the current policy
+func (c Client) GetBucketPolicy(ctx context.Context, bucketName string) (string, error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return "", err
+	}
+	bucketPolicy, err := c.getBucketPolicy(ctx, bucketName)
+	if err != nil {
+		errResponse := ToErrorResponse(err)
+		if errResponse.Code == "NoSuchBucketPolicy" {
+			return "", nil
+		}
+		return "", err
+	}
+	return bucketPolicy, nil
+}
+
+// Request server for current bucket policy.
+func (c Client) getBucketPolicy(ctx context.Context, bucketName string) (string, error) {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("policy", "")
+
+	// Execute GET on bucket to list objects.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return "", err
+	}
+
+	if resp != nil {
+		if resp.StatusCode != http.StatusOK {
+			return "", httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+
+	bucketPolicyBuf, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	policy := string(bucketPolicyBuf)
+	return policy, err
+}

vendor/github.com/minio/minio-go/v7/api-bucket-replication.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+
+	"github.com/minio/minio-go/v7/pkg/replication"
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// RemoveBucketReplication removes a replication config on an existing bucket.
+func (c Client) RemoveBucketReplication(ctx context.Context, bucketName string) error {
+	return c.removeBucketReplication(ctx, bucketName)
+}
+
+// SetBucketReplication sets a replication config on an existing bucket.
+func (c Client) SetBucketReplication(ctx context.Context, bucketName string, cfg replication.Config) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// If replication is empty then delete it.
+	if cfg.Empty() {
+		return c.removeBucketReplication(ctx, bucketName)
+	}
+	// Save the updated replication.
+	return c.putBucketReplication(ctx, bucketName, cfg)
+}
+
+// Saves a new bucket replication.
+func (c Client) putBucketReplication(ctx context.Context, bucketName string, cfg replication.Config) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("replication", "")
+	replication, err := xml.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      bytes.NewReader(replication),
+		contentLength:    int64(len(replication)),
+		contentMD5Base64: sumMD5Base64(replication),
+	}
+
+	// Execute PUT to upload a new bucket replication config.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return httpRespToErrorResponse(resp, bucketName, "")
+	}
+
+	return nil
+}
+
+// Remove replication from a bucket.
+func (c Client) removeBucketReplication(ctx context.Context, bucketName string) error {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("replication", "")
+
+	// Execute DELETE on objectName.
+	resp, err := c.executeMethod(ctx, http.MethodDelete, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetBucketReplication fetches bucket replication configuration.If config is not
+// found, returns empty config with nil error.
+func (c Client) GetBucketReplication(ctx context.Context, bucketName string) (cfg replication.Config, err error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return cfg, err
+	}
+	bucketReplicationCfg, err := c.getBucketReplication(ctx, bucketName)
+	if err != nil {
+		errResponse := ToErrorResponse(err)
+		if errResponse.Code == "ReplicationConfigurationNotFoundError" {
+			return cfg, nil
+		}
+		return cfg, err
+	}
+	return bucketReplicationCfg, nil
+}
+
+// Request server for current bucket replication config.
+func (c Client) getBucketReplication(ctx context.Context, bucketName string) (cfg replication.Config, err error) {
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("replication", "")
+
+	// Execute GET on bucket to get replication config.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:  bucketName,
+		queryValues: urlValues,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return cfg, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return cfg, httpRespToErrorResponse(resp, bucketName, "")
+	}
+
+	if err = xmlDecoder(resp.Body, &cfg); err != nil {
+		return cfg, err
+	}
+
+	return cfg, nil
+}

vendor/github.com/minio/minio-go/v7/api-bucket-tagging.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"errors"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+	"github.com/minio/minio-go/v7/pkg/tags"
+)
+
+// GetBucketTagging fetch tagging configuration for a bucket with a
+// context to control cancellations and timeouts.
+func (c Client) GetBucketTagging(ctx context.Context, bucketName string) (*tags.Tags, error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return nil, err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("tagging", "")
+
+	// Execute GET on bucket to get tagging configuration.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:  bucketName,
+		queryValues: urlValues,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, httpRespToErrorResponse(resp, bucketName, "")
+	}
+
+	defer io.Copy(ioutil.Discard, resp.Body)
+	return tags.ParseBucketXML(resp.Body)
+}
+
+// SetBucketTagging sets tagging configuration for a bucket
+// with a context to control cancellations and timeouts.
+func (c Client) SetBucketTagging(ctx context.Context, bucketName string, tags *tags.Tags) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	if tags == nil {
+		return errors.New("nil tags passed")
+	}
+
+	buf, err := xml.Marshal(tags)
+	if err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("tagging", "")
+
+	// Content-length is mandatory to set a default encryption configuration
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      bytes.NewReader(buf),
+		contentLength:    int64(len(buf)),
+		contentMD5Base64: sumMD5Base64(buf),
+	}
+
+	// Execute PUT on bucket to put tagging configuration.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		return httpRespToErrorResponse(resp, bucketName, "")
+	}
+	return nil
+}
+
+// RemoveBucketTagging removes tagging configuration for a
+// bucket with a context to control cancellations and timeouts.
+func (c Client) RemoveBucketTagging(ctx context.Context, bucketName string) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("tagging", "")
+
+	// Execute DELETE on bucket to remove tagging configuration.
+	resp, err := c.executeMethod(ctx, http.MethodDelete, requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentSHA256Hex: emptySHA256Hex,
+	})
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusNoContent {
+		return httpRespToErrorResponse(resp, bucketName, "")
+	}
+	return nil
+}

vendor/github.com/minio/minio-go/v7/api-bucket-versioning.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2020 MinIO, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"bytes"
+	"context"
+	"encoding/xml"
+	"net/http"
+	"net/url"
+
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// SetBucketVersioning sets a bucket versioning configuration
+func (c Client) SetBucketVersioning(ctx context.Context, bucketName string, config BucketVersioningConfiguration) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+
+	buf, err := xml.Marshal(config)
+	if err != nil {
+		return err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("versioning", "")
+
+	reqMetadata := requestMetadata{
+		bucketName:       bucketName,
+		queryValues:      urlValues,
+		contentBody:      bytes.NewReader(buf),
+		contentLength:    int64(len(buf)),
+		contentMD5Base64: sumMD5Base64(buf),
+		contentSHA256Hex: sum256Hex(buf),
+	}
+
+	// Execute PUT to set a bucket versioning.
+	resp, err := c.executeMethod(ctx, http.MethodPut, reqMetadata)
+	defer closeResponse(resp)
+	if err != nil {
+		return err
+	}
+	if resp != nil {
+		if resp.StatusCode != http.StatusOK {
+			return httpRespToErrorResponse(resp, bucketName, "")
+		}
+	}
+	return nil
+}
+
+// EnableVersioning - enable object versioning in given bucket.
+func (c Client) EnableVersioning(ctx context.Context, bucketName string) error {
+	return c.SetBucketVersioning(ctx, bucketName, BucketVersioningConfiguration{Status: "Enabled"})
+}
+
+// SuspendVersioning - suspend object versioning in given bucket.
+func (c Client) SuspendVersioning(ctx context.Context, bucketName string) error {
+	return c.SetBucketVersioning(ctx, bucketName, BucketVersioningConfiguration{Status: "Suspended"})
+}
+
+// BucketVersioningConfiguration is the versioning configuration structure
+type BucketVersioningConfiguration struct {
+	XMLName   xml.Name `xml:"VersioningConfiguration"`
+	Status    string   `xml:"Status"`
+	MFADelete string   `xml:"MfaDelete,omitempty"`
+}
+
+// Various supported states
+const (
+	Enabled = "Enabled"
+	// Disabled  State = "Disabled" only used by MFA Delete not supported yet.
+	Suspended = "Suspended"
+)
+
+// Enabled returns true if bucket versioning is enabled
+func (b BucketVersioningConfiguration) Enabled() bool {
+	return b.Status == Enabled
+}
+
+// Suspended returns true if bucket versioning is suspended
+func (b BucketVersioningConfiguration) Suspended() bool {
+	return b.Status == Suspended
+}
+
+// GetBucketVersioning gets the versioning configuration on
+// an existing bucket with a context to control cancellations and timeouts.
+func (c Client) GetBucketVersioning(ctx context.Context, bucketName string) (BucketVersioningConfiguration, error) {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return BucketVersioningConfiguration{}, err
+	}
+
+	// Get resources properly escaped and lined up before
+	// using them in http request.
+	urlValues := make(url.Values)
+	urlValues.Set("versioning", "")
+
+	// Execute GET on bucket to get the versioning configuration.
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName:  bucketName,
+		queryValues: urlValues,
+	})
+
+	defer closeResponse(resp)
+	if err != nil {
+		return BucketVersioningConfiguration{}, err
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return BucketVersioningConfiguration{}, httpRespToErrorResponse(resp, bucketName, "")
+	}
+
+	versioningConfig := BucketVersioningConfiguration{}
+	if err = xmlDecoder(resp.Body, &versioningConfig); err != nil {
+		return versioningConfig, err
+	}
+
+	return versioningConfig, nil
+}

vendor/github.com/minio/minio-go/v7/api-datatypes.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2020 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"encoding/xml"
+	"io"
+	"net/http"
+	"time"
+)
+
+// BucketInfo container for bucket metadata.
+type BucketInfo struct {
+	// The name of the bucket.
+	Name string `json:"name"`
+	// Date the bucket was created.
+	CreationDate time.Time `json:"creationDate"`
+}
+
+// StringMap represents map with custom UnmarshalXML
+type StringMap map[string]string
+
+// UnmarshalXML unmarshals the XML into a map of string to strings,
+// creating a key in the map for each tag and setting it's value to the
+// tags contents.
+//
+// The fact this function is on the pointer of Map is important, so that
+// if m is nil it can be initialized, which is often the case if m is
+// nested in another xml structural. This is also why the first thing done
+// on the first line is initialize it.
+func (m *StringMap) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	*m = StringMap{}
+	type xmlMapEntry struct {
+		XMLName xml.Name
+		Value   string `xml:",chardata"`
+	}
+	for {
+		var e xmlMapEntry
+		err := d.Decode(&e)
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return err
+		}
+		(*m)[e.XMLName.Local] = e.Value
+	}
+	return nil
+}
+
+// Owner name.
+type Owner struct {
+	DisplayName string `json:"name"`
+	ID          string `json:"id"`
+}
+
+// UploadInfo contains information about the
+// newly uploaded or copied object.
+type UploadInfo struct {
+	Bucket       string
+	Key          string
+	ETag         string
+	Size         int64
+	LastModified time.Time
+	Location     string
+	VersionID    string
+
+	// Lifecycle expiry-date and ruleID associated with the expiry
+	// not to be confused with `Expires` HTTP header.
+	Expiration       time.Time
+	ExpirationRuleID string
+}
+
+// ObjectInfo container for object metadata.
+type ObjectInfo struct {
+	// An ETag is optionally set to md5sum of an object.  In case of multipart objects,
+	// ETag is of the form MD5SUM-N where MD5SUM is md5sum of all individual md5sums of
+	// each parts concatenated into one string.
+	ETag string `json:"etag"`
+
+	Key          string    `json:"name"`         // Name of the object
+	LastModified time.Time `json:"lastModified"` // Date and time the object was last modified.
+	Size         int64     `json:"size"`         // Size in bytes of the object.
+	ContentType  string    `json:"contentType"`  // A standard MIME type describing the format of the object data.
+	Expires      time.Time `json:"expires"`      // The date and time at which the object is no longer able to be cached.
+
+	// Collection of additional metadata on the object.
+	// eg: x-amz-meta-*, content-encoding etc.
+	Metadata http.Header `json:"metadata" xml:"-"`
+
+	// x-amz-meta-* headers stripped "x-amz-meta-" prefix containing the first value.
+	UserMetadata StringMap `json:"userMetadata"`
+
+	// x-amz-tagging values in their k/v values.
+	UserTags map[string]string `json:"userTags"`
+
+	// x-amz-tagging-count value
+	UserTagCount int
+
+	// Owner name.
+	Owner Owner
+
+	// ACL grant.
+	Grant []struct {
+		Grantee struct {
+			ID          string `xml:"ID"`
+			DisplayName string `xml:"DisplayName"`
+			URI         string `xml:"URI"`
+		} `xml:"Grantee"`
+		Permission string `xml:"Permission"`
+	} `xml:"Grant"`
+
+	// The class of storage used to store the object.
+	StorageClass string `json:"storageClass"`
+
+	// Versioning related information
+	IsLatest       bool
+	IsDeleteMarker bool
+	VersionID      string `xml:"VersionId"`
+
+	// x-amz-replication-status value is either in one of the following states
+	// - COMPLETE
+	// - PENDING
+	// - FAILED
+	// - REPLICA (on the destination)
+	ReplicationStatus string `xml:"ReplicationStatus"`
+
+	// Lifecycle expiry-date and ruleID associated with the expiry
+	// not to be confused with `Expires` HTTP header.
+	Expiration       time.Time
+	ExpirationRuleID string
+
+	// Error
+	Err error `json:"-"`
+}
+
+// ObjectMultipartInfo container for multipart object metadata.
+type ObjectMultipartInfo struct {
+	// Date and time at which the multipart upload was initiated.
+	Initiated time.Time `type:"timestamp" timestampFormat:"iso8601"`
+
+	Initiator initiator
+	Owner     owner
+
+	// The type of storage to use for the object. Defaults to 'STANDARD'.
+	StorageClass string
+
+	// Key of the object for which the multipart upload was initiated.
+	Key string
+
+	// Size in bytes of the object.
+	Size int64
+
+	// Upload ID that identifies the multipart upload.
+	UploadID string `xml:"UploadId"`
+
+	// Error
+	Err error
+}

vendor/github.com/minio/minio-go/v7/api-error-response.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2020 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"encoding/xml"
+	"fmt"
+	"net/http"
+)
+
+/* **** SAMPLE ERROR RESPONSE ****
+<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+   <Code>AccessDenied</Code>
+   <Message>Access Denied</Message>
+   <BucketName>bucketName</BucketName>
+   <Key>objectName</Key>
+   <RequestId>F19772218238A85A</RequestId>
+   <HostId>GuWkjyviSiGHizehqpmsD1ndz5NClSP19DOT+s2mv7gXGQ8/X1lhbDGiIJEXpGFD</HostId>
+</Error>
+*/
+
+// ErrorResponse - Is the typed error returned by all API operations.
+// ErrorResponse struct should be comparable since it is compared inside
+// golang http API (https://github.com/golang/go/issues/29768)
+type ErrorResponse struct {
+	XMLName    xml.Name `xml:"Error" json:"-"`
+	Code       string
+	Message    string
+	BucketName string
+	Key        string
+	RequestID  string `xml:"RequestId"`
+	HostID     string `xml:"HostId"`
+
+	// Region where the bucket is located. This header is returned
+	// only in HEAD bucket and ListObjects response.
+	Region string
+
+	// Captures the server string returned in response header.
+	Server string
+
+	// Underlying HTTP status code for the returned error
+	StatusCode int `xml:"-" json:"-"`
+}
+
+// ToErrorResponse - Returns parsed ErrorResponse struct from body and
+// http headers.
+//
+// For example:
+//
+//   import s3 "github.com/minio/minio-go/v7"
+//   ...
+//   ...
+//   reader, stat, err := s3.GetObject(...)
+//   if err != nil {
+//      resp := s3.ToErrorResponse(err)
+//   }
+//   ...
+func ToErrorResponse(err error) ErrorResponse {
+	switch err := err.(type) {
+	case ErrorResponse:
+		return err
+	default:
+		return ErrorResponse{}
+	}
+}
+
+// Error - Returns S3 error string.
+func (e ErrorResponse) Error() string {
+	if e.Message == "" {
+		msg, ok := s3ErrorResponseMap[e.Code]
+		if !ok {
+			msg = fmt.Sprintf("Error response code %s.", e.Code)
+		}
+		return msg
+	}
+	return e.Message
+}
+
+// Common string for errors to report issue location in unexpected
+// cases.
+const (
+	reportIssue = "Please report this issue at https://github.com/minio/minio-go/issues."
+)
+
+// httpRespToErrorResponse returns a new encoded ErrorResponse
+// structure as error.
+func httpRespToErrorResponse(resp *http.Response, bucketName, objectName string) error {
+	if resp == nil {
+		msg := "Empty http response. " + reportIssue
+		return errInvalidArgument(msg)
+	}
+
+	errResp := ErrorResponse{
+		StatusCode: resp.StatusCode,
+		Server:     resp.Header.Get("Server"),
+	}
+
+	err := xmlDecoder(resp.Body, &errResp)
+	// Xml decoding failed with no body, fall back to HTTP headers.
+	if err != nil {
+		switch resp.StatusCode {
+		case http.StatusNotFound:
+			if objectName == "" {
+				errResp = ErrorResponse{
+					StatusCode: resp.StatusCode,
+					Code:       "NoSuchBucket",
+					Message:    "The specified bucket does not exist.",
+					BucketName: bucketName,
+				}
+			} else {
+				errResp = ErrorResponse{
+					StatusCode: resp.StatusCode,
+					Code:       "NoSuchKey",
+					Message:    "The specified key does not exist.",
+					BucketName: bucketName,
+					Key:        objectName,
+				}
+			}
+		case http.StatusForbidden:
+			errResp = ErrorResponse{
+				StatusCode: resp.StatusCode,
+				Code:       "AccessDenied",
+				Message:    "Access Denied.",
+				BucketName: bucketName,
+				Key:        objectName,
+			}
+		case http.StatusConflict:
+			errResp = ErrorResponse{
+				StatusCode: resp.StatusCode,
+				Code:       "Conflict",
+				Message:    "Bucket not empty.",
+				BucketName: bucketName,
+			}
+		case http.StatusPreconditionFailed:
+			errResp = ErrorResponse{
+				StatusCode: resp.StatusCode,
+				Code:       "PreconditionFailed",
+				Message:    s3ErrorResponseMap["PreconditionFailed"],
+				BucketName: bucketName,
+				Key:        objectName,
+			}
+		default:
+			errResp = ErrorResponse{
+				StatusCode: resp.StatusCode,
+				Code:       resp.Status,
+				Message:    resp.Status,
+				BucketName: bucketName,
+			}
+		}
+	}
+
+	// Save hostID, requestID and region information
+	// from headers if not available through error XML.
+	if errResp.RequestID == "" {
+		errResp.RequestID = resp.Header.Get("x-amz-request-id")
+	}
+	if errResp.HostID == "" {
+		errResp.HostID = resp.Header.Get("x-amz-id-2")
+	}
+	if errResp.Region == "" {
+		errResp.Region = resp.Header.Get("x-amz-bucket-region")
+	}
+	if errResp.Code == "InvalidRegion" && errResp.Region != "" {
+		errResp.Message = fmt.Sprintf("Region does not match, expecting region ‘%s’.", errResp.Region)
+	}
+
+	return errResp
+}
+
+// errTransferAccelerationBucket - bucket name is invalid to be used with transfer acceleration.
+func errTransferAccelerationBucket(bucketName string) error {
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "InvalidArgument",
+		Message:    "The name of the bucket used for Transfer Acceleration must be DNS-compliant and must not contain periods ‘.’.",
+		BucketName: bucketName,
+	}
+}
+
+// errEntityTooLarge - Input size is larger than supported maximum.
+func errEntityTooLarge(totalSize, maxObjectSize int64, bucketName, objectName string) error {
+	msg := fmt.Sprintf("Your proposed upload size ‘%d’ exceeds the maximum allowed object size ‘%d’ for single PUT operation.", totalSize, maxObjectSize)
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "EntityTooLarge",
+		Message:    msg,
+		BucketName: bucketName,
+		Key:        objectName,
+	}
+}
+
+// errEntityTooSmall - Input size is smaller than supported minimum.
+func errEntityTooSmall(totalSize int64, bucketName, objectName string) error {
+	msg := fmt.Sprintf("Your proposed upload size ‘%d’ is below the minimum allowed object size ‘0B’ for single PUT operation.", totalSize)
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "EntityTooSmall",
+		Message:    msg,
+		BucketName: bucketName,
+		Key:        objectName,
+	}
+}
+
+// errUnexpectedEOF - Unexpected end of file reached.
+func errUnexpectedEOF(totalRead, totalSize int64, bucketName, objectName string) error {
+	msg := fmt.Sprintf("Data read ‘%d’ is not equal to the size ‘%d’ of the input Reader.", totalRead, totalSize)
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "UnexpectedEOF",
+		Message:    msg,
+		BucketName: bucketName,
+		Key:        objectName,
+	}
+}
+
+// errInvalidBucketName - Invalid bucket name response.
+func errInvalidBucketName(message string) error {
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "InvalidBucketName",
+		Message:    message,
+		RequestID:  "minio",
+	}
+}
+
+// errInvalidObjectName - Invalid object name response.
+func errInvalidObjectName(message string) error {
+	return ErrorResponse{
+		StatusCode: http.StatusNotFound,
+		Code:       "NoSuchKey",
+		Message:    message,
+		RequestID:  "minio",
+	}
+}
+
+// errInvalidArgument - Invalid argument response.
+func errInvalidArgument(message string) error {
+	return ErrorResponse{
+		StatusCode: http.StatusBadRequest,
+		Code:       "InvalidArgument",
+		Message:    message,
+		RequestID:  "minio",
+	}
+}
+
+// errAPINotSupported - API not supported response
+// The specified API call is not supported
+func errAPINotSupported(message string) error {
+	return ErrorResponse{
+		StatusCode: http.StatusNotImplemented,
+		Code:       "APINotSupported",
+		Message:    message,
+		RequestID:  "minio",
+	}
+}

vendor/github.com/minio/minio-go/v7/api-get-object-acl.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2018 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+)
+
+type accessControlPolicy struct {
+	Owner struct {
+		ID          string `xml:"ID"`
+		DisplayName string `xml:"DisplayName"`
+	} `xml:"Owner"`
+	AccessControlList struct {
+		Grant []struct {
+			Grantee struct {
+				ID          string `xml:"ID"`
+				DisplayName string `xml:"DisplayName"`
+				URI         string `xml:"URI"`
+			} `xml:"Grantee"`
+			Permission string `xml:"Permission"`
+		} `xml:"Grant"`
+	} `xml:"AccessControlList"`
+}
+
+// GetObjectACL get object ACLs
+func (c Client) GetObjectACL(ctx context.Context, bucketName, objectName string) (*ObjectInfo, error) {
+	resp, err := c.executeMethod(ctx, http.MethodGet, requestMetadata{
+		bucketName: bucketName,
+		objectName: objectName,
+		queryValues: url.Values{
+			"acl": []string{""},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer closeResponse(resp)
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, httpRespToErrorResponse(resp, bucketName, objectName)
+	}
+
+	res := &accessControlPolicy{}
+
+	if err := xmlDecoder(resp.Body, res); err != nil {
+		return nil, err
+	}
+
+	objInfo, err := c.statObject(ctx, bucketName, objectName, StatObjectOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	objInfo.Owner.DisplayName = res.Owner.DisplayName
+	objInfo.Owner.ID = res.Owner.ID
+
+	objInfo.Grant = append(objInfo.Grant, res.AccessControlList.Grant...)
+
+	cannedACL := getCannedACL(res)
+	if cannedACL != "" {
+		objInfo.Metadata.Add("X-Amz-Acl", cannedACL)
+		return &objInfo, nil
+	}
+
+	grantACL := getAmzGrantACL(res)
+	for k, v := range grantACL {
+		objInfo.Metadata[k] = v
+	}
+
+	return &objInfo, nil
+}
+
+func getCannedACL(aCPolicy *accessControlPolicy) string {
+	grants := aCPolicy.AccessControlList.Grant
+
+	switch {
+	case len(grants) == 1:
+		if grants[0].Grantee.URI == "" && grants[0].Permission == "FULL_CONTROL" {
+			return "private"
+		}
+	case len(grants) == 2:
+		for _, g := range grants {
+			if g.Grantee.URI == "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" && g.Permission == "READ" {
+				return "authenticated-read"
+			}
+			if g.Grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers" && g.Permission == "READ" {
+				return "public-read"
+			}
+			if g.Permission == "READ" && g.Grantee.ID == aCPolicy.Owner.ID {
+				return "bucket-owner-read"
+			}
+		}
+	case len(grants) == 3:
+		for _, g := range grants {
+			if g.Grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers" && g.Permission == "WRITE" {
+				return "public-read-write"
+			}
+		}
+	}
+	return ""
+}
+
+func getAmzGrantACL(aCPolicy *accessControlPolicy) map[string][]string {
+	grants := aCPolicy.AccessControlList.Grant
+	res := map[string][]string{}
+
+	for _, g := range grants {
+		switch {
+		case g.Permission == "READ":
+			res["X-Amz-Grant-Read"] = append(res["X-Amz-Grant-Read"], "id="+g.Grantee.ID)
+		case g.Permission == "WRITE":
+			res["X-Amz-Grant-Write"] = append(res["X-Amz-Grant-Write"], "id="+g.Grantee.ID)
+		case g.Permission == "READ_ACP":
+			res["X-Amz-Grant-Read-Acp"] = append(res["X-Amz-Grant-Read-Acp"], "id="+g.Grantee.ID)
+		case g.Permission == "WRITE_ACP":
+			res["X-Amz-Grant-Write-Acp"] = append(res["X-Amz-Grant-Write-Acp"], "id="+g.Grantee.ID)
+		case g.Permission == "FULL_CONTROL":
+			res["X-Amz-Grant-Full-Control"] = append(res["X-Amz-Grant-Full-Control"], "id="+g.Grantee.ID)
+		}
+	}
+	return res
+}

vendor/github.com/minio/minio-go/v7/api-get-object-file.go

+/*
+ * MinIO Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 MinIO, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package minio
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/minio/minio-go/v7/pkg/s3utils"
+)
+
+// FGetObject - download contents of an object to a local file.
+// The options can be used to specify the GET request further.
+func (c Client) FGetObject(ctx context.Context, bucketName, objectName, filePath string, opts GetObjectOptions) error {
+	// Input validation.
+	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
+		return err
+	}
+	if err := s3utils.CheckValidObjectName(objectName); err != nil {
+		return err
+	}
+
+	// Verify if destination already exists.
+	st, err := os.Stat(filePath)
+	if err == nil {
+		// If the destination exists and is a directory.
+		if st.IsDir() {
+			return errInvalidArgument("fileName is a directory.")
+		}
+	}
+
+	// Proceed if file does not exist. return for all other errors.
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+	}
+
+	// Extract top level directory.
+	objectDir, _ := filepath.Split(filePath)
+	if objectDir != "" {
+		// Create any missing top level directories.
+		if err := os.MkdirAll(objectDir, 0700); err != nil {
+			return err
+		}
+	}
+
+	// Gather md5sum.
+	objectStat, err := c.StatObject(ctx, bucketName, objectName, StatObjectOptions(opts))
+	if err != nil {
+		return err
+	}
+
+	// Write to a temporary file "fileName.part.minio" before saving.
+	filePartPath := filePath + objectStat.ETag + ".part.minio"
+
+	// If exists, open in append mode. If not create it as a part file.
+	filePart, err := os.OpenFile(filePartPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
+	if err != nil {
+		return err
+	}
+
+	// If we return early with an error, be sure to close and delete
+	// filePart.  If we have an error along the way there is a chance
+	// that filePart is somehow damaged, and we should discard it.
+	closeAndRemove := true
+	defer func() {
+		if closeAndRemove {
+			_ = filePart.Close()
+			_ = os.Remove(filePartPath)
+		}
+	}()
+
+	// Issue Stat to get the current offset.
+	st, err = filePart.Stat()
+	if err != nil {
+		return err
+	}
+
+	// Initialize get object request headers to set the
+	// appropriate range offsets to read from.
+	if st.Size() > 0 {
+		opts.SetRange(st.Size(), 0)
+	}
+
+	// Seek to current position for incoming reader.
+	objectReader, objectStat, _, err := c.getObject(ctx, bucketName, objectName, opts)
+	if err != nil {
+		return err
+	}
+
+	// Write to the part file.
+	if _, err = io.CopyN(filePart, objectReader, objectStat.Size); err != nil {
+		return err
+	}
+
+	// Close the file before rename, this is specifically needed for Windows users.
+	closeAndRemove = false
+	if err = filePart.Close(); err != nil {
+		return err
+	}
+
+	// Safely completed. Now commit by renaming to actual filename.
+	if err = os.Rename(filePartPath, filePath); err != nil {
+		return err
+	}
+
+	// Return.
+	return nil
+}