Update minio-go dependencies to latest 5.0.0 release (#5640)

With following changes

- Add SSE and refactor encryption API (#942) <Andreas Auernhammer>
- add copyObject test changing metadata and preserving etag (#944) <Harshavardhana>
- Add SSE-C tests for multipart, copy, get range operations (#941) <Harshavardhana>
- Removing conditional check for notificationInfoCh in api-notication (#940) <Matthew Magaldi>
- Honor prefix parameter in ListBucketPolicies API (#929) <kannappanr>
- test for empty objects uploaded with SSE-C headers (#927) <kannappanr>
- Encryption headers should also be set during initMultipart (#930) <Harshavardhana>
- Add support for Content-Language metadata header (#928) <kannappanr>
- Fix check for duplicate notification configuration entries (#917) <kannappanr>
- allow OS to cleanup sockets in TIME_WAIT (#925) <Harshavardhana>
- Sign V2: Fix signature calculation in virtual host style (#921) <A. Elleuch>
- bucket policy: Support json string in Principal field (#919) <A. Elleuch>
- Fix copyobject failure for empty files (#918) <kannappanr>
- Add new constructor NewWithOptions to SDK (#915) <poornas>
- Support redirect headers to sign again with new Host header. (#829) <Harshavardhana>
- Fail in PutObject if invalid user metadata is passed <Harshavadhana>
- PutObjectOptions Header: Don't include invalid header <Isaac Hess>
- increase max retry count to 10 (#913) <poornas>
- Add new regions for Paris and China west. (#905) <Harshavardhana>
- fix s3signer to use req.Host header (#899) <Bartłomiej Nogaś>

vendor/github.com/minio/go-homedir/LICENSE

@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2013 Mitchell Hashimoto
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

vendor/github.com/minio/go-homedir/README.md

@@ -1,16 +0,0 @@
-# go-homedir
-
-This is a Go library for detecting the user's home directory without
-the use of cgo, so the library can be used in cross-compilation environments.
-
-Usage is incredibly simple, just call `homedir.Dir()` to get the home directory
-for a user, and `homedir.Expand()` to expand the `~` in a path to the home
-directory.
-
-**Why not just use `os/user`?** The built-in `os/user` package is not
-available on certain architectures such as i386 or PNaCl. Additionally
-it has a cgo dependency on Darwin systems. This means that any Go code
-that uses that package cannot cross compile. But 99% of the time the
-use for `os/user` is just to retrieve the home directory, which we can
-do for the current user without cgo. This library does that, enabling
-cross-compilation. 

vendor/github.com/minio/go-homedir/dir_posix.go

@@ -1,64 +0,0 @@
-// +build !windows
-
-// Copyright 2016 (C) Mitchell Hashimoto
-// Distributed under the MIT License.
-
-package homedir
-
-import (
-	"bytes"
-	"errors"
-	"os"
-	"os/exec"
-	"os/user"
-	"strconv"
-	"strings"
-)
-
-// dir returns the homedir of current user for all POSIX compatible
-// operating systems.
-func dir() (string, error) {
-	// First prefer the HOME environmental variable
-	if home := os.Getenv("HOME"); home != "" {
-		return home, nil
-	}
-
-	// user.Current is not implemented for i386 and PNaCL like environments.
-	if currUser, err := user.Current(); err == nil {
-		return currUser.HomeDir, nil
-	}
-
-	// If that fails, try getent
-	var stdout bytes.Buffer
-	cmd := exec.Command("getent", "passwd", strconv.Itoa(os.Getuid()))
-	cmd.Stdout = &stdout
-	if err := cmd.Run(); err != nil {
-		// If "getent" is missing, ignore it
-		if err == exec.ErrNotFound {
-			return "", err
-		}
-	} else {
-		if passwd := strings.TrimSpace(stdout.String()); passwd != "" {
-			// username:password:uid:gid:gecos:home:shell
-			passwdParts := strings.SplitN(passwd, ":", 7)
-			if len(passwdParts) > 5 {
-				return passwdParts[5], nil
-			}
-		}
-	}
-
-	// If all else fails, try the shell
-	stdout.Reset()
-	cmd = exec.Command("sh", "-c", "cd && pwd")
-	cmd.Stdout = &stdout
-	if err := cmd.Run(); err != nil {
-		return "", err
-	}
-
-	result := strings.TrimSpace(stdout.String())
-	if result == "" {
-		return "", errors.New("blank output when reading home directory")
-	}
-
-	return result, nil
-}

vendor/github.com/minio/go-homedir/dir_windows.go

@@ -1,24 +0,0 @@
-// Copyright 2016 (C) Mitchell Hashimoto
-// Distributed under the MIT License.
-
-package homedir
-
-import (
-	"errors"
-	"os"
-)
-
-// dir returns the homedir of current user for MS Windows OS.
-func dir() (string, error) {
-	drive := os.Getenv("HOMEDRIVE")
-	path := os.Getenv("HOMEPATH")
-	home := drive + path
-	if drive == "" || path == "" {
-		home = os.Getenv("USERPROFILE")
-	}
-	if home == "" {
-		return "", errors.New("HOMEDRIVE, HOMEPATH, and USERPROFILE are blank")
-	}
-
-	return home, nil
-}

vendor/github.com/minio/go-homedir/homedir.go

@@ -1,68 +0,0 @@
-// Copyright 2016 (C) Mitchell Hashimoto
-// Distributed under the MIT License.
-
-// Package homedir implements a portable function to determine current user's homedir.
-package homedir
-
-import (
-	"errors"
-	"path/filepath"
-	"sync"
-)
-
-// DisableCache will disable caching of the home directory. Caching is enabled
-// by default.
-var DisableCache bool
-
-var homedirCache string
-var cacheLock sync.Mutex
-
-// Dir returns the home directory for the executing user.
-//
-// This uses an OS-specific method for discovering the home directory.
-// An error is returned if a home directory cannot be detected.
-func Dir() (string, error) {
-	cacheLock.Lock()
-	defer cacheLock.Unlock()
-
-	// Return cached homedir if available.
-	if !DisableCache {
-		if homedirCache != "" {
-			return homedirCache, nil
-		}
-	}
-
-	// Determine OS speific current homedir.
-	result, err := dir()
-	if err != nil {
-		return "", err
-	}
-
-	// Cache for future lookups.
-	homedirCache = result
-	return result, nil
-}
-
-// Expand expands the path to include the home directory if the path
-// is prefixed with `~`. If it isn't prefixed with `~`, the path is
-// returned as-is.
-func Expand(path string) (string, error) {
-	if len(path) == 0 {
-		return path, nil
-	}
-
-	if path[0] != '~' {
-		return path, nil
-	}
-
-	if len(path) > 1 && path[1] != '/' && path[1] != '\\' {
-		return "", errors.New("cannot expand user-specific home dir")
-	}
-
-	dir, err := Dir()
-	if err != nil {
-		return "", err
-	}
-
-	return filepath.Join(dir, path[1:]), nil
-}

vendor/github.com/minio/go-homedir/homedir_test.go

@@ -1,114 +0,0 @@
-package homedir
-
-import (
-	"fmt"
-	"os"
-	"os/user"
-	"testing"
-)
-
-func patchEnv(key, value string) func() {
-	bck := os.Getenv(key)
-	deferFunc := func() {
-		os.Setenv(key, bck)
-	}
-
-	os.Setenv(key, value)
-	return deferFunc
-}
-
-func BenchmarkDir(b *testing.B) {
-	// We do this for any "warmups"
-	for i := 0; i < 10; i++ {
-		Dir()
-	}
-
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		Dir()
-	}
-}
-
-func TestDir(t *testing.T) {
-	// NOTE: This test is not portable. If user.Current() worked
-	// everywhere, we wouldn't need our package in the first place.
-	u, err := user.Current()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	dir, err := Dir()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if u.HomeDir != dir {
-		t.Fatalf("%#v != %#v", u.HomeDir, dir)
-	}
-}
-
-func TestExpand(t *testing.T) {
-	u, err := user.Current()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	cases := []struct {
-		Input  string
-		Output string
-		Err    bool
-	}{
-		{
-			"/foo",
-			"/foo",
-			false,
-		},
-
-		{
-			"~/foo",
-			fmt.Sprintf("%s/foo", u.HomeDir),
-			false,
-		},
-
-		{
-			"",
-			"",
-			false,
-		},
-
-		{
-			"~",
-			u.HomeDir,
-			false,
-		},
-
-		{
-			"~foo/foo",
-			"",
-			true,
-		},
-	}
-
-	for _, tc := range cases {
-		actual, err := Expand(tc.Input)
-		if (err != nil) != tc.Err {
-			t.Fatalf("Input: %#v\n\nErr: %s", tc.Input, err)
-		}
-
-		if actual != tc.Output {
-			t.Fatalf("Input: %#v\n\nOutput: %#v", tc.Input, actual)
-		}
-	}
-
-	DisableCache = true
-	defer func() { DisableCache = false }()
-	defer patchEnv("HOME", "/custom/path/")()
-	expected := "/custom/path/foo/bar"
-	actual, err := Expand("~/foo/bar")
-
-	if err != nil {
-		t.Errorf("No error is expected, got: %v", err)
-	} else if actual != "/custom/path/foo/bar" {
-		t.Errorf("Expected: %v; actual: %v", expected, actual)
-	}
-}

vendor/github.com/minio/minio-go/Makefile

@@ -1,14 +1,12 @@
 all: checks
 
 checks:
-	@go get -u github.com/go-ini/ini/...
-	@go get -u github.com/mitchellh/go-homedir/...
-	@go get -u github.com/cheggaaa/pb/...
-	@go get -u github.com/sirupsen/logrus/...
-	@go get -u github.com/dustin/go-humanize/...
+	@go get -t ./...
 	@go vet ./...
-	@SERVER_ENDPOINT=play.minio.io:9000 ACCESS_KEY=Q3AM3UQ867SPQQA43P2F SECRET_KEY=zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG ENABLE_HTTPS=1 go test -race -v ./...
-	@SERVER_ENDPOINT=play.minio.io:9000 ACCESS_KEY=Q3AM3UQ867SPQQA43P2F SECRET_KEY=zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG ENABLE_HTTPS=1 go run functional_tests.go
+	@SERVER_ENDPOINT=play.minio.io:9000 ACCESS_KEY=Q3AM3UQ867SPQQA43P2F SECRET_KEY=zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG ENABLE_HTTPS=1 MINT_MODE=full go test -race -v ./...
+	@go get github.com/dustin/go-humanize/...
+	@go get github.com/sirupsen/logrus/...
+	@SERVER_ENDPOINT=play.minio.io:9000 ACCESS_KEY=Q3AM3UQ867SPQQA43P2F SECRET_KEY=zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG ENABLE_HTTPS=1 MINT_MODE=full go run functional_tests.go
 	@mkdir -p /tmp/examples && for i in $(echo examples/s3/*); do go build -o /tmp/examples/$(basename ${i:0:-3}) ${i}; done
 	@go get -u github.com/a8m/mark/...
 	@go get -u github.com/minio/cli/...

vendor/github.com/minio/minio-go/README.md

@@ -156,10 +156,6 @@ The full API Reference is available here.
 * [`RemoveObjects`](https://docs.minio.io/docs/golang-client-api-reference#RemoveObjects)
 * [`RemoveIncompleteUpload`](https://docs.minio.io/docs/golang-client-api-reference#RemoveIncompleteUpload)
 
-### API Reference: Encrypted Object Operations
-* [`GetEncryptedObject`](https://docs.minio.io/docs/golang-client-api-reference#GetEncryptedObject)
-* [`PutEncryptedObject`](https://docs.minio.io/docs/golang-client-api-reference#PutEncryptedObject)
-
 ### API Reference : Presigned Operations
 * [`PresignedGetObject`](https://docs.minio.io/docs/golang-client-api-reference#PresignedGetObject)
 * [`PresignedPutObject`](https://docs.minio.io/docs/golang-client-api-reference#PresignedPutObject)

vendor/github.com/minio/minio-go/api-compose-object.go

@@ -19,7 +19,6 @@ package minio
 
 import (
 	"context"
-	"encoding/base64"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -27,58 +26,15 @@ import (
 	"strings"
 	"time"
 
+	"github.com/minio/minio-go/pkg/encrypt"
 	"github.com/minio/minio-go/pkg/s3utils"
 )
 
-// SSEInfo - represents Server-Side-Encryption parameters specified by
-// a user.
-type SSEInfo struct {
-	key  []byte
-	algo string
-}
-
-// NewSSEInfo - specifies (binary or un-encoded) encryption key and
-// algorithm name. If algo is empty, it defaults to "AES256". Ref:
-// https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html
-func NewSSEInfo(key []byte, algo string) SSEInfo {
-	if algo == "" {
-		algo = "AES256"
-	}
-	return SSEInfo{key, algo}
-}
-
-// internal method that computes SSE-C headers
-func (s *SSEInfo) getSSEHeaders(isCopySource bool) map[string]string {
-	if s == nil {
-		return nil
-	}
-
-	cs := ""
-	if isCopySource {
-		cs = "copy-source-"
-	}
-	return map[string]string{
-		"x-amz-" + cs + "server-side-encryption-customer-algorithm": s.algo,
-		"x-amz-" + cs + "server-side-encryption-customer-key":       base64.StdEncoding.EncodeToString(s.key),
-		"x-amz-" + cs + "server-side-encryption-customer-key-MD5":   sumMD5Base64(s.key),
-	}
-}
-
-// GetSSEHeaders - computes and returns headers for SSE-C as key-value
-// pairs. They can be set as metadata in PutObject* requests (for
-// encryption) or be set as request headers in `Core.GetObject` (for
-// decryption).
-func (s *SSEInfo) GetSSEHeaders() map[string]string {
-	return s.getSSEHeaders(false)
-}
-
 // DestinationInfo - type with information about the object to be
 // created via server-side copy requests, using the Compose API.
 type DestinationInfo struct {
 	bucket, object string
-
-	// key for encrypting destination
-	encryption *SSEInfo
+	encryption     encrypt.ServerSide
 
 	// if no user-metadata is provided, it is copied from source
 	// (when there is only once source object in the compose
@@ -97,9 +53,7 @@ type DestinationInfo struct {
 // if needed. If nil is passed, and if only a single source (of any
 // size) is provided in the ComposeObject call, then metadata from the
 // source is copied to the destination.
-func NewDestinationInfo(bucket, object string, encryptSSEC *SSEInfo,
-	userMeta map[string]string) (d DestinationInfo, err error) {
-
+func NewDestinationInfo(bucket, object string, sse encrypt.ServerSide, userMeta map[string]string) (d DestinationInfo, err error) {
 	// Input validation.
 	if err = s3utils.CheckValidBucketName(bucket); err != nil {
 		return d, err
@@ -125,7 +79,7 @@ func NewDestinationInfo(bucket, object string, encryptSSEC *SSEInfo,
 	return DestinationInfo{
 		bucket:       bucket,
 		object:       object,
-		encryption:   encryptSSEC,
+		encryption:   sse,
 		userMetadata: m,
 	}, nil
 }
@@ -154,10 +108,8 @@ func (d *DestinationInfo) getUserMetaHeadersMap(withCopyDirectiveHeader bool) ma
 // server-side copying APIs.
 type SourceInfo struct {
 	bucket, object string
-
-	start, end int64
-
-	decryptKey *SSEInfo
+	start, end     int64
+	encryption     encrypt.ServerSide
 	// Headers to send with the upload-part-copy request involving
 	// this source object.
 	Headers http.Header
@@ -169,12 +121,12 @@ type SourceInfo struct {
 // `decryptSSEC` is the decryption key using server-side-encryption
 // with customer provided key. It may be nil if the source is not
 // encrypted.
-func NewSourceInfo(bucket, object string, decryptSSEC *SSEInfo) SourceInfo {
+func NewSourceInfo(bucket, object string, sse encrypt.ServerSide) SourceInfo {
 	r := SourceInfo{
 		bucket:     bucket,
 		object:     object,
 		start:      -1, // range is unspecified by default
-		decryptKey: decryptSSEC,
+		encryption: sse,
 		Headers:    make(http.Header),
 	}
 
@@ -182,8 +134,8 @@ func NewSourceInfo(bucket, object string, decryptSSEC *SSEInfo) SourceInfo {
 	r.Headers.Set("x-amz-copy-source", s3utils.EncodePath(bucket+"/"+object))
 
 	// Assemble decryption headers for upload-part-copy request
-	for k, v := range decryptSSEC.getSSEHeaders(true) {
-		r.Headers.Set(k, v)
+	if r.encryption != nil {
+		encrypt.SSECopy(r.encryption).Marshal(r.Headers)
 	}
 
 	return r
@@ -245,10 +197,7 @@ func (s *SourceInfo) getProps(c Client) (size int64, etag string, userMeta map[s
 	// Get object info - need size and etag here. Also, decryption
 	// headers are added to the stat request if given.
 	var objInfo ObjectInfo
-	opts := StatObjectOptions{}
-	for k, v := range s.decryptKey.getSSEHeaders(false) {
-		opts.Set(k, v)
-	}
+	opts := StatObjectOptions{GetObjectOptions{ServerSideEncryption: s.encryption}}
 	objInfo, err = c.statObject(context.Background(), s.bucket, s.object, opts)
 	if err != nil {
 		err = ErrInvalidArgument(fmt.Sprintf("Could not stat object - %s/%s: %v", s.bucket, s.object, err))
@@ -476,12 +425,12 @@ func (c Client) ComposeObject(dst DestinationInfo, srcs []SourceInfo) error {
 
 	// Single source object case (i.e. when only one source is
 	// involved, it is being copied wholly and at most 5GiB in
-	// size).
-	if totalParts == 1 && srcs[0].start == -1 && totalSize <= maxPartSize {
+	// size, emptyfiles are also supported).
+	if (totalParts == 1 && srcs[0].start == -1 && totalSize <= maxPartSize) || (totalSize == 0) {
 		h := srcs[0].Headers
 		// Add destination encryption headers
-		for k, v := range dst.encryption.getSSEHeaders(false) {
-			h.Set(k, v)
+		if dst.encryption != nil {
+			dst.encryption.Marshal(h)
 		}
 
 		// If no user metadata is specified (and so, the
@@ -527,7 +476,8 @@ func (c Client) ComposeObject(dst DestinationInfo, srcs []SourceInfo) error {
 	for k, v := range metaMap {
 		metaHeaders[k] = v
 	}
-	uploadID, err := c.newUploadID(ctx, dst.bucket, dst.object, PutObjectOptions{UserMetadata: metaHeaders})
+
+	uploadID, err := c.newUploadID(ctx, dst.bucket, dst.object, PutObjectOptions{ServerSideEncryption: dst.encryption, UserMetadata: metaHeaders})
 	if err != nil {
 		return err
 	}
@@ -538,8 +488,8 @@ func (c Client) ComposeObject(dst DestinationInfo, srcs []SourceInfo) error {
 	for i, src := range srcs {
 		h := src.Headers
 		// Add destination encryption headers
-		for k, v := range dst.encryption.getSSEHeaders(false) {
-			h.Set(k, v)
+		if dst.encryption != nil {
+			dst.encryption.Marshal(h)
 		}
 
 		// calculate start/end indices of parts after

vendor/github.com/minio/minio-go/api-get-object-file.go

@@ -18,14 +18,11 @@
 package minio
 
 import (
+	"context"
 	"io"
 	"os"
 	"path/filepath"
 
-	"github.com/minio/minio-go/pkg/encrypt"
-
-	"context"
-
 	"github.com/minio/minio-go/pkg/s3utils"
 )
 
@@ -40,14 +37,6 @@ func (c Client) FGetObject(bucketName, objectName, filePath string, opts GetObje
 	return c.fGetObjectWithContext(context.Background(), bucketName, objectName, filePath, opts)
 }
 
-// FGetEncryptedObject - Decrypt and store an object at filePath.
-func (c Client) FGetEncryptedObject(bucketName, objectName, filePath string, materials encrypt.Materials) error {
-	if materials == nil {
-		return ErrInvalidArgument("Unable to recognize empty encryption properties")
-	}
-	return c.FGetObject(bucketName, objectName, filePath, GetObjectOptions{Materials: materials})
-}
-
 // fGetObjectWithContext - fgetObject wrapper function with context
 func (c Client) fGetObjectWithContext(ctx context.Context, bucketName, objectName, filePath string, opts GetObjectOptions) error {
 	// Input validation.

vendor/github.com/minio/minio-go/api-get-object.go

@@ -27,20 +27,9 @@ import (
 	"sync"
 	"time"
 
-	"github.com/minio/minio-go/pkg/encrypt"
 	"github.com/minio/minio-go/pkg/s3utils"
 )
 
-// GetEncryptedObject deciphers and streams data stored in the server after applying a specified encryption materials,
-// returned stream should be closed by the caller.
-func (c Client) GetEncryptedObject(bucketName, objectName string, encryptMaterials encrypt.Materials) (io.ReadCloser, error) {
-	if encryptMaterials == nil {
-		return nil, ErrInvalidArgument("Unable to recognize empty encryption properties")
-	}
-
-	return c.GetObject(bucketName, objectName, GetObjectOptions{Materials: encryptMaterials})
-}
-
 // GetObject - returns an seekable, readable object.
 func (c Client) GetObject(bucketName, objectName string, opts GetObjectOptions) (*Object, error) {
 	return c.getObjectWithContext(context.Background(), bucketName, objectName, opts)
@@ -127,6 +116,9 @@ func (c Client) getObjectWithContext(ctx context.Context, bucketName, objectName
 					} else {
 						// First request is a Stat or Seek call.
 						// Only need to run a StatObject until an actual Read or ReadAt request comes through.
+
+						// Remove range header if already set, for stat Operations to get original file size.
+						delete(opts.headers, "Range")
 						objectInfo, err = c.statObject(ctx, bucketName, objectName, StatObjectOptions{opts})
 						if err != nil {
 							resCh <- getResponse{
@@ -142,6 +134,8 @@ func (c Client) getObjectWithContext(ctx context.Context, bucketName, objectName
 						}
 					}
 				} else if req.settingObjectInfo { // Request is just to get objectInfo.
+					// Remove range header if already set, for stat Operations to get original file size.
+					delete(opts.headers, "Range")
 					if etag != "" {
 						opts.SetMatchETag(etag)
 					}
@@ -381,13 +375,11 @@ func (o *Object) Stat() (ObjectInfo, error) {
 
 	// This is the first request.
 	if !o.isStarted || !o.objectInfoSet {
-		statReq := getRequest{
+		// Send the request and get the response.
+		_, err := o.doGetRequest(getRequest{
 			isFirstReq:        !o.isStarted,
 			settingObjectInfo: !o.objectInfoSet,
-		}
-
-		// Send the request and get the response.
-		_, err := o.doGetRequest(statReq)
+		})
 		if err != nil {
 			o.prevErr = err
 			return ObjectInfo{}, err
@@ -493,7 +485,7 @@ func (o *Object) Seek(offset int64, whence int) (n int64, err error) {
 
 	// Negative offset is valid for whence of '2'.
 	if offset < 0 && whence != 2 {
-		return 0, ErrInvalidArgument(fmt.Sprintf("Negative position not allowed for %d.", whence))
+		return 0, ErrInvalidArgument(fmt.Sprintf("Negative position not allowed for %d", whence))
 	}
 
 	// This is the first request. So before anything else
@@ -662,15 +654,6 @@ func (c Client) getObject(ctx context.Context, bucketName, objectName string, op
 		Metadata: extractObjMetadata(resp.Header),
 	}
 
-	reader := resp.Body
-	if opts.Materials != nil {
-		err = opts.Materials.SetupDecryptMode(reader, objectStat.Metadata.Get(amzHeaderIV), objectStat.Metadata.Get(amzHeaderKey))
-		if err != nil {
-			return nil, ObjectInfo{}, err
-		}
-		reader = opts.Materials
-	}
-
 	// do not close body here, caller will close
-	return reader, objectStat, nil
+	return resp.Body, objectStat, nil
 }

vendor/github.com/minio/minio-go/api-get-options.go

@@ -28,9 +28,8 @@ import (
 // GetObjectOptions are used to specify additional headers or options
 // during GET requests.
 type GetObjectOptions struct {
-	headers map[string]string
-
-	Materials encrypt.Materials
+	headers              map[string]string
+	ServerSideEncryption encrypt.ServerSide
 }
 
 // StatObjectOptions are used to specify additional headers or options
@@ -45,6 +44,9 @@ func (o GetObjectOptions) Header() http.Header {
 	for k, v := range o.headers {
 		headers.Set(k, v)
 	}
+	if o.ServerSideEncryption != nil {
+		o.ServerSideEncryption.Marshal(headers)
+	}
 	return headers
 }
 

vendor/github.com/minio/minio-go/api-get-policy.go

@@ -65,7 +65,7 @@ func (c Client) ListBucketPolicies(bucketName, objectPrefix string) (bucketPolic
 		}
 		return map[string]policy.BucketPolicy{}, err
 	}
-	return policy.GetPolicies(policyInfo.Statements, bucketName), nil
+	return policy.GetPolicies(policyInfo.Statements, bucketName, objectPrefix), nil
 }
 
 // Default empty bucket access policy.

vendor/github.com/minio/minio-go/api-notification.go

@@ -150,7 +150,7 @@ func (c Client) ListenBucketNotification(bucketName, prefix, suffix string, even
 		}
 
 		// Check ARN partition to verify if listening bucket is supported
-		if s3utils.IsAmazonEndpoint(c.endpointURL) || s3utils.IsGoogleEndpoint(c.endpointURL) {
+		if s3utils.IsAmazonEndpoint(*c.endpointURL) || s3utils.IsGoogleEndpoint(*c.endpointURL) {
 			notificationInfoCh <- NotificationInfo{
 				Err: ErrAPINotSupported("Listening for bucket notification is specific only to `minio` server endpoints"),
 			}
@@ -205,13 +205,11 @@ func (c Client) ListenBucketNotification(bucketName, prefix, suffix string, even
 				if err = json.Unmarshal(bio.Bytes(), &notificationInfo); err != nil {
 					continue
 				}
-				// Send notifications on channel only if there are events received.
-				if len(notificationInfo.Records) > 0 {
-					select {
-					case notificationInfoCh <- notificationInfo:
-					case <-doneCh:
-						return
-					}
+				// Send notificationInfo
+				select {
+				case notificationInfoCh <- notificationInfo:
+				case <-doneCh:
+					return
 				}
 			}
 			// Look for any underlying errors.

vendor/github.com/minio/minio-go/api-presigned.go

@@ -119,7 +119,9 @@ func (c Client) PresignedPostPolicy(p *PostPolicy) (u *url.URL, formData map[str
 		return nil, nil, err
 	}
 
-	u, err = c.makeTargetURL(bucketName, "", location, nil)
+	isVirtualHost := c.isVirtualHostStyleRequest(*c.endpointURL, bucketName)
+
+	u, err = c.makeTargetURL(bucketName, "", location, isVirtualHost, nil)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -148,7 +150,7 @@ func (c Client) PresignedPostPolicy(p *PostPolicy) (u *url.URL, formData map[str
 		policyBase64 := p.base64()
 		p.formData["policy"] = policyBase64
 		// For Google endpoint set this value to be 'GoogleAccessId'.
-		if s3utils.IsGoogleEndpoint(c.endpointURL) {
+		if s3utils.IsGoogleEndpoint(*c.endpointURL) {
 			p.formData["GoogleAccessId"] = accessKeyID
 		} else {
 			// For all other endpoints set this value to be 'AWSAccessKeyId'.

vendor/github.com/minio/minio-go/api-put-object-context.go

@@ -29,11 +29,5 @@ func (c Client) PutObjectWithContext(ctx context.Context, bucketName, objectName
 	if err != nil {
 		return 0, err
 	}
-	if opts.EncryptMaterials != nil {
-		if err = opts.EncryptMaterials.SetupEncryptMode(reader); err != nil {
-			return 0, err
-		}
-		return c.putObjectMultipartStreamNoLength(ctx, bucketName, objectName, opts.EncryptMaterials, opts)
-	}
 	return c.putObjectCommon(ctx, bucketName, objectName, reader, objectSize, opts)
 }

vendor/github.com/minio/minio-go/api-put-object-encrypted.go

@@ -1,44 +0,0 @@
-/*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package minio
-
-import (
-	"context"
-	"io"
-
-	"github.com/minio/minio-go/pkg/encrypt"
-)
-
-// PutEncryptedObject - Encrypt and store object.
-func (c Client) PutEncryptedObject(bucketName, objectName string, reader io.Reader, encryptMaterials encrypt.Materials) (n int64, err error) {
-
-	if encryptMaterials == nil {
-		return 0, ErrInvalidArgument("Unable to recognize empty encryption properties")
-	}
-
-	if err := encryptMaterials.SetupEncryptMode(reader); err != nil {
-		return 0, err
-	}
-
-	return c.PutObjectWithContext(context.Background(), bucketName, objectName, reader, -1, PutObjectOptions{EncryptMaterials: encryptMaterials})
-}
-
-// FPutEncryptedObject - Encrypt and store an object with contents from file at filePath.
-func (c Client) FPutEncryptedObject(bucketName, objectName, filePath string, encryptMaterials encrypt.Materials) (n int64, err error) {
-	return c.FPutObjectWithContext(context.Background(), bucketName, objectName, filePath, PutObjectOptions{EncryptMaterials: encryptMaterials})
-}

vendor/github.com/minio/minio-go/api-put-object-multipart.go

@@ -33,6 +33,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/minio/minio-go/pkg/encrypt"
 	"github.com/minio/minio-go/pkg/s3utils"
 )
 
@@ -138,7 +139,7 @@ func (c Client) putObjectMultipartNoStream(ctx context.Context, bucketName, obje
 		// Proceed to upload the part.
 		var objPart ObjectPart
 		objPart, err = c.uploadPart(ctx, bucketName, objectName, uploadID, rd, partNumber,
-			md5Base64, sha256Hex, int64(length), opts.UserMetadata)
+			md5Base64, sha256Hex, int64(length), opts.ServerSideEncryption)
 		if err != nil {
 			return totalUploadedSize, err
 		}
@@ -226,11 +227,9 @@ func (c Client) initiateMultipartUpload(ctx context.Context, bucketName, objectN
 	return initiateMultipartUploadResult, nil
 }
 
-const serverEncryptionKeyPrefix = "x-amz-server-side-encryption"
-
 // uploadPart - Uploads a part in a multipart upload.
 func (c Client) uploadPart(ctx context.Context, bucketName, objectName, uploadID string, reader io.Reader,
-	partNumber int, md5Base64, sha256Hex string, size int64, metadata map[string]string) (ObjectPart, error) {
+	partNumber int, md5Base64, sha256Hex string, size int64, sse encrypt.ServerSide) (ObjectPart, error) {
 	// Input validation.
 	if err := s3utils.CheckValidBucketName(bucketName); err != nil {
 		return ObjectPart{}, err
@@ -260,12 +259,8 @@ func (c Client) uploadPart(ctx context.Context, bucketName, objectName, uploadID
 
 	// Set encryption headers, if any.
 	customHeader := make(http.Header)
-	for k, v := range metadata {
-		if len(v) > 0 {
-			if strings.HasPrefix(strings.ToLower(k), serverEncryptionKeyPrefix) {
-				customHeader.Set(k, v)
-			}
-		}
+	if sse != nil {
+		sse.Marshal(customHeader)
 	}
 
 	reqMetadata := requestMetadata{

vendor/github.com/minio/minio-go/api-put-object-streaming.go

@@ -167,7 +167,7 @@ func (c Client) putObjectMultipartStreamFromReadAt(ctx context.Context, bucketNa
 				var objPart ObjectPart
 				objPart, err = c.uploadPart(ctx, bucketName, objectName, uploadID,
 					sectionReader, uploadReq.PartNum,
-					"", "", partSize, opts.UserMetadata)
+					"", "", partSize, opts.ServerSideEncryption)
 				if err != nil {
 					uploadedPartsCh <- uploadedPartRes{
 						Size:  0,
@@ -280,7 +280,7 @@ func (c Client) putObjectMultipartStreamNoChecksum(ctx context.Context, bucketNa
 		var objPart ObjectPart
 		objPart, err = c.uploadPart(ctx, bucketName, objectName, uploadID,
 			io.LimitReader(hookReader, partSize),
-			partNumber, "", "", partSize, opts.UserMetadata)
+			partNumber, "", "", partSize, opts.ServerSideEncryption)
 		if err != nil {
 			return totalUploadedSize, err
 		}
@@ -339,7 +339,7 @@ func (c Client) putObjectNoChecksum(ctx context.Context, bucketName, objectName
 
 	// Size -1 is only supported on Google Cloud Storage, we error
 	// out in all other situations.
-	if size < 0 && !s3utils.IsGoogleEndpoint(c.endpointURL) {
+	if size < 0 && !s3utils.IsGoogleEndpoint(*c.endpointURL) {
 		return 0, ErrEntityTooSmall(size, bucketName, objectName)
 	}
 	if size > 0 {
@@ -381,6 +381,7 @@ func (c Client) putObjectDo(ctx context.Context, bucketName, objectName string,
 	}
 	// Set headers.
 	customHeader := opts.Header()
+
 	// Populate request metadata.
 	reqMetadata := requestMetadata{
 		bucketName:       bucketName,

vendor/github.com/minio/minio-go/api-put-object.go

@@ -28,19 +28,21 @@ import (
 
 	"github.com/minio/minio-go/pkg/encrypt"
 	"github.com/minio/minio-go/pkg/s3utils"
+	"golang.org/x/net/lex/httplex"
 )
 
 // PutObjectOptions represents options specified by user for PutObject call
 type PutObjectOptions struct {
-	UserMetadata       map[string]string
-	Progress           io.Reader
-	ContentType        string
-	ContentEncoding    string
-	ContentDisposition string
-	CacheControl       string
-	EncryptMaterials   encrypt.Materials
-	NumThreads         uint
-	StorageClass       string
+	UserMetadata         map[string]string
+	Progress             io.Reader
+	ContentType          string
+	ContentEncoding      string
+	ContentDisposition   string
+	ContentLanguage      string
+	CacheControl         string
+	ServerSideEncryption encrypt.ServerSide
+	NumThreads           uint
+	StorageClass         string
 }
 
 // getNumThreads - gets the number of threads to be used in the multipart
@@ -70,19 +72,20 @@ func (opts PutObjectOptions) Header() (header http.Header) {
 	if opts.ContentDisposition != "" {
 		header["Content-Disposition"] = []string{opts.ContentDisposition}
 	}
+	if opts.ContentLanguage != "" {
+		header["Content-Language"] = []string{opts.ContentLanguage}
+	}
 	if opts.CacheControl != "" {
 		header["Cache-Control"] = []string{opts.CacheControl}
 	}
-	if opts.EncryptMaterials != nil {
-		header[amzHeaderIV] = []string{opts.EncryptMaterials.GetIV()}
-		header[amzHeaderKey] = []string{opts.EncryptMaterials.GetKey()}
-		header[amzHeaderMatDesc] = []string{opts.EncryptMaterials.GetDesc()}
+	if opts.ServerSideEncryption != nil {
+		opts.ServerSideEncryption.Marshal(header)
 	}
 	if opts.StorageClass != "" {
 		header[amzStorageClass] = []string{opts.StorageClass}
 	}
 	for k, v := range opts.UserMetadata {
-		if !isAmzHeader(k) && !isStandardHeader(k) && !isSSEHeader(k) && !isStorageClassHeader(k) {
+		if !isAmzHeader(k) && !isStandardHeader(k) && !isStorageClassHeader(k) {
 			header["X-Amz-Meta-"+k] = []string{v}
 		} else {
 			header[k] = []string{v}
@@ -91,12 +94,14 @@ func (opts PutObjectOptions) Header() (header http.Header) {
 	return
 }
 
-// validate() checks if the UserMetadata map has standard headers or client side
-// encryption headers and raises an error if so.
+// validate() checks if the UserMetadata map has standard headers or and raises an error if so.
 func (opts PutObjectOptions) validate() (err error) {
-	for k := range opts.UserMetadata {
-		if isStandardHeader(k) || isCSEHeader(k) || isStorageClassHeader(k) {
-			return ErrInvalidArgument(k + " unsupported request parameter for user defined metadata from minio-go")
+	for k, v := range opts.UserMetadata {
+		if !httplex.ValidHeaderFieldName(k) || isStandardHeader(k) || isSSEHeader(k) || isStorageClassHeader(k) {
+			return ErrInvalidArgument(k + " unsupported user defined metadata name")
+		}
+		if !httplex.ValidHeaderFieldValue(v) {
+			return ErrInvalidArgument(v + " unsupported user defined metadata value")
 		}
 	}
 	return nil
@@ -133,7 +138,7 @@ func (c Client) putObjectCommon(ctx context.Context, bucketName, objectName stri
 	}
 
 	// NOTE: Streaming signature is not supported by GCS.
-	if s3utils.IsGoogleEndpoint(c.endpointURL) {
+	if s3utils.IsGoogleEndpoint(*c.endpointURL) {
 		// Do not compute MD5 for Google Cloud Storage.
 		return c.putObjectNoChecksum(ctx, bucketName, objectName, reader, size, opts)
 	}
@@ -213,7 +218,7 @@ func (c Client) putObjectMultipartStreamNoLength(ctx context.Context, bucketName
 		// Proceed to upload the part.
 		var objPart ObjectPart
 		objPart, err = c.uploadPart(ctx, bucketName, objectName, uploadID, rd, partNumber,
-			"", "", int64(length), opts.UserMetadata)
+			"", "", int64(length), opts.ServerSideEncryption)
 		if err != nil {
 			return totalUploadedSize, err
 		}

vendor/github.com/minio/minio-go/api-remove.go

@@ -129,10 +129,8 @@ func processRemoveMultiObjectsResponse(body io.Reader, objects []string, errorCh
 	}
 }
 
-// RemoveObjects remove multiples objects from a bucket.
-// The list of objects to remove are received from objectsCh.
-// Remove failures are sent back via error channel.
-func (c Client) RemoveObjects(bucketName string, objectsCh <-chan string) <-chan RemoveObjectError {
+// RemoveObjectsWithContext - Identical to RemoveObjects call, but accepts context to facilitate request cancellation.
+func (c Client) RemoveObjectsWithContext(ctx context.Context, bucketName string, objectsCh <-chan string) <-chan RemoveObjectError {
 	errorCh := make(chan RemoveObjectError, 1)
 
 	// Validate if bucket name is valid.
@@ -189,7 +187,7 @@ func (c Client) RemoveObjects(bucketName string, objectsCh <-chan string) <-chan
 			// Generate remove multi objects XML request
 			removeBytes := generateRemoveMultiObjectsRequest(batch)
 			// Execute GET on bucket to list objects.
-			resp, err := c.executeMethod(context.Background(), "POST", requestMetadata{
+			resp, err := c.executeMethod(ctx, "POST", requestMetadata{
 				bucketName:       bucketName,
 				queryValues:      urlValues,
 				contentBody:      bytes.NewReader(removeBytes),
@@ -213,6 +211,13 @@ func (c Client) RemoveObjects(bucketName string, objectsCh <-chan string) <-chan
 	return errorCh
 }
 
+// RemoveObjects removes multiple objects from a bucket.
+// The list of objects to remove are received from objectsCh.
+// Remove failures are sent back via error channel.
+func (c Client) RemoveObjects(bucketName string, objectsCh <-chan string) <-chan RemoveObjectError {
+	return c.RemoveObjectsWithContext(context.Background(), bucketName, objectsCh)
+}
+
 // RemoveIncompleteUpload aborts an partially uploaded object.
 func (c Client) RemoveIncompleteUpload(bucketName, objectName string) error {
 	// Input validation.

vendor/github.com/minio/minio-go/api-stat.go

@@ -115,7 +115,7 @@ func (c Client) statObject(ctx context.Context, bucketName, objectName string, o
 		return ObjectInfo{}, err
 	}
 	if resp != nil {
-		if resp.StatusCode != http.StatusOK {
+		if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
 			return ObjectInfo{}, httpRespToErrorResponse(resp, bucketName, objectName)
 		}
 	}

vendor/github.com/minio/minio-go/api.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2015-2017 Minio, Inc.
+ * Copyright 2015-2018 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -48,7 +48,7 @@ type Client struct {
 	///  Standard options.
 
 	// Parsed endpoint url provided by the user.
-	endpointURL url.URL
+	endpointURL *url.URL
 
 	// Holds various credential providers.
 	credsProvider *credentials.Credentials
@@ -81,12 +81,25 @@ type Client struct {
 
 	// Random seed.
 	random *rand.Rand
+
+	// lookup indicates type of url lookup supported by server. If not specified,
+	// default to Auto.
+	lookup BucketLookupType
+}
+
+// Options for New method
+type Options struct {
+	Creds        *credentials.Credentials
+	Secure       bool
+	Region       string
+	BucketLookup BucketLookupType
+	// Add future fields here
 }
 
 // Global constants.
 const (
 	libraryName    = "minio-go"
-	libraryVersion = "4.0.6"
+	libraryVersion = "5.0.1"
 )
 
 // User Agent should always following the below style.
@@ -98,11 +111,21 @@ const (
 	libraryUserAgent       = libraryUserAgentPrefix + libraryName + "/" + libraryVersion
 )
 
+// BucketLookupType is type of url lookup supported by server.
+type BucketLookupType int
+
+// Different types of url lookup supported by the server.Initialized to BucketLookupAuto
+const (
+	BucketLookupAuto BucketLookupType = iota
+	BucketLookupDNS
+	BucketLookupPath
+)
+
 // NewV2 - instantiate minio client with Amazon S3 signature version
 // '2' compatibility.
 func NewV2(endpoint string, accessKeyID, secretAccessKey string, secure bool) (*Client, error) {
 	creds := credentials.NewStaticV2(accessKeyID, secretAccessKey, "")
-	clnt, err := privateNew(endpoint, creds, secure, "")
+	clnt, err := privateNew(endpoint, creds, secure, "", BucketLookupAuto)
 	if err != nil {
 		return nil, err
 	}
@@ -114,7 +137,7 @@ func NewV2(endpoint string, accessKeyID, secretAccessKey string, secure bool) (*
 // '4' compatibility.
 func NewV4(endpoint string, accessKeyID, secretAccessKey string, secure bool) (*Client, error) {
 	creds := credentials.NewStaticV4(accessKeyID, secretAccessKey, "")
-	clnt, err := privateNew(endpoint, creds, secure, "")
+	clnt, err := privateNew(endpoint, creds, secure, "", BucketLookupAuto)
 	if err != nil {
 		return nil, err
 	}
@@ -125,16 +148,16 @@ func NewV4(endpoint string, accessKeyID, secretAccessKey string, secure bool) (*
 // New - instantiate minio client, adds automatic verification of signature.
 func New(endpoint, accessKeyID, secretAccessKey string, secure bool) (*Client, error) {
 	creds := credentials.NewStaticV4(accessKeyID, secretAccessKey, "")
-	clnt, err := privateNew(endpoint, creds, secure, "")
+	clnt, err := privateNew(endpoint, creds, secure, "", BucketLookupAuto)
 	if err != nil {
 		return nil, err
 	}
 	// Google cloud storage should be set to signature V2, force it if not.
-	if s3utils.IsGoogleEndpoint(clnt.endpointURL) {
+	if s3utils.IsGoogleEndpoint(*clnt.endpointURL) {
 		clnt.overrideSignerType = credentials.SignatureV2
 	}
 	// If Amazon S3 set to signature v4.
-	if s3utils.IsAmazonEndpoint(clnt.endpointURL) {
+	if s3utils.IsAmazonEndpoint(*clnt.endpointURL) {
 		clnt.overrideSignerType = credentials.SignatureV4
 	}
 	return clnt, nil
@@ -144,7 +167,7 @@ func New(endpoint, accessKeyID, secretAccessKey string, secure bool) (*Client, e
 // for retrieving credentials from various credentials provider such as
 // IAM, File, Env etc.
 func NewWithCredentials(endpoint string, creds *credentials.Credentials, secure bool, region string) (*Client, error) {
-	return privateNew(endpoint, creds, secure, region)
+	return privateNew(endpoint, creds, secure, region, BucketLookupAuto)
 }
 
 // NewWithRegion - instantiate minio client, with region configured. Unlike New(),
@@ -152,7 +175,12 @@ func NewWithCredentials(endpoint string, creds *credentials.Credentials, secure
 // Use this function when if your application deals with single region.
 func NewWithRegion(endpoint, accessKeyID, secretAccessKey string, secure bool, region string) (*Client, error) {
 	creds := credentials.NewStaticV4(accessKeyID, secretAccessKey, "")
-	return privateNew(endpoint, creds, secure, region)
+	return privateNew(endpoint, creds, secure, region, BucketLookupAuto)
+}
+
+// NewWithOptions - instantiate minio client with options
+func NewWithOptions(endpoint string, opts *Options) (*Client, error) {
+	return privateNew(endpoint, opts.Creds, opts.Secure, opts.Region, opts.BucketLookup)
 }
 
 // lockedRandSource provides protected rand source, implements rand.Source interface.
@@ -177,32 +205,68 @@ func (r *lockedRandSource) Seed(seed int64) {
 	r.lk.Unlock()
 }
 
-// getRegionFromURL - parse region from URL if present.
-func getRegionFromURL(u url.URL) (region string) {
-	region = ""
-	if s3utils.IsGoogleEndpoint(u) {
-		return
-	} else if s3utils.IsAmazonChinaEndpoint(u) {
-		// For china specifically we need to set everything to
-		// cn-north-1 for now, there is no easier way until AWS S3
-		// provides a cleaner compatible API across "us-east-1" and
-		// China region.
-		return "cn-north-1"
-	} else if s3utils.IsAmazonGovCloudEndpoint(u) {
-		// For us-gov specifically we need to set everything to
-		// us-gov-west-1 for now, there is no easier way until AWS S3
-		// provides a cleaner compatible API across "us-east-1" and
-		// Gov cloud region.
-		return "us-gov-west-1"
+// Redirect requests by re signing the request.
+func (c *Client) redirectHeaders(req *http.Request, via []*http.Request) error {
+	if len(via) >= 5 {
+		return errors.New("stopped after 5 redirects")
 	}
-	parts := s3utils.AmazonS3Host.FindStringSubmatch(u.Host)
-	if len(parts) > 1 {
-		region = parts[1]
+	if len(via) == 0 {
+		return nil
 	}
-	return region
+	lastRequest := via[len(via)-1]
+	var reAuth bool
+	for attr, val := range lastRequest.Header {
+		// if hosts do not match do not copy Authorization header
+		if attr == "Authorization" && req.Host != lastRequest.Host {
+			reAuth = true
+			continue
+		}
+		if _, ok := req.Header[attr]; !ok {
+			req.Header[attr] = val
+		}
+	}
+
+	*c.endpointURL = *req.URL
+
+	value, err := c.credsProvider.Get()
+	if err != nil {
+		return err
+	}
+	var (
+		signerType      = value.SignerType
+		accessKeyID     = value.AccessKeyID
+		secretAccessKey = value.SecretAccessKey
+		sessionToken    = value.SessionToken
+		region          = c.region
+	)
+
+	// Custom signer set then override the behavior.
+	if c.overrideSignerType != credentials.SignatureDefault {
+		signerType = c.overrideSignerType
+	}
+
+	// If signerType returned by credentials helper is anonymous,
+	// then do not sign regardless of signerType override.
+	if value.SignerType == credentials.SignatureAnonymous {
+		signerType = credentials.SignatureAnonymous
+	}
+
+	if reAuth {
+		// Check if there is no region override, if not get it from the URL if possible.
+		if region == "" {
+			region = s3utils.GetRegionFromURL(*c.endpointURL)
+		}
+		switch {
+		case signerType.IsV2():
+			return errors.New("signature V2 cannot support redirection")
+		case signerType.IsV4():
+			req = s3signer.SignV4(*req, accessKeyID, secretAccessKey, sessionToken, getDefaultLocation(*c.endpointURL, region))
+		}
+	}
+	return nil
 }
 
-func privateNew(endpoint string, creds *credentials.Credentials, secure bool, region string) (*Client, error) {
+func privateNew(endpoint string, creds *credentials.Credentials, secure bool, region string, lookup BucketLookupType) (*Client, error) {
 	// construct endpoint.
 	endpointURL, err := getEndpointURL(endpoint, secure)
 	if err != nil {
@@ -219,16 +283,17 @@ func privateNew(endpoint string, creds *credentials.Credentials, secure bool, re
 	clnt.secure = secure
 
 	// Save endpoint URL, user agent for future uses.
-	clnt.endpointURL = *endpointURL
+	clnt.endpointURL = endpointURL
 
 	// Instantiate http client and bucket location cache.
 	clnt.httpClient = &http.Client{
-		Transport: defaultMinioTransport,
+		Transport:     DefaultTransport,
+		CheckRedirect: clnt.redirectHeaders,
 	}
 
 	// Sets custom region, if region is empty bucket location cache is used automatically.
 	if region == "" {
-		region = getRegionFromURL(clnt.endpointURL)
+		region = s3utils.GetRegionFromURL(*clnt.endpointURL)
 	}
 	clnt.region = region
 
@@ -238,6 +303,9 @@ func privateNew(endpoint string, creds *credentials.Credentials, secure bool, re
 	// Introduce a new locked random seed.
 	clnt.random = rand.New(&lockedRandSource{src: rand.NewSource(time.Now().UTC().UnixNano())})
 
+	// Sets bucket lookup style, whether server accepts DNS or Path lookup. Default is Auto - determined
+	// by the SDK. When Auto is specified, DNS lookup is used for Amazon/Google cloud endpoints and Path for all other endpoints.
+	clnt.lookup = lookup
 	// Return.
 	return clnt, nil
 }
@@ -269,7 +337,7 @@ func (c *Client) SetCustomTransport(customHTTPTransport http.RoundTripper) {
 	//           TLSClientConfig:    &tls.Config{RootCAs: pool},
 	//           DisableCompression: true,
 	//   }
-	//   api.SetTransport(tr)
+	//   api.SetCustomTransport(tr)
 	//
 	if c.httpClient != nil {
 		c.httpClient.Transport = customHTTPTransport
@@ -301,7 +369,7 @@ func (c *Client) TraceOff() {
 // please vist -
 // http://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html
 func (c *Client) SetS3TransferAccelerate(accelerateEndpoint string) {
-	if s3utils.IsAmazonEndpoint(c.endpointURL) {
+	if s3utils.IsAmazonEndpoint(*c.endpointURL) {
 		c.s3AccelerateEndpoint = accelerateEndpoint
 	}
 }
@@ -405,6 +473,7 @@ func (c Client) dumpHTTP(req *http.Request, resp *http.Response) error {
 			}
 		}
 	}
+
 	// Write response to trace output.
 	_, err = fmt.Fprint(c.traceOutput, strings.TrimSuffix(string(respTrace), "\r\n"))
 	if err != nil {
@@ -423,38 +492,22 @@ func (c Client) dumpHTTP(req *http.Request, resp *http.Response) error {
 
 // do - execute http request.
 func (c Client) do(req *http.Request) (*http.Response, error) {
-	var resp *http.Response
-	var err error
-	// Do the request in a loop in case of 307 http is met since golang still doesn't
-	// handle properly this situation (https://github.com/golang/go/issues/7912)
-	for {
-		resp, err = c.httpClient.Do(req)
-		if err != nil {
-			// Handle this specifically for now until future Golang
-			// versions fix this issue properly.
-			urlErr, ok := err.(*url.Error)
-			if ok && strings.Contains(urlErr.Err.Error(), "EOF") {
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		// Handle this specifically for now until future Golang versions fix this issue properly.
+		if urlErr, ok := err.(*url.Error); ok {
+			if strings.Contains(urlErr.Err.Error(), "EOF") {
 				return nil, &url.Error{
 					Op:  urlErr.Op,
 					URL: urlErr.URL,
 					Err: errors.New("Connection closed by foreign host " + urlErr.URL + ". Retry again."),
 				}
 			}
-			return nil, err
-		}
-		// Redo the request with the new redirect url if http 307 is returned, quit the loop otherwise
-		if resp != nil && resp.StatusCode == http.StatusTemporaryRedirect {
-			newURL, err := url.Parse(resp.Header.Get("Location"))
-			if err != nil {
-				break
-			}
-			req.URL = newURL
-		} else {
-			break
 		}
+		return nil, err
 	}
 
-	// Response cannot be non-nil, report if its the case.
+	// Response cannot be non-nil, report error if thats the case.
 	if resp == nil {
 		msg := "Response is empty. " + reportIssue
 		return nil, ErrInvalidArgument(msg)
@@ -467,6 +520,7 @@ func (c Client) do(req *http.Request) (*http.Response, error) {
 			return nil, err
 		}
 	}
+
 	return resp, nil
 }
 
@@ -538,6 +592,7 @@ func (c Client) executeMethod(ctx context.Context, method string, metadata reque
 			}
 			return nil, err
 		}
+
 		// Add context to request
 		req = req.WithContext(ctx)
 
@@ -634,12 +689,15 @@ func (c Client) newRequest(method string, metadata requestMetadata) (req *http.R
 			// happen when GetBucketLocation() is disabled using IAM policies.
 		}
 		if location == "" {
-			location = getDefaultLocation(c.endpointURL, c.region)
+			location = getDefaultLocation(*c.endpointURL, c.region)
 		}
 	}
 
+	// Look if target url supports virtual host.
+	isVirtualHost := c.isVirtualHostStyleRequest(*c.endpointURL, metadata.bucketName)
+
 	// Construct a new target URL.
-	targetURL, err := c.makeTargetURL(metadata.bucketName, metadata.objectName, location, metadata.queryValues)
+	targetURL, err := c.makeTargetURL(metadata.bucketName, metadata.objectName, location, isVirtualHost, metadata.queryValues)
 	if err != nil {
 		return nil, err
 	}
@@ -681,7 +739,7 @@ func (c Client) newRequest(method string, metadata requestMetadata) (req *http.R
 		}
 		if signerType.IsV2() {
 			// Presign URL with signature v2.
-			req = s3signer.PreSignV2(*req, accessKeyID, secretAccessKey, metadata.expires)
+			req = s3signer.PreSignV2(*req, accessKeyID, secretAccessKey, metadata.expires, isVirtualHost)
 		} else if signerType.IsV4() {
 			// Presign URL with signature v4.
 			req = s3signer.PreSignV4(*req, accessKeyID, secretAccessKey, sessionToken, location, metadata.expires)
@@ -727,7 +785,7 @@ func (c Client) newRequest(method string, metadata requestMetadata) (req *http.R
 	switch {
 	case signerType.IsV2():
 		// Add signature version '2' authorization header.
-		req = s3signer.SignV2(*req, accessKeyID, secretAccessKey)
+		req = s3signer.SignV2(*req, accessKeyID, secretAccessKey, isVirtualHost)
 	case metadata.objectName != "" && method == "PUT" && metadata.customHeader.Get("X-Amz-Copy-Source") == "" && !c.secure:
 		// Streaming signature is used by default for a PUT object request. Additionally we also
 		// look if the initialized client is secure, if yes then we don't need to perform
@@ -759,10 +817,10 @@ func (c Client) setUserAgent(req *http.Request) {
 }
 
 // makeTargetURL make a new target url.
-func (c Client) makeTargetURL(bucketName, objectName, bucketLocation string, queryValues url.Values) (*url.URL, error) {
+func (c Client) makeTargetURL(bucketName, objectName, bucketLocation string, isVirtualHostStyle bool, queryValues url.Values) (*url.URL, error) {
 	host := c.endpointURL.Host
 	// For Amazon S3 endpoint, try to fetch location based endpoint.
-	if s3utils.IsAmazonEndpoint(c.endpointURL) {
+	if s3utils.IsAmazonEndpoint(*c.endpointURL) {
 		if c.s3AccelerateEndpoint != "" && bucketName != "" {
 			// http://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html
 			// Disable transfer acceleration for non-compliant bucket names.
@@ -775,7 +833,7 @@ func (c Client) makeTargetURL(bucketName, objectName, bucketLocation string, que
 			host = c.s3AccelerateEndpoint
 		} else {
 			// Do not change the host if the endpoint URL is a FIPS S3 endpoint.
-			if !s3utils.IsAmazonFIPSGovCloudEndpoint(c.endpointURL) {
+			if !s3utils.IsAmazonFIPSGovCloudEndpoint(*c.endpointURL) {
 				// Fetch new host based on the bucket location.
 				host = getS3Endpoint(bucketLocation)
 			}
@@ -798,9 +856,6 @@ func (c Client) makeTargetURL(bucketName, objectName, bucketLocation string, que
 	// Make URL only if bucketName is available, otherwise use the
 	// endpoint URL.
 	if bucketName != "" {
-		// Save if target url will have buckets which suppport virtual host.
-		isVirtualHostStyle := s3utils.IsVirtualHostSupported(c.endpointURL, bucketName)
-
 		// If endpoint supports virtual host style use that always.
 		// Currently only S3 and Google Cloud Storage would support
 		// virtual host style.
@@ -823,10 +878,23 @@ func (c Client) makeTargetURL(bucketName, objectName, bucketLocation string, que
 		urlStr = urlStr + "?" + s3utils.QueryEncode(queryValues)
 	}
 
-	u, err := url.Parse(urlStr)
-	if err != nil {
-		return nil, err
+	return url.Parse(urlStr)
+}
+
+// returns true if virtual hosted style requests are to be used.
+func (c *Client) isVirtualHostStyleRequest(url url.URL, bucketName string) bool {
+	if bucketName == "" {
+		return false
 	}
 
-	return u, nil
+	if c.lookup == BucketLookupDNS {
+		return true
+	}
+	if c.lookup == BucketLookupPath {
+		return false
+	}
+
+	// default to virtual only for Amazon/Google  storage. In all other cases use
+	// path style requests
+	return s3utils.IsVirtualHostSupported(url, bucketName)
 }

vendor/github.com/minio/minio-go/appveyor.yml

@@ -17,11 +17,10 @@ install:
   - go version
   - go env
   - go get -u github.com/golang/lint/golint
-  - go get -u github.com/go-ini/ini
-  - go get -u github.com/mitchellh/go-homedir
   - go get -u github.com/remyoudompheng/go-misc/deadcode
   - go get -u github.com/gordonklaus/ineffassign
-  - go get -u github.com/dustin/go-humanize
+  - go get -u golang.org/x/crypto/argon2
+  - go get -t ./...
 
 # to run your custom scripts instead of automatic MSBuild
 build_script:

vendor/github.com/minio/minio-go/bucket-cache.go

@@ -203,7 +203,9 @@ func (c Client) getBucketLocationRequest(bucketName string) (*http.Request, erro
 	}
 
 	if signerType.IsV2() {
-		req = s3signer.SignV2(*req, accessKeyID, secretAccessKey)
+		// Get Bucket Location calls should be always path style
+		isVirtualHost := false
+		req = s3signer.SignV2(*req, accessKeyID, secretAccessKey, isVirtualHost)
 		return req, nil
 	}
 

vendor/github.com/minio/minio-go/bucket-notification.go

@@ -19,7 +19,8 @@ package minio
 
 import (
 	"encoding/xml"
-	"reflect"
+
+	"github.com/minio/minio-go/pkg/set"
 )
 
 // NotificationEventType is a S3 notification event associated to the bucket notification configuration
@@ -96,7 +97,7 @@ type NotificationConfig struct {
 
 // NewNotificationConfig creates one notification config and sets the given ARN
 func NewNotificationConfig(arn Arn) NotificationConfig {
-	return NotificationConfig{Arn: arn}
+	return NotificationConfig{Arn: arn, Filter: &Filter{}}
 }
 
 // AddEvents adds one event to the current notification config
@@ -163,39 +164,79 @@ type BucketNotification struct {
 }
 
 // AddTopic adds a given topic config to the general bucket notification config
-func (b *BucketNotification) AddTopic(topicConfig NotificationConfig) {
+func (b *BucketNotification) AddTopic(topicConfig NotificationConfig) bool {
 	newTopicConfig := TopicConfig{NotificationConfig: topicConfig, Topic: topicConfig.Arn.String()}
 	for _, n := range b.TopicConfigs {
-		if reflect.DeepEqual(n, newTopicConfig) {
-			// Avoid adding duplicated entry
-			return
+		// If new config matches existing one
+		if n.Topic == newTopicConfig.Arn.String() && newTopicConfig.Filter == n.Filter {
+
+			existingConfig := set.NewStringSet()
+			for _, v := range n.Events {
+				existingConfig.Add(string(v))
+			}
+
+			newConfig := set.NewStringSet()
+			for _, v := range topicConfig.Events {
+				newConfig.Add(string(v))
+			}
+
+			if !newConfig.Intersection(existingConfig).IsEmpty() {
+				return false
+			}
 		}
 	}
 	b.TopicConfigs = append(b.TopicConfigs, newTopicConfig)
+	return true
 }
 
 // AddQueue adds a given queue config to the general bucket notification config
-func (b *BucketNotification) AddQueue(queueConfig NotificationConfig) {
+func (b *BucketNotification) AddQueue(queueConfig NotificationConfig) bool {
 	newQueueConfig := QueueConfig{NotificationConfig: queueConfig, Queue: queueConfig.Arn.String()}
 	for _, n := range b.QueueConfigs {
-		if reflect.DeepEqual(n, newQueueConfig) {
-			// Avoid adding duplicated entry
-			return
+		if n.Queue == newQueueConfig.Arn.String() && newQueueConfig.Filter == n.Filter {
+
+			existingConfig := set.NewStringSet()
+			for _, v := range n.Events {
+				existingConfig.Add(string(v))
+			}
+
+			newConfig := set.NewStringSet()
+			for _, v := range queueConfig.Events {
+				newConfig.Add(string(v))
+			}
+
+			if !newConfig.Intersection(existingConfig).IsEmpty() {
+				return false
+			}
 		}
 	}
 	b.QueueConfigs = append(b.QueueConfigs, newQueueConfig)
+	return true
 }
 
 // AddLambda adds a given lambda config to the general bucket notification config
-func (b *BucketNotification) AddLambda(lambdaConfig NotificationConfig) {
+func (b *BucketNotification) AddLambda(lambdaConfig NotificationConfig) bool {
 	newLambdaConfig := LambdaConfig{NotificationConfig: lambdaConfig, Lambda: lambdaConfig.Arn.String()}
 	for _, n := range b.LambdaConfigs {
-		if reflect.DeepEqual(n, newLambdaConfig) {
-			// Avoid adding duplicated entry
-			return
+		if n.Lambda == newLambdaConfig.Arn.String() && newLambdaConfig.Filter == n.Filter {
+
+			existingConfig := set.NewStringSet()
+			for _, v := range n.Events {
+				existingConfig.Add(string(v))
+			}
+
+			newConfig := set.NewStringSet()
+			for _, v := range lambdaConfig.Events {
+				newConfig.Add(string(v))
+			}
+
+			if !newConfig.Intersection(existingConfig).IsEmpty() {
+				return false
+			}
 		}
 	}
 	b.LambdaConfigs = append(b.LambdaConfigs, newLambdaConfig)
+	return true
 }
 
 // RemoveTopicByArn removes all topic configurations that match the exact specified ARN

vendor/github.com/minio/minio-go/constants.go

@@ -59,12 +59,5 @@ const (
 	iso8601DateFormat = "20060102T150405Z"
 )
 
-// Encryption headers stored along with the object.
-const (
-	amzHeaderIV      = "X-Amz-Meta-X-Amz-Iv"
-	amzHeaderKey     = "X-Amz-Meta-X-Amz-Key"
-	amzHeaderMatDesc = "X-Amz-Meta-X-Amz-Matdesc"
-)
-
 // Storage class header constant.
 const amzStorageClass = "X-Amz-Storage-Class"

vendor/github.com/minio/minio-go/core.go

@@ -78,6 +78,8 @@ func (c Core) PutObject(bucket, object string, data io.Reader, size int64, md5Ba
 			opts.ContentEncoding = v
 		} else if strings.ToLower(k) == "content-disposition" {
 			opts.ContentDisposition = v
+		} else if strings.ToLower(k) == "content-language" {
+			opts.ContentLanguage = v
 		} else if strings.ToLower(k) == "content-type" {
 			opts.ContentType = v
 		} else if strings.ToLower(k) == "cache-control" {
@@ -103,13 +105,7 @@ func (c Core) ListMultipartUploads(bucket, prefix, keyMarker, uploadIDMarker, de
 
 // PutObjectPart - Upload an object part.
 func (c Core) PutObjectPart(bucket, object, uploadID string, partID int, data io.Reader, size int64, md5Base64, sha256Hex string) (ObjectPart, error) {
-	return c.PutObjectPartWithMetadata(bucket, object, uploadID, partID, data, size, md5Base64, sha256Hex, nil)
-}
-
-// PutObjectPartWithMetadata - upload an object part with additional request metadata.
-func (c Core) PutObjectPartWithMetadata(bucket, object, uploadID string, partID int, data io.Reader,
-	size int64, md5Base64, sha256Hex string, metadata map[string]string) (ObjectPart, error) {
-	return c.uploadPart(context.Background(), bucket, object, uploadID, data, partID, md5Base64, sha256Hex, size, metadata)
+	return c.uploadPart(context.Background(), bucket, object, uploadID, data, partID, md5Base64, sha256Hex, size, nil)
 }
 
 // ListObjectParts - List uploaded parts of an incomplete upload.x

vendor/github.com/minio/minio-go/pkg/credentials/chain.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,8 +17,6 @@
 
 package credentials
 
-import "fmt"
-
 // A Chain will search for a provider which returns credentials
 // and cache that provider until Retrieve is called again.
 //
@@ -27,11 +25,11 @@ import "fmt"
 // Providers in the list.
 //
 // If none of the Providers retrieve valid credentials Value, ChainProvider's
-// Retrieve() will return the error, collecting all errors from all providers.
+// Retrieve() will return the no credentials value.
 //
 // If a Provider is found which returns valid credentials Value ChainProvider
 // will cache that Provider for all calls to IsExpired(), until Retrieve is
-// called again.
+// called again after IsExpired() is true.
 //
 //     creds := credentials.NewChainCredentials(
 //         []credentials.Provider{
@@ -58,28 +56,30 @@ func NewChainCredentials(providers []Provider) *Credentials {
 	})
 }
 
-// Retrieve returns the credentials value or error if no provider returned
-// without error.
+// Retrieve returns the credentials value, returns no credentials(anonymous)
+// if no credentials provider returned any value.
 //
-// If a provider is found it will be cached and any calls to IsExpired()
-// will return the expired state of the cached provider.
+// If a provider is found with credentials, it will be cached and any calls
+// to IsExpired() will return the expired state of the cached provider.
 func (c *Chain) Retrieve() (Value, error) {
-	var errs []error
 	for _, p := range c.Providers {
-		creds, err := p.Retrieve()
-		if err != nil {
-			errs = append(errs, err)
+		creds, _ := p.Retrieve()
+		// Always prioritize non-anonymous providers, if any.
+		if creds.AccessKeyID == "" && creds.SecretAccessKey == "" {
 			continue
-		} // Success.
+		}
 		c.curr = p
 		return creds, nil
 	}
-	c.curr = nil
-	return Value{}, fmt.Errorf("No valid providers found %v", errs)
+	// At this point we have exhausted all the providers and
+	// are left without any credentials return anonymous.
+	return Value{
+		SignerType: SignatureAnonymous,
+	}, nil
 }
 
 // IsExpired will returned the expired state of the currently cached provider
-// if there is one.  If there is no current provider, true will be returned.
+// if there is one. If there is no current provider, true will be returned.
 func (c *Chain) IsExpired() bool {
 	if c.curr != nil {
 		return c.curr.IsExpired()

vendor/github.com/minio/minio-go/pkg/credentials/credentials.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/credentials/doc.go

@@ -1,3 +1,20 @@
+/*
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2017 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 // Package credentials provides credential retrieval and management
 // for S3 compatible object storage.
 //

vendor/github.com/minio/minio-go/pkg/credentials/env_aws.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/credentials/env_minio.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/credentials/file_aws_credentials.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@ import (
 	"path/filepath"
 
 	"github.com/go-ini/ini"
-	homedir "github.com/minio/go-homedir"
+	homedir "github.com/mitchellh/go-homedir"
 )
 
 // A FileAWSCredentials retrieves credentials from the current user's home

vendor/github.com/minio/minio-go/pkg/credentials/file_minio_client.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@ import (
 	"path/filepath"
 	"runtime"
 
-	homedir "github.com/minio/go-homedir"
+	homedir "github.com/mitchellh/go-homedir"
 )
 
 // A FileMinioClient retrieves credentials from the current user's home

vendor/github.com/minio/minio-go/pkg/credentials/iam_aws.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -46,18 +46,6 @@ type IAM struct {
 	endpoint string
 }
 
-// redirectHeaders copies all headers when following a redirect URL.
-// This won't be needed anymore from go 1.8 (https://github.com/golang/go/issues/4800)
-func redirectHeaders(req *http.Request, via []*http.Request) error {
-	if len(via) == 0 {
-		return nil
-	}
-	for key, val := range via[0].Header {
-		req.Header[key] = val
-	}
-	return nil
-}
-
 // IAM Roles for Amazon EC2
 // http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html
 const (
@@ -74,8 +62,7 @@ func NewIAM(endpoint string) *Credentials {
 	}
 	p := &IAM{
 		Client: &http.Client{
-			Transport:     http.DefaultTransport,
-			CheckRedirect: redirectHeaders,
+			Transport: http.DefaultTransport,
 		},
 		endpoint: endpoint,
 	}

vendor/github.com/minio/minio-go/pkg/credentials/signature-type.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2017 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/credentials/static.go

@@ -1,6 +1,6 @@
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * (C) 2017 Minio, Inc.
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/encrypt/cbc.go

@@ -1,293 +0,0 @@
-/*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package encrypt
-
-import (
-	"bytes"
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"io"
-)
-
-// Crypt mode - encryption or decryption
-type cryptMode int
-
-const (
-	encryptMode cryptMode = iota
-	decryptMode
-)
-
-// CBCSecureMaterials encrypts/decrypts data using AES CBC algorithm
-type CBCSecureMaterials struct {
-
-	// Data stream to encrypt/decrypt
-	stream io.Reader
-
-	// Last internal error
-	err error
-
-	// End of file reached
-	eof bool
-
-	// Holds initial data
-	srcBuf *bytes.Buffer
-
-	// Holds transformed data (encrypted or decrypted)
-	dstBuf *bytes.Buffer
-
-	// Encryption algorithm
-	encryptionKey Key
-
-	// Key to encrypts/decrypts data
-	contentKey []byte
-
-	// Encrypted form of contentKey
-	cryptedKey []byte
-
-	// Initialization vector
-	iv []byte
-
-	// matDesc - currently unused
-	matDesc []byte
-
-	// Indicate if we are going to encrypt or decrypt
-	cryptMode cryptMode
-
-	// Helper that encrypts/decrypts data
-	blockMode cipher.BlockMode
-}
-
-// NewCBCSecureMaterials builds new CBC crypter module with
-// the specified encryption key (symmetric or asymmetric)
-func NewCBCSecureMaterials(key Key) (*CBCSecureMaterials, error) {
-	if key == nil {
-		return nil, errors.New("Unable to recognize empty encryption properties")
-	}
-	return &CBCSecureMaterials{
-		srcBuf:        bytes.NewBuffer([]byte{}),
-		dstBuf:        bytes.NewBuffer([]byte{}),
-		encryptionKey: key,
-		matDesc:       []byte("{}"),
-	}, nil
-
-}
-
-// Close implements closes the internal stream.
-func (s *CBCSecureMaterials) Close() error {
-	closer, ok := s.stream.(io.Closer)
-	if ok {
-		return closer.Close()
-	}
-	return nil
-}
-
-// SetupEncryptMode - tells CBC that we are going to encrypt data
-func (s *CBCSecureMaterials) SetupEncryptMode(stream io.Reader) error {
-	// Set mode to encrypt
-	s.cryptMode = encryptMode
-
-	// Set underlying reader
-	s.stream = stream
-
-	s.eof = false
-	s.srcBuf.Reset()
-	s.dstBuf.Reset()
-
-	var err error
-
-	// Generate random content key
-	s.contentKey = make([]byte, aes.BlockSize*2)
-	if _, err := rand.Read(s.contentKey); err != nil {
-		return err
-	}
-	// Encrypt content key
-	s.cryptedKey, err = s.encryptionKey.Encrypt(s.contentKey)
-	if err != nil {
-		return err
-	}
-	// Generate random IV
-	s.iv = make([]byte, aes.BlockSize)
-	if _, err = rand.Read(s.iv); err != nil {
-		return err
-	}
-	// New cipher
-	encryptContentBlock, err := aes.NewCipher(s.contentKey)
-	if err != nil {
-		return err
-	}
-
-	s.blockMode = cipher.NewCBCEncrypter(encryptContentBlock, s.iv)
-
-	return nil
-}
-
-// SetupDecryptMode - tells CBC that we are going to decrypt data
-func (s *CBCSecureMaterials) SetupDecryptMode(stream io.Reader, iv string, key string) error {
-	// Set mode to decrypt
-	s.cryptMode = decryptMode
-
-	// Set underlying reader
-	s.stream = stream
-
-	// Reset
-	s.eof = false
-	s.srcBuf.Reset()
-	s.dstBuf.Reset()
-
-	var err error
-
-	// Get IV
-	s.iv, err = base64.StdEncoding.DecodeString(iv)
-	if err != nil {
-		return err
-	}
-
-	// Get encrypted content key
-	s.cryptedKey, err = base64.StdEncoding.DecodeString(key)
-	if err != nil {
-		return err
-	}
-
-	// Decrypt content key
-	s.contentKey, err = s.encryptionKey.Decrypt(s.cryptedKey)
-	if err != nil {
-		return err
-	}
-
-	// New cipher
-	decryptContentBlock, err := aes.NewCipher(s.contentKey)
-	if err != nil {
-		return err
-	}
-
-	s.blockMode = cipher.NewCBCDecrypter(decryptContentBlock, s.iv)
-	return nil
-}
-
-// GetIV - return randomly generated IV (per S3 object), base64 encoded.
-func (s *CBCSecureMaterials) GetIV() string {
-	return base64.StdEncoding.EncodeToString(s.iv)
-}
-
-// GetKey - return content encrypting key (cek) in encrypted form, base64 encoded.
-func (s *CBCSecureMaterials) GetKey() string {
-	return base64.StdEncoding.EncodeToString(s.cryptedKey)
-}
-
-// GetDesc - user provided encryption material description in JSON (UTF8) format.
-func (s *CBCSecureMaterials) GetDesc() string {
-	return string(s.matDesc)
-}
-
-// Fill buf with encrypted/decrypted data
-func (s *CBCSecureMaterials) Read(buf []byte) (n int, err error) {
-	// Always fill buf from bufChunk at the end of this function
-	defer func() {
-		if s.err != nil {
-			n, err = 0, s.err
-		} else {
-			n, err = s.dstBuf.Read(buf)
-		}
-	}()
-
-	// Return
-	if s.eof {
-		return
-	}
-
-	// Fill dest buffer if its length is less than buf
-	for !s.eof && s.dstBuf.Len() < len(buf) {
-
-		srcPart := make([]byte, aes.BlockSize)
-		dstPart := make([]byte, aes.BlockSize)
-
-		// Fill src buffer
-		for s.srcBuf.Len() < aes.BlockSize*2 {
-			_, err = io.CopyN(s.srcBuf, s.stream, aes.BlockSize)
-			if err != nil {
-				break
-			}
-		}
-
-		// Quit immediately for errors other than io.EOF
-		if err != nil && err != io.EOF {
-			s.err = err
-			return
-		}
-
-		// Mark current encrypting/decrypting as finished
-		s.eof = (err == io.EOF)
-
-		if s.eof && s.cryptMode == encryptMode {
-			if srcPart, err = pkcs5Pad(s.srcBuf.Bytes(), aes.BlockSize); err != nil {
-				s.err = err
-				return
-			}
-		} else {
-			_, _ = s.srcBuf.Read(srcPart)
-		}
-
-		// Crypt srcPart content
-		for len(srcPart) > 0 {
-
-			// Crypt current part
-			s.blockMode.CryptBlocks(dstPart, srcPart[:aes.BlockSize])
-
-			// Unpad when this is the last part and we are decrypting
-			if s.eof && s.cryptMode == decryptMode {
-				dstPart, err = pkcs5Unpad(dstPart, aes.BlockSize)
-				if err != nil {
-					s.err = err
-					return
-				}
-			}
-
-			// Send crypted data to dstBuf
-			if _, wErr := s.dstBuf.Write(dstPart); wErr != nil {
-				s.err = wErr
-				return
-			}
-			// Move to the next part
-			srcPart = srcPart[aes.BlockSize:]
-		}
-	}
-	return
-}
-
-// Unpad a set of bytes following PKCS5 algorithm
-func pkcs5Unpad(buf []byte, blockSize int) ([]byte, error) {
-	len := len(buf)
-	if len == 0 {
-		return nil, errors.New("buffer is empty")
-	}
-	pad := int(buf[len-1])
-	if pad > len || pad > blockSize {
-		return nil, errors.New("invalid padding size")
-	}
-	return buf[:len-pad], nil
-}
-
-// Pad a set of bytes following PKCS5 algorithm
-func pkcs5Pad(buf []byte, blockSize int) ([]byte, error) {
-	len := len(buf)
-	pad := blockSize - (len % blockSize)
-	padText := bytes.Repeat([]byte{byte(pad)}, pad)
-	return append(buf, padText...), nil
-}

vendor/github.com/minio/minio-go/pkg/encrypt/interface.go

@@ -1,53 +0,0 @@
-/*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// Package encrypt implements a generic interface to encrypt any stream of data.
-// currently this package implements two types of encryption
-// - Symmetric encryption using AES.
-// - Asymmetric encrytion using RSA.
-package encrypt
-
-import "io"
-
-// Materials - provides generic interface to encrypt any stream of data.
-type Materials interface {
-
-	// Closes the wrapped stream properly, initiated by the caller.
-	Close() error
-
-	// Returns encrypted/decrypted data, io.Reader compatible.
-	Read(b []byte) (int, error)
-
-	// Get randomly generated IV, base64 encoded.
-	GetIV() (iv string)
-
-	// Get content encrypting key (cek) in encrypted form, base64 encoded.
-	GetKey() (key string)
-
-	// Get user provided encryption material description in
-	// JSON (UTF8) format. This is not used, kept for future.
-	GetDesc() (desc string)
-
-	// Setup encrypt mode, further calls of Read() function
-	// will return the encrypted form of data streamed
-	// by the passed reader
-	SetupEncryptMode(stream io.Reader) error
-
-	// Setup decrypted mode, further calls of Read() function
-	// will return the decrypted form of data streamed
-	// by the passed reader
-	SetupDecryptMode(stream io.Reader, iv string, key string) error
-}

vendor/github.com/minio/minio-go/pkg/encrypt/keys.go

@@ -1,165 +0,0 @@
-/*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2017 Minio, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package encrypt
-
-import (
-	"crypto/aes"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"errors"
-)
-
-// Key - generic interface to encrypt/decrypt a key.
-// We use it to encrypt/decrypt content key which is the key
-// that encrypt/decrypt object data.
-type Key interface {
-	// Encrypt data using to the set encryption key
-	Encrypt([]byte) ([]byte, error)
-	// Decrypt data using to the set encryption key
-	Decrypt([]byte) ([]byte, error)
-}
-
-// SymmetricKey - encrypts data with a symmetric master key
-type SymmetricKey struct {
-	masterKey []byte
-}
-
-// Encrypt passed bytes
-func (s *SymmetricKey) Encrypt(plain []byte) ([]byte, error) {
-	// Initialize an AES encryptor using a master key
-	keyBlock, err := aes.NewCipher(s.masterKey)
-	if err != nil {
-		return []byte{}, err
-	}
-
-	// Pad the key before encryption
-	plain, _ = pkcs5Pad(plain, aes.BlockSize)
-
-	encKey := []byte{}
-	encPart := make([]byte, aes.BlockSize)
-
-	// Encrypt the passed key by block
-	for {
-		if len(plain) < aes.BlockSize {
-			break
-		}
-		// Encrypt the passed key
-		keyBlock.Encrypt(encPart, plain[:aes.BlockSize])
-		// Add the encrypted block to the total encrypted key
-		encKey = append(encKey, encPart...)
-		// Pass to the next plain block
-		plain = plain[aes.BlockSize:]
-	}
-	return encKey, nil
-}
-
-// Decrypt passed bytes
-func (s *SymmetricKey) Decrypt(cipher []byte) ([]byte, error) {
-	// Initialize AES decrypter
-	keyBlock, err := aes.NewCipher(s.masterKey)
-	if err != nil {
-		return nil, err
-	}
-
-	var plain []byte
-	plainPart := make([]byte, aes.BlockSize)
-
-	// Decrypt the encrypted data block by block
-	for {
-		if len(cipher) < aes.BlockSize {
-			break
-		}
-		keyBlock.Decrypt(plainPart, cipher[:aes.BlockSize])
-		// Add the decrypted block to the total result
-		plain = append(plain, plainPart...)
-		// Pass to the next cipher block
-		cipher = cipher[aes.BlockSize:]
-	}
-
-	// Unpad the resulted plain data
-	plain, err = pkcs5Unpad(plain, aes.BlockSize)
-	if err != nil {
-		return nil, err
-	}
-
-	return plain, nil
-}
-
-// NewSymmetricKey generates a new encrypt/decrypt crypto using
-// an AES master key password
-func NewSymmetricKey(b []byte) *SymmetricKey {
-	return &SymmetricKey{masterKey: b}
-}
-
-// AsymmetricKey - struct which encrypts/decrypts data
-// using RSA public/private certificates
-type AsymmetricKey struct {
-	publicKey  *rsa.PublicKey
-	privateKey *rsa.PrivateKey
-}
-
-// Encrypt data using public key
-func (a *AsymmetricKey) Encrypt(plain []byte) ([]byte, error) {
-	cipher, err := rsa.EncryptPKCS1v15(rand.Reader, a.publicKey, plain)
-	if err != nil {
-		return nil, err
-	}
-	return cipher, nil
-}
-
-// Decrypt data using public key
-func (a *AsymmetricKey) Decrypt(cipher []byte) ([]byte, error) {
-	cipher, err := rsa.DecryptPKCS1v15(rand.Reader, a.privateKey, cipher)
-	if err != nil {
-		return nil, err
-	}
-	return cipher, nil
-}
-
-// NewAsymmetricKey - generates a crypto module able to encrypt/decrypt
-// data using a pair for private and public key
-func NewAsymmetricKey(privData []byte, pubData []byte) (*AsymmetricKey, error) {
-	// Parse private key from passed data
-	priv, err := x509.ParsePKCS8PrivateKey(privData)
-	if err != nil {
-		return nil, err
-	}
-	privKey, ok := priv.(*rsa.PrivateKey)
-	if !ok {
-		return nil, errors.New("not a valid private key")
-	}
-
-	// Parse public key from passed data
-	pub, err := x509.ParsePKIXPublicKey(pubData)
-	if err != nil {
-		return nil, err
-	}
-
-	pubKey, ok := pub.(*rsa.PublicKey)
-	if !ok {
-		return nil, errors.New("not a valid public key")
-	}
-
-	// Associate the private key with the passed public key
-	privKey.PublicKey = *pubKey
-
-	return &AsymmetricKey{
-		publicKey:  pubKey,
-		privateKey: privKey,
-	}, nil
-}

vendor/github.com/minio/minio-go/pkg/encrypt/server-side.go

@@ -0,0 +1,146 @@
+/*
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2018 Minio, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package encrypt
+
+import (
+	"crypto/md5"
+	"encoding/base64"
+	"errors"
+	"net/http"
+
+	"golang.org/x/crypto/argon2"
+)
+
+const (
+	// sseGenericHeader is the AWS SSE header used for SSE-S3 and SSE-KMS.
+	sseGenericHeader = "X-Amz-Server-Side-Encryption"
+
+	// sseCustomerAlgorithm is the AWS SSE-C algorithm HTTP header key.
+	sseCustomerAlgorithm = sseGenericHeader + "-Customer-Algorithm"
+	// sseCustomerKey is the AWS SSE-C encryption key HTTP header key.
+	sseCustomerKey = sseGenericHeader + "-Customer-Key"
+	// sseCustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key.
+	sseCustomerKeyMD5 = sseGenericHeader + "-Customer-Key-MD5"
+
+	// sseCopyCustomerAlgorithm is the AWS SSE-C algorithm HTTP header key for CopyObject API.
+	sseCopyCustomerAlgorithm = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm"
+	// sseCopyCustomerKey is the AWS SSE-C encryption key HTTP header key for CopyObject API.
+	sseCopyCustomerKey = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key"
+	// sseCopyCustomerKeyMD5 is the AWS SSE-C encryption key MD5 HTTP header key for CopyObject API.
+	sseCopyCustomerKeyMD5 = "X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-MD5"
+)
+
+// PBKDF creates a SSE-C key from the provided password and salt.
+// PBKDF is a password-based key derivation function
+// which can be used to derive a high-entropy cryptographic
+// key from a low-entropy password and a salt.
+type PBKDF func(password, salt []byte) ServerSide
+
+// DefaultPBKDF is the default PBKDF. It uses Argon2id with the
+// recommended parameters from the RFC draft (1 pass, 64 MB memory, 4 threads).
+var DefaultPBKDF PBKDF = func(password, salt []byte) ServerSide {
+	sse := ssec{}
+	copy(sse[:], argon2.IDKey(password, salt, 1, 64*1024, 4, 32))
+	return sse
+}
+
+// Type is the server-side-encryption method. It represents one of
+// the following encryption methods:
+//  - SSE-C: server-side-encryption with customer provided keys
+//  - KMS:   server-side-encryption with managed keys
+//  - S3:    server-side-encryption using S3 storage encryption
+type Type string
+
+const (
+	// SSEC represents server-side-encryption with customer provided keys
+	SSEC Type = "SSE-C"
+	// KMS represents server-side-encryption with managed keys
+	KMS Type = "KMS"
+	// S3 represents server-side-encryption using S3 storage encryption
+	S3 Type = "S3"
+)
+
+// ServerSide is a form of S3 server-side-encryption.
+type ServerSide interface {
+	// Type returns the server-side-encryption method.
+	Type() Type
+
+	// Marshal adds encryption headers to the provided HTTP headers.
+	// It marks an HTTP request as server-side-encryption request
+	// and inserts the required data into the headers.
+	Marshal(h http.Header)
+}
+
+// NewSSE returns a server-side-encryption using S3 storage encryption.
+// Using SSE-S3 the server will encrypt the object with server-managed keys.
+func NewSSE() ServerSide { return s3{} }
+
+// NewSSEC returns a new server-side-encryption using SSE-C and the provided key.
+// The key must be 32 bytes long.
+func NewSSEC(key []byte) (ServerSide, error) {
+	if len(key) != 32 {
+		return nil, errors.New("encrypt: SSE-C key must be 256 bit long")
+	}
+	sse := ssec{}
+	copy(sse[:], key)
+	return sse, nil
+}
+
+// SSECopy transforms a SSE-C encryption into a SSE-C copy
+// encryption. This is required for SSE-C key rotation or a SSE-C
+// copy where the source and the destination should be encrypted.
+//
+// If the provided sse is no SSE-C encryption SSECopy returns
+// sse unmodified.
+func SSECopy(sse ServerSide) ServerSide {
+	if sse == nil || sse.Type() != SSEC {
+		return sse
+	}
+	if sse, ok := sse.(ssec); ok {
+		return ssecCopy(sse)
+	}
+	return sse
+}
+
+type ssec [32]byte
+
+func (s ssec) Type() Type { return SSEC }
+
+func (s ssec) Marshal(h http.Header) {
+	keyMD5 := md5.Sum(s[:])
+	h.Set(sseCustomerAlgorithm, "AES256")
+	h.Set(sseCustomerKey, base64.StdEncoding.EncodeToString(s[:]))
+	h.Set(sseCustomerKeyMD5, base64.StdEncoding.EncodeToString(keyMD5[:]))
+}
+
+type ssecCopy [32]byte
+
+func (s ssecCopy) Type() Type { return SSEC }
+
+func (s ssecCopy) Marshal(h http.Header) {
+	keyMD5 := md5.Sum(s[:])
+	h.Set(sseCopyCustomerAlgorithm, "AES256")
+	h.Set(sseCopyCustomerKey, base64.StdEncoding.EncodeToString(s[:]))
+	h.Set(sseCopyCustomerKeyMD5, base64.StdEncoding.EncodeToString(keyMD5[:]))
+}
+
+type s3 struct{}
+
+func (s s3) Type() Type { return S3 }
+
+func (s s3) Marshal(h http.Header) { h.Set(sseGenericHeader, "AES256") }

vendor/github.com/minio/minio-go/pkg/policy/bucket-policy-condition.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2015 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/pkg/policy/bucket-policy.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2015 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +18,8 @@
 package policy
 
 import (
+	"encoding/json"
+	"errors"
 	"reflect"
 	"strings"
 
@@ -81,6 +84,33 @@ type User struct {
 	CanonicalUser set.StringSet `json:"CanonicalUser,omitempty"`
 }
 
+// UnmarshalJSON is a custom json unmarshaler for Principal field,
+// the reason is that Principal can take a json struct represented by
+// User string but it can also take a string.
+func (u *User) UnmarshalJSON(data []byte) error {
+	// Try to unmarshal data in a struct equal to User, we need it
+	// to avoid infinite recursive call of this function
+	type AliasUser User
+	var au AliasUser
+	err := json.Unmarshal(data, &au)
+	if err == nil {
+		*u = User(au)
+		return nil
+	}
+	// Data type is not known, check if it is a json string
+	// which contains a star, which is permitted in the spec
+	var str string
+	err = json.Unmarshal(data, &str)
+	if err == nil {
+		if str != "*" {
+			return errors.New("unrecognized Principal field")
+		}
+		*u = User{AWS: set.CreateStringSet("*")}
+		return nil
+	}
+	return err
+}
+
 // Statement - minio policy statement
 type Statement struct {
 	Actions    set.StringSet `json:"Action"`
@@ -563,14 +593,14 @@ func GetPolicy(statements []Statement, bucketName string, prefix string) BucketP
 	return policy
 }
 
-// GetPolicies - returns a map of policies rules of given bucket name, prefix in given statements.
-func GetPolicies(statements []Statement, bucketName string) map[string]BucketPolicy {
+// GetPolicies - returns a map of policies of given bucket name, prefix in given statements.
+func GetPolicies(statements []Statement, bucketName, prefix string) map[string]BucketPolicy {
 	policyRules := map[string]BucketPolicy{}
 	objResources := set.NewStringSet()
 	// Search all resources related to objects policy
 	for _, s := range statements {
 		for r := range s.Resources {
-			if strings.HasPrefix(r, awsResourcePrefix+bucketName+"/") {
+			if strings.HasPrefix(r, awsResourcePrefix+bucketName+"/"+prefix) {
 				objResources.Add(r)
 			}
 		}

vendor/github.com/minio/minio-go/pkg/s3signer/request-signature-streaming.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2017 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,7 +33,6 @@ import (
 // http://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-streaming.html#example-signature-calculations-streaming
 const (
 	streamingSignAlgorithm = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
-	streamingEncoding      = "aws-chunked"
 	streamingPayloadHdr    = "AWS4-HMAC-SHA256-PAYLOAD"
 	emptySHA256            = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 	payloadChunkSize       = 64 * 1024
@@ -99,9 +99,8 @@ func prepareStreamingRequest(req *http.Request, sessionToken string, dataLen int
 	if sessionToken != "" {
 		req.Header.Set("X-Amz-Security-Token", sessionToken)
 	}
-	req.Header.Add("Content-Encoding", streamingEncoding)
-	req.Header.Set("X-Amz-Date", timestamp.Format(iso8601DateFormat))
 
+	req.Header.Set("X-Amz-Date", timestamp.Format(iso8601DateFormat))
 	// Set content length with streaming signature for each chunk included.
 	req.ContentLength = getStreamLength(dataLen, int64(payloadChunkSize))
 	req.Header.Set("x-amz-decoded-content-length", strconv.FormatInt(dataLen, 10))

vendor/github.com/minio/minio-go/pkg/s3signer/request-signature-v2.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2015 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,7 +25,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
@@ -39,28 +39,25 @@ const (
 )
 
 // Encode input URL path to URL encoded path.
-func encodeURL2Path(u *url.URL) (path string) {
-	// Encode URL path.
-	if isS3, _ := filepath.Match("*.s3*.amazonaws.com", u.Host); isS3 {
-		bucketName := u.Host[:strings.LastIndex(u.Host, ".s3")]
-		path = "/" + bucketName
-		path += u.Path
-		path = s3utils.EncodePath(path)
-		return
+func encodeURL2Path(req *http.Request, virtualHost bool) (path string) {
+	if virtualHost {
+		reqHost := getHostAddr(req)
+		dotPos := strings.Index(reqHost, ".")
+		if dotPos > -1 {
+			bucketName := reqHost[:dotPos]
+			path = "/" + bucketName
+			path += req.URL.Path
+			path = s3utils.EncodePath(path)
+			return
+		}
 	}
-	if strings.HasSuffix(u.Host, ".storage.googleapis.com") {
-		path = "/" + strings.TrimSuffix(u.Host, ".storage.googleapis.com")
-		path += u.Path
-		path = s3utils.EncodePath(path)
-		return
-	}
-	path = s3utils.EncodePath(u.Path)
+	path = s3utils.EncodePath(req.URL.Path)
 	return
 }
 
 // PreSignV2 - presign the request in following style.
 // https://${S3_BUCKET}.s3.amazonaws.com/${S3_OBJECT}?AWSAccessKeyId=${S3_ACCESS_KEY}&Expires=${TIMESTAMP}&Signature=${SIGNATURE}.
-func PreSignV2(req http.Request, accessKeyID, secretAccessKey string, expires int64) *http.Request {
+func PreSignV2(req http.Request, accessKeyID, secretAccessKey string, expires int64, virtualHost bool) *http.Request {
 	// Presign is not needed for anonymous credentials.
 	if accessKeyID == "" || secretAccessKey == "" {
 		return &req
@@ -76,7 +73,7 @@ func PreSignV2(req http.Request, accessKeyID, secretAccessKey string, expires in
 	}
 
 	// Get presigned string to sign.
-	stringToSign := preStringifyHTTPReq(req)
+	stringToSign := preStringToSignV2(req, virtualHost)
 	hm := hmac.New(sha1.New, []byte(secretAccessKey))
 	hm.Write([]byte(stringToSign))
 
@@ -85,7 +82,7 @@ func PreSignV2(req http.Request, accessKeyID, secretAccessKey string, expires in
 
 	query := req.URL.Query()
 	// Handle specially for Google Cloud Storage.
-	if strings.Contains(req.URL.Host, ".storage.googleapis.com") {
+	if strings.Contains(getHostAddr(&req), ".storage.googleapis.com") {
 		query.Set("GoogleAccessId", accessKeyID)
 	} else {
 		query.Set("AWSAccessKeyId", accessKeyID)
@@ -130,7 +127,7 @@ func PostPresignSignatureV2(policyBase64, secretAccessKey string) string {
 // CanonicalizedProtocolHeaders = <described below>
 
 // SignV2 sign the request before Do() (AWS Signature Version 2).
-func SignV2(req http.Request, accessKeyID, secretAccessKey string) *http.Request {
+func SignV2(req http.Request, accessKeyID, secretAccessKey string, virtualHost bool) *http.Request {
 	// Signature calculation is not needed for anonymous credentials.
 	if accessKeyID == "" || secretAccessKey == "" {
 		return &req
@@ -145,7 +142,7 @@ func SignV2(req http.Request, accessKeyID, secretAccessKey string) *http.Request
 	}
 
 	// Calculate HMAC for secretAccessKey.
-	stringToSign := stringifyHTTPReq(req)
+	stringToSign := stringToSignV2(req, virtualHost)
 	hm := hmac.New(sha1.New, []byte(secretAccessKey))
 	hm.Write([]byte(stringToSign))
 
@@ -170,15 +167,14 @@ func SignV2(req http.Request, accessKeyID, secretAccessKey string) *http.Request
 //	 Expires + "\n" +
 //	 CanonicalizedProtocolHeaders +
 //	 CanonicalizedResource;
-func preStringifyHTTPReq(req http.Request) string {
+func preStringToSignV2(req http.Request, virtualHost bool) string {
 	buf := new(bytes.Buffer)
 	// Write standard headers.
 	writePreSignV2Headers(buf, req)
 	// Write canonicalized protocol headers if any.
 	writeCanonicalizedHeaders(buf, req)
 	// Write canonicalized Query resources if any.
-	isPreSign := true
-	writeCanonicalizedResource(buf, req, isPreSign)
+	writeCanonicalizedResource(buf, req, virtualHost)
 	return buf.String()
 }
 
@@ -198,15 +194,14 @@ func writePreSignV2Headers(buf *bytes.Buffer, req http.Request) {
 //	 Date + "\n" +
 //	 CanonicalizedProtocolHeaders +
 //	 CanonicalizedResource;
-func stringifyHTTPReq(req http.Request) string {
+func stringToSignV2(req http.Request, virtualHost bool) string {
 	buf := new(bytes.Buffer)
 	// Write standard headers.
 	writeSignV2Headers(buf, req)
 	// Write canonicalized protocol headers if any.
 	writeCanonicalizedHeaders(buf, req)
 	// Write canonicalized Query resources if any.
-	isPreSign := false
-	writeCanonicalizedResource(buf, req, isPreSign)
+	writeCanonicalizedResource(buf, req, virtualHost)
 	return buf.String()
 }
 
@@ -253,17 +248,27 @@ func writeCanonicalizedHeaders(buf *bytes.Buffer, req http.Request) {
 	}
 }
 
-// The following list is already sorted and should always be, otherwise we could
-// have signature-related issues
+// AWS S3 Signature V2 calculation rule is give here:
+// http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html#RESTAuthenticationStringToSign
+
+// Whitelist resource list that will be used in query string for signature-V2 calculation.
+// The list should be alphabetically sorted
 var resourceList = []string{
 	"acl",
 	"delete",
+	"lifecycle",
 	"location",
 	"logging",
 	"notification",
 	"partNumber",
 	"policy",
 	"requestPayment",
+	"response-cache-control",
+	"response-content-disposition",
+	"response-content-encoding",
+	"response-content-language",
+	"response-content-type",
+	"response-expires",
 	"torrent",
 	"uploadId",
 	"uploads",
@@ -278,22 +283,11 @@ var resourceList = []string{
 // CanonicalizedResource = [ "/" + Bucket ] +
 // 	  <HTTP-Request-URI, from the protocol name up to the query string> +
 // 	  [ sub-resource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
-func writeCanonicalizedResource(buf *bytes.Buffer, req http.Request, isPreSign bool) {
+func writeCanonicalizedResource(buf *bytes.Buffer, req http.Request, virtualHost bool) {
 	// Save request URL.
 	requestURL := req.URL
 	// Get encoded URL path.
-	path := encodeURL2Path(requestURL)
-	if isPreSign {
-		// Get encoded URL path.
-		if len(requestURL.Query()) > 0 {
-			// Keep the usual queries unescaped for string to sign.
-			query, _ := url.QueryUnescape(s3utils.QueryEncode(requestURL.Query()))
-			path = path + "?" + query
-		}
-		buf.WriteString(path)
-		return
-	}
-	buf.WriteString(path)
+	buf.WriteString(encodeURL2Path(&req, virtualHost))
 	if requestURL.RawQuery != "" {
 		var n int
 		vals, _ := url.ParseQuery(requestURL.RawQuery)

vendor/github.com/minio/minio-go/pkg/s3signer/request-signature-v4.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2015 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -143,7 +144,7 @@ func getCanonicalHeaders(req http.Request, ignoredHeaders map[string]bool) strin
 		buf.WriteByte(':')
 		switch {
 		case k == "host":
-			buf.WriteString(req.URL.Host)
+			buf.WriteString(getHostAddr(&req))
 			fallthrough
 		default:
 			for idx, v := range vals[k] {

vendor/github.com/minio/minio-go/pkg/s3signer/utils.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2015 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +20,7 @@ package s3signer
 import (
 	"crypto/hmac"
 	"crypto/sha256"
+	"net/http"
 )
 
 // unsignedPayload - value to be set to X-Amz-Content-Sha256 header when
@@ -37,3 +39,11 @@ func sumHMAC(key []byte, data []byte) []byte {
 	hash.Write(data)
 	return hash.Sum(nil)
 }
+
+// getHostAddr returns host header if available, otherwise returns host from URL
+func getHostAddr(req *http.Request) string {
+	if req.Host != "" {
+		return req.Host
+	}
+	return req.URL.Host
+}

vendor/github.com/minio/minio-go/pkg/s3utils/utils.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2016 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -80,18 +81,56 @@ func IsVirtualHostSupported(endpointURL url.URL, bucketName string) bool {
 	return IsAmazonEndpoint(endpointURL) || IsGoogleEndpoint(endpointURL)
 }
 
-// AmazonS3Host - regular expression used to determine if an arg is s3 host.
-var AmazonS3Host = regexp.MustCompile("^s3[.-]?(.*?)\\.amazonaws\\.com$")
+// Refer for region styles - https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region
+
+// amazonS3HostHyphen - regular expression used to determine if an arg is s3 host in hyphenated style.
+var amazonS3HostHyphen = regexp.MustCompile(`^s3-(.*?)\.amazonaws\.com$`)
+
+// amazonS3HostDualStack - regular expression used to determine if an arg is s3 host dualstack.
+var amazonS3HostDualStack = regexp.MustCompile(`^s3\.dualstack\.(.*?)\.amazonaws\.com$`)
+
+// amazonS3HostDot - regular expression used to determine if an arg is s3 host in . style.
+var amazonS3HostDot = regexp.MustCompile(`^s3\.(.*?)\.amazonaws\.com$`)
+
+// amazonS3ChinaHost - regular expression used to determine if the arg is s3 china host.
+var amazonS3ChinaHost = regexp.MustCompile(`^s3\.(cn.*?)\.amazonaws\.com\.cn$`)
+
+// GetRegionFromURL - returns a region from url host.
+func GetRegionFromURL(endpointURL url.URL) string {
+	if endpointURL == sentinelURL {
+		return ""
+	}
+	if endpointURL.Host == "s3-external-1.amazonaws.com" {
+		return ""
+	}
+	if IsAmazonGovCloudEndpoint(endpointURL) {
+		return "us-gov-west-1"
+	}
+	parts := amazonS3HostDualStack.FindStringSubmatch(endpointURL.Host)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	parts = amazonS3HostHyphen.FindStringSubmatch(endpointURL.Host)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	parts = amazonS3ChinaHost.FindStringSubmatch(endpointURL.Host)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	parts = amazonS3HostDot.FindStringSubmatch(endpointURL.Host)
+	if len(parts) > 1 {
+		return parts[1]
+	}
+	return ""
+}
 
 // IsAmazonEndpoint - Match if it is exactly Amazon S3 endpoint.
 func IsAmazonEndpoint(endpointURL url.URL) bool {
-	if IsAmazonChinaEndpoint(endpointURL) {
+	if endpointURL.Host == "s3-external-1.amazonaws.com" || endpointURL.Host == "s3.amazonaws.com" {
 		return true
 	}
-	if IsAmazonGovCloudEndpoint(endpointURL) {
-		return true
-	}
-	return AmazonS3Host.MatchString(endpointURL.Host)
+	return GetRegionFromURL(endpointURL) != ""
 }
 
 // IsAmazonGovCloudEndpoint - Match if it is exactly Amazon S3 GovCloud endpoint.
@@ -111,19 +150,6 @@ func IsAmazonFIPSGovCloudEndpoint(endpointURL url.URL) bool {
 	return endpointURL.Host == "s3-fips-us-gov-west-1.amazonaws.com"
 }
 
-// IsAmazonChinaEndpoint - Match if it is exactly Amazon S3 China endpoint.
-// Customers who wish to use the new Beijing Region are required
-// to sign up for a separate set of account credentials unique to
-// the China (Beijing) Region. Customers with existing AWS credentials
-// will not be able to access resources in the new Region, and vice versa.
-// For more info https://aws.amazon.com/about-aws/whats-new/2013/12/18/announcing-the-aws-china-beijing-region/
-func IsAmazonChinaEndpoint(endpointURL url.URL) bool {
-	if endpointURL == sentinelURL {
-		return false
-	}
-	return endpointURL.Host == "s3.cn-north-1.amazonaws.com.cn"
-}
-
 // IsGoogleEndpoint - Match if it is exactly Google cloud storage endpoint.
 func IsGoogleEndpoint(endpointURL url.URL) bool {
 	if endpointURL == sentinelURL {

vendor/github.com/minio/minio-go/pkg/set/stringset.go

@@ -1,5 +1,6 @@
 /*
- * Minio Go Library for Amazon S3 Compatible Cloud Storage (C) 2016 Minio, Inc.
+ * Minio Go Library for Amazon S3 Compatible Cloud Storage
+ * Copyright 2015-2017 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

vendor/github.com/minio/minio-go/retry.go

@@ -26,7 +26,7 @@ import (
 )
 
 // MaxRetry is the maximum number of retries before stopping.
-var MaxRetry = 5
+var MaxRetry = 10
 
 // MaxJitter will randomize over the full exponential backoff time
 const MaxJitter = 1.0

vendor/github.com/minio/minio-go/s3-endpoints.go

@@ -18,15 +18,15 @@
 package minio
 
 // awsS3EndpointMap Amazon S3 endpoint map.
-// "cn-north-1" adds support for AWS China.
 var awsS3EndpointMap = map[string]string{
 	"us-east-1":      "s3.amazonaws.com",
 	"us-east-2":      "s3-us-east-2.amazonaws.com",
 	"us-west-2":      "s3-us-west-2.amazonaws.com",
 	"us-west-1":      "s3-us-west-1.amazonaws.com",
-	"ca-central-1":   "s3.ca-central-1.amazonaws.com",
+	"ca-central-1":   "s3-ca-central-1.amazonaws.com",
 	"eu-west-1":      "s3-eu-west-1.amazonaws.com",
 	"eu-west-2":      "s3-eu-west-2.amazonaws.com",
+	"eu-west-3":      "s3-eu-west-3.amazonaws.com",
 	"eu-central-1":   "s3-eu-central-1.amazonaws.com",
 	"ap-south-1":     "s3-ap-south-1.amazonaws.com",
 	"ap-southeast-1": "s3-ap-southeast-1.amazonaws.com",
@@ -36,6 +36,7 @@ var awsS3EndpointMap = map[string]string{
 	"sa-east-1":      "s3-sa-east-1.amazonaws.com",
 	"us-gov-west-1":  "s3-us-gov-west-1.amazonaws.com",
 	"cn-north-1":     "s3.cn-north-1.amazonaws.com.cn",
+	"cn-northwest-1": "s3.cn-northwest-1.amazonaws.com.cn",
 }
 
 // getS3Endpoint get Amazon S3 endpoint based on the bucket location.

vendor/github.com/minio/minio-go/transport.go

@@ -2,7 +2,7 @@
 
 /*
  * Minio Go Library for Amazon S3 Compatible Cloud Storage
- * Copyright 2017 Minio, Inc.
+ * Copyright 2017-2018 Minio, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,9 +25,10 @@ import (
 	"time"
 )
 
-// This default transport is similar to http.DefaultTransport
-// but with additional DisableCompression:
-var defaultMinioTransport http.RoundTripper = &http.Transport{
+// DefaultTransport - this default transport is similar to
+// http.DefaultTransport but with additional param  DisableCompression
+// is set to true to avoid decompressing content with 'gzip' encoding.
+var DefaultTransport http.RoundTripper = &http.Transport{
 	Proxy: http.ProxyFromEnvironment,
 	DialContext: (&net.Dialer{
 		Timeout:   30 * time.Second,
@@ -35,6 +36,7 @@ var defaultMinioTransport http.RoundTripper = &http.Transport{
 		DualStack: true,
 	}).DialContext,
 	MaxIdleConns:          100,
+	MaxIdleConnsPerHost:   100,
 	IdleConnTimeout:       90 * time.Second,
 	TLSHandshakeTimeout:   10 * time.Second,
 	ExpectContinueTimeout: 1 * time.Second,

vendor/github.com/minio/minio-go/utils.go

@@ -209,14 +209,11 @@ func getDefaultLocation(u url.URL, regionOverride string) (location string) {
 	if regionOverride != "" {
 		return regionOverride
 	}
-	if s3utils.IsAmazonChinaEndpoint(u) {
-		return "cn-north-1"
+	region := s3utils.GetRegionFromURL(u)
+	if region == "" {
+		region = "us-east-1"
 	}
-	if s3utils.IsAmazonGovCloudEndpoint(u) {
-		return "us-gov-west-1"
-	}
-	// Default to location to 'us-east-1'.
-	return "us-east-1"
+	return region
 }
 
 var supportedHeaders = []string{
@@ -224,16 +221,10 @@ var supportedHeaders = []string{
 	"cache-control",
 	"content-encoding",
 	"content-disposition",
+	"content-language",
 	// Add more supported headers here.
 }
 
-// cseHeaders is list of client side encryption headers
-var cseHeaders = []string{
-	"X-Amz-Iv",
-	"X-Amz-Key",
-	"X-Amz-Matdesc",
-}
-
 // isStorageClassHeader returns true if the header is a supported storage class header
 func isStorageClassHeader(headerKey string) bool {
 	return strings.ToLower(amzStorageClass) == strings.ToLower(headerKey)
@@ -250,19 +241,6 @@ func isStandardHeader(headerKey string) bool {
 	return false
 }
 
-// isCSEHeader returns true if header is a client side encryption header.
-func isCSEHeader(headerKey string) bool {
-	key := strings.ToLower(headerKey)
-	for _, h := range cseHeaders {
-		header := strings.ToLower(h)
-		if (header == key) ||
-			(("x-amz-meta-" + header) == key) {
-			return true
-		}
-	}
-	return false
-}
-
 // sseHeaders is list of server side encryption headers
 var sseHeaders = []string{
 	"x-amz-server-side-encryption",