I can confirm AWS accept providing the part number list 2, 4, so it neither require starting from 1, nor be sequential, only ordered and between 1 and 10000
to verify, but I think this is stricter than AWS : I believe I've read somewhere it's possible to have holes between part number, so 2, 4, 6 would be a correct sequence. Will try against AWS when I have time
this bit has an invalid edge case : by cutting the stream just before a new chunk header, an attacker can truncate the file without it being rejected. Getting here (inner stream returns None and this.buf is empy) is either such a truncation, or a call to SignedPayloadStream::poll_next after it returned Ok(Ready(None)) once, which is a contract error (Ok(Ready(None)) means that the stream has terminated, and poll_next should not be invoked again), so this check and return can be safely removed
Actually AWS encode quotes like quick_xml does
Sample response obtained from AWS
<?xml version="1.0" encoding="UTF-8"?>
<ListBucketResult…