ensure bucket owner retains permissions

concat.go

@@ -133,6 +133,7 @@ func (r *RecursiveConcat) mergePair(ctx context.Context, objectList []*S3Obj, tr
 	output, err := r.Client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
 		Bucket: aws.String(bucket),
 		Key:    aws.String(key),
+		ACL:    types.ObjectCannedACLBucketOwnerFullControl,
 	})
 	if err != nil {
 		return complete, err

extract.go

@@ -91,6 +91,7 @@ func extractRange(ctx context.Context, svc *s3.Client, bucket, key, dstBucket, d
 	output, err := svc.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
 		Bucket: aws.String(dstBucket),
 		Key:    aws.String(dstKey),
+		ACL:    types.ObjectCannedACLBucketOwnerFullControl,
 	})
 	if err != nil {
 		return err

mem_concat.go

@@ -56,6 +56,7 @@ func buildInMemoryConcat(ctx context.Context, client *s3.Client, objectList []*S
 			StorageClass:      opts.storageClass,
 			ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
 			Tagging:           &tags,
+			ACL:               types.ObjectCannedACLBucketOwnerFullControl,
 		})
 		if err != nil {
 			Errorf(ctx, "unable to create multipart")

s3tar.go

@@ -400,6 +400,7 @@ func redistribute(ctx context.Context, client *s3.Client, obj *S3Obj, trimoffset
 		Key:          aws.String(key),
 		StorageClass: storageClass,
 		Tagging:      &tags,
+		ACL:          types.ObjectCannedACLBucketOwnerFullControl,
 	})
 	if err != nil {
 		Infof(ctx, err.Error())
@@ -694,6 +695,7 @@ func concatObjects(ctx context.Context, client *s3.Client, trimFirstBytes int, o
 	output, err := client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{
 		Bucket: &bucket,
 		Key:    &key,
+		ACL:    types.ObjectCannedACLBucketOwnerFullControl,
 	})
 	if err != nil {
 		return complete, err

utils.go

@@ -332,7 +332,7 @@ func getObjectRange(ctx context.Context, svc *s3.Client, bucket, key string, sta
 	}
 	output, err := svc.GetObject(ctx, params)
 	if err != nil {
-		return output.Body, err
+		return nil, err
 	}
 	return output.Body, nil
 }