java-version: 11
      - id: determine-sys-prop-args
        uses: actions/github-script@v7
        with:
          script: |
            if (context.payload.pull_request && context.payload.pull_request.head.repo.fork) {
                core.setOutput('sys-prop-args', '-DagreePublicBuildScanTermOfService=yes -DcacheNode=us')
            } else {
                core.setOutput('sys-prop-args', '-DcacheNode=us')
            }

      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

      initContainerName: "istio-validation"

      brokenPodLabelKey: "cni.istio.io/uninitialized"
      brokenPodLabelValue: "true"

 /* POSIX 2008 makes locale_t official.  */
 typedef __locale_t locale_t;
 
+#endif /* bits/types/__locale_t.h */
+
 #endif /* xlocale.h */
diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
index d1cb3dd..30482a1 100644
--- a/misc/sys/cdefs.h
+++ b/misc/sys/cdefs.h
@@ -423,4 +423,14 @@
 # endif
 #endif
 
+/* Undefine (also defined in libc-symbols.h).  */
+#undef __attribute_copy__
+#if __GNUC_PREREQ (9, 0)

              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:

          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false