* domain-based DFS root shares to links for each
                 */
                Map<String, CacheEntry<DfsReferralDataInternal>> roots = domains.get(domain);
                if ( roots != null ) {
                    dr = getLinkReferral(tf, domain, root, path, now, roots);
                }

                if ( tf.getConfig().isDfsConvertToFQDN() && dr instanceof DfsReferralDataImpl ) {

        List<String> roots;
        if (nonNull(scope, "scope") == ProjectScope.MAIN) {
            roots = prj.getCompileSourceRoots();
        } else if (scope == ProjectScope.TEST) {
            roots = prj.getTestCompileSourceRoots();
        } else {
            throw new IllegalArgumentException("Unsupported scope " + scope);
        }
        return roots.stream()
                .map(Paths::get)

    /**
     * Obtain an immutable list of compile source roots for the given project and scope.
     * Paths are absolute.
     *
     * @param project the project
     * @param scope the scope, i.e. usually main or test
     * @return the list of compile source roots
     */
    @Nonnull
    List<Path> getCompileSourceRoots(@Nonnull Project project, @Nonnull ProjectScope scope);

a client and a client that authenticates a server.

```java
// Create the root for client and server to trust. We could also use different roots for each!
HeldCertificate rootCertificate = new HeldCertificate.Builder()
    .certificateAuthority(0)
    .build();

// Create a server certificate and a server that uses it.

 *    will be used to authenticate the client's certificate chain. Typically this is not the same
 *    set of root certificates used in server authentication. Instead it will be a small set of
 *    roots private to an organization or service.
 */
class HandshakeCertificates private constructor(
  @get:JvmName("keyManager") val keyManager: X509KeyManager,
  @get:JvmName("trustManager") val trustManager: X509TrustManager,
) {

        sourceRoots.asSequence()
            .map { it.resolve(sourceFilePath) to it }
            .firstOrNull { it.first.isFile }
            ?: error("Source file '$sourceFilePath' not found, searched in source roots:\n  - ${sourceRoots.joinToString("\n  - ")}")

    private
    val KtFile.normalizedPath: String?
        get() = virtualFile.canonicalPath?.let { normaliseFileSeparators(it) }

    private

test these changes without affecting `master`/`release` pipeline. Here are the instructions.

- Click the left sidebar "VCS Roots" here and create a VCS root [here](https://builds.gradle.org/admin/editProject.html?projectId=Gradle&cameFromUrl=%2Fproject.html%3FprojectId%3DGradle%26tab%3DprojectOverview%26branch_Gradle_Master_Check%3Dmaster)

    @Test
    public void logonUserNoDomain () throws IOException {
        Assume.assumeTrue(getTestDomain().equalsIgnoreCase(getTestUserDomain()));
        // without a domain name, at this point we do not resolve the domain DFS roots
        Assume.assumeTrue(getProperties().get("test.share.dfsroot.url") == null);
        CIFSContext ctx = getContext();
        try ( SmbResource f = new SmbFile(
            getTestShareURL(),

  //
  // +optional
  optional ServiceReference service = 1;

  // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
  // If unspecified, system trust roots on the apiserver are used.
  // +optional
  optional bytes caBundle = 2;

            # "-Wl,--undefined-version",
            # copybara:uncomment_end(google-only)
        ],
    }),
    linkstatic = 1,
    per_os_targets = True,
    roots = [
                "//tensorflow/c/experimental/filesystem:filesystem_interface",
                "//tensorflow/c/experimental/stream_executor:stream_executor",
                "//tensorflow/c:env",