// in constant time, we compute t = h - (2¹³⁰ - 5), and select h as the
	// result if the subtraction underflows, and t otherwise.

	hMinusP0, b := bits.Sub64(h0, p0, 0)
	hMinusP1, b := bits.Sub64(h1, p1, b)
	_, b = bits.Sub64(h2, p2, b)

	// h = h if h < p else h - p
	h0 = select64(b, h0, hMinusP0)
	h1 = select64(b, h1, hMinusP1)

	// Finally, we compute the last Poly1305 step
	//

	"istio.io/istio/pkg/config/resource"
	"istio.io/istio/pkg/config/schema/gvk"
)

// SelectorAnalyzer validates, per namespace, that:
// * sidecar resources that define a workload selector match at least one pod
// * there aren't multiple sidecar resources that select overlapping pods
type SelectorAnalyzer struct{}

var _ analysis.Analyzer = &SelectorAnalyzer{}

// Metadata implements Analyzer

func ParseSelectorOrDie(s string) Selector {
	selector, err := ParseSelector(s)
	if err != nil {
		panic(err)
	}
	return selector
}

// ParseSelector takes a string representing a selector and returns an
// object suitable for matching, or an error.
func ParseSelector(selector string) (Selector, error) {
	return parseSelector(selector,
		func(lhs, rhs string) (newLhs, newRhs string, err error) {

	"k8s.io/apimachinery/pkg/watch"
)

// Selector is a Visitor for resources that match a label selector.
type Selector struct {
	Client        RESTClient
	Mapping       *meta.RESTMapping
	Namespace     string
	LabelSelector string
	FieldSelector string
	LimitChunks   int64
}

// NewSelector creates a resource selector which hides details of getting items by their label selector.

type Requirements []Requirement

// Selector represents a label selector.
type Selector interface {
	// Matches returns true if this selector matches the given set of labels.
	Matches(Labels) bool

	// Empty returns true if this selector does not restrict the selection space.
	Empty() bool

	// String returns a human readable string that represents this selector.
	String() string

	// Using an index for selectoes is problematic because selector != label
	// We can match a label to a selector, but we can't generate a selector from a label.
	c.ForEach(gvk.Telemetry, func(rs *resource.Instance) bool {
		s := rs.Message.(*v1alpha1.Telemetry)

		// For this analysis, ignore Telemetries with no selectors specified at all.
		if s.Selector == nil || len(s.GetSelector().MatchLabels) == 0 {
			return true
		}

)

// ByServiceSelector returns a predicate that matches workload instances
// of a given service.
func ByServiceSelector(namespace string, selector labels.Instance) func(*model.WorkloadInstance) bool {
	return func(wi *model.WorkloadInstance) bool {
		return wi.Namespace == namespace && selector.Match(wi.Endpoint.Labels)
	}
}

// FindAllInIndex returns a list of workload instances in the index
// that match given predicate.
//

kind: Telemetry
metadata:
  name: dupe-1
  namespace: default
spec:
  selector:
    matchLabels:
      app: reviews # Multiple telemetries have the same selector, should generate errors for both
  metrics:
    - providers:
        - name: prometheus
      overrides:
        - match:
            metric: ALL_METRICS
          disabled: false
---
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:

spec:
  containers:
  - image: proxyv2:1.3.1
    name: istio-proxy
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  namespace: default
  name: ra-ineffective
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1

	// optimization: zero-case select
	if ncas == 0 {
		return []ir.Node{mkcallstmt("block")}
	}

	// optimization: one-case select: single op.
	if ncas == 1 {
		cas := cases[0]
		ir.SetPos(cas)
		l := cas.Init()
		if cas.Comm != nil { // not default:
			n := cas.Comm
			l = append(l, ir.TakeInit(n)...)
			switch n.Op() {
			default:
				base.Fatalf("select %v", n.Op())

			case ir.OSEND: