when:
        fails TEST_AND_JACOCO_COVERAGE_VERIFICATION_TASK_PATHS

        then:
        executedAndNotSkipped(TEST_AND_JACOCO_COVERAGE_VERIFICATION_TASK_PATHS)
        failure.assertHasCause("Rule violated for bundle $testDirectory.name: $errorMessage")

        where:
        limits                                                      | description                                                              | errorMessage

- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get"]
  # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
  # agent bootstrapping, see the spire-bundle ConfigMap)
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["spire-bundle"]
  verbs: ["get", "patch"]

---
# RoleBinding granting the spire-server-role to the SPIRE server
# service account.
kind: RoleBinding

    MLIRImportOptions options,
    std::unique_ptr<tensorflow::SavedModelBundle>* saved_model_bundle) {
  // Create local bundle if no one is provided to use.
  std::unique_ptr<tensorflow::SavedModelBundle> bundle;
  if (saved_model_bundle == nullptr) {
    bundle = std::make_unique<tensorflow::SavedModelBundle>();
  } else if (*saved_model_bundle == nullptr) {

                BundleModel bundle = config.getBundle(path);
                List<String> coordinates = bundle.getComponents().stream()
                    .map(config::getDependencyData)
                    .map(LibrariesSourceGenerator::coordinatesDescriptorFor)
                    .collect(toList());
                writeBundle(path, coordinates, bundle.getContext(), true, deprecated);
            }

func NewKeyCertBundleFromPem(certBytes, privKeyBytes, certChainBytes, rootCertBytes []byte) *KeyCertBundle {
	bundle := &KeyCertBundle{}
	bundle.setAllFromPem(certBytes, privKeyBytes, certChainBytes, rootCertBytes)
	return bundle
}

// NewVerifiedKeyCertBundleFromPem returns a new KeyCertBundle, or error if the provided certs failed the
// verification.

			}
		} else if tc.expectedErr != "" {
			t.Errorf("%s: Expected error %s but succeeded", id, tc.expectedErr)
		} else if bundle == nil {
			t.Errorf("%s: the bundle should not be empty", id)
		} else {
			cert, key, chain, root := bundle.GetAllPem()
			if len(cert) != 0 {
				t.Errorf("%s: certBytes should be empty", id)
			}
			if len(key) != 0 {

				n, _ := resp.Body.Read(b)
				errMsg = fmt.Sprintf("Calling %s failed with unexpected status: %v, fetching bundle: %s",
					endpoint, resp.StatusCode, string(b[:n]))
			} else {
				break
			}

			if startTime.Add(retryTimeout).Before(time.Now()) {
				return nil, fmt.Errorf("exhausted retries to fetch the SPIFFE bundle %s from url %s. Latest error: %v",
					trustDomain, endpoint, errMsg)
			}

        spec()
    }

    void hasBundle(String id, List<String> expectedElements) {
        assert model.hasBundle(id)
        def bundle = model.getBundle(id)?.components
        assert bundle != null: "Expected a bundle with name $id but it wasn't found"
        assert bundle == expectedElements
    }

    void hasVersion(String id, String version) {
        assert model.hasVersion(id)

			errContains: `unexpected status: 503, fetching bundle: {"error": "system down"}`,
		},
		{
			name:        "Bundle contains no certificate",
			in:          input1,
			extraCerts:  serverCerts,
			statusCode:  http.StatusOK,
			body:        invalidSpiffeX509Bundle,
			errContains: "expected 1 certificate in x509-svid entry 0; got 0",
		},
		{
			name:        "Bundle cannot be decoded",
			in:          input1,

            """${intro}  - Problem: In version catalog ${catalog}, a bundle with name '${bundle}' declares a dependency on '${aliasRef}' which doesn't exist.

    Reason: Bundles can only contain references to existing library aliases.

    Possible solutions:
      1. Make sure that the library alias '${aliasRef}' is declared.
      2. Remove '${aliasRef}' from bundle '${bundle}'.

    ${documentation}"""
        }
    }