opts.claims[ldapAttribPrefix+attribKey] = attribValue
		}

		// NOTE: if not using LDAP, then internal IDP or open ID is
		// being used - in the former, group info is enforced when
		// generated credentials are used to make requests, and in the
		// latter, a group notion is not supported.
	}

        gradleInvocation.implicitLauncherJvmArgs.clear();
    }

    /**
     * Returns the JVM opts that should be used to start a forked JVM.
     */
    private void calculateLauncherJvmArgs(GradleInvocation gradleInvocation) {
        // Add JVM args that were explicitly requested
        gradleInvocation.launcherJvmArgs.addAll(commandLineJvmOpts);

				},
				Rules: []flowcontrol.PolicyRulesWithSubjects{{
					Subjects: []flowcontrol.Subject{{
						Kind:  flowcontrol.SubjectKindServiceAccount,
						User:  &flowcontrol.UserSubject{Name: "fred"},
						Group: &flowcontrol.GroupSubject{Name: "fred"},
					}},
					NonResourceRules: []flowcontrol.NonResourcePolicyRule{{
						Verbs:           []string{flowcontrol.VerbAll},
						NonResourceURLs: []string{"*"},
					}},
				}},

            setActiveProfiles((Collections.unmodifiableList(project.getActiveProfiles())));
        }

        if (project.getAttachedArtifacts() != null) {
            // clone properties modifiable by plugins in a forked lifecycle
            setAttachedArtifacts(new ArrayList<>(project.getAttachedArtifacts()));
        }

        if (project.getCompileSourceRoots() != null) {
            // clone source roots

			}
		}
		// Note: we forbid additionalProperties at resource root, both embedded and top-level.
		//       But further inside, additionalProperites is possible, e.g. for labels or annotations.
		subSsv := ssv
		if ssv.insideResourceMeta() {
			// we have to forbid defaults inside additionalProperties because pruning without actual value is ambiguous

  if is_s390x() and 'boringssl' not in syslibs:
    syslibs = 'boringssl' + (', ' + syslibs if syslibs else '')

  if syslibs:
    if ',' in syslibs:
      syslibs = ','.join(sorted(syslibs.split(',')))
    else:
      syslibs = ','.join(sorted(syslibs.split()))
    write_action_env_to_bazelrc('TF_SYSTEM_LIBS', syslibs)

  for varname in ('PREFIX', 'LIBDIR', 'INCLUDEDIR', 'PROTOBUF_INCLUDE_PATH'):

  # jump through hoops to avoid removing docker/containerd
  # when installing nftables and kmod, as those docker/containerd
  # packages depend on iptables
  dpkg -r --force-depends iptables && \
  apt -y --fix-broken install && \
  apt -y install nftables kmod && \
  apt -y install iptables
}

function tolerate_cgroups_v2 {

	root := &work.Action{Mode: "go test", Actor: work.ActorFunc(printExitStatus), Deps: prints}

	// Force the printing of results to happen in order,
	// one at a time.
	for i, a := range prints {
		if i > 0 {
			a.Deps = append(a.Deps, prints[i-1])
		}
	}

	// Force benchmarks to run in serial.
	if !testC && (testBench != "") {
		// The first run must wait for all builds.

(Store {t} ptr val mem) && t.Size() == 2 => (MOVHstore ptr val mem)
(Store {t} ptr val mem) && t.Size() == 1 => (MOVBstore ptr val mem)

// Using Zero instead of LoweredZero allows the
// target address to be folded where possible.
(Zero [0] _ mem) => mem
(Zero [1] destptr mem) => (MOVBstorezero destptr mem)
(Zero [2] destptr mem) =>
	(MOVHstorezero destptr mem)
(Zero [3] destptr mem) =>
	(MOVBstorezero [2] destptr

	// IsPodKnownTerminated returns true once SyncTerminatingPod completes
	// successfully - the provided pod UID it is known by the pod
	// worker to be terminated. If the pod has been force deleted and the pod worker
	// has completed termination this method will return false, so this method should
	// only be used to filter out pods from the desired set such as in admission.
	//