sr.ReturnNonDecryptable(true)

	// Debug corrupted streams.
	if false {
		sr.SkipEncrypted(true)
		return sr.DebugStream(os.Stdout)
	}
	extracted := false
	for {
		stream, err := sr.NextStream()
		if err != nil {
			if err == io.EOF {
				if extracted {
					return nil
				}
				return errors.New("no data found on stream")
			}
			if errors.Is(err, estream.ErrNoKey) {
				if stream.Name == "inspect.zip" {

package com.example

import org.gradle.declarative.dsl.model.annotations.Adding
import org.gradle.declarative.dsl.model.annotations.Builder
import org.gradle.declarative.dsl.model.annotations.Restricted


class Abc {
    @get:Restricted
    var a: Int = 0

    @Restricted
    fun b(): Int = 1

    @get:Restricted
    var str: String = ""

    @Adding
    fun c(x: Int, configure: C.() -> Unit = { }) =
        C().apply {

				if cfg.BuildX {
					fmt.Fprintf(os.Stderr, "# get %s: insecure\n", url.Redacted())
				}
				return nil, fmt.Errorf("insecure URL: %s", url.Redacted())
			}
		case "":
			if security != Insecure {
				panic("should have returned after HTTPS failure")
			}
		default:
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: unsupported\n", url.Redacted())
			}

    /**
     * Retrieve the file that contains the extracted class file.
     *
     * <p>
     * This method will extract the class file if it is
     * not extracted yet. Extracted class files are deleted on exit of the Gradle process. The same class is only
     * extracted once.
     * </p>
     *
     * @param className Name of the class to extract.
     * @return File that contains the extracted class file.
     */

	return func(db *gorm.DB) {
		if db.Error == nil && db.Statement.Schema != nil {
			selectColumns, restricted := db.Statement.SelectAndOmitColumns(create, !create)

			// Save Belongs To associations
			for _, rel := range db.Statement.Schema.Relationships.BelongsTo {
				if v, ok := selectColumns[rel.Name]; (ok && !v) || (!ok && restricted) {
					continue
				}

				setupReferences := func(obj reflect.Value, elem reflect.Value) {

    // An outside compiled op can be extracted if its operands are not from
    // other ops in the cluster that cannot be extracted.

    // Check if the side effecting op right before this side effecting op, if
    // it is side effecting, can be head extracted. Because of op ordering due
    // to side effects, if this is not true, this op cannot be head extracted.

            def initialSize = ruleCache.size()
            gradle.buildFinished { println "### extracted new rules: \${ruleCache.size() > initialSize}" }
        """
    }

    boolean getNewRulesExtracted() {
        def match = output =~ /.*### extracted new rules: (true|false).*/
        match[0][1] == "true"
    }

    def "rules extracted from core plugins are reused across builds"() {
        given:
        buildFile << '''

cmpenv go.mod $WORK/go.mod.edit1
go mod edit -droprequire=x.1 -dropexclude=x.1@v1.2.1 -dropexclude=x.1@v2.0.0+incompatible -dropreplace=x.1@v1.3.0 -require=x.3@v1.99.0 -dropretract=v1.0.0 -dropretract=[v1.1.0,v1.2.0]
cmpenv go.mod $WORK/go.mod.edit2

# -exclude and -retract reject invalid versions.

    interface InnerReceiver {
        @Restricted
        fun value(): Value

        @Restricted
        fun value(arg: Value): Value

        @Adding
        fun addingValue(value: Value): Value

        @get:Restricted
        val utils: Utils

        @get:Restricted
        var property: Value
    }

    interface Utils {
        @Restricted
        fun value(): Value
    }

		c.CertificateAuthority = "REDACTED"
	}
	lrcfg, err := latest.Scheme.ConvertToVersion(kcfg, latest.ExternalVersion)
	if err != nil {
		return kubeconfig{}, err
	}
	redacted, err := yaml.Marshal(lrcfg)
	if err != nil {
		return kubeconfig{}, err
	}

	return kubeconfig{
		Full:     string(fullYaml),
		Redacted: string(redacted),
	}, nil
}