policies:
      ns[foo]-policy[httpbin-deny]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://deny

        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 80
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns-1/.*
  shadowRulesStatPrefix: istio_dry_run_allow_

  // Returns a set of resource IDs that have potential dependencies to
  // `resource_id` (i.e., there are potential dependencies between the
  // resources corresponding to the IDs).
  llvm::SmallSet<ResourceId, 8> GetDependentIds(ResourceId resource_id,
                                                bool is_fetch_op) const;

  // Returns the parallel ids of the op.
  ParallelIdsMap GetParallelIdsMap(Operation* op);

    /**
     * Gets the list of group ids to scan for the plugin prefix.
     *
     * @return The list of group ids to scan for the plugin prefix, never {@code null}.
     */
    List<String> getPluginGroups();

    /**
     * Sets the list of group ids to scan for the plugin prefix.
     *
     * @param pluginGroups The list of group ids to scan for the plugin prefix, may be {@code null}.

                List<UserIDPacket> ids;
                List<List<PGPSignature>> idSignatures;
                if (id.isPresent()) {
                    ids = Collections.singletonList(new UserIDPacket(id.get()));
                    idSignatures = Collections.singletonList(Collections.emptyList());
                } else {
                    ids = Collections.emptyList();

        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin2
        principals:
        - andIds:
            ids:
            - any: true

    private final Set<ModuleIdentifier> moduleIds;
    private final int hashCode;

    static ModuleIdSetExclude of(Set<ModuleIdentifier> ids) {
        return new DefaultModuleIdSetExclude(ImmutableSet.copyOf(ids));
    }

    private DefaultModuleIdSetExclude(ImmutableSet<ModuleIdentifier> moduleIds) {
        this.moduleIds = moduleIds;
        this.hashCode = moduleIds.hashCode();
    }

cp stdout $WORK/rawtoolbuildid.txt

# Make sure that the two build IDs agree with respect to the
# m/example package. Build IDs from binaries are of the form X/Y/Z/W
# where Y/Z is the package build ID; running the program below will
# pick out the parts of the ID that we want.
env GOCOVERDIR=$WORK
exec $WORK/m.exe $WORK/rawtoolbuildid.txt
cp stdout $WORK/toolbuildid.txt

# Build IDs should match here.
cmp $WORK/toolbuildid.txt $WORK/listbuildid.txt

            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]-deny-due-to-bad-CUSTOM-action:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:

            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /httpbin1
        principals:
        - andIds:
            ids:
            - any: true
      istio-ext-authz-ns[foo]-policy[httpbin-2]-rule[0]-deny-due-to-bad-CUSTOM-action:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules: