initialHealthRequest      *discovery.DiscoveryRequest
	initialDeltaHealthRequest *discovery.DeltaDiscoveryRequest
	connectedMutex            sync.RWMutex

	// Wasm cache and ecds channel are used to replace wasm remote load with local file.
	wasmCache wasm.Cache

	// ecds version and nonce uses atomic only to prevent race in testing.
	// In reality there should not be race as istiod will only have one

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build unix || (js && wasm) || wasip1

package syscall

import (
	"internal/byteorder"
	"internal/goarch"
	"runtime"
	"unsafe"
)

// readInt returns the size-bytes unsigned integer in native byte order at offset off.

	pre = append(pre, authzCustomBuilder.BuildHTTP(cls)...)
	pre = extension.PopAppendHTTP(pre, wasm, extensions.PluginPhase_AUTHN)
	pre = append(pre, authnBuilder.BuildHTTP(cls)...)
	pre = extension.PopAppendHTTP(pre, wasm, extensions.PluginPhase_AUTHZ)
	pre = append(pre, authzBuilder.BuildHTTP(cls)...)

// Copyright 2021 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build ((darwin || dragonfly || freebsd || (js && wasm) || wasip1 || (!android && linux) || netbsd || openbsd || solaris) && ((!cgo && !darwin) || osusergo)) || aix || illumos

package user

import (
	"fmt"
	"slices"
	"strings"
	"testing"
)

// Hashing algorithm inspired by
// wyhash: https://github.com/wangyi-fudan/wyhash

//go:build amd64 || arm64 || loong64 || mips64 || mips64le || ppc64 || ppc64le || riscv64 || s390x || wasm

package runtime

import (
	"runtime/internal/math"
	"unsafe"
)

const (
	m5 = 0x1d8e4e27c47d124f
)

func memhashFallback(p unsafe.Pointer, seed, s uintptr) uintptr {
	var a, b uintptr

		// riscv64:"SLL",-"AND",-"SLTIU"
		// s390x:-"RISBGZ",-"AND",-"LOCGR"
		// wasm:-"Select",-".*LtU"
		// arm64:"LSL",-"CSEL"
		return v << s
	}
	panic("shift too large")
}

func rshGuarded64U(v uint64, s uint) uint64 {
	if s < 64 {
		// riscv64:"SRL\t",-"AND",-"SLTIU"
		// s390x:-"RISBGZ",-"AND",-"LOCGR"
		// wasm:-"Select",-".*LtU"
		// arm64:"LSR",-"CSEL"
		return v >> s
	}

// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build unix || (js && wasm) || wasip1 || windows

package os

import (
	"internal/itoa"
	"internal/syscall/execenv"
	"runtime"
	"syscall"
)

// The only signal values guaranteed to be present in the os package on all

/pkg/fuzz/                                                       @istio/wg-test-and-release-maintainers
/pkg/tracing/                                                    @istio/wg-policies-and-telemetry-maintainers
/pkg/wasm/                                                       @istio/wg-policies-and-telemetry-maintainers
/pkg/webhooks/                                                   @istio/wg-environments-maintainers

	"mips":     {4, 4},
	"mipsle":   {4, 4},
	"mips64":   {8, 8},
	"mips64le": {8, 8},
	"ppc64":    {8, 8},
	"ppc64le":  {8, 8},
	"riscv64":  {8, 8},
	"s390x":    {8, 8},
	"sparc64":  {8, 8},
	"wasm":     {8, 8},
	// When adding more architectures here,
	// update the doc string of SizesFor below.
}

// SizesFor returns the Sizes used by a compiler for an architecture.

	@envvarlinter istioctl pilot security

# Allow-list:
# (k8s) some Machinery, utils, klog
# (proto) Istio API non-CRDs, MeshConfig and ProxyConfig
# (proto) Envoy TLS proto for SDS
# (proto) Envoy Wasm filters for wasm xDS proxy
# (proto) xDS discovery service for xDS proxy
# (proto) SDS secret and contrib QAT and cryptomb
.PHONY: check-agent-deps
check-agent-deps:
	@go list -f '{{ join .Deps "\n" }}' -tags=agent \