inputs = []string{input.File}
		*keyHex = input.Key
	case len(flag.Args()) == 1:
		var err error
		inputs, err = filepathx.Glob(flag.Args()[0])
		fatalErr(err)
	default:
		flag.Usage()
		fatalIf(true, "Only 1 file can be decrypted")
		os.Exit(1)
	}
	for _, input := range inputs {
		processFile(input, privateKey)
	}
}

func processFile(inputFileName string, privateKey []byte) {

This functionality in this package is mostly captured in the Arena type.
Arenas allocate large chunks of memory for Go values, so they're likely to
be inefficient for allocating only small amounts of small Go values. They're
best used in bulk, on the order of MiB of memory allocated on each use.

Note that by allowing for this limited form of manual memory allocation

  AUTH_HEADER="Authorization: Bearer $(gcloud auth print-access-token)"
  export AUTH_HEADER
fi

SIDECAR="${SIDECAR:-envoy}"

# OS-neutral vars. These currently only work for linux.
ISTIO_ENVOY_VERSION="${ISTIO_ENVOY_VERSION:-${PROXY_REPO_SHA}}"
ISTIO_ENVOY_DEBUG_URL="${ISTIO_ENVOY_DEBUG_URL:-${ISTIO_ENVOY_BASE_URL}/envoy-debug-${ISTIO_ENVOY_VERSION}${ISTIO_ENVOY_ARCH_SUFFIX}.tar.gz}"

// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional

	// Alignment not required.
	currentPaths sync.Map

	cycleInfoMu sync.Mutex
	cycleInfo   *currentScannerCycle
}

var globalScannerMetrics scannerMetrics

const (
	// START Realtime metrics, that only to records
	// last minute latencies and total operation count.
	scannerMetricReadMetadata scannerMetric = iota
	scannerMetricCheckMissing
	scannerMetricSaveUsage
	scannerMetricApplyAll
	scannerMetricApplyVersion

         * Only kill local Gradle processes (classpath in checkout directory).
         * Not clean up global Gradle processes (i.e. classpath in ~/.gradle/...).
         */
        KILL_LEAKED_PROCESSES_FROM_PREVIOUS_BUILDS,
        /**
         * Run at the end of each build. Kill potentially leaked processes in the current build.
         * Only kill local Gradle processes (classpath in checkout directory).

  // which corresponds to the IfHealthyBudget policy.
  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),
  // but not yet healthy can be evicted only if the guarded application is not
  // disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
  // Healthy pods will be subject to the PDB for eviction.
  //

    /** updatedBy */
    protected String updatedBy;

    /** updatedTime */
    protected Long updatedTime;

    /** virtualHosts */
    protected String[] virtualHosts;

    // [Referrers] *comment only

    // ===================================================================================
    //                                                                             DB Meta

    # o classificationUndefinedHandlingType: (NotRequired - Default LOGGING)
    #  The handling type when undefined classification is found.
    #
    #   EXCEPTION - throws exception when found
    #   LOGGING   - logging only when found (exception if ReplaceSchema)
    #   ALLOWED   - no action
    #
    #; classificationUndefinedHandlingType = LOGGING
    # - - - - - - - - - -/

    }

    @Override
    protected Executor executor() {
      transitionStates.add(state());
      return directExecutor();
    }
  }

  // Functional tests using real thread. We only verify publicly visible state.
  // Interaction assertions are done by the single-threaded unit tests.

  private static class DefaultService extends AbstractIdleService {
    @Override