final URL url = new URL(null, "zip:/Program Files/foo.zip!/", new URLStreamHandler() {
            @Override
            protected void parseURL(final URL u, final String spec, final int start, final int limit) {
                setURL(u, "zip", null, 0, null, null, spec.substring(4), null, null);
            }

            @Override
            protected URLConnection openConnection(final URL u) throws IOException {

    }

    private Version parseVersion(String spec) {
        try {
            return versionScheme.parseVersion(spec);
        } catch (InvalidVersionSpecificationException e) {
            throw new RuntimeException(e);
        }
    }

    private VersionRange parseVersionRange(String spec) {
        try {
            return versionScheme.parseVersionRange(spec);

    CipherSuite.TLS_AES_256_GCM_SHA384,
    CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
    CipherSuite.TLS_AES_128_CCM_SHA256,
    CipherSuite.TLS_AES_128_CCM_8_SHA256,
  )

/**
 * A TLS 1.3 only Connection Spec. This will be eventually be exposed
 * as part of MODERN_TLS or folded into the default OkHttp client once published and
 * available in JDK11 or Conscrypt.
 */
private val TLS_13 =
  ConnectionSpec
    .Builder(true)

    private static final String SOURCE_SET_NAME = "yamlRestCompatTest";
    private static final Path RELATIVE_API_PATH = Path.of("rest-api-spec/api");
    private static final Path RELATIVE_TEST_PATH = Path.of("rest-api-spec/test");
    private static final Path RELATIVE_REST_API_RESOURCES = Path.of("rest-api-spec/src/main/resources");
    private static final Path RELATIVE_REST_XPACK_RESOURCES = Path.of("x-pack/plugin/src/test/resources");

    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    monitoring: "true"
  {{- if .Values.service.annotations }}
  annotations: {{- toYaml .Values.service.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.service.type }}
  {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
  clusterIP: {{ .Values.service.clusterIP }}
  {{- end }}

			d, ok := decl.(*ast.GenDecl)
			if !ok {
				ast2.Decls[w] = decl
				w++
				continue
			}
			ws := 0
			for _, spec := range d.Specs {
				s, ok := spec.(*ast.ImportSpec)
				if !ok || s.Path.Value != `"C"` {
					d.Specs[ws] = spec
					ws++
				}
			}
			if ws == 0 {
				continue
			}
			d.Specs = d.Specs[0:ws]
			ast2.Decls[w] = d
			w++
		}

                it.create(model, stage, FlakyTestStrategy.EXCLUDE)
            }

        val (smokeBuildTypes, nonSmokeBuildTypes) =
            stage.specificBuilds.zip(specificBuildTypes).partition { (spec, _) ->
                spec in SmokeTestProject.pullRequestFeedbackSmokeBuilds
            }
        if (smokeBuildTypes.isNotEmpty()) {
            subProject(SmokeTestProject(model, stage, smokeBuildTypes.map { it.second }))
        }

      assumeTrue(PlatformVersion.majorVersion != 8)
    }

    val sessionIds = mutableListOf<String>()

    enableTls()

    val tlsVersion = TlsVersion.forJavaName(tlsVersion)
    val spec =
      ConnectionSpec
        .Builder(ConnectionSpec.MODERN_TLS)
        .tlsVersions(tlsVersion)
        .build()

    var reuseSession = false

    val sslContext = handshakeCertificates.sslContext()

  }

  private void testSubMultisetEntrySet(SubMultisetSpec spec) {
    List<Entry<E>> entries = copyToList(sortedMultiset.entrySet());
    for (int i = 0; i < entries.size(); i++) {
      List<Entry<E>> expected = spec.expectedEntries(i, entries);
      SortedMultiset<E> subMultiset = spec.subMultiset(sortedMultiset, entries, i);
      assertEquals(expected, copyToList(subMultiset.entrySet()));
    }

```

See <https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html> for AWS S3 spec on object locking and permissions required for object retention and governance bypass overrides.

### Set legal hold on an object

PutObject API allows setting legal hold using `x-amz-object-lock-legal-hold` header.

```sh