apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
- 35231

releaseNotes:
- |

    def "does not watch when there's nothing to watch"() {
        def watchable = Mock(WatchableHierarchies)
        when:
        def watched = resolveWatchedFiles(watchable, buildHierarchy([]))
        then:
        rootsOf(watched) == []
        1 * watchable.stream() >> Stream.of()
    }

    def "watches empty directory"() {
        def watchable = Mock(WatchableHierarchies)

Rita Zhang <******@****.***> 1709268932 -0800

Dr. Stefan Schimanski <******@****.***> 1486027168 +0100

	// Data must contain the bytes that will be patched.
	Data []byte
}

// PatchManager defines an object that can apply patches.
type PatchManager struct {
	patchSets    []*patchSet
	knownTargets []string
	output       io.Writer
}

// patchSet defines a set of patches of a certain type that can patch a PatchTarget.
type patchSet struct {
	targetName string
	patchType  types.PatchType
	patches    []string
}

// layer.
type IAMStoreSys struct {
	IAMStorageAPI

	group *singleflight.Group
}

// HasWatcher - returns if the storage system has a watcher.
func (store *IAMStoreSys) HasWatcher() bool {
	_, ok := store.IAMStorageAPI.(iamStorageWatcher)
	return ok
}

// GetUser - fetches credential from memory.

 *     operating system to watch.
 *     See {@link org.gradle.internal.watch.registry.impl.HierarchicalFileWatcherUpdater}.</dd>
 *
 *     <dt>watched directories</dt>
 *     <dd>On OSs with non-hierarchical file system events (currently Linux only) we don't watch whole
 *     hierarchies, but need to individually watch each directory and its immediate children.

 *
 * - Locations known to be modified during a build might receive late file events that would invalidate VFS state we just
 *   captured after the changes; to avoid this, after a known modification we assume no further modifications will
 *   happen to the same location, and all file events belong the know modifications instead.
 */

Xiaopeng Han <******@****.***> 1709887099 +0800

		if jwtPath == "" {
			return nil, nil // no cred fetcher - using certificates only
		}
		return plugin.CreateTokenPlugin(jwtPath), nil
	case security.Mock: // for test only
		return plugin.CreateMockPlugin("test_token"), nil
	default:
		return nil, fmt.Errorf("invalid credential fetcher type %s", credtype)
	}