idat = "\x00\x00\x00\x0eIDAT\x78\x9c\x62\x62\x00\x04\x00\x00\xff\xff\x00\x06\x00\x03\xfa\xd0\x59\xae"
		iend = "\x00\x00\x00\x00IEND\xae\x42\x60\x82"
	)
	_, err := Decode(strings.NewReader(pngHeader + ihdr + idat + iend))
	if err == nil {
		t.Fatal("got nil error, want non-nil")
	}
}

func TestTrailingIDATChunks(t *testing.T) {

	var x77 uint64
	var x78 uint64
	x77, x78 = bits.Add64(x48, x45, uint64(p521Uint1(x76)))
	x79 := (uint64(p521Uint1(x78)) + x46)
	var x81 uint64
	_, x81 = bits.Add64(x26, x61, uint64(0x0))
	var x82 uint64
	var x83 uint64
	x82, x83 = bits.Add64(x28, x63, uint64(p521Uint1(x81)))
	var x84 uint64
	var x85 uint64
	x84, x85 = bits.Add64(x30, x65, uint64(p521Uint1(x83)))
	var x86 uint64
	var x87 uint64

    X65,
    X66,
    X67,
    X68,
    X69,
    X70,
    X71,
    X72,
    X73,
    X74,
    X75,
    X76,
    X77,
    X78,
    X79,
    X80,
    X81,
    X82,
    X83,
    X84,
    X85,
    X86,
    X87,
    X88,
    X89,
    X90,
    X91,
    X92,
    X93,
    X94,
    X95,
    X96,
    X97,
    X98,
    X99
  }

    X65,
    X66,
    X67,
    X68,
    X69,
    X70,
    X71,
    X72,
    X73,
    X74,
    X75,
    X76,
    X77,
    X78,
    X79,
    X80,
    X81,
    X82,
    X83,
    X84,
    X85,
    X86,
    X87,
    X88,
    X89,
    X90,
    X91,
    X92,
    X93,
    X94,
    X95,
    X96,
    X97,
    X98,
    X99
  }

			"\x00\xb6\x00\x9f\x01\xa7\x01\xa9\x36\x20\xa0\x83\x14\x34\x63\x4a" +
			"\x21\x70\x8c\x07\x46\x03\x4e\x10\x62\x3c\x06\x4e\xc8\x8c\xb0\x32" +
			"\x2a\x59\xad\xb2\xf1\x02\x82\x7c\x33\xcb\x92\x6f\x32\x4f\x9b\xb0" +
			"\xa2\x30\xf0\xc0\x06\x1e\x98\x99\x2c\x06\x1e\xd8\xc0\x03\x56\xd8" +
			"\xc0\x03\x0f\x6c\xe0\x01\xf1\xf0\xee\x9a\xc6\xc8\x97\x99\xd1\x6c" +

		t.Skip("behavior only enforced in macOS 11 and after")
	}

	// badCertData contains a cert that we parse as valid
	// but that macOS SecCertificateCreateWithData rejects.

		"\x00\x00\x01\x7d\x01\x02\x03\x00\x04\x11\x05\x12\x21\x31\x01\x06" +
		"\x13\x51\x61\x07\x22\x71\x14\x32\x81\x91\xa1\x08\x23\xd8\xff\xdd" +
		"\x42\xb1\xc1\x15\x52\xd1\xf0\x24\x33\x62\x72\x82\x09\x0a\x16\x17" +
		"\x18\x19\x1a\x25\x26\x27\x28\x29\x2a\x34\x35\x36\x37\x38\x39\x3a" +
		"\x43\x44\x45\x46\x47\x48\x49\x4a\x53\x54\x55\x56\x57\x58\x59\x5a" +
		"\x00\x63\x64\x65\x66\x67\x68\x69\x6a\x73\x74\x75\x76\x77\x78\x79" +

func TestExtendedNonceGCMLegacyDataCompatibility(t *testing.T) {
	// recorded output from NewKDFExtendedNonceGCMTransformerWithUniqueSeed from https://github.com/kubernetes/kubernetes/pull/118828
	const (
		legacyKey        = "]@2:\x82\x0f\xf9Uag^;\x95\xe8\x18g\xc5\xfd\xd5a\xd3Z\x88\xa2Ћ\b\xaa\x9dO\xcf\\"

	{"72c2ed7592debca1c90fc0100f931a2f", "The fugacity of a constituent in a mixture of gases at a given temperature is proportional to its mole fraction.  Lewis-Randall Rule", "md5\x01\xa7\xc9\x18\x9b\xc3E\x18\xf2\x82\xfd\xf3$\x9d_\v\nem\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\...

				Format:  FormatGNU,
			}, nil},
			testClose{nil},
		},
	}, {
		file: "testdata/gnu-not-utf8.tar",
		tests: []testFnc{
			testHeader{Header{
				Typeflag: TypeReg,
				Name:     "hi\x80\x81\x82\x83bye",
				Mode:     0644,
				Uid:      1000,
				Gid:      1000,
				Uname:    "rawr",
				Gname:    "dsnet",
				ModTime:  time.Unix(0, 0),
				Format:   FormatGNU,
			}, nil},
			testClose{nil},