- orIds:
                ids:
                - remoteIp:
                    addressPrefix: 172.18.4.0
                    prefixLen: 22
            - notId:
                orIds:
                  ids:
                  - remoteIp:
                      addressPrefix: 192.168.244.139
                      prefixLen: 32
            - orIds:
                ids:

		t.Run(fmt.Sprintf("Run %d/100", i), func(t *testing.T) {
			orig := &v1.MutatingWebhook{}
			f.Fuzz(orig)

			// zero out any accessor type specific fields not included in the accessor
			orig.ReinvocationPolicy = nil

			uid := fmt.Sprintf("test.configuration.admission/%s/0", orig.Name)
			accessor := NewMutatingWebhookAccessor(uid, "test.configuration.admission", orig)
			if uid != accessor.GetUID() {

		return b.key, nil
	}

	b = new(boringPriv)
	b.orig = copyPrivateKey(priv)

	var N, E, D, P, Q, Dp, Dq, Qinv *big.Int
	N = b.orig.N
	E = big.NewInt(int64(b.orig.E))
	D = b.orig.D
	if len(b.orig.Primes) == 2 {
		P = b.orig.Primes[0]
		Q = b.orig.Primes[1]
		Dp = b.orig.Precomputed.Dp
		Dq = b.orig.Precomputed.Dq
		Qinv = b.orig.Precomputed.Qinv
	}

        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - andIds:

type boringPub struct {
	key  *boring.PublicKeyECDSA
	orig PublicKey
}

func boringPublicKey(pub *PublicKey) (*boring.PublicKeyECDSA, error) {
	b := pubCache.Get(pub)
	if b != nil && publicKeyEqual(&b.orig, pub) {
		return b.key, nil
	}

	b = new(boringPub)
	b.orig = copyPublicKey(pub)
	key, err := boring.NewPublicKeyECDSA(b.orig.Curve.Params().Name, bbig.Enc(b.orig.X), bbig.Enc(b.orig.Y))
	if err != nil {
		return nil, err
	}

	defer ctxt.mu.Unlock()

	for _, e := range ctxt.typeMap[h] {
		if identicalInstance(orig, targs, e.orig, e.targs) {
			return e.instance
		}
		if debug {
			// Panic during development to surface any imperfections in our hash.
			panic(fmt.Sprintf("non-identical instances: (orig: %s, targs: %v) and %s", orig, targs, e.instance))
		}
	}

	return nil
}

package p

type Node struct {
	Orig *Node
}

var sink *Node

func f1() {
	var n Node // ERROR "."
	n.Orig = &n

	m := n // ERROR "."
	sink = &m
}

func f2() {
	var n1, n2 Node // ERROR "."
	n1.Orig = &n2
	n2 = n1

	m := n2 // ERROR "."
	sink = &m
}

func f3() {
	var n1, n2 Node // ERROR "."
	n1.Orig = &n1
	n1.Orig = &n2

	sink = n1.Orig.Orig

                          regex: .*/ns/.*/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 1.2.3.4
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 5.6.0.0
                    prefixLen: 16
            - notId:
                orIds:
                  ids:
                  - remoteIp:

	SqrtPi  = 1.77245385090551602729816748334114518279754945612238712821380779 // https://oeis.org/A002161
	SqrtPhi = 1.27201964951406896425242246173749149171560804184009624861664038 // https://oeis.org/A139339

	Ln2    = 0.693147180559945309417232121458176568075500134360255254120680009 // https://oeis.org/A002162
	Log2E  = 1 / Ln2
	Ln10   = 2.30258509299404568401799145468436420760110148862877297603332790 // https://oeis.org/A002392

		t.Errorf("Unexpected groups\ngot:\t%#v\nwant:\t%#v", r.User.GetGroups(), want)
	}

	if got := toJson(response); got != orig {
		t.Errorf("Expected response from delegate to be unmodified: orig=%v got=%v", orig, got)
	}
}

func TestAuthenticatedGroupAdder(t *testing.T) {
	tests := []struct {
		name         string
		inputUser    *user.DefaultInfo
		expectedUser user.Info
	}{