# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE file.

# When run as (for example)
#
#	GOOS=linux GOARCH=ppc64 bootstrap.bash
#
# this script cross-compiles a toolchain for that GOOS/GOARCH
# combination, leaving the resulting tree in ../../go-${GOOS}-${GOARCH}-bootstrap.
# That tree can be copied to a machine of the given target type

- github.com/google/uuid: [v1.1.2 → v1.3.0](https://github.com/google/uuid/compare/v1.1.2...v1.3.0)
- github.com/kr/pretty: [v0.2.1 → v0.3.0](https://github.com/kr/pretty/compare/v0.2.1...v0.3.0)
- github.com/rogpeppe/go-internal: [v1.3.0 → v1.6.1](https://github.com/rogpeppe/go-internal/compare/v1.3.0...v1.6.1)
- github.com/vmware/govmomi: [v0.20.3 → v0.30.0](https://github.com/vmware/govmomi/compare/v0.20.3...v0.30.0)

### Removed
_Nothing has changed._

 * for information on the behaviour of the algorithm.
 *
 * <p>On Intel Core2 2.66, on 1000 bytes, fingerprint2011 takes 0.9 microseconds compared to
 * fingerprint at 4.0 microseconds and md5 at 4.5 microseconds.
 *
 * <p>Note to maintainers: This implementation relies on signed arithmetic being bit-wise equivalent
 * to unsigned arithmetic in all cases except:
 *

abstract class AbstractFutureState<V extends @Nullable Object> extends InternalFutureFailureAccess
    implements ListenableFuture<V> {
  /**
   * Performs a {@linkplain java.lang.invoke.VarHandle#compareAndSet compare-and-set} operation on
   * {@link #listenersField}.
   */
  final boolean casListeners(@Nullable Listener expect, Listener update) {
    return ATOMIC_HELPER.casListeners(this, expect, update);
  }

  /**

			Joins: []clause.Join{
				{
					Table: clause.Table{Name: "companies", Raw: false},
					ON: clause.Where{
						Exprs: []clause.Expression{
							clause.Eq{
								Column: clause.Column{
									Table: "users",
									Name:  "company_id",
								},
								Value: clause.Column{
									Table: "companies",
									Name:  "id",
								},
							},
						},
					},
				},

     * <li>{@code repo,repo1} = {@code repo} or {@code repo1},</li>
     * <li>{@code *,!repo1} = everything except {@code repo1}.</li>
     * </ul>
     *
     * @param originalRepository to compare for a match.
     * @param pattern used for match.
     * @return true if the repository is a match to this pattern.
     */
    static boolean matchPattern(ArtifactRepository originalRepository, String pattern) {

#### **专业**攻击 { #a-professional-attack }

当然，攻击者不用手动操作，而是编写每秒能执行成千上万次测试的攻击程序，每次都会找到更多正确字符。

但是，在您的应用的**帮助**下，攻击者利用时间差，就能在几分钟或几小时内，以这种方式猜出正确的用户名和密码。

#### 使用 `secrets.compare_digest()` 修补 { #fix-it-with-secrets-compare-digest }

在此，代码中使用了 `secrets.compare_digest()`。

简单的说，它使用相同的时间对比 `stanleyjobsox` 和 `stanleyjobson`，还有 `johndoe` 和 `stanleyjobson`。对比密码时也一样。

在代码中使用 `secrets.compare_digest()` ，就可以安全地防御这整类安全攻击。

			<fileset dir="${plugins.dir}">
				<include name="configsync/commons-codec-*" />
				<include name="dataformat/commons-codec-*" />
				<include name="dataformat/commons-collections4-*" />
				<include name="dataformat/commons-compress-*" />
				<include name="dataformat/commons-math3-*" />
				<include name="dataformat/curvesapi-*" />
				<include name="dataformat/orangesignal-csv-*" />
				<include name="dataformat/poi-*" />

    }
  }

  @Nullable E higher(E e) {
    checkNotNull(e);
    Iterator<E> iterator = tailSet(e).iterator();
    while (iterator.hasNext()) {
      E higher = iterator.next();
      if (comparator().compare(e, higher) < 0) {
        return higher;
      }
    }
    return null;
  }

  public @Nullable E ceiling(E e) {
    ImmutableSortedSet<E> set = tailSet(e, true);

#### Виправте за допомогою `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

Але в нашому коді ми насправді використовуємо `secrets.compare_digest()`.