- andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - metadata:

cmp go.sum.orig go.sum

# go.mod and go.sum require updates, should return non-zero exit code.
cp go.mod.orig go.mod
cp go.sum.orig go.sum
! go mod tidy -diff
stdout 'diff current/go.mod tidy/go.mod'
stdout 'diff current/go.sum tidy/go.sum'
cmp go.mod.orig go.mod
cmp go.sum.orig go.sum

# Save the result from running tidy.
[exec:patch] cp go.mod.orig go.mod
[exec:patch] cp go.sum.orig go.sum
[exec:patch] go mod tidy

	}
}

func patch(c kube.Client, orig config.Config, origMeta metav1.ObjectMeta, mod config.Config, modMeta metav1.ObjectMeta, typ types.PatchType) (metav1.Object, error) {
	if orig.GroupVersionKind != mod.GroupVersionKind {
		return nil, fmt.Errorf("gvk mismatch: %v, modified: %v", orig.GroupVersionKind, mod.GroupVersionKind)
	}
	switch orig.GroupVersionKind {
	case gvk.AuthorizationPolicy:

}

func (x *IndexExpr) Pos() token.Pos {
	return x.Orig.Pos()
}

func UnpackIndexExpr(n ast.Node) *IndexExpr {
	switch e := n.(type) {
	case *ast.IndexExpr:
		return &IndexExpr{
			Orig:    e,
			X:       e.X,
			Lbrack:  e.Lbrack,
			Indices: []ast.Expr{e.Index},
			Rbrack:  e.Rbrack,
		}
	case *ast.IndexListExpr:
		return &IndexExpr{
			Orig:    e,
			X:       e.X,
			Lbrack:  e.Lbrack,

                          regex: .*/ns/.*/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 1.2.3.4
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 5.6.0.0
                    prefixLen: 16
            - notId:
                orIds:
                  ids:
                  - remoteIp:

		Ext runtime.RawExtension
	}

	testCases := map[string]struct {
		orig test
	}{
		"non-empty object": {
			orig: test{Ext: runtime.RawExtension{Raw: []byte(`{"foo":"bar"}`)}},
		},
		"empty object": {
			orig: test{Ext: runtime.RawExtension{}},
		},
	}

	for k, tc := range testCases {
		new := test{}
		data, _ := json.Marshal(tc.orig)
		if err := json.Unmarshal(data, &new); err != nil {

			for _, resource := range args.Resources {
				lris, ok := l.lockMap[resource]
				if !ok {
					continue
				}
				// Collect uids, so we don't mutate while we delete
				uids := make([]string, 0, len(lris))
				for _, lri := range lris {
					uids = append(uids, lri.UID)
				}

				// Delete collected uids:
				for _, uid := range uids {
					lris, ok := l.lockMap[resource]
					if !ok {

# rejected proxy fails verification
cp go.mod.orig go.mod
rm go.sum
env GOPROXY=$proxy/sumdb-503
! go get rsc.io/quote
stderr 503

# fetch through working proxy is OK
cp go.mod.orig go.mod
rm go.sum
env GOPROXY=$proxy
go get rsc.io/quote

# repeated fetch works entirely from cache, does not consult sumdb
cp go.mod.orig go.mod
rm go.sum
env GOPROXY=$proxy/sumdb-503
go get rsc.io/quote

go get example.com/cmd/a
! stderr deprecated
! stderr 'no longer installs'
cp go.mod.orig go.mod

# 'go get' should not print a warning for a main package inside the main module.
# The intent is most likely to update the dependencies of that package.
# 'go install' would be used otherwise.
go get m
! stderr .
cp go.mod.orig go.mod

-- go.mod.orig --
module m

go 1.17
-- main.go --
package main

		[]staticHostEntry{
			{"PreserveMe", []string{"127.0.0.1", "::1"}},
			{"PreserveMe.local", []string{"127.0.0.1", "::1"}},
		},
	},
}

func TestLookupStaticHost(t *testing.T) {
	defer func(orig string) { hostsFilePath = orig }(hostsFilePath)

	for _, tt := range lookupStaticHostTests {
		hostsFilePath = tt.name
		for _, ent := range tt.ents {
			testStaticHost(t, tt.name, ent)
		}
	}
}