if err != nil {
			internalLogIf(ctx, err, logger.WarningKind)
			return true
		}
		if ret.RetainUntilDate.After(t) {
			return true
		}
	}
	return false
}

// enforceRetentionBypassForDelete enforces whether an existing object under governance can be deleted
// with governance bypass headers set in the request.
// Objects under site wide WORM can never be overwritten.

import jcifs.DfsReferralData;
import jcifs.SmbResourceLocator;


/**
 * @author mbechler
 *
 */
public interface SmbResourceLocatorInternal extends SmbResourceLocator {

    /**
     * @return whether to enforce the use of signing on connection to this resource
     */
    boolean shouldForceSigning ();


    /**
     * @param other
     * @return whether the paths share a common root
     * @throws CIFSException

+ If referring to a repo other than `golang/go` you can use the
  `owner/repo#issue_number` syntax: `Fixes golang/tools#1234`
+ We do not use Signed-off-by lines in Go. Please don't add them.
  Our Gerrit server & GitHub bots enforce CLA compliance instead.

                                    + "but not for non maven-plugin projects. "
                                    + "For such purposes you should use the maven-enforcer-plugin. "
                                    + "See https://maven.apache.org/enforcer/enforcer-rules/requireMavenVersion.html",
                            mavenProject.getId());
                }
            }
        }
    }

    /**

                for (Plugin element : src) {
                    if (element.isInherited() || !element.getExecutions().isEmpty()) {
                        // NOTE: Enforce recursive merge to trigger merging/inheritance logic for executions
                        Plugin plugin = Plugin.newInstance(false);
                        plugin = mergePlugin(plugin, element, sourceDominant, context);

 * serialization of funnels. When possible, it is recommended that funnels be implemented as a
 * single-element enum to maintain serialization guarantees. See Effective Java (2nd Edition), Item
 * 3: "Enforce the singleton property with a private constructor or an enum type". For example:
 *
 * <pre>{@code
 * public enum PersonFunnel implements Funnel<Person> {
 *   INSTANCE;

confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.

Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.

## Attribution

- **Cross-Language Compatibility:**
Java serialization is inherently Java-centric and does not support cross-language scenarios well.

- **Type Safety:**
Java serialization does not enforce type safety as strictly as some alternatives, potentially leading to runtime errors.

## Decision

We do not use Java serialization.

Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.
If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

### CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.

**Affected Versions**:
  - kube-apiserver v1.29.0 - v1.29.3