*/
private class LinkedTags<K : Any>(
  private val key: KClass<K>,
  private val value: K,
  private val next: Tags,
) : Tags() {
  override fun <T : Any> plus(
    key: KClass<T>,
    value: T?,
  ): Tags {
    // Create a copy of this `LinkedTags` that doesn't have a mapping for `key`.
    val thisMinusKey =
      when {
        key == this.key -> next // Subtract this!

        else -> {

var (
	defaultHelpPostfix = func(key string) string {
		return config.DefaultHelpPostfix(DefaultKVS, key)
	}

	Help = config.HelpKVS{
		config.HelpKV{
			Key:         ServerAddr,
			Description: `AD/LDAP server address e.g. "myldap.com" or "myldapserver.com:636"` + defaultHelpPostfix(ServerAddr),
			Type:        "address",
			Sensitive:   true,
		},
		config.HelpKV{
			Key:         SRVRecordName,

	// There are two possibilities:
	// - We use a KMS -> There must be non-empty key ID and a KMS data key.
	// - We use a K/V -> There must be no key ID and no KMS data key.
	// Otherwise, the caller has passed an invalid argument combination.
	if keyID == "" && len(kmsKey) != 0 {
		logger.CriticalIf(context.Background(), errors.New("The key ID must not be empty if a KMS data key is present"))
	}
	if keyID != "" && len(kmsKey) == 0 {

	if len(keys) != 1 {
		t.Fatalf("expected len(keys)=1, but found %d", len(keys))
	}

	key := keys[0]
	if !key.Compress {
		t.Fatal("expected the item to be compressed")
	}
	if key.ItemCount != 10 {
		t.Fatalf("expected itemcount=10 but found %v", key.ItemCount)
	}

	raw, err := store.GetRaw(key)
	if err != nil {
		t.Fatalf("unable to get multiple items; %v", err)
	}

    Object key = new Object();
    int hash = map.hash(key);
    Object oldValue = new Object();
    Object newValue = new Object();

    // no entry
    assertThat(segment.count).isEqualTo(0);
    assertThat(segment.put(key, hash, oldValue, true)).isNull();
    assertThat(segment.count).isEqualTo(1);

    // same key
    assertThat(segment.put(key, hash, newValue, true)).isSameInstanceAs(oldValue);

    Object key = new Object();
    int hash = map.hash(key);
    Object oldValue = new Object();
    Object newValue = new Object();

    // no entry
    assertThat(segment.count).isEqualTo(0);
    assertThat(segment.put(key, hash, oldValue, true)).isNull();
    assertThat(segment.count).isEqualTo(1);

    // same key
    assertThat(segment.put(key, hash, newValue, true)).isSameInstanceAs(oldValue);

// unsealObjectKey decrypts and returns the sealed object key
// from the metadata using the SSE-C client key.
func unsealObjectKey(clientKey []byte, metadata map[string]string, bucket, object string) (key ObjectKey, err error) {
	sealedKey, err := SSEC.ParseMetadata(metadata)
	if err != nil {
		return key, err
	}
	err = key.Unseal(clientKey, sealedKey, SSEC.String(), bucket, object)
	return key, err
}

}

var (
	errMalformedJWKRSAKey = errors.New("malformed JWK RSA key")
	errMalformedJWKECKey  = errors.New("malformed JWK EC key")
)

// DecodePublicKey - decodes JSON Web Key (JWK) as public key
func (key *JWKS) DecodePublicKey() (crypto.PublicKey, error) {
	switch key.Kty {
	case "RSA":
		if key.N == "" || key.E == "" {
			return nil, errMalformedJWKRSAKey
		}

		// decode exponent

	}
	key, rest := pem.Decode(keyPEMBlock)
	if len(rest) > 0 {
		return tls.Certificate{}, ErrTLSUnexpectedData(nil).Msgf("The private key contains additional data")
	}
	if key == nil {
		return tls.Certificate{}, ErrTLSUnexpectedData(nil).Msgf("The private key is not readable")
	}
	if x509.IsEncryptedPEMBlock(key) {
		password := env.Get(EnvCertPassword, "")

  @Override
  public boolean containsKey(@Nullable Object key) {
    if (unfiltered.containsKey(key)) {
      @SuppressWarnings("unchecked") // k is equal to a K, if not one itself
      K k = (K) key;
      return keyPredicate.apply(k);
    }
    return false;
  }

  @Override
  public Collection<V> removeAll(@Nullable Object key) {
    return containsKey(key) ? unfiltered.removeAll(key) : unmodifiableEmptyCollection();
  }