//
        // Note that there is a race condition here which can result in missing
        // a cyclic edge: it's possible for two threads to simultaneous find
        // "safe" edges which together form a cycle. Preventing this race
        // condition efficiently without _introducing_ deadlock is probably
        // tricky. For now, just accept the race condition---missing a warning

      assertThat(expected.message)
        .isEqualTo("Client-sent frames must be masked.")
    }
  }

  @Test fun serverSentFramesMustNotBeMasked() {
    data.write("8180".decodeHex())
    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Server-sent frames must not be masked.")
    }
  }

class WindowCounter(
  val streamId: Int,
) {
  /** The total number of bytes consumed. */
  var total: Long = 0L
    private set

  /** The total number of bytes acknowledged by outgoing `WINDOW_UPDATE` frames. */
  var acknowledged: Long = 0L
    private set

  val unacknowledged: Long
    @Synchronized get() = total - acknowledged

  @Synchronized
  fun update(
    total: Long = 0,
    acknowledged: Long = 0,

          name: origin
          # master node jenkins user ~/.ssh
          credentials-id: f6c7695a-671e-4f4f-a331-acdce44ff9ba
          reference-repo: "/var/lib/jenkins/.git-references/elasticsearch.git"
          branches:
            - "${branch_specifier}"
          url: "https://github.com/elastic/elasticsearch.git"
          basedir: ""
          wipe-workspace: true
    triggers: []
    wrappers:
      - timeout:

      try {
        checkCurrentState(RUNNING);
      } finally {
        monitor.leave();
      }
    } else {
      // It is possible due to races that we are currently in the expected state even though we
      // timed out. e.g. if we weren't event able to grab the lock within the timeout we would never

  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
  schedule:
    - cron: '45 9 * * 0'
  push:
    branches: [ "master" ]

# Declare default permissions as read only.
permissions: read-all

jobs:
  analysis:
    name: Scorecard analysis
    runs-on: ubuntu-latest
    permissions:

 *  Fix: Don't lose HTTP/2 flow control bytes when incoming data races with a stream close. If this
    happened enough then eventually the connection would stall.

 *  Fix: Acknowledge and apply inbound HTTP/2 settings atomically. Previously we had a race where we
    could use new flow control capacity before acknowledging it, causing strict HTTP/2 servers to
    fail the call.

        assertEquals('F', dst[1]); // (0x54 >> 4) + 0x41 = 0x46 = 'F'
        assertEquals('E', dst[2]); // (0x54 & 0x0F) + 0x41 = 0x45 = 'E'

        // Check padding (positions 8-30 should be 'CA' pairs for spaces)
        for (int i = 8; i < 31; i += 2) {
            assertEquals('C', dst[i + 1]);
            assertEquals('A', dst[i + 2]);
        }

        // Check type encoding at position 31-32

#         integration-tests/gradle/gradle/wrapper/gradle-wrapper.properties
#         integration-tests/gradle/gradlew
#         integration-tests/gradle/gradlew.bat
# Please commit your changes or stash them before you switch branches.

GRADLE_TEMP="$(mktemp -d)"
trap 'rm -rf "${GRADLE_TEMP}"' EXIT

# The Gradle tests need the pom.xml only to read its version number.
# (And the file needs to be two directory levels up from the Gradle build file.)

    frame.writeByte(FLAG_NONE)
    frame.writeInt(expectedStreamId and 0x7fffffff)
    frame.write(headerBlock, Http2.INITIAL_MAX_FRAME_SIZE.toLong())

    // Write the continuation frame, specifying no more frames are expected.
    writeMedium(frame, headerBlock.size.toInt())
    frame.writeByte(Http2.TYPE_CONTINUATION)
    frame.writeByte(FLAG_END_HEADERS)
    frame.writeInt(expectedStreamId and 0x7fffffff)