}

	return target, nil
}

var errInvalidPsqlTablename = errors.New("invalid PostgreSQL table")

func validatePsqlTableName(name string) error {
	// check for quoted string (string may not contain a quote)
	if match, err := regexp.MatchString("^\"[^\"]+\"$", name); err != nil {
		return err
	} else if match {
		return nil
	}

	// normalize the name to letters, digits, _ or $
	valid := true

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \
    --name opa \
    --publish 8181:8181 \
    docker.io/openpolicyagent/opa:0.40.0-rootless \
       run --server \
           --log-format=json-pretty \

                }

                function appendErrorCorrections(reason) {
                    var result = JSON.parse('${currentApiChanges.replace('\n', '')}'); // JSON string from report uses double quotes, contain it within single quotes
                    getAllErrorCorrections().forEach((correction) => {
                        correction.acceptation = reason;
                        result.acceptedApiChanges.push(correction);

 * will allow the Mojo to communicate to the outside world through standard Maven channels.
 *
 */
@ThreadSafe
public interface Mojo {
    /** The component <code>role</code> hint for Plexus container */
    String ROLE = Mojo.class.getName();

    /**
     * Perform whatever build-process behavior this <code>Mojo</code> implements.<br>

         7d:ab:b8:e9:75:ec:b4:39:fb:c8:cf:53:16:5b:1f:15:b6:7f:
         5a:d1:35:2d:fc:31:3a:10:e7:0c
```

> Observe the `Subject: CN = consoleAdmin` field.

Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.

Now, the STS certificate-based authentication happens in 4 steps:

import org.apache.maven.api.annotations.Nullable;

/**
 * Interface used to locate the root directory for a given project.
 *
 * The root locator is usually looked up from the plexus container.
 * One notable exception is the computation of the early {@code session.rootDirectory}
 * property which happens very early.  The implementation used in this case
 * will be discovered using the JDK service mechanism.
 *

        super(true);
        this.root = root;
    }

    /**
     * <p>Split the expression into parts, tokenized on the dot ('.') character. Then,
     * starting at the root object contained in this value source, apply each part
     * to the object graph below this root, using either 'getXXX()' or 'isXXX()'
     * accessor types to resolve the value for each successive expression part.

    /**
     * have to match the CHECKSUM_IDS
     */
    private static final String[] CHECKSUM_ALGORITHMS = {"MD5", "SHA-1"};

    @Inject
    private Logger logger;

    @Inject
    private PlexusContainer container;

    @Inject
    private UpdateCheckManager updateCheckManager;

    @Inject
    private LegacySupport legacySupport;

    //
    // Retriever
    //
    @Override
    public void getArtifact(

        if (path == null || path.isEmpty()) {
            // TODO This replacing shouldn't be necessary as user.home should be in the
            // context of the container and thus the value would be interpolated by Plexus
            String basedir = System.getProperty(basedirSysProp);
            if (basedir == null) {
                basedir = System.getProperty("user.dir");
            }

 * that subsequent call is right for the resident instance (ie no env change or different extension needed).
 * This implementation "pre-populates" MavenContext with pre-existing stuff (except for very first call)
 * and does not let DI container to be closed.
 */
public class ResidentMavenInvoker extends MavenInvoker {

    private final ConcurrentHashMap<String, MavenContext> residentContext;