CACHEBUSTER=${{ steps.vars.outputs.DATE }}
          tags: |
            tensorflow/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
            gcr.io/tensorflow-sigs/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
          cache-from: type=registry,ref=tensorflow/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
          cache-to: type=inline
      -

		// Kubernetes <1.28>:
		"errored", "error",
		// Kubernetes <1.29>:
		"add", "asApproximateFloat", "asInteger", "compareTo", "isGreaterThan", "isInteger", "isLessThan", "isQuantity", "quantity", "sign", "sub",
		// Kubernetes <1.30>:

          # See https://cloud.google.com/architecture/using-container-images#exploring_image_manifests_digests_and_tags
          echo -n "Trying to map name $1 to tag $2... "
          digest=$(curl -s --head "https://gcr.io/v2/tensorflow-sigs/build/manifests/$2" | egrep -o "sha256:[[:alnum:]]*")
          # Find the line matching the regex "sigbuild-r2.9" (with quotes) and
          # replace just the digest portion in it

            ${keyInfo.addAsPropertiesScript()}

            signing {
                sign {
                    sign(tasks.jar)
                }
            }
        """

        when:
        run "sign"

        then:
        executedAndNotSkipped ":signJar"

        and:
        file("build", "libs", "sign-1.0.jar.asc").text
    }

    def "use kotlin action when signing"() {
        given:

    def setup() {
        applyPlugin()
    }

    def "sign jar with defaults"() {
        given:
        useJavadocAndSourceJars()
        createJarTaskOutputFile('jar', 'sourcesJar', 'javadocJar')

        when:
        signing {
            sign jar
            sign sourcesJar, javadocJar
        }

        then:

        then:
        executedAndNotSkipped ":signArchives", ":signMeta"

        and:
        file("build", "libs", "sign-1.0.jar.asc").text
        file("build", "libs", "sign-1.0-javadoc.jar.asc").text
        file("build", "libs", "sign-1.0-sources.jar.asc").text
    }

    def "configurations are signed when executing assemble task"() {
        given:
        buildFile << """
            configurations {
                meta

    }
    
    def "sign single file with defaults"() {
        when:
        def operation = signing.sign(input1)
        
        then:
        output1.exists()
        output1 == operation.singleSignature.file
    }
    
    def "sign single artifact with defaults"() {
        when:
        def operation = signing.sign(input1Artifact)
        
        then:
        output1.exists()

    }

    def "sign configuration with inherited artifacts"() {
        when:
        signing {
            sign configurations.produced
        }

        then:
        configurations.signatures.artifacts.size() == 3
        signProduced.signatures.every { it in configurations.signatures.artifacts }
    }

    def "sign configuration with custom type"() {
        def signingTasks

Here's an example that configures the plugin to sign the `mavenJava` publication:

.Signing a publication
====
include::sample[dir="snippets/signing/maven-publish/kotlin",files="build.gradle.kts[tags=sign-publication]"]
include::sample[dir="snippets/signing/maven-publish/groovy",files="build.gradle[tags=sign-publication]"]
====

// implied by expression z, or if sign < 0, by expression !z.
func minVersion(z Expr, sign int) int {
	switch z := z.(type) {
	default:
		return -1
	case *AndExpr:
		op := andVersion
		if sign < 0 {
			op = orVersion
		}
		return op(minVersion(z.X, sign), minVersion(z.Y, sign))
	case *OrExpr:
		op := orVersion
		if sign < 0 {
			op = andVersion
		}