tensorflow/build:latest-${{ matrix.python-version }}
            tensorflow/build:${{ steps.tf-version.outputs.TF_VERSION }}-${{ matrix.python-version }}
            gcr.io/tensorflow-sigs/build:latest-${{ matrix.python-version }}
            gcr.io/tensorflow-sigs/build:${{ steps.tf-version.outputs.TF_VERSION }}-${{ matrix.python-version }}
          cache-from: type=registry,ref=tensorflow/build:latest-${{ matrix.python-version }}

	// % echo Thu Dec 19 18:06:16 EST 2013 > /tmp/msg
	// % openssl rsautl -sign -inkey key -out /tmp/sig -in /tmp/msg
	//
	// Where "key" contains the RSA private key given at the bottom of this
	// file.
	expectedSig := decodeBase64("pX4DR8azytjdQ1rtUiC040FjkepuQut5q2ZFX1pTjBrOVKNjgsCDyiJDGZTCNoh9qpXYbhl7iEym30BWWwuiZg==")

	sig, err := SignPKCS1v15(nil, rsaPrivateKey, crypto.Hash(0), msg)
	if err != nil {

            CACHEBUSTER=${{ steps.vars.outputs.DATE }}
          tags: |
            tensorflow/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
            gcr.io/tensorflow-sigs/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
          cache-from: type=registry,ref=tensorflow/build:${{ steps.vars.outputs.REF }}-${{ matrix.python-version }}
          cache-to: type=inline
      -

		// Kubernetes <1.28>:
		"errored", "error",
		// Kubernetes <1.29>:
		"add", "asApproximateFloat", "asInteger", "compareTo", "isGreaterThan", "isInteger", "isLessThan", "isQuantity", "quantity", "sign", "sub",
		// Kubernetes <1.30>:

          # See https://cloud.google.com/architecture/using-container-images#exploring_image_manifests_digests_and_tags
          echo -n "Trying to map name $1 to tag $2... "
          digest=$(curl -s --head "https://gcr.io/v2/tensorflow-sigs/build/manifests/$2" | egrep -o "sha256:[[:alnum:]]*")
          # Find the line matching the regex "sigbuild-r2.9" (with quotes) and
          # replace just the digest portion in it

		// generate test functions
		for _, r := range values {
			// TODO: could also test constant on lhs.
			sig := sigString(r)
			for _, op := range operators {
				// no need for go:noinline because the function is called indirectly
				fmt.Fprintf(w, "func %v_%v_%v(x %v) bool { return x %v %v; }\n", op.name, sig, typ, typ, op.op, r.String())
			}
		}

		// generate a table of test cases

            ${keyInfo.addAsPropertiesScript()}

            signing {
                sign {
                    sign(tasks.jar)
                }
            }
        """

        when:
        run "sign"

        then:
        executedAndNotSkipped ":signJar"

        and:
        file("build", "libs", "sign-1.0.jar.asc").text
    }

    def "use kotlin action when signing"() {
        given:

    def setup() {
        applyPlugin()
    }

    def "sign jar with defaults"() {
        given:
        useJavadocAndSourceJars()
        createJarTaskOutputFile('jar', 'sourcesJar', 'javadocJar')

        when:
        signing {
            sign jar
            sign sourcesJar, javadocJar
        }

        then:

        then:
        executedAndNotSkipped ":signArchives", ":signMeta"

        and:
        file("build", "libs", "sign-1.0.jar.asc").text
        file("build", "libs", "sign-1.0-javadoc.jar.asc").text
        file("build", "libs", "sign-1.0-sources.jar.asc").text
    }

    def "configurations are signed when executing assemble task"() {
        given:
        buildFile << """
            configurations {
                meta

    }
    
    def "sign single file with defaults"() {
        when:
        def operation = signing.sign(input1)
        
        then:
        output1.exists()
        output1 == operation.singleSignature.file
    }
    
    def "sign single artifact with defaults"() {
        when:
        def operation = signing.sign(input1Artifact)
        
        then:
        output1.exists()