return rune(p0&mask2)<<6 | rune(b1&maskx), 2
	}
	b2 := p[2]
	if b2 < locb || hicb < b2 {
		return RuneError, 1
	}
	if sz <= 3 {
		return rune(p0&mask3)<<12 | rune(b1&maskx)<<6 | rune(b2&maskx), 3
	}
	b3 := p[3]
	if b3 < locb || hicb < b3 {
		return RuneError, 1
	}
	return rune(p0&mask4)<<18 | rune(b1&maskx)<<12 | rune(b2&maskx)<<6 | rune(b3&maskx), 4
}

	// read.
	//
	// These steps are complicated by the rules around foreground process
	// groups. A process group cannot be foreground if it is "orphaned",
	// unless it masks SIGTTOU.  i.e., to be foreground the process group
	// must have a parent process group in the same session or mask SIGTTOU
	// (which we do). An orphaned process group cannot receive
	// terminal-generated SIGTSTP at all.
	//
	// Achieving this requires three processes total:

	_, _, maskedDocument := fetchPath(defaultManager, "application/json", discoveryPath, "")
	masked := initialDocument.DeepCopy()
	masked.Items[0].Versions[0].Freshness = apidiscoveryv2.DiscoveryFreshnessStale

	require.Equal(t, masked.Items, maskedDocument.Items)

	// Wipe out default group. The other versions from the other group should now

	base := subnet.Masked().Addr()
	bytes := base.AsSlice()
	// get all the host bits from the subnet
	n := 8*len(bytes) - subnet.Bits()
	// set all the host bits to 1
	for i := len(bytes) - 1; i >= 0 && n > 0; i-- {
		if n >= 8 {
			bytes[i] = 0xff
			n -= 8
		} else {
			mask := ^uint8(0) >> (8 - n)
			bytes[i] |= mask
			break
		}
	}

        url '${mavenRepo.uri}'
    }
}
configurations {
    lockedConf
}
dependencies {
    lockedConf 'org:bar:$version'
    lockedConf 'org:baz:1.0' // Ensure the fact that '1.0' is from a lock isn't masked by a real dependency
    lockedConf 'org:baz:$version'
    lockedConf 'org:foo:$version'
}
"""
        lockfileFixture.createLockfile('lockedConf', ['org:bar:1.0', 'org:baz:1.0', 'org:foo:1.0'])

        when:

			// So we double the cost of parsing the string.
			cost := uint64(math.Ceil(float64(actualSize(args[0])) * 2 * common.StringTraversalCostFactor))
			return &cost
		}
	case "masked", "prefixLength", "family", "isUnspecified", "isLoopback", "isLinkLocalMulticast", "isLinkLocalUnicast":
		// IP and CIDR accessors are nominal cost.
		cost := uint64(1)
		return &cost
	case "containsIP":

abstract class Striped64 extends Number {
  /*
   * This class maintains a lazily-initialized table of atomically
   * updated variables, plus an extra "base" field. The table size
   * is a power of two. Indexing uses masked per-thread hash codes.
   * Nearly all declarations in this class are package-private,
   * accessed directly by subclasses.
   *
   * Table entries are of class Cell; a variant of AtomicLong padded

	overlapErr                     = "using overlapping resources such as 'secrets' and '*.' in the same resource list is not allowed as they will be masked"
	nonRESTAPIResourceErr          = "resources which do not have REST API/s cannot be encrypted"
	resourceNameErr                = "resource name should not contain capital letters"

```

This can occur when network address translation (NAT) masquerade is used.
When NAT masquerade is enabled, connections that should be considered local to the machine are masked to appear from external IP addresses.
Gradle refuses to connect to any external IP address as a security precaution.

              stats:
                description: Stats produced by the last entry reconciliation run
                properties:
                  entriesMasked:
                    description: How many entries were masked by entries for other
                      ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs
                      produce an entry for the same pod with the same set of workload
                      selectors.