return;
                        }
                        try {
                            boolean verified = SecuritySupport.verify(origin, pgpSignature, pgpPublicKey);
                            if (!verified) {
                                result.failed(pgpPublicKey);
                            } else {

  - On artifact foo-1.0.pom (org:foo:1.0) in repository 'maven': Artifact was signed with key '14F53F0824875D73' but it wasn't found in any key server so it couldn't be verified

This can indicate that a dependency has been compromised. Please carefully verify the signatures and checksums."""
        }

// tag::custom-task-implementation[]
import org.gradle.api.tasks.options.Option;

public class UrlVerify extends DefaultTask {
    private String url;

    @Option(option = "url", description = "Configures the URL to be verified.")
    public void setUrl(String url) {
        this.url = url;
    }

    @Input
    public String getUrl() {
        return url;
    }

    @TaskAction
    public void verify() {

cp go.mod go.mod.edit
! go list -m all
stderr 'updates to go.mod needed'

go mod graph
cmp stdout graph.want
cmp go.mod go.mod.edit

go mod verify
stdout '^all modules verified$'
cmp go.mod go.mod.edit

go mod why rsc.io/sampler
cmp stdout why.want
cmp go.mod go.mod.edit

go mod why -m rsc.io/sampler
cmp stdout why.want
cmp go.mod go.mod.edit

cp go.mod.orig go.mod

# go mod verify should not try to verify the workspace modules.
# This is a test for #54372.

go mod verify
stdout 'all modules verified'
! stderr .

-- go.work --
go 1.21

use (
    ./a
    ./b
    ./c
    ./d
)
-- a/go.mod --
module example.com/a

go 1.21

require rsc.io/quote v1.1.0
-- a/a.go --
package a
import _ "rsc.io/quote"
-- b/go.mod --
module example.com/b

go 1.21

	}

	tlsInfo := peer.AuthInfo.(credentials.TLSInfo)
	chains := tlsInfo.State.VerifiedChains
	if len(chains) == 0 || len(chains[0]) == 0 {
		return nil, fmt.Errorf("no verified chain is found")
	}

	ids, err := util.ExtractIDs(chains[0][0].Extensions)
	if err != nil {
		return nil, err
	}

	return &security.Caller{
		AuthSource: security.AuthSourceClientCertificate,

        setup:
        buildScript """
            println "GRADLE_VERSION: " + gradle.gradleVersion

            task verify {
                doFirst {
                    println "verified = " + java.nio.charset.Charset.defaultCharset().name()
                }
            }
        """

        when:
        executer.withEnvironmentVars(GRADLE_OPTS: "-Dfile.encoding=UTF-8");
        run "verify"

	// Within this directory, `<group>.<version>.<kind>.[json|yaml|pb]` files are required to exist, and are:
	// * verified to match serialized FilledObjects[GVK]
	// * verified to decode without error
	// * verified to round-trip byte-for-byte when re-encoded
	// * verified to be semantically equal when decoded into memory
	TestDataDirCurrentVersion string

 */
package org.gradle.api.internal.artifacts.verification.signatures;

import org.bouncycastle.openpgp.PGPPublicKey;

public interface SignatureVerificationResultBuilder {
    void missingKey(String keyId);
    void verified(PGPPublicKey key, boolean trusted);
    void failed(PGPPublicKey pgpPublicKey);
    void ignored(String keyId);

    void noSignatures();

}

// JWTTokenAuthenticator authenticates tokens as JWT tokens produced by JWTTokenGenerator
// Token signatures are verified using each of the given public keys until one works (allowing key rotation)
// If lookup is true, the service account and secret referenced as claims inside the token are retrieved and verified with the provided ServiceAccountTokenGetter