go 1.20
-- example_test.go --
package example_test

import (
	"fmt"
	"os"
	"strconv"
	"testing"
	"strings"
	"time"
)

func FuzzInterrupt(f *testing.F) {
	pids := os.Getenv("GO_TEST_INTERRUPT_PIDS")
	if pids == "" {
		// This is the main test process.
		// Set the environment variable for fuzz workers.
		pid := os.Getpid()
		ppid := os.Getppid()

        return result == "" ? [] : result.split("\\n")
    }

    // Only supported on *nix platforms
    String[] getProcessInfo(String[] pids) {
        if (pids == null || pids.size() == 0) {
            throw new RuntimeException("Unable to get process info because provided pids are null or empty!")
        }
        if (!(OperatingSystem.current().unix)) {

        } else {
            entry = vertex;
        }

        MetadataTreeNode[] kids = node.getChildren();
        if (kids == null || kids.length < 1) {
            return;
        }

        for (int i = 0; i < kids.length; i++) {
            MetadataTreeNode n = kids[i];
            processTreeNodes(vertex, n, depth + 1, i);
        }
    }

	if len(keyUsages) == 0 {
		keyUsages = []ExtKeyUsage{ExtKeyUsageServerAuth}
	}
	oids := make([]*byte, 0, len(keyUsages))
	for _, eku := range keyUsages {
		if eku == ExtKeyUsageAny {
			oids = nil
			break
		}
		if oid, ok := windowsExtKeyUsageOIDs[eku]; ok {
			oids = append(oids, &oid[0])
		}
	}
	if oids != nil {
		para.RequestedUsage.Type = syscall.USAGE_MATCH_TYPE_OR

now support a `MayRunAs` rule for `fsGroup` and `supplementalGroups` options. This allows specifying ranges of allowed GIDs for pods/containers without forcing a default GID the way `MustRunAs` does. This means that a container to which such a policy applies to won't use any fsGroup/supplementalGroup GID if not explicitly specified, yet a specified GID must still fall in the GID range according to the policy. ([#65135](https://github.com/kubernetes/kubernetes/pull/65135), [@stlaz](https://github.com/stlaz))...

		t.Fatalf("Expected 3 keys, got %d", len(jk.Keys))
	}

	var kids []string
	for ii, jks := range jk.Keys {
		_, err := jks.DecodePublicKey()
		if err != nil {
			t.Fatalf("Failed to decode key %d: %v", ii, err)
		}
		kids = append(kids, jks.Kid)
	}
	if len(kids) != 3 {
		t.Fatalf("Failed to find the expected number of kids: 3, got %d", len(kids))
	}
}

// A.1 - Example public keys

	for i, err := range errs {
		if err != nil {
			t.Errorf("Failed adding first round of UIDs for job %s: %v", tracks[i].job, err)
		}
	}

	for _, track := range tracks {
		uids := expectations.getSet(track.job)
		if uids == nil {
			t.Errorf("Set of UIDs is empty for job %s", track.job)
		} else if diff := cmp.Diff(track.firstRound, sets.List(uids.set)); diff != "" {
			t.Errorf("Unexpected keys for job %s (-want,+got):\n%s", track.job, diff)

iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
ip6tables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
ip6tables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1

iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 2 -j RETURN

	// array and then call "f" on it.
	for pidx, p := range mm.pkgs {
		fids := make([]int, 0, len(p.ctab))
		for fid := range p.ctab {
			fids = append(fids, int(fid))
		}
		sort.Ints(fids)
		if *verbflag >= 4 {
			fmt.Printf("fids for pk=%d: %+v\n", pidx, fids)
		}
		for _, fid := range fids {
			fp := p.ctab[uint32(fid)]
			if *verbflag >= 4 {