assertThat(expected).hasCauseThat().hasMessageThat().isEqualTo("kaboom!");
    executionThread.join();

    assertTrue(service.startUpCalled);
    assertEquals(Service.State.FAILED, service.state());
    assertThat(service.failureCause()).hasMessageThat().isEqualTo("kaboom!");
  }

  private class ThrowOnStartUpService extends AbstractExecutionThreadService {

    assertThat(Ints.saturatedCast(Long.MIN_VALUE)).isEqualTo(LEAST);
  }

  private static void assertCastFails(long value) {
    try {
      Ints.checkedCast(value);
      fail("Cast to int should have failed: " + value);
    } catch (IllegalArgumentException ex) {
      assertWithMessage("%s not found in exception text: %s", value, ex.getMessage())
          .that(ex.getMessage().contains(String.valueOf(value)))

        logger.warning("Cannot access " + file + ": " + e);
        // TODO(emcmanus): consider whether to log other failure cases too.
        return;
      }
      if (file.isDirectory()) {
        scanDirectory(file, builder);
      } else {
        scanJar(file, scannedUris, builder);
      }
    }

    private void scanJar(
        File file, Set<File> scannedUris, ImmutableSet.Builder<ResourceInfo> builder)

        result.task(":darwin-${archiveType}:checkExtraction").outcome == TaskOutcome.FAILED
        result.output.contains("Detected class file in distribution ('SomeFile.class')")

        where:
        archiveType << ["zip", 'tar']
    }

    def "fails on unexpected license content"() {
        given:
        elasticLicense()
        file("LICENSE.txt") << """elastic license coorp stuff line 1
unknown license content line 2

   * The deadline to respond to this ping attempts to limit the cost of being wrong. If it is too
   * long, streams created while we await the pong will reuse broken connections and inevitably
   * fail. If it is too short, slow connections will be marked as failed and extra TCP and TLS
   * handshakes will be required.
   *
   * The deadline is currently hardcoded. We may make this configurable in the future!
   */

#### General Fixes and Reliability

* Fixed a regression in kube-scheduler to properly load client connection information from a `--config` file that references a kubeconfig file. ([#65507](https://github.com/kubernetes/kubernetes/pull/65507), [@liggitt](https://github.com/liggitt))

       * initialized by next() -- which initializes rowEntry, too.
       *
       * - rowEntry isn't cleared except below. If it was cleared below, then either
       *   columnIterator.remove() would have failed above (if the user hasn't called next() since
       *   then) or rowEntry would have been initialized by next() (as discussed above).
       */
      if (requireNonNull(rowEntry).getValue().isEmpty()) {
        rowIterator.remove();

- Fixed an issue which didn't append OS's environment variables with the one provided in Credential Provider Config file, which may lead to failed execution of external credential provider binary. 
  See https://github.com/kubernetes/kubernetes/issues/102750 ([#103231](https://github.com/kubernetes/kubernetes/pull/103231), [@n4j](https://github.com/n4j)) [SIG Auth and Node]

        }

        // Test basic properties
        assertTrue(file.exists(), "File should exist");
        assertTrue(file.canRead(), "File should be readable");
        assertTrue(file.canWrite(), "File should be writable");
        assertEquals(content.length(), file.length(), "File length should match");

        // Test timestamps
        long lastModified = file.lastModified();

- kubelet: the `--image-credential-provider-config` file was loaded with strict deserialization, which failed if the config file contained duplicate or unknown fields. This protected against accidentally running with malformed config files, unindented files, or typos in field names, and it prevented unexpected behavior. ([#128062](https://github.com/kubernetes/kubernetes/pull/128062), [@aramase](https://github.com/aramase))...