isSvcAccForRequestor := targetUser == requestorUser || targetUser == requestorParentUser

	// If we are creating svc account for request sender, ensure
	// that targetUser is a real user (i.e. not derived
	// credentials).
	if isSvcAccForRequestor {
		if requestorIsDerivedCredential {
			if requestorParentUser == "" {
				writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx,

    EntryTransformer<K, V1, V2> transformer = (key, value) -> function.apply(value);
    return transformEntries(fromMultimap, transformer);
  }

  /**
   * Returns a view of a multimap whose values are derived from the original multimap's entries. In
   * contrast to {@link #transformValues}, this method's entry-transformation logic may depend on
   * the key as well as the value.
   *

    EntryTransformer<K, V1, V2> transformer = (key, value) -> function.apply(value);
    return transformEntries(fromMultimap, transformer);
  }

  /**
   * Returns a view of a multimap whose values are derived from the original multimap's entries. In
   * contrast to {@link #transformValues}, this method's entry-transformation logic may depend on
   * the key as well as the value.
   *

"C? Go? Cgo!" for an introduction to using cgo:
https://golang.org/doc/articles/c_go_cgo.html.

CFLAGS, CPPFLAGS, CXXFLAGS, FFLAGS and LDFLAGS may be defined with pseudo
#cgo directives within these comments to tweak the behavior of the C, C++
or Fortran compiler. Values defined in multiple directives are concatenated
together. The directive can include a list of build constraints limiting its
effect to systems satisfying one of the constraints

 *
 * You can customize a shared OkHttpClient instance with [newBuilder]. This builds a client that
 * shares the same connection pool, thread pools, and configuration. Use the builder methods to
 * add configuration to the derived client for a specific purpose.
 *
 * This example shows the single instance with default configurations.
 *
 * ```java
 * public final OkHttpClient client = new OkHttpClient.Builder()

          <required>false</required>
          <description>Default dependency information for projects that inherit from this one. The
            dependencies in this section are not immediately resolved. Instead, when a POM derived
            from this one declares a dependency described by a matching groupId and artifactId, the
            version and other values from this section are used for that dependency if they were not

// AssumeRoleWithCertificate case, the "virtual" parent user is the value of the
// `Subject.CommonName` field. For the OIDC (without RoleARN) case the "virtual"
// parent is derived as a concatenation of the `sub` and `iss` fields. The
// policies applicable to the STS credential are associated with this "virtual"
// parent.
//
// When a policyName is given to this function, the policy association is

import org.jspecify.annotations.NullUnmarked;
import org.jspecify.annotations.Nullable;

/**
 * The concurrent hash map implementation built by {@link MapMaker}.
 *
 * <p>This implementation is heavily derived from revision 1.96 of <a
 * href="http://tinyurl.com/ConcurrentHashMap">ConcurrentHashMap.java</a>.
 *
 * @param <K> the type of the keys in the map
 * @param <V> the type of the values in the map

*MasterSecret { derived := deriveSecret(s.hash, s.secret, "derived", nil) return &MasterSecret{ secret: extract(s.hash, nil, derived), hash: s.hash, } } // ClientApplicationTra derives the client_application_traffic_secret_0 // from the master secret and the transcript up to the server Finished. func (s *MasterSecret) ClientApplicationTra(transcript fips140.Hash) []byte { return deriveSecret(s.hash, s.secret, clientApplicationTra, transcript) } // ServerApplicationTra derives the server_application_traffic_secret_0...

## Known Issues