* <p>
     * Note: only one, this method or {@link #getRecommendedVersion()} method must return non-{@code null} value.
     */
    @Nullable
    VersionRange getVersionRange();

    /**
     * Returns the recommended version of this constraint, or {@code null} if none.
     * <p>
     * Note: only one, this method or {@link #getVersionRange()} method must return non-{@code null} value.

# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See

    CipherSuite.TLS_AES_256_GCM_SHA384,
    CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
    CipherSuite.TLS_AES_128_CCM_SHA256,
    CipherSuite.TLS_AES_128_CCM_8_SHA256,
  )

/**
 * A TLS 1.3 only Connection Spec. This will be eventually be exposed
 * as part of MODERN_TLS or folded into the default OkHttp client once published and
 * available in JDK11 or Conscrypt.
 */
private val TLS_13 =

		pod    *corev1.Pod
		want   bool
	}{
		{
			"Testing OK pod with only ExitCode check",
			config.RepairConfig{
				SidecarAnnotation: "sidecar.istio.io/status",
				InitContainerName: constants.ValidationContainerName,
				InitExitCode:      126,
			},
			workingPod,
			false,
		},
		{
			"Testing working pod (that previously died) with only ExitCode check",
			config.RepairConfig{

  // +optional
  repeated string resourceNames = 4;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.

  // Allowed values are "Exact" or "Equivalent".
  //
  // - Exact: match a request only if it exactly matches a specified rule.
  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
  // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,

### TLS with SNI Extension

**Only one process** in the server can be listening on a specific **port** in a specific **IP address**. There could be other processes listening on other ports in the same IP address, but only one for each combination of IP address and port.

TLS (HTTPS) uses the specific port `443` by default. So that's the port we would need.

     * exists and is not marked read-only. By default, resources are
     * considered to be read-only and therefore for <code>smb://</code>,
     * <code>smb://workgroup/</code>, and <code>smb://server/</code> resources
     * will be read-only.
     *
     * @return <code>true</code> if the resource exists is not marked
     *         read-only
     * @throws CIFSException
     */

 * Don't start a new attempt until 250 ms after the most recent attempt was started.
 * Keep whichever TCP connection succeeds first and cancel all the others.
 * Race TCP only. Only attempt a TLS handshake on the winning TCP connection.

 * followed by <dfn>flattening</dfn> and <dfn>resolution</dfn>.
 * The version selection is done for each dependency during the collection phase.
 * The flatten phase will keep only a single version per ({@code groupId}, {@code artifactId}) pair.
 * The resolution will actually download the dependencies (or artifacts) that have been computed.
 *
 * @since 4.0.0
 */
@Experimental
@Immutable