// should be decrypted. Therefore, it is the callers
	// responsibility to remember the corresponding context for
	// a particular DEK. The context may be nil.
	GenerateKey(context.Context, *GenerateKeyRequest) (DEK, error)

	// DecryptKey decrypts the ciphertext with the key referenced
	// by the key ID. The context must match the context value
	// used to generate the ciphertext.

      - '!tensorflow/tools/tf_sig_build_dockerfiles/README.md'

permissions:
  contents: read

jobs:
  docker:
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [python3.9, python3.10, python3.11, python3.12]
    permissions:
      contents: read
      pull-requests: write
    steps:

    public int execute(DefaultEncryptInvoker.LocalContext context) throws Exception {
        context.addInHeader(context.style.italic().bold().foreground(Colors.rgbColor("yellow")), "goal: init");
        context.addInHeader("");

        ConsolePrompt prompt = context.prompt;
        boolean force = context.invokerRequest.options().force().orElse(false);
        boolean yes = context.invokerRequest.options().yes().orElse(false);

// SetAuditEntry sets Audit info in the context.
func SetAuditEntry(ctx context.Context, audit *audit.Entry) context.Context {
	if ctx == nil {
		LogIf(context.Background(), "audit", fmt.Errorf("context is nil"))
		return nil
	}
	return context.WithValue(ctx, contextAuditKey, audit)
}

// GetAuditEntry returns Audit entry if set.
func GetAuditEntry(ctx context.Context) *audit.Entry {
	if ctx != nil {

}

func (restClient *ReconnectRESTClient) Lock(ctx context.Context, args LockArgs) (status bool, err error) {
	return restClient.Call("/v1/lock", args)
}

func (restClient *ReconnectRESTClient) RUnlock(ctx context.Context, args LockArgs) (status bool, err error) {
	return restClient.Call("/v1/runlock", args)
}

func (restClient *ReconnectRESTClient) Unlock(ctx context.Context, args LockArgs) (status bool, err error) {

func (s *erasureSets) GetObjectNInfo(ctx context.Context, bucket, object string, rs *HTTPRangeSpec, h http.Header, opts ObjectOptions) (gr *GetObjectReader, err error) {
	set := s.getHashedSet(object)
	return set.GetObjectNInfo(ctx, bucket, object, rs, h, opts)
}

// PutObject - writes an object to hashedSet based on the object name.

type RWLocker interface {
	GetLock(ctx context.Context, timeout *dynamicTimeout) (lkCtx LockContext, timedOutErr error)
	Unlock(lkCtx LockContext)
	GetRLock(ctx context.Context, timeout *dynamicTimeout) (lkCtx LockContext, timedOutErr error)
	RUnlock(lkCtx LockContext)
}

// LockContext lock context holds the lock backed context and canceler for the context.
type LockContext struct {
	ctx    context.Context
	cancel context.CancelFunc
}

	cache.InitOnce(2*time.Second, Opts{},
		func(ctx context.Context) (time.Time, error) {
			return time.Now(), slowCaller(ctx)
		},
	)

	ctx, cancel := context.WithCancel(context.Background())
	cancel() // cancel context to test.

	_, err := cache.GetWithCtx(ctx)
	if !errors.Is(err, context.Canceled) {
		t.Fatalf("expected context.Canceled err, got %v", err)
	}

	ctx, cancel = context.WithCancel(context.Background())
	defer cancel()

	Lock(ctx context.Context, args LockArgs) (bool, error)

	// Do read unlock for given LockArgs. It should return
	// * a boolean to indicate success/failure of the operation
	// * an error on failure of unlock request operation.
	// Canceling the context will abort the remote call.
	// In that case, the resource may or may not be unlocked.
	RUnlock(ctx context.Context, args LockArgs) (bool, error)

func (s StubKMS) Version(ctx context.Context) (string, error) {
	return "stub", nil
}

// APIs returns supported APIs
func (s StubKMS) APIs(ctx context.Context) ([]madmin.KMSAPI, error) {
	return []madmin.KMSAPI{
		{Method: http.MethodGet, Path: "stub/path"},
	}, nil
}

// Status returns a set of endpoints and their KMS status.
func (s StubKMS) Status(context.Context) (map[string]madmin.ItemState, error) {