},
		"secure, no roots": {
			TLSConfig:   &tls.Config{InsecureSkipVerify: false},
			ExpectError: "unknown authority|not trusted",
		},
		"secure with roots": {
			TLSConfig: &tls.Config{InsecureSkipVerify: false, RootCAs: roots},
		},
		"secure with mismatched server": {
			TLSConfig:   &tls.Config{InsecureSkipVerify: false, RootCAs: roots, ServerName: "bogus.com"},
			ExpectError: "not bogus.com",

var x509usefallbackroots = godebug.New("x509usefallbackroots")

// SetFallbackRoots sets the roots to use during certificate verification, if no
// custom roots are specified and a platform verifier or a system certificate
// pool is not available (for instance in a container which does not have a root
// certificate bundle). SetFallbackRoots will panic if roots is nil.
//
// SetFallbackRoots may only be called once, if called multiple times it will

# Routes
# This file defines all application routes (Higher priority routes first)
# ~~~~

# Home page
# GET     /                           controllers.Application.index()
GET         /suggest/get                        controllers.Suggest.get()
GET         /suggest/create/content             controllers.Suggest.createContent()
GET         /suggest/create/suggest/content     controllers.Suggest.createSuggestFromContent()

# Routes
# This file defines all application routes (Higher priority routes first)
# ~~~~

# Home page
GET     /                           @controllers.Application.index

# Map static resources from the /public folder to the /assets URL path

# Routes
# Home page
GET     /                           @controllers.Application.index

GET     /shutdown                   @controllers.Application.shutdown

# Map static resources from the /public folder to the /assets URL path

-----END CERTIFICATE-----`

	// First, create the set of root certificates. For this example we only
	// have one. It's also possible to omit this in order to use the
	// default root set of the current operating system.
	roots := x509.NewCertPool()
	ok := roots.AppendCertsFromPEM([]byte(rootPEM))
	if !ok {
		panic("failed to parse root certificate")
	}

	conn, err := tls.Dial("tcp", "mail.google.com:443", &tls.Config{

# Routes
# Home page
GET     /                           controllers.Application.index

GET     /shutdown                   controllers.Application.shutdown

# Map static resources from the /public folder to the /assets URL path

    public final List<BuildOperationRecord> roots;
    public final Map<Long, BuildOperationRecord> records;

    BuildOperationTree(List<BuildOperationRecord> roots) {
        ImmutableMap.Builder<Long, BuildOperationRecord> records = ImmutableMap.builder();
        for (BuildOperationRecord record : roots) {
            visit(records, record);
        }
        this.roots = BuildOperationRecord.ORDERING.immutableSortedCopy(roots);

    private final FileSystemSnapshot roots;
    private final ImmutableMultimap<String, HashCode> rootHashes;
    private final HashCode strategyConfigurationHash;
    private HashCode hash;

    public static CurrentFileCollectionFingerprint from(FileSystemSnapshot roots, FingerprintingStrategy strategy, @Nullable  FileCollectionFingerprint candidate) {
        if (roots == FileSystemSnapshot.EMPTY) {

}

func loadSystemRoots() (*CertPool, error) {
	roots := NewCertPool()
	var bestErr error
	for _, file := range certFiles {
		data, err := os.ReadFile(file)
		if err == nil {
			roots.AppendCertsFromPEM(data)
			return roots, nil
		}
		if bestErr == nil || (os.IsNotExist(bestErr) && !os.IsNotExist(err)) {
			bestErr = err
		}
	}
	if bestErr == nil {
		return roots, nil
	}
	return nil, bestErr