then:
        configurationCache.assertStateLoaded()

        where:
        encryptionTransformation | source
        "AES/ECB/PKCS5PADDING"   | EncryptionKind.KEYSTORE
        "AES/CBC/PKCS5PADDING"   | EncryptionKind.KEYSTORE
        "AES/ECB/PKCS5PADDING"   | EncryptionKind.ENV_VAR
        "AES/CBC/PKCS5PADDING"   | EncryptionKind.ENV_VAR
    }

) : SecretKeySource {

    private
    val keyProtection = KeyStore.PasswordProtection(CharArray(0))

    private
    val keyStore by lazy {
        KeyStore.getInstance(KEYSTORE_TYPE)
    }

    override val sourceDescription: String
        get() = customKeyStoreDir?.let { "custom Java keystore at $it" }
            ?: "default Gradle configuration cache keystore"

    private

    TestKeyStore keyStore

    def setup() {
        keyStore = TestKeyStore.init(resources.dir)
        // We need to set the SSL properties as arguments here even for non-embedded test mode
        // because we want them to be set on the wrapper client JVM, not the daemon one
        wrapperExecuter.withArguments(keyStore.getTrustStoreArguments())
        server.configure(keyStore)

        runner.warmUpRuns = 2
        runner.runs = 8
        runner.addBuildMutator { cleanLocalCache() }

        def keyStore = TestKeyStore.init(temporaryFolder.file('ssl-keystore'))
        keyStore.enableSslWithServerCert(buildCacheServer)

        runner.gradleOpts.addAll(keyStore.serverAndClientCertArgs)

        when:
        def result = runner.run()

        then:

    void prepareWrapper(URI distributionUri = distribution.binDistribution.toURI(), TestKeyStore keyStore) {
        def executer = new InProcessGradleExecuter(distribution, temporaryFolder)
        executer.withArguments(
            "wrapper",
            "--gradle-distribution-url",
            distributionUri.toString(),
        )
        keyStore.trustStoreArguments.each {
            executer.withArgument(it)
        }

        noneSkipped()
        httpBuildCacheServer.authenticationAttempts == ['Basic'] as Set
    }

    def "can use a self-signed certificate with allowUntrusted"() {
        def keyStore = TestKeyStore.init(file('ssl-keystore'))
        keyStore.enableSslWithServerCert(httpBuildCacheServer)
        settingsFile.text = useHttpBuildCache(httpBuildCacheServer.uri)
        settingsFile << """
            buildCache {

         *
         * Hundreds of Gradle's integration tests use a local web-server to test logic that relies upon
         * this behavior.
         *
         * Changing all of those tests so that they use a KeyStore would have been impractical.
         * Instead, the test fixture was updated to use 127.0.0.1 when making HTTP requests.
         *

The following JVM system properties are immutable:

* `file.encoding`
* `user.language`
* `user.country`
* `user.variant`
* `java.io.tmpdir`
* `javax.net.ssl.keyStore`
* `javax.net.ssl.keyStorePassword`
* `javax.net.ssl.keyStoreType`
* `javax.net.ssl.trustStore`
* `javax.net.ssl.trustStorePassword`
* `javax.net.ssl.trustStoreType`
* `com.sun.management.jmxremote`

         *
         * Hundreds of Gradle's integration tests use a local web-server to test logic that relies upon
         * this behavior.
         *
         * Changing all of those tests so that they use a KeyStore would have been impractical.
         * Instead, the test fixture was updated to use 127.0.0.1 when making HTTP requests.
         *

Leonardo Sarra <******@****.***> 1718116194 +0200