public static class AdjustablePolicy extends Policy {
    Permissions perms = new Permissions();

    AdjustablePolicy(Permission... permissions) {
      for (Permission permission : permissions) perms.add(permission);
    }

    void addPermission(Permission perm) {
      perms.add(perm);
    }

    void clearPermissions() {
      perms = new Permissions();
    }

    @Override

    .build();
OkHttpClient client = new OkHttpClient.Builder()
    .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
    .build();
```

PEM files
---------

You can encode a `HeldCertificate` in PEM format:

```java
HeldCertificate heldCertificate = ...
System.out.println(heldCertificate.certificatePem())
```

```
-----BEGIN CERTIFICATE-----

          java-version: 11

      - name: Configure JDK
        uses: actions/setup-java@v5
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Enable KVM group perms
        # https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
        run: |

      We could probably have resumed it after https://github.com/google/guava/pull/6664.
      But it's always weird that published poms reference test-only libraries at all, so I'm not in any rush to do so.
      -->
    </dependencies>
  </dependencyManagement>
  <build>
    <!-- Handle where Guava deviates from Maven defaults -->

      We could probably have resumed it after https://github.com/google/guava/pull/6664.
      But it's always weird that published poms reference test-only libraries at all, so I'm not in any rush to do so.
      -->
    </dependencies>
  </dependencyManagement>
  <build>
    <!-- Handle where Guava deviates from Maven defaults -->

    <alias type="application/x-x509-user-cert"/>
    <glob pattern="*.crt"/>
  </mime-type>
  <mime-type type="application/x-x509-cert;format=pem">
    <sub-class-of type="application/x-x509-cert"/>
    <glob pattern="*.pem"/>
    <magic priority="50">
      <match value="-----BEGIN CERTIFICATE-----" type="string" offset="0"/>
    </magic>
  </mime-type>

- Updated the control plane's trust anchor publisher to create and manage a new ClusterTrustBundle object, associated with the `kubernetes.io/kube-apiserver-serving` X.509 certificate signer. This ClusterTrustBundle contains a PEM bundle in its payload that you can use to verify kube-apiserver serving certificates. ([#127326](https://github.com/kubernetes/kubernetes/pull/127326), [@stlaz](https://github.com/stlaz)) [SIG API Machinery, Apps, Auth, Cluster Lifecycle and Testing]...