"S34CON",
	"64CON",
	"SACON",
	"LACON",
	"DACON",
	"BRA",
	"BRAPIC",
	"ZOREG",
	"SOREG",
	"LOREG",
	"XOREG",
	"FPSCR",
	"LR",
	"CTR",
	"ANY",
	"GOK",
	"ADDR",
	"TLS_LE",
	"TLS_IE",
	"TEXTSIZE",
	"NCLASS",

      .assertLogMatch(Regex("""secureConnectStart"""))
      .assertLogMatch(
        Regex(
          """secureConnectEnd: Handshake\{tlsVersion=TLS_1_[23] cipherSuite=TLS_.* peerCertificates=\[CN=localhost] localCertificates=\[]\}""",
        ),
      )
      .assertLogMatch(Regex("""connectEnd: h2"""))
      .assertLogMatch(

		return val, nExtReloc, true

	case objabi.R_POWER_TLS_IE:
		// Convert TLS_IE relocation to TLS_LE if supported.
		if !(target.IsPIE() && target.IsElf()) {
			log.Fatalf("cannot handle R_POWER_TLS_IE (sym %s) when linking non-PIE, non-ELF binaries internally", ldr.SymName(s))
		}

		// We are an ELF binary, we can safely convert to TLS_LE from:
		// addis to, r2, x@got@tprel@ha
		// ld to, to, x@got@tprel@l(to)
		//

}

class IanaSuites(
  val name: String,
  val suites: List<SuiteId>,
) {
  fun fromJavaName(javaName: String): SuiteId {
    return suites.firstOrNull {
      it.name == javaName || it.name == "TLS_${javaName.drop(4)}"
    } ?: throw IllegalArgumentException("No such suite: $javaName")
  }
}

suspend fun fetchIanaSuites(okHttpClient: OkHttpClient): IanaSuites {

)

const (
	// The size of a private key for a leaf certificate.
	keySize = 2048
)

var certWatchTimeout = 60 * time.Second

// GenKeyCertK8sCA : Generates a key pair and gets public certificate signed by K8s_CA
// Options are meant to sign DNS certs
// 1. Generate a CSR
// 2. Call SignCSRK8s to finish rest of the flow
func GenKeyCertK8sCA(client clientset.Interface, dnsName,

      cache.delete()
    }
  }

  @Test
  fun corruptedCipher() {
    val response =
      testCorruptingCache {
        corruptMetadata {
          // mess with cipher suite
          it.replace("TLS_", "SLT_")
        }
      }

    assertThat(response.body.string()).isEqualTo("ABC.1") // cached
    assertThat(cache.requestCount()).isEqualTo(2)
    assertThat(cache.networkCount()).isEqualTo(1)

	MOVQ	$TEB_ArbitraryPtr, CX
	JMP	settls
ok:
	// Convert the TLS index at CX into
	// an offset from TEB_TlsSlots.
	SHLQ	$3, CX

	// Save offset from TLS into tls_g.
	ADDQ	$TEB_TlsSlots, CX
settls:
	MOVQ	CX, runtime·tls_g(SB)

	}{
		"No SAN RSA": {
			caCertFile:    rootCertFile,
			caKeyFile:     rootKeyFile,
			certChainFile: nil,
			rootCertFile:  rootCertFile,
			certOptions: &CertOptions{
				Host:       "test_ca.com",
				TTL:        time.Hour,
				Org:        "MyOrg",
				IsCA:       true,
				RSAKeySize: 2048,
			},
			expectedErr: "failed to extract id the SAN extension does not exist",
		},
		"RSA Success": {

	ADD	$176, RSP
	JMP	(LR)

noswitch:
	// already on g0
	MOVD	R0, 8(RSP)	// func arg
	MOVD	R1, 16(RSP)	// func arg
	BL	runtime·racecallback(SB)
	JMP	ret

#ifndef TLSG_IS_VARIABLE
// tls_g, g value for each thread in TLS
GLOBL runtime·tls_g+0(SB), TLSBSS+DUPOK, $8

	// arg 4: TLS base, stored in slot 0 (Android's TLS_SLOT_SELF).
	// Compensate for tls_g (+8).
	MOVL	-8(TLS), BX
	MOVL	BX, 12(SP)
	MOVL	$runtime·tls_g(SB), 8(SP)	// arg 3: &tls_g
#else
	MOVL	$0, BX
	MOVL	BX, 12(SP)	// arg 4: not used when using platform's TLS
#ifdef GOOS_windows
	MOVL	$runtime·tls_g(SB), 8(SP)	// arg 3: &tls_g
#else
	MOVL	BX, 8(SP)	// arg 3: not used when using platform's TLS
#endif
#endif