}

    fun build(): HeldCertificate {
      // Subject keys & identity.
      val subjectKeyPair = keyPair ?: generateKeyPair()
      val subjectPublicKeyInfo =
        CertificateAdapters.subjectPublicKeyInfo.fromDer(
          subjectKeyPair.public.encoded.toByteString(),
        )
      val subject: List<List<AttributeTypeAndValue>> = subject()

  // Defaults to "v1" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io/v1alpha1" for User and Group subjects.
  // +k8s:conversion-gen=false
  // +optional
  optional string apiVersion = 2;

  // Name of the object being referenced.
  optional string name = 3;

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

  // `type` indicates whether this priority level is subject to
  // limitation on request execution.  A value of `"Exempt"` means
  // that requests of this priority level are not subject to a limit
  // (and thus are never queued) and do not detract from the
  // capacity made available to other priority levels.  A value of
  // `"Limited"` means that (a) requests of this priority level
  // _are_ subject to limits and (b) some of the server's limited

  // `type` indicates whether this priority level is subject to
  // limitation on request execution.  A value of `"Exempt"` means
  // that requests of this priority level are not subject to a limit
  // (and thus are never queued) and do not detract from the
  // capacity made available to other priority levels.  A value of
  // `"Limited"` means that (a) requests of this priority level
  // _are_ subject to limits and (b) some of the server's limited

        ObjectIdentifiers.RSA_ENCRYPTION -> Adapters.NULL
        ObjectIdentifiers.EC_PUBLIC_KEY -> Adapters.OBJECT_IDENTIFIER
        else -> null
      }
    }

  /**
   * ```
   * AlgorithmIdentifier ::= SEQUENCE  {
   *   algorithm      OBJECT IDENTIFIER,
   *   parameters     ANY DEFINED BY algorithm OPTIONAL
   * }
   * ```
   */

* All changes should have an associated GitHub issue and/or a release note.
* Large fixes, where the LOC>100 not withstanding unit tests changes, require subject matter expert approval.

# Backporting fixes

* Cherry-picking is discussed in the original PR and subject-matter experts have approved the backport.
    * Behavioral changes should be highly scrutinized, while typo fixes don't require that level of scrutiny.

  val signatureValue: BitString,
) {
  val commonName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.COMMON_NAME }
        ?.value
    }

  val organizationalUnitName: Any?
    get() {
      return tbsCertificate.subject
        .flatten()
        .firstOrNull { it.type == ObjectIdentifiers.ORGANIZATIONAL_UNIT_NAME }
        ?.value

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.
  // Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
  // +optional
  optional string apiGroup = 2;

  // Name of the object being referenced.
  optional string name = 3;

   2. GRANT OF RIGHTS

a) Subject to the terms of this Agreement, each Contributor hereby grants
Recipient a non-exclusive, worldwide, royalty-free copyright license to reproduce,
prepare derivative works of, publicly display, publicly perform, distribute
and sublicense the Contribution of such Contributor, if any, and such derivative
works, in source code and object code form.