const val RSA_ENCRYPTION = "1.2.840.113549.1.1.1"
  const val SHA256_WITH_RSA_ENCRYPTION = "1.2.840.113549.1.1.11"
  const val SUBJECT_ALTERNATIVE_NAME = "2.5.29.17"
  const val BASIC_CONSTRAINTS = "2.5.29.19"
  const val COMMON_NAME = "2.5.4.3"
  const val ORGANIZATIONAL_UNIT_NAME = "2.5.4.11"

        it.id == ObjectIdentifiers.SUBJECT_ALTERNATIVE_NAME
      }
    }

  val basicConstraints: Extension
    get() {
      return tbsCertificate.extensions.first {
        it.id == ObjectIdentifiers.BASIC_CONSTRAINTS
      }
    }

  /** Returns true if the certificate was signed by [issuer]. */
  @Throws(SignatureException::class)
  fun checkSignature(issuer: PublicKey): Boolean {

 * limitations under the License.
 */
package okhttp3.internal.idn

import kotlin.math.abs
import okio.ByteString

internal sealed interface MappedRange {
  val rangeStart: Int

  data class Constant(
    override val rangeStart: Int,
    val type: Int,
  ) : MappedRange {
    val b1: Int
      get() =
        when (type) {
          TYPE_IGNORED -> 119
          TYPE_VALID -> 120

    assertThat(CertificateAdapters.generalName.toDer(generalNameDnsName to "example.com"))
      .isEqualTo(bytes)
  }

  @Test fun `extension with type hint for basic constraints`() {
    val extension =
      Extension(
        BASIC_CONSTRAINTS,
        false,
        BasicConstraints(true, 4),
      )
    val bytes = "300f0603551d13040830060101ff020104".decodeHex()

 *  New: Add `cacheHit`, `cacheMiss`, and `cacheConditionalHit()` events to `EventListener`. Use
    these in logs, metrics, and even test cases to confirm your cache headers are configured as
    expected.

 *  New: Constant string `okhttp3.VERSION`. This is a string like "4.5.0-RC1", "4.5.0", or
    "4.6.0-SNAPSHOT" indicating the version of OkHttp in the current runtime. Use this to include
    the OkHttp version in custom `User-Agent` headers.

import okio.buffer

/**
 * Streaming decoder of data encoded following Abstract Syntax Notation One (ASN.1). There are
 * multiple variants of ASN.1, including:
 *
 *  * DER: Distinguished Encoding Rules. This further constrains ASN.1 for deterministic encoding.
 *  * BER: Basic Encoding Rules.
 *
 * This class was implemented according to the [X.690 spec][[x690]], and under the advice of
 * [Lets Encrypt's ASN.1 and DER][asn1_and_der] guide.
 *

      }

      // If this response shouldn't have been stored, it should never be used as a response source.
      // This check should be redundant as long as the persistence store is well-behaved and the
      // rules are constant.
      if (!isCacheable(cacheResponse, request)) {
        return CacheStrategy(request, null)
      }

      val requestCaching = request.cacheControl
      if (requestCaching.noCache || hasConditions(request)) {

   *     READ 335c4c6028171cfddfbaae1a9c313c52
   *     READ 3400330d1dfc7f3f7f4b8d4d803dfcf6
   *
   * The first five lines of the journal form its header. They are the constant string
   * "libcore.io.DiskLruCache", the disk cache's version, the application's version, the value
   * count, and a blank line.
   *

 *  Fix: Don't silently ignore calls to `EventSource.cancel()` made from
    `EventSourceListener.onOpen()`.
 *  Fix: Enforce the max intermediates constraint when using pinned certificates with Conscrypt.
    This impacts Conscrypt when the server's presented certificates form both a trusted-but-unpinned
    chain and an untrusted-but-pinned chain.

import java.text.SimpleDateFormat
import java.util.Date
import java.util.TimeZone
import okhttp3.tls.HeldCertificate
import okhttp3.tls.decodeCertificatePem
import okhttp3.tls.internal.der.ObjectIdentifiers.BASIC_CONSTRAINTS
import okhttp3.tls.internal.der.ObjectIdentifiers.COMMON_NAME
import okhttp3.tls.internal.der.ObjectIdentifiers.ORGANIZATIONAL_UNIT_NAME
import okhttp3.tls.internal.der.ObjectIdentifiers.RSA_ENCRYPTION