}
	return ret
}

func TestNoConfigMap(t *testing.T) {
	signer, cl, _, _, err := newSigner()
	if err != nil {
		t.Fatalf("error creating Signer: %v", err)
	}
	signer.signConfigMap(context.TODO())
	verifyActions(t, []core.Action{}, cl.Actions())
}

func TestSimpleSign(t *testing.T) {
	signer, cl, secrets, configMaps, err := newSigner()
	if err != nil {
		t.Fatalf("error creating Signer: %v", err)
	}

	arrSigners := strings.Split(signerNames, ",")
	signersMap := make(map[string]*signer.Signer, len(arrSigners))
	var rootCertSignerArr []SignerRootCert
	for _, signerName := range arrSigners {
		signer, err := signer.NewSigner(signerRoot, signerName, certificateDuration)
		if err != nil {
			return nil, fmt.Errorf("unable to start signer for %q: %v", signerName, err)
		}
		signersMap[signerName] = signer

	privateJWK := &jose.JSONWebKey{
		Algorithm: string(jose.RS256),
		Key:       keyPair,
		KeyID:     keyID,
		Use:       "sig",
	}

	signer, err := jose.NewSigner(
		jose.SigningKey{
			Algorithm: jose.RS256,
			Key:       privateJWK,
		},
		nil,
	)

	if err != nil {
		return nil, fmt.Errorf("failed to create signer: %v", err)
	}

	"istio.io/istio/pkg/test/csrctrl/authority"
	"istio.io/istio/security/pkg/pki/util"
)

type Signer struct {
	caProvider *caProvider
	CertTTL    time.Duration
}

func NewSigner(signerRoot, signerName string, certificateDuration time.Duration) (*Signer, error) {
	caProvider, err := newCAProvider(signerRoot, signerName)
	if err != nil {
		return nil, err
	}

	ret := &Signer{

		isDisabledByDefault: true,
	}
}
func startBootstrapSignerController(ctx context.Context, controllerContext ControllerContext, controllerName string) (controller.Interface, bool, error) {
	bsc, err := bootstrap.NewSigner(
		controllerContext.ClientBuilder.ClientOrDie("bootstrap-signer"),
		controllerContext.InformerFactory.Core().V1().Secrets(),
		controllerContext.InformerFactory.Core().V1().ConfigMaps(),
		bootstrap.DefaultSignerOptions(),

func (v *verifier) KeyHash() uint32             { return v.hash }
func (v *verifier) Verify(msg, sig []byte) bool { return v.verify(msg, sig) }

// NewSigner constructs a new [Signer] from an encoded signer key.
func NewSigner(skey string) (Signer, error) {
	priv1, skey := chop(skey, "+")
	priv2, skey := chop(skey, "+")
	name, skey := chop(skey, "+")
	hash16, key64 := chop(skey, "+")

type Signer struct {
	csrs    kclient.Client[*certv1.CertificateSigningRequest]
	signers map[string]*signer.Signer
	queue   controllers.Queue
}

func NewSigner(cl kube.Client, signers map[string]*signer.Signer) *Signer {
	c := &Signer{
		csrs:    kclient.New[*certv1.CertificateSigningRequest](cl),
		signers: signers,
	}
	c.queue = controllers.NewQueue("csr",

	secretLister corelisters.SecretLister
	secretSynced cache.InformerSynced

	configMapLister corelisters.ConfigMapLister
	configMapSynced cache.InformerSynced
}

// NewSigner returns a new *Signer.
func NewSigner(cl clientset.Interface, secrets informers.SecretInformer, configMaps informers.ConfigMapInformer, options SignerOptions) (*Signer, error) {
	e := &Signer{
		client:             cl,

	signerName string,
	client clientset.Interface,
	csrInformer certificatesinformers.CertificateSigningRequestInformer,
	caFile, caKeyFile string,
	certTTL time.Duration,
) (*CSRSigningController, error) {
	signer, err := newSigner(signerName, caFile, caKeyFile, client, certTTL)
	if err != nil {
		return nil, err
	}

	return &CSRSigningController{
		certificateController: certificates.NewCertificateController(
			ctx,
			controllerName,

	defer s.mu.Unlock()

	size := int64(len(s.records))
	h, err := tlog.TreeHash(size, s.hashes)
	if err != nil {
		return nil, err
	}
	text := tlog.FormatTree(tlog.Tree{N: size, Hash: h})
	signer, err := note.NewSigner(s.signer)
	if err != nil {
		return nil, err
	}
	return note.Sign(&note.Note{Text: string(text)}, signer)
}

func (s *TestServer) ReadRecords(ctx context.Context, id, n int64) ([][]byte, error) {
	s.mu.Lock()