return false
		}
	}
	return readUint16LengthPrefixed(&s, &m.signature) && s.Empty()
}

type newSessionTicketMsg struct {
	ticket []byte
}

func (m *newSessionTicketMsg) marshal() ([]byte, error) {
	// See RFC 5077, Section 3.3.
	ticketLen := len(m.ticket)
	length := 2 + 4 + ticketLen
	x := make([]byte, 4+length)
	x[0] = typeNewSessionTicket
	x[1] = uint8(length >> 16)

						// code for Norwegian, to the dominant variant "nb". This
						// change is currently under consideration for CLDR as well.
						// See https://unicode.org/cldr/trac/ticket/2698 and also
						// https://unicode.org/cldr/trac/ticket/1790 for some of the
						// practical implications. TODO: this check could be removed
						// if CLDR adopts this change.
						if c&CLDR == 0 || t.LangID != _nb {
							changed = true

-fake-certificate title: How to Create A Fake Certificate Authority And Generate TLS Certs for FastAPI - author: Ben Gamble author_link: https://uk.linkedin.com/in/bengamble7 link: https://ably.com/blog/realtime-ticket-booking-solution-kafka-fastapi-ably title: Building a realtime ticket booking solution with Kafka, FastAPI, and Ably - author: Shahriyar(Shako) Rzayev author_link: https://www.linkedin.com/in/shahriyar-rzayev/ link: https://www.azepug.az/posts/fastapi/#building-simple-e-commerce-w...

	_                       = flag.Bool("enable-early-data", false, "")
	_                       = flag.Bool("on-resume-expect-accept-early-data", false, "")
	_                       = flag.Bool("expect-ticket-supports-early-data", false, "")
	onResumeShimWritesFirst = flag.Bool("on-resume-shim-writes-first", false, "")

	advertiseALPN = flag.String("advertise-alpn", "", "")
	expectALPN    = flag.String("expect-alpn", "", "")

	m := &finishedMsg{}
	m.verifyData = randomBytes(12, rand)
	return reflect.ValueOf(m)
}

func (*newSessionTicketMsg) Generate(rand *rand.Rand, size int) reflect.Value {
	m := &newSessionTicketMsg{}
	m.ticket = randomBytes(rand.Intn(4), rand)
	return reflect.ValueOf(m)
}

var sessionTestCerts []*x509.Certificate

func init() {
	cert, err := x509.ParseCertificate(testRSACertificate)
	if err != nil {

        "EchoTLS13CompatibilitySessionID": "TODO reject compat session ID",
        "*Client-P-224*": "no P-224 support",
        "*Server-P-224*": "no P-224 support",
        "CurveID-Resume*": "unexposed curveID is not stored in the ticket yet",
        "CheckLeafCurve": "TODO: first pass, this should be fixed",
        "DisabledCurve-HelloRetryRequest-TLS13": "TODO: first pass, this should be fixed",

	}
	if !c.next() || c.src[c.pSrc] == 'j' {
		return false
	}
	if c.src[c.pSrc] != 'J' {
		c.unreadRune()
	}
	return true
}

// Not part of CLDR, but see https://unicode.org/cldr/trac/ticket/7078.
func afnlRewrite(c *context) {
	if c.hasPrefix("'") || c.hasPrefix("’") {
		c.isMidWord = true
	}

	"three":                                "3\ufe0f\u20e3",
	"thumbsdown":                           "\U0001f44e",
	"thumbsup":                             "\U0001f44d",
	"ticket":                               "\U0001f3ab",
	"tickets":                              "\U0001f39f\ufe0f",
	"tiger":                                "\U0001f42f",
	"tiger2":                               "\U0001f405",

// Counts returns the counts for the given bucket, subBucket indices.
// Returns true if the bucket was valid, otherwise returns the counts
// for the overflow bucket if bucket > 0 or the underflow bucket if
// bucket < 0, and false.
func (th *TimeHistogram) Count(bucket, subBucket int) (uint64, bool) {
	t := (*timeHistogram)(th)
	if bucket < 0 {
		return t.underflow.Load(), false
	}

	// or sending NewSessionTicket messages.
	resumptionSecret []byte
	echAccepted      bool

	// ticketKeys is the set of active session ticket keys for this
	// connection. The first one is used to encrypt new tickets and
	// all are tried to decrypt tickets.
	ticketKeys []ticketKey

	// clientFinishedIsFirst is true if the client sent the first Finished