)

// initDNSCertsK8SRA will create the certificates using K8S RA.
// Only called by initIstiodCerts if provider (PILOT_CERT_PROVIDER) has k8s.io prefix
// and local certificates are not found.
//
// The roots are loaded from mesh config.
func (s *Server) initDNSCertsK8SRA() error {
	var certChain, keyPEM, caBundle []byte
	var err error
	pilotCertProviderName := features.PilotCertProvider

        }

        private class HeaderFileCollection implements MinimalFileSet, Buildable {
            @Override
            public String getDisplayName() {
                return "Include roots of " + sourceSet.getName();
            }

            @Override
            public Set<File> getFiles() {
                return sourceSet.getExportedHeaders().getSrcDirs();
            }

			// load ca certificates into a pool
			roots := x509.NewCertPool()
			for _, caCert := range caCerts {
				roots.AddCert(caCert)
			}

			<-startedCh

			// try to dial
			addr := fmt.Sprintf("localhost:%d", secureOptions.BindPort)
			t.Logf("Dialing %s as %q", addr, test.ServerName)
			conn, err := tls.Dial("tcp", addr, &tls.Config{
				RootCAs:    roots,

     * That is, the term “file” is used in the java.io.File sense, not the regular file sense.
     *
     * @param files the site of files to find the encompassing roots of
     * @return the encompassing roots
     */
    public static Collection<? extends File> calculateRoots(Iterable<? extends File> files) {
        List<File> sortedFiles = Lists.newArrayList(files);

a client and a client that authenticates a server.

```java
// Create the root for client and server to trust. We could also use different roots for each!
HeldCertificate rootCertificate = new HeldCertificate.Builder()
    .certificateAuthority(0)
    .build();

// Create a server certificate and a server that uses it.

#
# An argument to 'go get' that results in an upgrade to a different existing
# root should be allowed, and should not panic the 'go' command.

cp go.mod go.mod.orig


# Transitive upgrades from upgraded roots should not prevent
# 'go get -u' from performing upgrades.

cp go.mod.orig go.mod
go get -u .
cmp go.mod go.mod.want


# 'go get' of a specific version should allow upgrades of

 *    will be used to authenticate the client's certificate chain. Typically this is not the same
 *    set of root certificates used in server authentication. Instead it will be a small set of
 *    roots private to an organization or service.
 */
class HandshakeCertificates private constructor(
  @get:JvmName("keyManager") val keyManager: X509KeyManager,
  @get:JvmName("trustManager") val trustManager: X509TrustManager,
) {

		}

		tlsOpts.Key, tlsOpts.Cert = a.GetKeyCertsForCA()
	}

	// Will use TLS unless the reserved 15010 port is used ( istiod on an ipsec/secure VPC)
	// rootCert may be nil - in which case the system roots are used, and the CA is expected to have public key
	// Otherwise assume the injection has mounted /etc/certs/root-cert.pem
	return citadel.NewCitadelClient(opts, tlsOpts)
}

func init() {

This comes with several benefits:

* dependencies do not leak into the compile include roots and link libraries of consumers, so they can never accidentally depend on a transitive dependency
* faster compilation thanks to the reduced include roots and link libraries
* fewer recompilations when implementation dependencies change since the consumer would not need to be recompiled

        !tmpDir.file('foo').exists()
        tmpDir.testDirectory.exists()
    }

    def "does not delete files that are not under one of the given roots"() {
        def destDir = tmpDir.file('dir')
        def file1 = destDir.file('file1').createFile()
        def file2 = tmpDir.file('file2').createFile()

        expect: