%elem_shape_3 = "tf.Const"() {value = dense<-1> : tensor<1xi32>} : () -> tensor<1xi32>
    %tls_2 = "tf.TensorListStack"(%tl_set_item_2, %elem_shape_3) {num_elements = 300 : i64} : (tensor<!tf_type.variant<tensor<*xf32>>>, tensor<1xi32>) -> tensor<300x?xf32>
    func.return %tls, %tls_2 : tensor<300x?xf32>, tensor<300x?xf32>
  }
}

// CHECK-LABEL: HloModule main

                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

	MOVD	R0, 0(R1)		// clear back chain pointer
	BL	(CTR)
	MOVD	$0, R0			// C code can clobber R0 set it back to 0
	MOVD	R16, R1			// restore R1;
	MOVD	runtime·tls_g(SB), R10	// find correct g
	MOVD	0(R10), g
	RET

// tls_g, g value for each thread in TLS

	case BuildModeCShared:
		return true, "buildmode=c-shared"
	case BuildModePIE:
		if !platform.InternalLinkPIESupported(buildcfg.GOOS, buildcfg.GOARCH) {
			// Internal linking does not support TLS_IE.
			return true, "buildmode=pie"
		}
	case BuildModePlugin:
		return true, "buildmode=plugin"
	case BuildModeShared:
		return true, "buildmode=shared"
	}
	if ctxt.linkShared {

		return val, nExtReloc, true

	case objabi.R_POWER_TLS_IE:
		// Convert TLS_IE relocation to TLS_LE if supported.
		if !(target.IsPIE() && target.IsElf()) {
			log.Fatalf("cannot handle R_POWER_TLS_IE (sym %s) when linking non-PIE, non-ELF binaries internally", ldr.SymName(s))
		}

		// We are an ELF binary, we can safely convert to TLS_LE from:
		// addis to, r2, x@got@tprel@ha
		// ld to, to, x@got@tprel@l(to)
		//

//       runtime.mcall assumes this function only clobbers R0 and R11.
// Returns with g in R0.
// Save the value in the _TEB->TlsSlots array.
// Effectively implements TlsSetValue().
// tls_g stores the TLS slot allocated TlsAlloc().
TEXT runtime·save_g(SB),NOSPLIT,$0
	MRC	15, 0, R0, C13, C0, 2
	ADD	$0xe10, R0
	MOVW 	$runtime·tls_g(SB), R11
	MOVW	(R11), R11
	MOVW	g, R11<<2(R0)

}

class IanaSuites(
  val name: String,
  val suites: List<SuiteId>,
) {
  fun fromJavaName(javaName: String): SuiteId {
    return suites.firstOrNull {
      it.name == javaName || it.name == "TLS_${javaName.drop(4)}"
    } ?: throw IllegalArgumentException("No such suite: $javaName")
  }
}

suspend fun fetchIanaSuites(okHttpClient: OkHttpClient): IanaSuites {

)

const (
	// The size of a private key for a leaf certificate.
	keySize = 2048
)

var certWatchTimeout = 60 * time.Second

// GenKeyCertK8sCA : Generates a key pair and gets public certificate signed by K8s_CA
// Options are meant to sign DNS certs
// 1. Generate a CSR
// 2. Call SignCSRK8s to finish rest of the flow
func GenKeyCertK8sCA(client clientset.Interface, dnsName,