private const val ALT_IPA_NAME = 7

  override fun verify(
    host: String,
    session: SSLSession,
  ): Boolean =
    if (!host.isAscii()) {
      false
    } else {
      try {
        verify(host, session.peerCertificates[0] as X509Certificate)
      } catch (_: SSLException) {
        false
      }
    }

  fun verify(
    host: String,
    certificate: X509Certificate,

import java.io.ByteArrayOutputStream
import java.io.File


/**
 * `dir / "sub"` is the same as `dir.resolve("sub")`.
 *
 * @see [File.resolve]
 */
operator fun File.div(child: String): File =
    resolve(child)


fun ExecOperations.execAndGetStdout(workingDir: File, ignoreExitValue: Boolean, vararg args: String): String {
    val out = ByteArrayOutputStream()
    exec {

  // and because it's a common pattern for VMs to have differences between supported and
  // defaulted versions for TLS based on what is requested.
  override fun newSSLContext(): SSLContext = SSLContext.getInstance("TLSv1.3", provider)

  override fun platformTrustManager(): X509TrustManager {
    val factory =
      TrustManagerFactory.getInstance(
        TrustManagerFactory.getDefaultAlgorithm(),
        provider,
      )

  val request = Request("https://publicsuffix.org/list/public_suffix_list.dat".toHttpUrl())

  suspend fun import() {
    check(fileSystem.metadata(testResources).isDirectory)

    updateLocalFile()

    val importResults = readImportResults()

    writeOutputFile(importResults)
  }

  private suspend fun updateLocalFile() =
    withContext(Dispatchers.IO) {
      client.newCall(request).executeAsync().use { response ->

    }
  }

  internal fun useAsSocket() {
    javaNetSocket.soTimeout = 0
    noNewExchanges()
  }

  override fun route(): Route = route

  override fun cancel() {
    // Close the raw socket so we don't end up doing synchronous I/O.
    rawSocket.closeQuietly()
  }

  override fun socket(): JavaNetSocket = javaNetSocket

internal class UnreadableResponseBody(
  private val mediaType: MediaType?,
  private val contentLength: Long,
) : ResponseBody(),
  Source {
  override fun contentType() = mediaType

  override fun contentLength() = contentLength

  override fun source() = buffer()

  override fun read(
    sink: Buffer,
    byteCount: Long,
  ): Long =
    throw IllegalStateException(
      """

      }
    }
  }

  override fun newSSLContext(): SSLContext {
    StrictMode.noteSlowCall("newSSLContext")

    return super.newSSLContext()
  }

  override fun trustManager(sslSocketFactory: SSLSocketFactory): X509TrustManager? =
    socketAdapters
      .find { it.matchesSocketFactory(sslSocketFactory) }
      ?.trustManager(sslSocketFactory)

  override fun configureTlsExtensions(
    sslSocket: SSLSocket,

  }

  override fun trackFailure(
    call: RealCall,
    e: IOException?,
  ) {
    // Do nothing.
  }

  override fun noNewExchanges() {
    // Do nothing.
  }

  override fun cancel() {
    canceled = true
    // Close the raw socket so we don't end up doing synchronous I/O.
    rawSocket?.closeQuietly()
  }

  override fun retry(): RoutePlanner.Plan =
    ConnectPlan(

    fun verify(
      hostname: String?,
      session: SSLSession?,
    ): Boolean = true

    override fun verify(
      certs: Array<out X509Certificate>?,
      hostname: String?,
      session: SSLSession?,
    ): Boolean = true
  }

  override fun trustManager(sslSocketFactory: SSLSocketFactory): X509TrustManager? = null

  override fun configureTlsExtensions(

   * strict than the others.
   */
  fun escapeForUri(vararg codePoints: Int) =
    apply {
      uriEscapedCodePoints.append(String(*codePoints))
    }

  /**
   * Configure code points to be stripped in conversion to `java.net.URI`. That class is more
   * strict than the others.
   */
  fun stripForUri(vararg codePoints: Int) =
    apply {