sessionFactory.start();
    }

    HttpUrl authorizeUrl = sessionFactory.newAuthorizeUrl(scopes, team, session -> {
      initOauthSession(session);
      System.out.printf("session granted: %s\n", session);
    });

    System.out.printf("open this URL in a browser: %s\n", authorizeUrl);
  }

  /** Set the OAuth session for this client. */
  public synchronized void initOauthSession(OAuthSession session) {

# https://github.com/eggert/tz/blob/main/Makefile
if ! make CFLAGS=-DSTD_INSPIRED AWK=awk TZDIR=zoneinfo PACKRATDATA=backzone PACKRATLIST=zone.tab posix_only >make.out 2>&1; then
	cat make.out
	exit 2
fi

cd zoneinfo
../mkzip ../../zoneinfo.zip
cd ../..

files="update.bash zoneinfo.zip"
modified=true
if git diff --quiet $files; then
	modified=false
fi

8. Export the node's private key
   `openssl pkcs12 -in test-node.p12 -passin pass:keypass -nocerts -passout pass:test-node-key-password -out test-node.key`
9. Convert the client's keystore to PKCS#12 temporarily so that we can export the private key (as keytool doesn't allow this)

                    } while (prefixLen > 1 && out[prefixLen - 1] != '/');
                    break;
                }
                state = 2;
            case 2:
                if (in[i] == '/') {
                    state = 1;
                }
                out[prefixLen++] = in[i];
                break;
            }
        }

        this.canon = new String(out, 0, prefixLen);
        if (prefixLen > 1) {

			u = parsedURL
		}
	}
	return u
}

// copyURL provides update safe copy by avoiding shallow copying User field
func copyURL(i *url.URL) *url.URL {
	out := *i
	if i.User != nil {
		u := *i.User
		out.User = &u
	}
	return &out
}

// Modify the request to handle the target URL
func (f *Forwarder) modifyRequest(outReq *http.Request, target *url.URL) {
	outReq.URL = copyURL(outReq.URL)

    streamPrimesToSinkAsynchronously(pipeBody.sink());

    try (Response response = client.newCall(request).execute()) {
      if (!response.isSuccessful()) throw new IOException("Unexpected code " + response);

      System.out.println(response.body().string());
    }
  }

  private void streamPrimesToSinkAsynchronously(final BufferedSink sink) {
    Thread thread = new Thread("writer") {
      @Override public void run() {
        try {

  }

  @SuppressWarnings("unchecked")
  static <T> T reserialize(T object) {
    try {
      ByteArrayOutputStream bytes = new ByteArrayOutputStream();
      ObjectOutputStream out = new ObjectOutputStream(bytes);
      out.writeObject(object);
      ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()));
      return (T) in.readObject();
    } catch (IOException | ClassNotFoundException e) {

Call call = client.newCall(new Request.Builder()
    .url(server.url("/"))
    .build());
Response response = call.execute();
System.out.println(response.handshake().peerPrincipal());
RecordedRequest recordedRequest = server.takeRequest();
System.out.println(recordedRequest.getHandshake().peerPrincipal());
```

This handshake is successful because each party has prearranged to trust the root certificate that

      for (int inI = 0, outI = 0; inI < size * 2; ) {
        if (dups.get(inI >>> 1)) {
          inI += 2;
        } else {
          newAlternatingKeysAndValues[outI++] =
              requireNonNull(localAlternatingKeysAndValues[inI++]);
          newAlternatingKeysAndValues[outI++] =
              requireNonNull(localAlternatingKeysAndValues[inI++]);
        }

   * match "*.com" or similar. This was a nonstandard check that we've since dropped. It is the CA's
   * responsibility to not hand out certificates that match so broadly.
   */
  @Test fun wildcardsDoesNotNeedTwoDots() {
    // openssl req -x509 -nodes -days 36500 -subj '/CN=*.com' -newkey rsa:512 -out cert.pem
    val session =
      session(
        """
        -----BEGIN CERTIFICATE-----