val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

            if (encoded != null) {
                String decoded = permissionHelper.decode(encoded);
                assertNotNull("Decoded value should not be null for: " + value, decoded);
                assertEquals("Decoded value should match original: " + value + " -> " + encoded + " -> " + decoded, value, decoded);
            }
        }
    }

    @Test

        // Decode
        FileRenameInformation2 decoded = new FileRenameInformation2();
        int bytesRead = decoded.decode(buffer, 0, bytesWritten);

        // Verify round trip
        assertEquals(bytesWritten, bytesRead);
        assertEquals(original.size(), decoded.size());
        assertEquals(original.getFileInformationLevel(), decoded.getFileInformationLevel());
    }

    @Test

        // Decode from buffer
        NdrBuffer decodeBuffer = new NdrBuffer(buffer, 0);
        lsarpc.LsarTranslatedName decodedName = new lsarpc.LsarTranslatedName();
        decodedName.decode(decodeBuffer);

        // Verify the decoded data matches
        assertEquals(translatedName.sid_type, decodedName.sid_type);

     *            The encoding scheme. Must not be {@literal null} or empty.
     * @return The decoded string.
     */
    public static String decode(final String s, final String enc) {
        assertArgumentNotEmpty("s", s);
        assertArgumentNotEmpty("enc", enc);

        try {
            return URLDecoder.decode(s, enc);
        } catch (final UnsupportedEncodingException e) {

            }
        }
        return u;
    }

    /**
     * Decodes a URL as a name using appropriate character encoding.
     * Handles encoding detection from parent URLs and configuration settings.
     *
     * @param url the URL to decode
     * @param escapePlus whether to escape plus signs before decoding
     * @return the decoded URL name, or original URL if decoding fails
     */

            assertEquals(8, encoded);

            // Decode into new instance
            FileEndOfFileInformation decoded = new FileEndOfFileInformation();
            int decodedBytes = decoded.decode(buffer, 0, buffer.length);

            assertEquals(8, decodedBytes);

            // Verify values match
            assertEquals(original.toString(), decoded.toString());
        }
    }

    @Test

	XMLName xml.Name `xml:"ServerSideEncryptionConfiguration"`
	Rules   []Rule   `xml:"Rule"`
}

// ParseBucketSSEConfig - Decodes given XML to a valid default bucket encryption config
func ParseBucketSSEConfig(r io.Reader) (*BucketSSEConfig, error) {
	var config BucketSSEConfig
	err := xml.NewDecoder(r).Decode(&config)
	if err != nil {
		return nil, err
	}

	// Validates server-side encryption config rules

      return decode(certificatePem, pkcs8Base64)
    }

    private fun decode(
      certificatePem: String,
      pkcs8Base64Text: String,
    ): HeldCertificate {
      val certificate = certificatePem.decodeCertificatePem()

      val pkcs8Bytes =
        pkcs8Base64Text.decodeBase64()
          ?: throw IllegalArgumentException("failed to decode private key")

        // create a new empty range and decode
        LockingAndXRange decoded = new LockingAndXRange(false);
        int decodedSize = decoded.decode(dst, 0, dst.length);
        assertEquals(10, decodedSize, "Decode should return size 10");
        assertEquals(99, decoded.getPid());
        assertEquals(123456L, decoded.getByteOffset());
        assertEquals(654321L, decoded.getLengthInBytes());
    }