if diff := cmp.Diff(gotErrors, tc.wantErrors); diff != "" {
				t.Fatalf("Unexpected error output from Validate; diff (-got +want)\n%s", diff)
			}

			// When there are no changes to the object,
			// ValidateClusterTrustBundleUpdate should not report errors about
			// the TrustBundle field.
			tc.bundle.ObjectMeta.ResourceVersion = "1"
			newBundle := tc.bundle.DeepCopy()

				n, _ := resp.Body.Read(b)
				errMsg = fmt.Sprintf("Calling %s failed with unexpected status: %v, fetching bundle: %s",
					endpoint, resp.StatusCode, string(b[:n]))
			} else {
				break
			}

			if startTime.Add(retryTimeout).Before(time.Now()) {
				return nil, fmt.Errorf("exhausted retries to fetch the SPIFFE bundle %s from url %s. Latest error: %v",
					trustDomain, endpoint, errMsg)
			}

        spec()
    }

    void hasBundle(String id, List<String> expectedElements) {
        assert model.hasBundle(id)
        def bundle = model.getBundle(id)?.components
        assert bundle != null: "Expected a bundle with name $id but it wasn't found"
        assert bundle == expectedElements
    }

    void hasVersion(String id, String version) {
        assert model.hasVersion(id)

type WebhookCertPatcher struct {
	// revision to patch webhooks for
	revision    string
	webhookName string

	queue controllers.Queue

	// File path to the x509 certificate bundle used by the webhook server
	// and patched into the webhook config.
	CABundleWatcher *keycertbundle.Watcher

	webhooks kclient.Client[*v1.MutatingWebhookConfiguration]
}

rootProject.name = 'cacheable-bundle'...

executable: gradle
args: "bundle clean"

			errContains: `unexpected status: 503, fetching bundle: {"error": "system down"}`,
		},
		{
			name:        "Bundle contains no certificate",
			in:          input1,
			extraCerts:  serverCerts,
			statusCode:  http.StatusOK,
			body:        invalidSpiffeX509Bundle,
			errContains: "expected 1 certificate in x509-svid entry 0; got 0",
		},
		{
			name:        "Bundle cannot be decoded",
			in:          input1,

	//
	// +optional
	SignerName string `json:"signerName,omitempty" protobuf:"bytes,1,opt,name=signerName"`

	// trustBundle contains the individual X.509 trust anchors for this
	// bundle, as PEM bundle of PEM-wrapped, DER-formatted X.509 certificates.
	//
	// The data must consist only of PEM certificate blocks that parse as valid
	// X.509 certificates.  Each certificate must include a basic constraints

	if err != nil {
		return 0
	}
	_, err = rootCertFile.Write(rootCertFileBytes)
	if err != nil {
		return 0
	}
	bundle, err := util.NewVerifiedKeyCertBundleFromFile("certfile", "privKeyFile", []string{"certChainFile"}, "rootCertFile")
	if err != nil {
		return 0
	}
	_, err = bundle.CertOptions()
	if err == nil {
		panic("Ran successfully")
	}

	newCertFile, err := os.Create("newCertfile")

        buildFile << """
            plugins {
                id("version-catalog")
            }

            catalog {
                versionCatalog {
                    bundle('my', ['foo', 'bar'])
                }
            }
            dependencies {
                versionCatalog 'org:foo:1.0'
                versionCatalog('org:bar') {
                    version {