SerialNumber: big.NewInt(0),
		Subject: pkix.Name{
			CommonName: "root1",
		},
		IsCA:                  true,
		BasicConstraintsValid: true,
	})

	goodCert2 := mustMakeCertificate(t, &x509.Certificate{
		SerialNumber: big.NewInt(0),
		Subject: pkix.Name{
			CommonName: "root2",
		},
		IsCA:                  true,
		BasicConstraintsValid: true,
	})

	// This test is limited by the use of a fake clientset and volume host.  We
	// can't meaningfully test that label selectors end up doing the correct
	// thing for example.

	goodCert1 := mustMakeRoot(t, "root1")

	testCases := []struct {
		name string

		source  v1.ProjectedVolumeSource
		bundles []runtime.Object

		fsUser  *int64
		fsGroup *int64

		wantPayload map[string]util.FileProjection

var x509usefallbackroots = godebug.New("x509usefallbackroots")

// SetFallbackRoots sets the roots to use during certificate verification, if no
// custom roots are specified and a platform verifier or a system certificate
// pool is not available (for instance in a container which does not have a root
// certificate bundle). SetFallbackRoots will panic if roots is nil.
//
// SetFallbackRoots may only be called once, if called multiple times it will

const (
	FlagCharts = "charts"
)

// ConfigAndEnvProcessing uses spf13/viper for overriding CLI parameters
func ConfigAndEnvProcessing() error {
	configPath := filepath.Dir(root.IstioConfig)
	baseName := filepath.Base(root.IstioConfig)
	configType := filepath.Ext(root.IstioConfig)
	configName := baseName[0 : len(baseName)-len(configType)]
	if configType != "" {
		configType = configType[1:]
	}

	if err := os.WriteFile(root.ConfFile, []byte(rootCAConf), os.ModePerm); err != nil {
		return Root{}, err
	}

	// Create the root key.
	if err := cert.GenerateKey(root.KeyFile); err != nil {
		return Root{}, err
	}

	// Create the root CSR
	if err := cert.GenerateCSR(root.ConfFile, root.KeyFile, root.CSRFile); err != nil {
		return Root{}, err
	}

	// Create the root cert

root.b...

// limitations under the License.

package main

import (
	"flag"

	"github.com/spf13/cobra"

	"istio.io/istio/pkg/collateral"
	"istio.io/istio/pkg/version"
)

// getRootCmd returns the root of the cobra command-tree.
func getRootCmd(args []string) *cobra.Command {
	rootCmd := &cobra.Command{
		Use:   "operator",
		Short: "The Istio operator.",
		Args:  cobra.ExactArgs(0),

    <orderEntry type="module-library" scope="RUNTIME">
      <library>
        <CLASSES>
          <root url="jar://$CUSTOM_DIR$/../cache/junit/junit/jars/junit-4.7.jar!/"/>
        </CLASSES>
        <JAVADOC/>
        <SOURCES>
          <root url="jar://$CUSTOM_DIR$/../cache/junit/junit/sources/junit-4.7-sources.jar!/"/>
        </SOURCES>
      </library>
    </orderEntry>
  </component>

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ matrix.go-version }}
          check-latest: true
      - name: Start root lockdown tests
        run: |

}

func addFlags(cmd *cobra.Command, rootArgs *RootArgs) {
	cmd.PersistentFlags().BoolVarP(&rootArgs.DryRun, "dry-run", "",
		false, "Console/log output only, make no changes.")
}

// GetRootCmd returns the root of the cobra command-tree.
func GetRootCmd(ctx cli.Context, args []string) *cobra.Command {
	rootCmd := &cobra.Command{
		Use:          "mesh",
		Short:        "Command line Istio install utility.",
		SilenceUsage: true,