*/
@Suppress("UNCHECKED_CAST") // This needs to cast decoded collections.
internal object CertificateAdapters {
  /**
   * ```
   * Time ::= CHOICE {
   *   utcTime        UTCTime,
   *   generalTime    GeneralizedTime
   * }
   * ```
   *
   * RFC 5280, section 4.1.2.5:
   *
   * > CAs conforming to this profile MUST always encode certificate validity dates through the year

	"fmt"
	"log"
	"net/http"
	"net/url"
	"strings"
	"time"

	"golang.org/x/oauth2"

	"github.com/minio/minio-go/v7"
	"github.com/minio/minio-go/v7/pkg/credentials"
)

// Returns a base64 encoded random 32 byte string.
func randomState() string {
	b := make([]byte, 32)
	rand.Read(b)
	return base64.RawURLEncoding.EncodeToString(b)
}

var (
	stsEndpoint    string
	configEndpoint string

  return IdnaMappingTableData(
    sections = sectionIndexBuffer.readUtf8(),
    ranges = rangesBuffer.readUtf8(),
    mappings = mappingsBuffer.toString(),
  )
}

/**
 * If [mapping] qualifies to be encoded as [MappedRange.InlineDelta] return new instance, otherwise null.
 * An [MappedRange.InlineDelta] must be a mapping from a single code-point to a single code-point with a difference
 * that can be represented in 2^18-1.
 */

    private final int d;

    // Four 64-bit words of internal state.
    // The initial state corresponds to the ASCII string "somepseudorandomlygeneratedbytes",
    // big-endian encoded. There is nothing special about this value; the only requirement
    // was some asymmetry so that the initial v0 and v1 differ from v2 and v3.
    private long v0 = 0x736f6d6570736575L;
    private long v1 = 0x646f72616e646f6dL;

  val normalized = normalizeNfc(bufferB.readUtf8())
  bufferA.writeUtf8(normalized)

  // 3. For each label, convert/validate Punycode.
  val decoded = Punycode.decode(bufferA.readUtf8()) ?: return null

  // 4.1 Validate.

  // Must be NFC.
  if (decoded != normalizeNfc(decoded)) return null

  // TODO: Must not begin with a combining mark.
  // TODO: Each character must be 'valid' or 'deviation'. Not mapped.

 * character encoding} using {@link ByteSink#asCharSink(Charset)}. Characters written to the
 * resulting {@code CharSink} will written to the {@code ByteSink} as encoded bytes.
 *
 * @since 14.0
 * @author Colin Decker
 */
@J2ktIncompatible
@GwtIncompatible
public abstract class CharSink {

  /** Constructor for use by subclasses. */
  protected CharSink() {}

import org.bouncycastle.asn1.ASN1TaggedObject;
import org.bouncycastle.asn1.DLSequence;

/**
 * Utility class for ASN.1 parsing and manipulation operations.
 *
 * This class provides helper methods for working with ASN.1
 * encoded data structures used in Kerberos PAC processing.
 */
public final class ASN1Util {

    private ASN1Util() {
    }

    /**
     * Casts an object to the specified type with type checking

    }

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE
        byte[] notASequence = new ASN1Integer(42).getEncoded();

        // Act + Assert
        assertThrows(PACDecodingException.class, () -> new KerberosApRequest(notASequence, null));
    }

	switch op {
	case arm.ASTREX, arm.ASTREXD, arm.ASTREXB, arm.ASWPW, arm.ASWPBU:
		return true
	}
	return false
}

// MCR is not defined by the obj/arm; instead we define it privately here.
// It is encoded as an MRC with a bit inside the instruction word,
// passed to arch.ARMMRCOffset.
const aMCR = arm.ALAST + 1

// IsARMMRC reports whether the op (as defined by an arm.A* constant) is
// MRC or MCR.

		}
	}

	if opts.WantChecksum != nil {
		if checksumType.FullObjectRequested() {
			if opts.WantChecksum.Encoded != checksum.Encoded {
				err := hash.ChecksumMismatch{
					Want: opts.WantChecksum.Encoded,
					Got:  checksum.Encoded,
				}
				return oi, err
			}
		} else {
			err := opts.WantChecksum.Matches(checksumCombined, len(parts))
			if err != nil {