int keyBits = 32;
    int hashBits = function.bits();
    for (int i = 0; i < keyBits; i++) {
      int[] same = new int[hashBits];
      int[] diff = new int[hashBits];
      // go through trials to compute probability
      for (int j = 0; j < trials; j++) {
        int key1 = rand.nextInt();
        // flip input bit for key2
        int key2 = key1 ^ (1 << i);
        // compute hash values

    return CollectCollectors.toMultiset(elementFunction, countFunction, multisetSupplier);
  }

  /**
   * Returns an unmodifiable view of the specified multiset. Query operations on the returned
   * multiset "read through" to the specified multiset, and attempts to modify the returned multiset
   * result in an {@link UnsupportedOperationException}.
   *
   * <p>The returned multiset will be serializable if the specified multiset is serializable.

    return CollectCollectors.toMultiset(elementFunction, countFunction, multisetSupplier);
  }

  /**
   * Returns an unmodifiable view of the specified multiset. Query operations on the returned
   * multiset "read through" to the specified multiset, and attempts to modify the returned multiset
   * result in an {@link UnsupportedOperationException}.
   *
   * <p>The returned multiset will be serializable if the specified multiset is serializable.

  // b) features of normal volumes like restoring from snapshot or capacity
  //    tracking are needed,
  // c) the storage driver is specified through a storage class, and
  // d) the storage driver supports dynamic volume provisioning through
  //    a PersistentVolumeClaim (see EphemeralVolumeSource for more
  //    information on the connection between this volume type
  //    and PersistentVolumeClaim).
  //

      throw noMoreExchanges(e) as Throwable
    } finally {
      if (!calledNoMoreExchanges) {
        noMoreExchanges(null)
      }
    }
  }

  /**
   * Prepare for a potential trip through all of this call's network interceptors. This prepares to
   * find an exchange to carry the request.
   *
   * Note that an exchange will not be needed if the request is satisfied by the cache.
   *

import okio.ByteString.Companion.toByteString

/**
 * Constrains which certificates are trusted. Pinning certificates defends against attacks on
 * certificate authorities. It also prevents connections through man-in-the-middle certificate
 * authorities either known or unknown to the application's user.
 * This class currently pins a certificate's Subject Public Key Info as described on

  return b == addressOffset + 4
}

/** Encodes an IPv6 address in canonical form according to RFC 5952. */
internal fun inet6AddressToAscii(address: ByteArray): String {
  // Go through the address looking for the longest run of 0s. Each group is 2-bytes.
  // A run must be longer than one group (section 4.2.2).
  // If there are multiple equal runs, the first one must be used (section 4.2.3).

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all

            // the default must become the current project of the thread that clones this
            MavenProject current = getCurrentProject();
            // we replace the thread local of the clone to prevent write through and enforce the new default value
            clone.currentProject = ThreadLocal.withInitial(() -> current);
            return clone;
        } catch (CloneNotSupportedException e) {

However, this is not enough to fully serve the request - Ztunnel will need the certificate (from the CA) and full workload information (from the XDS server).
This is done through a waiting mechanism: Ztunnel will accept all connections, but it will not start forwarding traffic until all the above is fetched.