return ImmutableMultiset.copyOf(keys);
      }
    },
    COPY_OF_ITERATOR {
      @Override
      public ImmutableMultiset<Object> create(List<?> keys) {
        return ImmutableMultiset.copyOf(keys.iterator());
      }
    },
    BUILDER_ADD_ENTRY_BY_ENTRY {
      @Override
      public ImmutableMultiset<Object> create(List<?> keys) {

import java.util.TreeMap;
import org.jspecify.annotations.Nullable;

/**
 * Implementation of {@code Table} whose row keys and column keys are ordered by their natural
 * ordering or by supplied comparators. When constructing a {@code TreeBasedTable}, you may provide
 * comparators for the row keys and the column keys, or you may use natural ordering for both.
 *

	}

	// Check returned key list is correct
	if test.wantKeyNames != nil {
		keys := []madmin.KMSKeyInfo{}
		err := json.Unmarshal(rec.Body.Bytes(), &keys)
		if err != nil {
			t.Fatal(err)
		}
		if len(keys) != len(test.wantKeyNames) {
			t.Fatalf("want %d keys, got %d", len(test.wantKeyNames), len(keys))
		}

		for i, want := range keys {
			if want.CreatedBy != kms.StubCreatedBy {

        # String columns may not be needed
        # to be set these condition-keys basically.
        #; GreaterThan = map:{}
        #; LessThan = map:{}
        #; GreaterEqual = map:{}
        #; LessEqual = map:{}

        # [Exclude]
        # Common columns of String type may not be needed
        # to be set these condition-keys basically.
        #; !NotEqual = map:{ $$ALL$$ = list:{ $$CommonColumn$$ } }

   */
  @VisibleForTesting transient int @Nullable [] entries;

  /**
   * The keys of the entries in the map, in the range of [0, size()). The keys in [size(),
   * keys.length) are all {@code null}.
   */
  @VisibleForTesting transient @Nullable Object @Nullable [] keys;

  /**
   * The values of the entries in the map, in the range of [0, size()). The values in [size(),

     *
     * @param token the Kerberos AP-REQ token
     * @param keys the Kerberos keys for decryption
     * @throws PACDecodingException if the token cannot be decoded
     */
    public KerberosApRequest(byte[] token, KerberosKey[] keys) throws PACDecodingException {
        this(parseSequence(token), keys);
    }

    private static ASN1Sequence parseSequence(byte[] token) throws PACDecodingException {

        keys.put(PacSignature.ETYPE_ARCFOUR_HMAC, hmacKey);
        keys.put(PacSignature.ETYPE_AES128_CTS_HMAC_SHA1_96, aes128Key);
        keys.put(PacSignature.ETYPE_AES256_CTS_HMAC_SHA1_96, aes256Key);

        // Test HMAC-MD5
        byte[] mac1 = PacMac.calculateMac(PacSignature.KERB_CHECKSUM_HMAC_MD5, keys, TEST_DATA);
        assertNotNull(mac1);

     *
     * @param token the PAC token bytes
     * @param keys map of Kerberos keys indexed by key type
     * @throws PACDecodingException if PAC decoding fails
     */
    public KerberosPacAuthData(byte[] token, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        this.pac = new Pac(token, keys);
    }

    /**
     * Returns the PAC object.
     *

  /**
   * Computes or retrieves the values corresponding to {@code keys}. This method is called by {@link
   * LoadingCache#getAll}.
   *
   * <p>If the returned map doesn't contain all requested {@code keys} then the entries it does
   * contain will be cached, but {@code getAll} will throw an exception. If the returned map
   * contains extra keys not present in {@code keys} then all returned entries will be cached, but

MinIO supports encrypted KES client private keys. Therefore, you can use
an password-protected private keys for `MINIO_KMS_KES_KEY_FILE`.

When using password-protected private keys for accessing KES you need to
provide the password via:

```
export MINIO_KMS_KES_KEY_PASSWORD=<your-password>
```

Note that MinIO only supports encrypted private keys - not encrypted certificates.