obvious way to ensure that.

    We could consider arranging things so that only the tests we know need this would get
    the add-opens. Right now that doesn't seem worth the effort, though.
    -->
    <test.add.opens>
      --add-opens java.base/java.lang=ALL-UNNAMED
      --add-opens java.base/java.util=ALL-UNNAMED
      --add-opens java.base/sun.security.jca=ALL-UNNAMED

   * Implementation for the EntryIterator, which is used to build Key and Value iterators.
   *
   * <p>Expiration is only checked on hasNext(), so as to ensure that a next() call never returns
   * null when hasNext() has already been called.
   */
  private final class EntryIterator implements Iterator<Entry<K, V>> {
    Iterator<Entry<K, Timestamped<V>>> iterator;
    Entry<K, Timestamped<V>> lastEntry;
    Entry<K, Timestamped<V>> nextEntry;

              int key = getNonGoldenRandomKey();
              // We can't check that the key is mightContain() == false before the
              // put() because the key could have already been generated *or* the
              // bloom filter might say true even when it's not there (false
              // positive).
              bloomFilter.put(key);
              // False negative should *never* happen.

    obvious way to ensure that.

    We could consider arranging things so that only the tests we know need this would get
    the add-opens. Right now that doesn't seem worth the effort, though.
    -->
    <test.add.opens>
      --add-opens java.base/java.lang=ALL-UNNAMED
      --add-opens java.base/java.util=ALL-UNNAMED
      --add-opens java.base/sun.security.jca=ALL-UNNAMED

                RANDOM.nextBytes(clientChallenge);
                java.util.Arrays.fill(clientChallenge, 8, 24, (byte) 0x00);

                // NTLMv1 w/ NTLM2 session sec and key exch all been verified with a debug build of smbclient

                final byte[] responseKeyNT = NtlmPasswordAuthentication.nTOWFv1(password);
                final byte[] ntlm2Response =

		// In SQLServer, If an index or constraint depends on the column,
		// this column will not be able to run ALTER
		// see https://stackoverflow.com/questions/19460912/the-object-df-is-dependent-on-column-changing-int-to-double/19461205#19461205
		// may we need to create another PR to fix it, see https://github.com/go-gorm/sqlserver/pull/106
		tests = []TestCase{

    // "intermediate_ca" as the good CA. This signs a rogue certificate for localhost. The server
    // serves the good CAs certificate in the chain, which means the certificate pinner sees a
    // different set of certificates than the SSL verifier.
    val compromisedIntermediateCa =
      HeldCertificate
        .Builder()
        .signedBy(compromisedRootCa)
        .certificateAuthority(0)

              int key = getNonGoldenRandomKey();
              // We can't check that the key is mightContain() == false before the
              // put() because the key could have already been generated *or* the
              // bloom filter might say true even when it's not there (false
              // positive).
              bloomFilter.put(key);
              // False negative should *never* happen.

// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package cmd

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"

        ).build(),
    )
    server.enqueue(
      MockResponse
        .Builder()
        .addHeader("Content-Encoding: gzip")
        .body(gzip("b"))
        .build(),
    )

    // Seed the pool with a bad connection.
    assertContent("a", getResponse(newRequest("/")))

    // Give the server time to disconnect.
    Thread.sleep(500)