if err := w.prepare(fh); err != nil {
		return nil, err
	}

	// The ZIP format has a sad state of affairs regarding character encoding.
	// Officially, the name and comment fields are supposed to be encoded
	// in CP-437 (which is mostly compatible with ASCII), unless the UTF-8
	// flag bit is set. However, there are several problems:
	//
	//	* Many ZIP readers still do not support UTF-8.

    }

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE
        byte[] notASequence = new ASN1Integer(42).getEncoded();

        // Act + Assert
        assertThrows(PACDecodingException.class, () -> new KerberosApRequest(notASequence, null));
    }

        byte[] dst = new byte[256];
        int bytesWritten = packet.writeTrailerWireFormat(dst, 0);

        assertTrue(bytesWritten > 0);
        // Each name should write at least 34 bytes (encoded name + scope)
        assertTrue(bytesWritten >= 68);
    }

    @Test
    @DisplayName("writeTrailerWireFormat with scope should handle scoped names")
    void testWriteTrailerWireFormatWithScope() {

TensorFlow
[**models**](https://developers.google.com/machine-learning/glossary/#model) (to
use a term commonly used by machine learning practitioners) are expressed as
programs that TensorFlow executes. TensorFlow programs are encoded as
computation
[**graphs**](https://developers.google.com/machine-learning/glossary/#graph).
Since models are practically programs that TensorFlow executes, using untrusted

		}
	}

	if opts.WantChecksum != nil {
		if checksumType.FullObjectRequested() {
			if opts.WantChecksum.Encoded != checksum.Encoded {
				err := hash.ChecksumMismatch{
					Want: opts.WantChecksum.Encoded,
					Got:  checksum.Encoded,
				}
				return oi, err
			}
		} else {
			err := opts.WantChecksum.Matches(checksumCombined, len(parts))
			if err != nil {

        buf[i++] = (byte) (nameLen & 0xFF);
        // NAME
        System.arraycopy(nameBytes, 0, buf, i, nameLen);
        return buf;
    }

    // Provide a common OID for tests (Kerberos V5 mechanism OID encoded in DER)
    private static ASN1ObjectIdentifier testOid() {
        return new ASN1ObjectIdentifier("1.2.840.113554.1.2.2");
    }

    private static byte[] oidDer() {
        // Full DER encoding of the OID

                    di++;
                }
                dst[di++] = (byte) (0x80 | ch >> 0 & 0x3F);
            }
        }

        return di - start;
    }

    /**
     * Decodes a UTF-8 encoded string from a byte array.
     *
     * @param src the source byte array
     * @param si the starting index in the source array
     * @param slim the limit index in the source array
     * @return the decoded String

   *
   * RFC 5280, section 4.1.2.5:
   *
   * > CAs conforming to this profile MUST always encode certificate validity dates through the year
   * > 2049 as UTCTime; certificate validity dates in 2050 or later MUST be encoded as
   * > GeneralizedTime.
   */
  internal val time: DerAdapter<Long> =
    object : DerAdapter<Long> {

 *
 * b0
 * --
 *
 * The inclusive start of the range. We get the first 14 bits of this code point from the section
 * and the last 7 bits from this byte.
 *
 * The end of the range is not encoded, but can be inferred by looking at the start of the range
 * that follows.
 *
 * b1
 * --
 *
 * This is either a mapping decision or the length of the mapped output, according to this table:
 *
 * ```

		}
	}
	b64Ctx, ok := metadata[MetaContext]
	if ok {
		b, err := base64.StdEncoding.DecodeString(b64Ctx)
		if err != nil {
			return keyID, kmsKey, sealedKey, ctx, Errorf("The internal KMS context is not base64-encoded")
		}
		json := jsoniter.ConfigCompatibleWithStandardLibrary
		if err = json.Unmarshal(b, &ctx); err != nil {
			return keyID, kmsKey, sealedKey, ctx, Errorf("The internal sealed KMS context is invalid %w", err)
		}