peerCertificates := make([]*x509.Certificate, 0, len(r.TLS.PeerCertificates))
	for _, cert := range r.TLS.PeerCertificates {
		if cert.IsCA {
			continue
		}
		peerCertificates = append(peerCertificates, cert)
	}
	r.TLS.PeerCertificates = peerCertificates

	// Now, we have to check that the client has provided exactly one leaf
	// certificate that we can map to a policy.

        .signedBy(pinnedRoot)
        .build()
    val attackerSwitch =
      HeldCertificate.Builder()
        .serialNumber(5L)
        .keyPair(attackerIntermediate.keyPair) // share keys between compromised CA and leaf!
        .commonName("attacker")
        .addSubjectAlternativeName("attacker.com")
        .signedBy(pinnedIntermediate)
        .build()
    val phonyVictim =
      HeldCertificate.Builder()

// branch level, and contains link to children branches or leaves.
//
// The leaves are "compacted" based on a number of properties.
// A compacted leaf contains the totals of all files beneath it.
//
// A leaf is only scanned once every dataUsageUpdateDirCycles,
// rarer if the bloom filter for the path is clean and no lifecycles are applied.

using the [`tls3des` setting](/pkg/crypto/tls/#Config.CipherSuites).

Go 1.23 changed the behavior of [`tls.X509KeyPair`](/pkg/crypto/tls#X509KeyPair)
and [`tls.LoadX509KeyPair`](/pkg/crypto/tls#LoadX509KeyPair) to populate the
Leaf field of the returned [`tls.Certificate`](/pkg/crypto/tls#Certificate).
This behavior is controlled by the `x509keypairleaf` setting. For Go 1.23, it
defaults to `x509keypairleaf=1`. Previous versions default to

</li>
<li>
<code>NOFRAME</code> = 512
<br>
(For <code>TEXT</code> items.)
Do not insert instructions to allocate a stack frame and save/restore the return
address, even if this is not a leaf function.
Only valid on functions that declare a frame size of 0.
</li>
<li>
<code>TOPFRAME</code> = 2048
<br>
(For <code>TEXT</code> items.)

				"image/x-raw-nikon",
				"image/x-raw-olympus",
				"image/x-raw-pentax",
				"image/x-raw-sony",
				"image/x-raw-sigma",
				"image/x-raw-epson",
				"image/x-raw-mamiya",
				"image/x-raw-leaf",
				"image/x-raw-panasonic",
				"image/x-raw-phaseone",
				"image/x-raw-red",
				"image/x-raw-imacon",
				"image/x-raw-logitech",
				"image/x-raw-casio",
				"image/x-raw-rawzor",

 * is by declaring that step to be the last step of the pipeline. Nevertheless, we refer to the
 * "value" of a successful step or the "result" (value or exception) of any step.
 *
 * <ol>
 *   <li>A pipeline starts at its leaf step (or steps), which is created from either a callable
 *       block or a {@link ListenableFuture}.
 *   <li>Each other step is derived from one or more input steps. At each step, zero or more objects

		return cache, err
	}

	cache.Info.updates = updates

	dataUsageInfo, err := scanDataFolder(ctx, disks, s, cache, func(item scannerItem) (sizeSummary, error) {
		// Look for `xl.meta/xl.json' at the leaf.
		if !strings.HasSuffix(item.Path, SlashSeparator+xlStorageFormatFile) &&
			!strings.HasSuffix(item.Path, SlashSeparator+xlStorageFormatFileV1) {
			// if no xl.meta/xl.json found, skip the file.

  </mime-type>

  <mime-type type="image/x-raw-mamiya">
    <_comment>Mamiya raw image</_comment>
    <glob pattern="*.mef"/>
  </mime-type>

  <mime-type type="image/x-raw-leaf">
    <_comment>Leaf raw image</_comment>
    <glob pattern="*.mos"/>
  </mime-type>

  <mime-type type="image/x-raw-panasonic">
    <_comment>Panasonic raw image</_comment>
    <glob pattern="*.raw"/>

  // +listMapKey=topologyKey
  // +listMapKey=whenUnsatisfiable
  repeated TopologySpreadConstraint topologySpreadConstraints = 33;

  // If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default).
  // In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname).