procid        uint64            // for debuggers, but offset not hard-coded
	gsignal       *g                // signal-handling g
	goSigStack    gsignalStack      // Go-allocated signal handling stack
	sigmask       sigset            // storage for saved signal mask
	tls           [tlsSlots]uintptr // thread-local storage (for x86 extern register)
	mstartfn      func()
	curg          *g       // current running goroutine

	}

	return prev, nil
}

//sysnb	rtSigprocmask(how int, set *Sigset_t, oldset *Sigset_t, sigsetsize uintptr) (err error) = SYS_RT_SIGPROCMASK

func PthreadSigmask(how int, set, oldset *Sigset_t) error {
	if oldset != nil {
		// Explicitly clear in case Sigset_t is larger than _C__NSIG.
		*oldset = Sigset_t{}
	}
	return rtSigprocmask(how, set, oldset, _C__NSIG/8)
}

// limitations under the License.

// Package signer implements a CA signer that uses keys stored on local disk.
package signer

import (
	"bytes"
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"time"

	capi "k8s.io/api/certificates/v1"

	"istio.io/istio/pkg/test/csrctrl/authority"
	"istio.io/istio/security/pkg/pki/util"
)

type Signer struct {
	caProvider *caProvider
	CertTTL    time.Duration
}

cuiweixie <******@****.***> 1664452800 +0800

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Package signer implements a CA signer that uses keys stored on local disk.
package signer

import (
	"context"
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"time"

	capi "k8s.io/api/certificates/v1"
	capiv1beta1 "k8s.io/api/certificates/v1beta1"

)

// IPSetVersioner can query the current ipset version.
type IPSetVersioner interface {
	// returns "X.Y"
	GetVersion() (string, error)
}

// IPSet wraps util/ipset which is used by IPVS proxier.
type IPSet struct {
	utilipset.IPSet
	// activeEntries is the current active entries of the ipset.
	activeEntries sets.Set[string]
	// handle is the util ipset interface handle.
	handle utilipset.Interface
}

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ipset

import (
	"errors"
	"fmt"
	"net/netip"
)

type IPSet struct {
	V4Name string
	V6Name string
	Prefix string
	Deps   NetlinkIpsetDeps
}

const (
	V4Name = "%s-v4"
	V6Name = "%s-v6"
)

	ListSets() ([]string, error)
	// GetVersion returns the "X.Y" version string for ipset.
	GetVersion() (string, error)
}

// IPSetCmd represents the ipset util. We use ipset command for ipset execute.
const IPSetCmd = "ipset"

// EntryMemberPattern is the regular expression pattern of ipset member list.
// The raw output of ipset command `ipset list {set}` is similar to,
// Name: foobar
// Type: hash:ip,port
// Revision: 2

SigVer.rsp # CAVS 11.0 # "SigVer" information # Curves/SHAs selected: P-192,SHA-1 P-192,SHA-224 P-192,SHA-256 P-192,SHA-384 P-192,SHA-512 P-224,SHA-1 P-224,SHA-224 P-224,SHA-256 P-224,SHA-384 P-224,SHA-512 P-256,SHA-1 P-256,SHA-224 P-256,SHA-256 P-256,SHA-384 P-256,SHA-512 P-384,SHA-1 P-384,SHA-224 P-384,SHA-256 P-384,SHA-384 P-384,SHA-512 P-521,SHA-1 P-521,SHA-224 P-521,SHA-256 P-521,SHA-384 P-521,SHA-512 K-163,SHA-1 K-163,SHA-224 K-163,SHA-256 K-163,SHA-384 K-163,SHA-512 K-233,SHA-1 K-233,SHA-224...

	/* 2 */ {_SigNotify + _SigKill, "SIGINT: interrupt"},
	/* 3 */ {_SigNotify + _SigThrow, "SIGQUIT: quit"},
	/* 4 */ {_SigThrow + _SigUnblock, "SIGILL: illegal instruction"},
	/* 5 */ {_SigThrow + _SigUnblock, "SIGTRAP: trace trap"},
	/* 6 */ {_SigNotify + _SigThrow, "SIGABRT: abort"},
	/* 7 */ {_SigThrow, "SIGEMT: emulate instruction executed"},