SigningConfig.java

// Generated by the protocol buffer compiler.  DO NOT EDIT!
// NO CHECKED-IN PROTOBUF GENCODE
// source: sigstore_trustroot.proto
// Protobuf Java Version: 4.30.2

package dev.sigstore.proto.trustroot.v1;

/**
 * <pre>
 * SigningConfig represents the trusted entities/state needed by Sigstore
 * signing. In particular, it primarily contains service URLs that a Sigstore
 * signer may need to connect to for the online aspects of signing.
 * </pre>
 *
 * Protobuf type {@code dev.sigstore.trustroot.v1.SigningConfig}
 */
@javax.annotation.Generated(value="protoc", comments="annotations:SigningConfig.java.pb.meta")
public final class SigningConfig extends
    com.google.protobuf.GeneratedMessage implements
    // @@protoc_insertion_point(message_implements:dev.sigstore.trustroot.v1.SigningConfig)
    SigningConfigOrBuilder {
private static final long serialVersionUID = 0L;
  static {
    com.google.protobuf.RuntimeVersion.validateProtobufGencodeVersion(
      com.google.protobuf.RuntimeVersion.RuntimeDomain.PUBLIC,
      /* major= */ 4,
      /* minor= */ 30,
      /* patch= */ 2,
      /* suffix= */ "",
      SigningConfig.class.getName());
  }
  // Use SigningConfig.newBuilder() to construct.
  private SigningConfig(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
    super(builder);
  }
  private SigningConfig() {
    mediaType_ = "";
    caUrls_ = java.util.Collections.emptyList();
    oidcUrls_ = java.util.Collections.emptyList();
    rekorTlogUrls_ = java.util.Collections.emptyList();
    tsaUrls_ = java.util.Collections.emptyList();
  }

  public static final com.google.protobuf.Descriptors.Descriptor
      getDescriptor() {
    return dev.sigstore.proto.trustroot.v1.TrustRootProto.internal_static_dev_sigstore_trustroot_v1_SigningConfig_descriptor;
  }

  @java.lang.Override
  protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
      internalGetFieldAccessorTable() {
    return dev.sigstore.proto.trustroot.v1.TrustRootProto.internal_static_dev_sigstore_trustroot_v1_SigningConfig_fieldAccessorTable
        .ensureFieldAccessorsInitialized(
            dev.sigstore.proto.trustroot.v1.SigningConfig.class, dev.sigstore.proto.trustroot.v1.SigningConfig.Builder.class);
  }

  private int bitField0_;
  public static final int MEDIA_TYPE_FIELD_NUMBER = 5;
  @SuppressWarnings("serial")
  private volatile java.lang.Object mediaType_ = "";
  /**
   * <pre>
   * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
   * Clients MAY choose to also support
   * application/vnd.dev.sigstore.signingconfig.v0.1+json
   * </pre>
   *
   * <code>string media_type = 5;</code>
   * @return The mediaType.
   */
  @java.lang.Override
  public java.lang.String getMediaType() {
    java.lang.Object ref = mediaType_;
    if (ref instanceof java.lang.String) {
      return (java.lang.String) ref;
    } else {
      com.google.protobuf.ByteString bs = 
          (com.google.protobuf.ByteString) ref;
      java.lang.String s = bs.toStringUtf8();
      mediaType_ = s;
      return s;
    }
  }
  /**
   * <pre>
   * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
   * Clients MAY choose to also support
   * application/vnd.dev.sigstore.signingconfig.v0.1+json
   * </pre>
   *
   * <code>string media_type = 5;</code>
   * @return The bytes for mediaType.
   */
  @java.lang.Override
  public com.google.protobuf.ByteString
      getMediaTypeBytes() {
    java.lang.Object ref = mediaType_;
    if (ref instanceof java.lang.String) {
      com.google.protobuf.ByteString b = 
          com.google.protobuf.ByteString.copyFromUtf8(
              (java.lang.String) ref);
      mediaType_ = b;
      return b;
    } else {
      return (com.google.protobuf.ByteString) ref;
    }
  }

  public static final int CA_URLS_FIELD_NUMBER = 6;
  @SuppressWarnings("serial")
  private java.util.List<dev.sigstore.proto.trustroot.v1.Service> caUrls_;
  /**
   * <pre>
   * URLs to Fulcio-compatible CAs, capable of receiving
   * Certificate Signing Requests (CSRs) and responding with
   * issued certificates.
   *
   * These URLs MUST be the "base" URL for the CAs, which clients
   * should construct an appropriate CSR endpoint on top of.
   * For example, if a CA URL is `https://example.com/ca`, then
   * the client MAY construct the CSR endpoint as
   * `https://example.com/ca/api/v2/signingCert`.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
   */
  @java.lang.Override
  public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getCaUrlsList() {
    return caUrls_;
  }
  /**
   * <pre>
   * URLs to Fulcio-compatible CAs, capable of receiving
   * Certificate Signing Requests (CSRs) and responding with
   * issued certificates.
   *
   * These URLs MUST be the "base" URL for the CAs, which clients
   * should construct an appropriate CSR endpoint on top of.
   * For example, if a CA URL is `https://example.com/ca`, then
   * the client MAY construct the CSR endpoint as
   * `https://example.com/ca/api/v2/signingCert`.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
   */
  @java.lang.Override
  public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
      getCaUrlsOrBuilderList() {
    return caUrls_;
  }
  /**
   * <pre>
   * URLs to Fulcio-compatible CAs, capable of receiving
   * Certificate Signing Requests (CSRs) and responding with
   * issued certificates.
   *
   * These URLs MUST be the "base" URL for the CAs, which clients
   * should construct an appropriate CSR endpoint on top of.
   * For example, if a CA URL is `https://example.com/ca`, then
   * the client MAY construct the CSR endpoint as
   * `https://example.com/ca/api/v2/signingCert`.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
   */
  @java.lang.Override
  public int getCaUrlsCount() {
    return caUrls_.size();
  }
  /**
   * <pre>
   * URLs to Fulcio-compatible CAs, capable of receiving
   * Certificate Signing Requests (CSRs) and responding with
   * issued certificates.
   *
   * These URLs MUST be the "base" URL for the CAs, which clients
   * should construct an appropriate CSR endpoint on top of.
   * For example, if a CA URL is `https://example.com/ca`, then
   * the client MAY construct the CSR endpoint as
   * `https://example.com/ca/api/v2/signingCert`.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.Service getCaUrls(int index) {
    return caUrls_.get(index);
  }
  /**
   * <pre>
   * URLs to Fulcio-compatible CAs, capable of receiving
   * Certificate Signing Requests (CSRs) and responding with
   * issued certificates.
   *
   * These URLs MUST be the "base" URL for the CAs, which clients
   * should construct an appropriate CSR endpoint on top of.
   * For example, if a CA URL is `https://example.com/ca`, then
   * the client MAY construct the CSR endpoint as
   * `https://example.com/ca/api/v2/signingCert`.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getCaUrlsOrBuilder(
      int index) {
    return caUrls_.get(index);
  }

  public static final int OIDC_URLS_FIELD_NUMBER = 7;
  @SuppressWarnings("serial")
  private java.util.List<dev.sigstore.proto.trustroot.v1.Service> oidcUrls_;
  /**
   * <pre>
   * URLs to OpenID Connect identity providers.
   *
   * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
   * should perform well-known OpenID Connect discovery against.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
   */
  @java.lang.Override
  public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getOidcUrlsList() {
    return oidcUrls_;
  }
  /**
   * <pre>
   * URLs to OpenID Connect identity providers.
   *
   * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
   * should perform well-known OpenID Connect discovery against.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
   */
  @java.lang.Override
  public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
      getOidcUrlsOrBuilderList() {
    return oidcUrls_;
  }
  /**
   * <pre>
   * URLs to OpenID Connect identity providers.
   *
   * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
   * should perform well-known OpenID Connect discovery against.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
   */
  @java.lang.Override
  public int getOidcUrlsCount() {
    return oidcUrls_.size();
  }
  /**
   * <pre>
   * URLs to OpenID Connect identity providers.
   *
   * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
   * should perform well-known OpenID Connect discovery against.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.Service getOidcUrls(int index) {
    return oidcUrls_.get(index);
  }
  /**
   * <pre>
   * URLs to OpenID Connect identity providers.
   *
   * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
   * should perform well-known OpenID Connect discovery against.
   *
   * Clients MUST select only one Service with the highest API version
   * that the client is compatible with, that is within its
   * validity period, and has the newest validity start date.
   * Client SHOULD select the first Service that meets this requirement.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getOidcUrlsOrBuilder(
      int index) {
    return oidcUrls_.get(index);
  }

  public static final int REKOR_TLOG_URLS_FIELD_NUMBER = 8;
  @SuppressWarnings("serial")
  private java.util.List<dev.sigstore.proto.trustroot.v1.Service> rekorTlogUrls_;
  /**
   * <pre>
   * URLs to Rekor transparency logs.
   *
   * These URL MUST be the "base" URLs for the transparency logs,
   * which clients should construct appropriate API endpoints on top of.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `rekor_tlog_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
   */
  @java.lang.Override
  public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getRekorTlogUrlsList() {
    return rekorTlogUrls_;
  }
  /**
   * <pre>
   * URLs to Rekor transparency logs.
   *
   * These URL MUST be the "base" URLs for the transparency logs,
   * which clients should construct appropriate API endpoints on top of.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `rekor_tlog_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
   */
  @java.lang.Override
  public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
      getRekorTlogUrlsOrBuilderList() {
    return rekorTlogUrls_;
  }
  /**
   * <pre>
   * URLs to Rekor transparency logs.
   *
   * These URL MUST be the "base" URLs for the transparency logs,
   * which clients should construct appropriate API endpoints on top of.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `rekor_tlog_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
   */
  @java.lang.Override
  public int getRekorTlogUrlsCount() {
    return rekorTlogUrls_.size();
  }
  /**
   * <pre>
   * URLs to Rekor transparency logs.
   *
   * These URL MUST be the "base" URLs for the transparency logs,
   * which clients should construct appropriate API endpoints on top of.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `rekor_tlog_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.Service getRekorTlogUrls(int index) {
    return rekorTlogUrls_.get(index);
  }
  /**
   * <pre>
   * URLs to Rekor transparency logs.
   *
   * These URL MUST be the "base" URLs for the transparency logs,
   * which clients should construct appropriate API endpoints on top of.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `rekor_tlog_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getRekorTlogUrlsOrBuilder(
      int index) {
    return rekorTlogUrls_.get(index);
  }

  public static final int REKOR_TLOG_CONFIG_FIELD_NUMBER = 9;
  private dev.sigstore.proto.trustroot.v1.ServiceConfiguration rekorTlogConfig_;
  /**
   * <pre>
   * Specifies how a client should select the set of Rekor transparency
   * logs to write to.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
   * @return Whether the rekorTlogConfig field is set.
   */
  @java.lang.Override
  public boolean hasRekorTlogConfig() {
    return ((bitField0_ & 0x00000001) != 0);
  }
  /**
   * <pre>
   * Specifies how a client should select the set of Rekor transparency
   * logs to write to.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
   * @return The rekorTlogConfig.
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceConfiguration getRekorTlogConfig() {
    return rekorTlogConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : rekorTlogConfig_;
  }
  /**
   * <pre>
   * Specifies how a client should select the set of Rekor transparency
   * logs to write to.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder getRekorTlogConfigOrBuilder() {
    return rekorTlogConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : rekorTlogConfig_;
  }

  public static final int TSA_URLS_FIELD_NUMBER = 10;
  @SuppressWarnings("serial")
  private java.util.List<dev.sigstore.proto.trustroot.v1.Service> tsaUrls_;
  /**
   * <pre>
   * URLs to RFC 3161 Time Stamping Authorities (TSA).
   *
   * These URLs MUST be the *full* URL for the TSA, meaning that it
   * should be suitable for submitting Time Stamp Requests (TSRs) to
   * via HTTP, per RFC 3161.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `tsa_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
   */
  @java.lang.Override
  public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getTsaUrlsList() {
    return tsaUrls_;
  }
  /**
   * <pre>
   * URLs to RFC 3161 Time Stamping Authorities (TSA).
   *
   * These URLs MUST be the *full* URL for the TSA, meaning that it
   * should be suitable for submitting Time Stamp Requests (TSRs) to
   * via HTTP, per RFC 3161.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `tsa_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
   */
  @java.lang.Override
  public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
      getTsaUrlsOrBuilderList() {
    return tsaUrls_;
  }
  /**
   * <pre>
   * URLs to RFC 3161 Time Stamping Authorities (TSA).
   *
   * These URLs MUST be the *full* URL for the TSA, meaning that it
   * should be suitable for submitting Time Stamp Requests (TSRs) to
   * via HTTP, per RFC 3161.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `tsa_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
   */
  @java.lang.Override
  public int getTsaUrlsCount() {
    return tsaUrls_.size();
  }
  /**
   * <pre>
   * URLs to RFC 3161 Time Stamping Authorities (TSA).
   *
   * These URLs MUST be the *full* URL for the TSA, meaning that it
   * should be suitable for submitting Time Stamp Requests (TSRs) to
   * via HTTP, per RFC 3161.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `tsa_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.Service getTsaUrls(int index) {
    return tsaUrls_.get(index);
  }
  /**
   * <pre>
   * URLs to RFC 3161 Time Stamping Authorities (TSA).
   *
   * These URLs MUST be the *full* URL for the TSA, meaning that it
   * should be suitable for submitting Time Stamp Requests (TSRs) to
   * via HTTP, per RFC 3161.
   *
   * Clients MUST group Services by `operator` and select at most one
   * Service from each operator. Clients MUST select Services with the
   * highest API version that the client is compatible with, that are
   * within its validity period, and have the newest validity start dates.
   * All listed Services SHOULD be sorted by the `valid_for` window in
   * descending order, with the newest instance first.
   *
   * Clients MUST select Services based on the selector value of
   * `tsa_config`.
   * </pre>
   *
   * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getTsaUrlsOrBuilder(
      int index) {
    return tsaUrls_.get(index);
  }

  public static final int TSA_CONFIG_FIELD_NUMBER = 11;
  private dev.sigstore.proto.trustroot.v1.ServiceConfiguration tsaConfig_;
  /**
   * <pre>
   * Specifies how a client should select the set of TSAs to request
   * signed timestamps from.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
   * @return Whether the tsaConfig field is set.
   */
  @java.lang.Override
  public boolean hasTsaConfig() {
    return ((bitField0_ & 0x00000002) != 0);
  }
  /**
   * <pre>
   * Specifies how a client should select the set of TSAs to request
   * signed timestamps from.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
   * @return The tsaConfig.
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceConfiguration getTsaConfig() {
    return tsaConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : tsaConfig_;
  }
  /**
   * <pre>
   * Specifies how a client should select the set of TSAs to request
   * signed timestamps from.
   * </pre>
   *
   * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
   */
  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder getTsaConfigOrBuilder() {
    return tsaConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : tsaConfig_;
  }

  private byte memoizedIsInitialized = -1;
  @java.lang.Override
  public final boolean isInitialized() {
    byte isInitialized = memoizedIsInitialized;
    if (isInitialized == 1) return true;
    if (isInitialized == 0) return false;

    memoizedIsInitialized = 1;
    return true;
  }

  @java.lang.Override
  public void writeTo(com.google.protobuf.CodedOutputStream output)
                      throws java.io.IOException {
    if (!com.google.protobuf.GeneratedMessage.isStringEmpty(mediaType_)) {
      com.google.protobuf.GeneratedMessage.writeString(output, 5, mediaType_);
    }
    for (int i = 0; i < caUrls_.size(); i++) {
      output.writeMessage(6, caUrls_.get(i));
    }
    for (int i = 0; i < oidcUrls_.size(); i++) {
      output.writeMessage(7, oidcUrls_.get(i));
    }
    for (int i = 0; i < rekorTlogUrls_.size(); i++) {
      output.writeMessage(8, rekorTlogUrls_.get(i));
    }
    if (((bitField0_ & 0x00000001) != 0)) {
      output.writeMessage(9, getRekorTlogConfig());
    }
    for (int i = 0; i < tsaUrls_.size(); i++) {
      output.writeMessage(10, tsaUrls_.get(i));
    }
    if (((bitField0_ & 0x00000002) != 0)) {
      output.writeMessage(11, getTsaConfig());
    }
    getUnknownFields().writeTo(output);
  }

  @java.lang.Override
  public int getSerializedSize() {
    int size = memoizedSize;
    if (size != -1) return size;

    size = 0;
    if (!com.google.protobuf.GeneratedMessage.isStringEmpty(mediaType_)) {
      size += com.google.protobuf.GeneratedMessage.computeStringSize(5, mediaType_);
    }
    for (int i = 0; i < caUrls_.size(); i++) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(6, caUrls_.get(i));
    }
    for (int i = 0; i < oidcUrls_.size(); i++) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(7, oidcUrls_.get(i));
    }
    for (int i = 0; i < rekorTlogUrls_.size(); i++) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(8, rekorTlogUrls_.get(i));
    }
    if (((bitField0_ & 0x00000001) != 0)) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(9, getRekorTlogConfig());
    }
    for (int i = 0; i < tsaUrls_.size(); i++) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(10, tsaUrls_.get(i));
    }
    if (((bitField0_ & 0x00000002) != 0)) {
      size += com.google.protobuf.CodedOutputStream
        .computeMessageSize(11, getTsaConfig());
    }
    size += getUnknownFields().getSerializedSize();
    memoizedSize = size;
    return size;
  }

  @java.lang.Override
  public boolean equals(final java.lang.Object obj) {
    if (obj == this) {
     return true;
    }
    if (!(obj instanceof dev.sigstore.proto.trustroot.v1.SigningConfig)) {
      return super.equals(obj);
    }
    dev.sigstore.proto.trustroot.v1.SigningConfig other = (dev.sigstore.proto.trustroot.v1.SigningConfig) obj;

    if (!getMediaType()
        .equals(other.getMediaType())) return false;
    if (!getCaUrlsList()
        .equals(other.getCaUrlsList())) return false;
    if (!getOidcUrlsList()
        .equals(other.getOidcUrlsList())) return false;
    if (!getRekorTlogUrlsList()
        .equals(other.getRekorTlogUrlsList())) return false;
    if (hasRekorTlogConfig() != other.hasRekorTlogConfig()) return false;
    if (hasRekorTlogConfig()) {
      if (!getRekorTlogConfig()
          .equals(other.getRekorTlogConfig())) return false;
    }
    if (!getTsaUrlsList()
        .equals(other.getTsaUrlsList())) return false;
    if (hasTsaConfig() != other.hasTsaConfig()) return false;
    if (hasTsaConfig()) {
      if (!getTsaConfig()
          .equals(other.getTsaConfig())) return false;
    }
    if (!getUnknownFields().equals(other.getUnknownFields())) return false;
    return true;
  }

  @java.lang.Override
  public int hashCode() {
    if (memoizedHashCode != 0) {
      return memoizedHashCode;
    }
    int hash = 41;
    hash = (19 * hash) + getDescriptor().hashCode();
    hash = (37 * hash) + MEDIA_TYPE_FIELD_NUMBER;
    hash = (53 * hash) + getMediaType().hashCode();
    if (getCaUrlsCount() > 0) {
      hash = (37 * hash) + CA_URLS_FIELD_NUMBER;
      hash = (53 * hash) + getCaUrlsList().hashCode();
    }
    if (getOidcUrlsCount() > 0) {
      hash = (37 * hash) + OIDC_URLS_FIELD_NUMBER;
      hash = (53 * hash) + getOidcUrlsList().hashCode();
    }
    if (getRekorTlogUrlsCount() > 0) {
      hash = (37 * hash) + REKOR_TLOG_URLS_FIELD_NUMBER;
      hash = (53 * hash) + getRekorTlogUrlsList().hashCode();
    }
    if (hasRekorTlogConfig()) {
      hash = (37 * hash) + REKOR_TLOG_CONFIG_FIELD_NUMBER;
      hash = (53 * hash) + getRekorTlogConfig().hashCode();
    }
    if (getTsaUrlsCount() > 0) {
      hash = (37 * hash) + TSA_URLS_FIELD_NUMBER;
      hash = (53 * hash) + getTsaUrlsList().hashCode();
    }
    if (hasTsaConfig()) {
      hash = (37 * hash) + TSA_CONFIG_FIELD_NUMBER;
      hash = (53 * hash) + getTsaConfig().hashCode();
    }
    hash = (29 * hash) + getUnknownFields().hashCode();
    memoizedHashCode = hash;
    return hash;
  }

  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      java.nio.ByteBuffer data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      java.nio.ByteBuffer data,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      com.google.protobuf.ByteString data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      com.google.protobuf.ByteString data,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(byte[] data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      byte[] data,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(java.io.InputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseWithIOException(PARSER, input);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      java.io.InputStream input,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseWithIOException(PARSER, input, extensionRegistry);
  }

  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseDelimitedFrom(java.io.InputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseDelimitedWithIOException(PARSER, input);
  }

  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseDelimitedFrom(
      java.io.InputStream input,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseDelimitedWithIOException(PARSER, input, extensionRegistry);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      com.google.protobuf.CodedInputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseWithIOException(PARSER, input);
  }
  public static dev.sigstore.proto.trustroot.v1.SigningConfig parseFrom(
      com.google.protobuf.CodedInputStream input,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage
        .parseWithIOException(PARSER, input, extensionRegistry);
  }

  @java.lang.Override
  public Builder newBuilderForType() { return newBuilder(); }
  public static Builder newBuilder() {
    return DEFAULT_INSTANCE.toBuilder();
  }
  public static Builder newBuilder(dev.sigstore.proto.trustroot.v1.SigningConfig prototype) {
    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
  }
  @java.lang.Override
  public Builder toBuilder() {
    return this == DEFAULT_INSTANCE
        ? new Builder() : new Builder().mergeFrom(this);
  }

  @java.lang.Override
  protected Builder newBuilderForType(
      com.google.protobuf.GeneratedMessage.BuilderParent parent) {
    Builder builder = new Builder(parent);
    return builder;
  }
  /**
   * <pre>
   * SigningConfig represents the trusted entities/state needed by Sigstore
   * signing. In particular, it primarily contains service URLs that a Sigstore
   * signer may need to connect to for the online aspects of signing.
   * </pre>
   *
   * Protobuf type {@code dev.sigstore.trustroot.v1.SigningConfig}
   */
  public static final class Builder extends
      com.google.protobuf.GeneratedMessage.Builder<Builder> implements
      // @@protoc_insertion_point(builder_implements:dev.sigstore.trustroot.v1.SigningConfig)
      dev.sigstore.proto.trustroot.v1.SigningConfigOrBuilder {
    public static final com.google.protobuf.Descriptors.Descriptor
        getDescriptor() {
      return dev.sigstore.proto.trustroot.v1.TrustRootProto.internal_static_dev_sigstore_trustroot_v1_SigningConfig_descriptor;
    }

    @java.lang.Override
    protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
        internalGetFieldAccessorTable() {
      return dev.sigstore.proto.trustroot.v1.TrustRootProto.internal_static_dev_sigstore_trustroot_v1_SigningConfig_fieldAccessorTable
          .ensureFieldAccessorsInitialized(
              dev.sigstore.proto.trustroot.v1.SigningConfig.class, dev.sigstore.proto.trustroot.v1.SigningConfig.Builder.class);
    }

    // Construct using dev.sigstore.proto.trustroot.v1.SigningConfig.newBuilder()
    private Builder() {
      maybeForceBuilderInitialization();
    }

    private Builder(
        com.google.protobuf.GeneratedMessage.BuilderParent parent) {
      super(parent);
      maybeForceBuilderInitialization();
    }
    private void maybeForceBuilderInitialization() {
      if (com.google.protobuf.GeneratedMessage
              .alwaysUseFieldBuilders) {
        internalGetCaUrlsFieldBuilder();
        internalGetOidcUrlsFieldBuilder();
        internalGetRekorTlogUrlsFieldBuilder();
        internalGetRekorTlogConfigFieldBuilder();
        internalGetTsaUrlsFieldBuilder();
        internalGetTsaConfigFieldBuilder();
      }
    }
    @java.lang.Override
    public Builder clear() {
      super.clear();
      bitField0_ = 0;
      mediaType_ = "";
      if (caUrlsBuilder_ == null) {
        caUrls_ = java.util.Collections.emptyList();
      } else {
        caUrls_ = null;
        caUrlsBuilder_.clear();
      }
      bitField0_ = (bitField0_ & ~0x00000002);
      if (oidcUrlsBuilder_ == null) {
        oidcUrls_ = java.util.Collections.emptyList();
      } else {
        oidcUrls_ = null;
        oidcUrlsBuilder_.clear();
      }
      bitField0_ = (bitField0_ & ~0x00000004);
      if (rekorTlogUrlsBuilder_ == null) {
        rekorTlogUrls_ = java.util.Collections.emptyList();
      } else {
        rekorTlogUrls_ = null;
        rekorTlogUrlsBuilder_.clear();
      }
      bitField0_ = (bitField0_ & ~0x00000008);
      rekorTlogConfig_ = null;
      if (rekorTlogConfigBuilder_ != null) {
        rekorTlogConfigBuilder_.dispose();
        rekorTlogConfigBuilder_ = null;
      }
      if (tsaUrlsBuilder_ == null) {
        tsaUrls_ = java.util.Collections.emptyList();
      } else {
        tsaUrls_ = null;
        tsaUrlsBuilder_.clear();
      }
      bitField0_ = (bitField0_ & ~0x00000020);
      tsaConfig_ = null;
      if (tsaConfigBuilder_ != null) {
        tsaConfigBuilder_.dispose();
        tsaConfigBuilder_ = null;
      }
      return this;
    }

    @java.lang.Override
    public com.google.protobuf.Descriptors.Descriptor
        getDescriptorForType() {
      return dev.sigstore.proto.trustroot.v1.TrustRootProto.internal_static_dev_sigstore_trustroot_v1_SigningConfig_descriptor;
    }

    @java.lang.Override
    public dev.sigstore.proto.trustroot.v1.SigningConfig getDefaultInstanceForType() {
      return dev.sigstore.proto.trustroot.v1.SigningConfig.getDefaultInstance();
    }

    @java.lang.Override
    public dev.sigstore.proto.trustroot.v1.SigningConfig build() {
      dev.sigstore.proto.trustroot.v1.SigningConfig result = buildPartial();
      if (!result.isInitialized()) {
        throw newUninitializedMessageException(result);
      }
      return result;
    }

    @java.lang.Override
    public dev.sigstore.proto.trustroot.v1.SigningConfig buildPartial() {
      dev.sigstore.proto.trustroot.v1.SigningConfig result = new dev.sigstore.proto.trustroot.v1.SigningConfig(this);
      buildPartialRepeatedFields(result);
      if (bitField0_ != 0) { buildPartial0(result); }
      onBuilt();
      return result;
    }

    private void buildPartialRepeatedFields(dev.sigstore.proto.trustroot.v1.SigningConfig result) {
      if (caUrlsBuilder_ == null) {
        if (((bitField0_ & 0x00000002) != 0)) {
          caUrls_ = java.util.Collections.unmodifiableList(caUrls_);
          bitField0_ = (bitField0_ & ~0x00000002);
        }
        result.caUrls_ = caUrls_;
      } else {
        result.caUrls_ = caUrlsBuilder_.build();
      }
      if (oidcUrlsBuilder_ == null) {
        if (((bitField0_ & 0x00000004) != 0)) {
          oidcUrls_ = java.util.Collections.unmodifiableList(oidcUrls_);
          bitField0_ = (bitField0_ & ~0x00000004);
        }
        result.oidcUrls_ = oidcUrls_;
      } else {
        result.oidcUrls_ = oidcUrlsBuilder_.build();
      }
      if (rekorTlogUrlsBuilder_ == null) {
        if (((bitField0_ & 0x00000008) != 0)) {
          rekorTlogUrls_ = java.util.Collections.unmodifiableList(rekorTlogUrls_);
          bitField0_ = (bitField0_ & ~0x00000008);
        }
        result.rekorTlogUrls_ = rekorTlogUrls_;
      } else {
        result.rekorTlogUrls_ = rekorTlogUrlsBuilder_.build();
      }
      if (tsaUrlsBuilder_ == null) {
        if (((bitField0_ & 0x00000020) != 0)) {
          tsaUrls_ = java.util.Collections.unmodifiableList(tsaUrls_);
          bitField0_ = (bitField0_ & ~0x00000020);
        }
        result.tsaUrls_ = tsaUrls_;
      } else {
        result.tsaUrls_ = tsaUrlsBuilder_.build();
      }
    }

    private void buildPartial0(dev.sigstore.proto.trustroot.v1.SigningConfig result) {
      int from_bitField0_ = bitField0_;
      if (((from_bitField0_ & 0x00000001) != 0)) {
        result.mediaType_ = mediaType_;
      }
      int to_bitField0_ = 0;
      if (((from_bitField0_ & 0x00000010) != 0)) {
        result.rekorTlogConfig_ = rekorTlogConfigBuilder_ == null
            ? rekorTlogConfig_
            : rekorTlogConfigBuilder_.build();
        to_bitField0_ |= 0x00000001;
      }
      if (((from_bitField0_ & 0x00000040) != 0)) {
        result.tsaConfig_ = tsaConfigBuilder_ == null
            ? tsaConfig_
            : tsaConfigBuilder_.build();
        to_bitField0_ |= 0x00000002;
      }
      result.bitField0_ |= to_bitField0_;
    }

    @java.lang.Override
    public Builder mergeFrom(com.google.protobuf.Message other) {
      if (other instanceof dev.sigstore.proto.trustroot.v1.SigningConfig) {
        return mergeFrom((dev.sigstore.proto.trustroot.v1.SigningConfig)other);
      } else {
        super.mergeFrom(other);
        return this;
      }
    }

    public Builder mergeFrom(dev.sigstore.proto.trustroot.v1.SigningConfig other) {
      if (other == dev.sigstore.proto.trustroot.v1.SigningConfig.getDefaultInstance()) return this;
      if (!other.getMediaType().isEmpty()) {
        mediaType_ = other.mediaType_;
        bitField0_ |= 0x00000001;
        onChanged();
      }
      if (caUrlsBuilder_ == null) {
        if (!other.caUrls_.isEmpty()) {
          if (caUrls_.isEmpty()) {
            caUrls_ = other.caUrls_;
            bitField0_ = (bitField0_ & ~0x00000002);
          } else {
            ensureCaUrlsIsMutable();
            caUrls_.addAll(other.caUrls_);
          }
          onChanged();
        }
      } else {
        if (!other.caUrls_.isEmpty()) {
          if (caUrlsBuilder_.isEmpty()) {
            caUrlsBuilder_.dispose();
            caUrlsBuilder_ = null;
            caUrls_ = other.caUrls_;
            bitField0_ = (bitField0_ & ~0x00000002);
            caUrlsBuilder_ = 
              com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders ?
                 internalGetCaUrlsFieldBuilder() : null;
          } else {
            caUrlsBuilder_.addAllMessages(other.caUrls_);
          }
        }
      }
      if (oidcUrlsBuilder_ == null) {
        if (!other.oidcUrls_.isEmpty()) {
          if (oidcUrls_.isEmpty()) {
            oidcUrls_ = other.oidcUrls_;
            bitField0_ = (bitField0_ & ~0x00000004);
          } else {
            ensureOidcUrlsIsMutable();
            oidcUrls_.addAll(other.oidcUrls_);
          }
          onChanged();
        }
      } else {
        if (!other.oidcUrls_.isEmpty()) {
          if (oidcUrlsBuilder_.isEmpty()) {
            oidcUrlsBuilder_.dispose();
            oidcUrlsBuilder_ = null;
            oidcUrls_ = other.oidcUrls_;
            bitField0_ = (bitField0_ & ~0x00000004);
            oidcUrlsBuilder_ = 
              com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders ?
                 internalGetOidcUrlsFieldBuilder() : null;
          } else {
            oidcUrlsBuilder_.addAllMessages(other.oidcUrls_);
          }
        }
      }
      if (rekorTlogUrlsBuilder_ == null) {
        if (!other.rekorTlogUrls_.isEmpty()) {
          if (rekorTlogUrls_.isEmpty()) {
            rekorTlogUrls_ = other.rekorTlogUrls_;
            bitField0_ = (bitField0_ & ~0x00000008);
          } else {
            ensureRekorTlogUrlsIsMutable();
            rekorTlogUrls_.addAll(other.rekorTlogUrls_);
          }
          onChanged();
        }
      } else {
        if (!other.rekorTlogUrls_.isEmpty()) {
          if (rekorTlogUrlsBuilder_.isEmpty()) {
            rekorTlogUrlsBuilder_.dispose();
            rekorTlogUrlsBuilder_ = null;
            rekorTlogUrls_ = other.rekorTlogUrls_;
            bitField0_ = (bitField0_ & ~0x00000008);
            rekorTlogUrlsBuilder_ = 
              com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders ?
                 internalGetRekorTlogUrlsFieldBuilder() : null;
          } else {
            rekorTlogUrlsBuilder_.addAllMessages(other.rekorTlogUrls_);
          }
        }
      }
      if (other.hasRekorTlogConfig()) {
        mergeRekorTlogConfig(other.getRekorTlogConfig());
      }
      if (tsaUrlsBuilder_ == null) {
        if (!other.tsaUrls_.isEmpty()) {
          if (tsaUrls_.isEmpty()) {
            tsaUrls_ = other.tsaUrls_;
            bitField0_ = (bitField0_ & ~0x00000020);
          } else {
            ensureTsaUrlsIsMutable();
            tsaUrls_.addAll(other.tsaUrls_);
          }
          onChanged();
        }
      } else {
        if (!other.tsaUrls_.isEmpty()) {
          if (tsaUrlsBuilder_.isEmpty()) {
            tsaUrlsBuilder_.dispose();
            tsaUrlsBuilder_ = null;
            tsaUrls_ = other.tsaUrls_;
            bitField0_ = (bitField0_ & ~0x00000020);
            tsaUrlsBuilder_ = 
              com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders ?
                 internalGetTsaUrlsFieldBuilder() : null;
          } else {
            tsaUrlsBuilder_.addAllMessages(other.tsaUrls_);
          }
        }
      }
      if (other.hasTsaConfig()) {
        mergeTsaConfig(other.getTsaConfig());
      }
      this.mergeUnknownFields(other.getUnknownFields());
      onChanged();
      return this;
    }

    @java.lang.Override
    public final boolean isInitialized() {
      return true;
    }

    @java.lang.Override
    public Builder mergeFrom(
        com.google.protobuf.CodedInputStream input,
        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
        throws java.io.IOException {
      if (extensionRegistry == null) {
        throw new java.lang.NullPointerException();
      }
      try {
        boolean done = false;
        while (!done) {
          int tag = input.readTag();
          switch (tag) {
            case 0:
              done = true;
              break;
            case 42: {
              mediaType_ = input.readStringRequireUtf8();
              bitField0_ |= 0x00000001;
              break;
            } // case 42
            case 50: {
              dev.sigstore.proto.trustroot.v1.Service m =
                  input.readMessage(
                      dev.sigstore.proto.trustroot.v1.Service.parser(),
                      extensionRegistry);
              if (caUrlsBuilder_ == null) {
                ensureCaUrlsIsMutable();
                caUrls_.add(m);
              } else {
                caUrlsBuilder_.addMessage(m);
              }
              break;
            } // case 50
            case 58: {
              dev.sigstore.proto.trustroot.v1.Service m =
                  input.readMessage(
                      dev.sigstore.proto.trustroot.v1.Service.parser(),
                      extensionRegistry);
              if (oidcUrlsBuilder_ == null) {
                ensureOidcUrlsIsMutable();
                oidcUrls_.add(m);
              } else {
                oidcUrlsBuilder_.addMessage(m);
              }
              break;
            } // case 58
            case 66: {
              dev.sigstore.proto.trustroot.v1.Service m =
                  input.readMessage(
                      dev.sigstore.proto.trustroot.v1.Service.parser(),
                      extensionRegistry);
              if (rekorTlogUrlsBuilder_ == null) {
                ensureRekorTlogUrlsIsMutable();
                rekorTlogUrls_.add(m);
              } else {
                rekorTlogUrlsBuilder_.addMessage(m);
              }
              break;
            } // case 66
            case 74: {
              input.readMessage(
                  internalGetRekorTlogConfigFieldBuilder().getBuilder(),
                  extensionRegistry);
              bitField0_ |= 0x00000010;
              break;
            } // case 74
            case 82: {
              dev.sigstore.proto.trustroot.v1.Service m =
                  input.readMessage(
                      dev.sigstore.proto.trustroot.v1.Service.parser(),
                      extensionRegistry);
              if (tsaUrlsBuilder_ == null) {
                ensureTsaUrlsIsMutable();
                tsaUrls_.add(m);
              } else {
                tsaUrlsBuilder_.addMessage(m);
              }
              break;
            } // case 82
            case 90: {
              input.readMessage(
                  internalGetTsaConfigFieldBuilder().getBuilder(),
                  extensionRegistry);
              bitField0_ |= 0x00000040;
              break;
            } // case 90
            default: {
              if (!super.parseUnknownField(input, extensionRegistry, tag)) {
                done = true; // was an endgroup tag
              }
              break;
            } // default:
          } // switch (tag)
        } // while (!done)
      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
        throw e.unwrapIOException();
      } finally {
        onChanged();
      } // finally
      return this;
    }
    private int bitField0_;

    private java.lang.Object mediaType_ = "";
    /**
     * <pre>
     * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
     * Clients MAY choose to also support
     * application/vnd.dev.sigstore.signingconfig.v0.1+json
     * </pre>
     *
     * <code>string media_type = 5;</code>
     * @return The mediaType.
     */
    public java.lang.String getMediaType() {
      java.lang.Object ref = mediaType_;
      if (!(ref instanceof java.lang.String)) {
        com.google.protobuf.ByteString bs =
            (com.google.protobuf.ByteString) ref;
        java.lang.String s = bs.toStringUtf8();
        mediaType_ = s;
        return s;
      } else {
        return (java.lang.String) ref;
      }
    }
    /**
     * <pre>
     * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
     * Clients MAY choose to also support
     * application/vnd.dev.sigstore.signingconfig.v0.1+json
     * </pre>
     *
     * <code>string media_type = 5;</code>
     * @return The bytes for mediaType.
     */
    public com.google.protobuf.ByteString
        getMediaTypeBytes() {
      java.lang.Object ref = mediaType_;
      if (ref instanceof String) {
        com.google.protobuf.ByteString b = 
            com.google.protobuf.ByteString.copyFromUtf8(
                (java.lang.String) ref);
        mediaType_ = b;
        return b;
      } else {
        return (com.google.protobuf.ByteString) ref;
      }
    }
    /**
     * <pre>
     * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
     * Clients MAY choose to also support
     * application/vnd.dev.sigstore.signingconfig.v0.1+json
     * </pre>
     *
     * <code>string media_type = 5;</code>
     * @param value The mediaType to set.
     * @return This builder for chaining.
     */
    public Builder setMediaType(
        java.lang.String value) {
      if (value == null) { throw new NullPointerException(); }
      mediaType_ = value;
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }
    /**
     * <pre>
     * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
     * Clients MAY choose to also support
     * application/vnd.dev.sigstore.signingconfig.v0.1+json
     * </pre>
     *
     * <code>string media_type = 5;</code>
     * @return This builder for chaining.
     */
    public Builder clearMediaType() {
      mediaType_ = getDefaultInstance().getMediaType();
      bitField0_ = (bitField0_ & ~0x00000001);
      onChanged();
      return this;
    }
    /**
     * <pre>
     * MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
     * Clients MAY choose to also support
     * application/vnd.dev.sigstore.signingconfig.v0.1+json
     * </pre>
     *
     * <code>string media_type = 5;</code>
     * @param value The bytes for mediaType to set.
     * @return This builder for chaining.
     */
    public Builder setMediaTypeBytes(
        com.google.protobuf.ByteString value) {
      if (value == null) { throw new NullPointerException(); }
      checkByteStringIsUtf8(value);
      mediaType_ = value;
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }

    private java.util.List<dev.sigstore.proto.trustroot.v1.Service> caUrls_ =
      java.util.Collections.emptyList();
    private void ensureCaUrlsIsMutable() {
      if (!((bitField0_ & 0x00000002) != 0)) {
        caUrls_ = new java.util.ArrayList<dev.sigstore.proto.trustroot.v1.Service>(caUrls_);
        bitField0_ |= 0x00000002;
       }
    }

    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> caUrlsBuilder_;

    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getCaUrlsList() {
      if (caUrlsBuilder_ == null) {
        return java.util.Collections.unmodifiableList(caUrls_);
      } else {
        return caUrlsBuilder_.getMessageList();
      }
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public int getCaUrlsCount() {
      if (caUrlsBuilder_ == null) {
        return caUrls_.size();
      } else {
        return caUrlsBuilder_.getCount();
      }
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service getCaUrls(int index) {
      if (caUrlsBuilder_ == null) {
        return caUrls_.get(index);
      } else {
        return caUrlsBuilder_.getMessage(index);
      }
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder setCaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (caUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureCaUrlsIsMutable();
        caUrls_.set(index, value);
        onChanged();
      } else {
        caUrlsBuilder_.setMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder setCaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (caUrlsBuilder_ == null) {
        ensureCaUrlsIsMutable();
        caUrls_.set(index, builderForValue.build());
        onChanged();
      } else {
        caUrlsBuilder_.setMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder addCaUrls(dev.sigstore.proto.trustroot.v1.Service value) {
      if (caUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureCaUrlsIsMutable();
        caUrls_.add(value);
        onChanged();
      } else {
        caUrlsBuilder_.addMessage(value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder addCaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (caUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureCaUrlsIsMutable();
        caUrls_.add(index, value);
        onChanged();
      } else {
        caUrlsBuilder_.addMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder addCaUrls(
        dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (caUrlsBuilder_ == null) {
        ensureCaUrlsIsMutable();
        caUrls_.add(builderForValue.build());
        onChanged();
      } else {
        caUrlsBuilder_.addMessage(builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder addCaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (caUrlsBuilder_ == null) {
        ensureCaUrlsIsMutable();
        caUrls_.add(index, builderForValue.build());
        onChanged();
      } else {
        caUrlsBuilder_.addMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder addAllCaUrls(
        java.lang.Iterable<? extends dev.sigstore.proto.trustroot.v1.Service> values) {
      if (caUrlsBuilder_ == null) {
        ensureCaUrlsIsMutable();
        com.google.protobuf.AbstractMessageLite.Builder.addAll(
            values, caUrls_);
        onChanged();
      } else {
        caUrlsBuilder_.addAllMessages(values);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder clearCaUrls() {
      if (caUrlsBuilder_ == null) {
        caUrls_ = java.util.Collections.emptyList();
        bitField0_ = (bitField0_ & ~0x00000002);
        onChanged();
      } else {
        caUrlsBuilder_.clear();
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public Builder removeCaUrls(int index) {
      if (caUrlsBuilder_ == null) {
        ensureCaUrlsIsMutable();
        caUrls_.remove(index);
        onChanged();
      } else {
        caUrlsBuilder_.remove(index);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder getCaUrlsBuilder(
        int index) {
      return internalGetCaUrlsFieldBuilder().getBuilder(index);
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getCaUrlsOrBuilder(
        int index) {
      if (caUrlsBuilder_ == null) {
        return caUrls_.get(index);  } else {
        return caUrlsBuilder_.getMessageOrBuilder(index);
      }
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
         getCaUrlsOrBuilderList() {
      if (caUrlsBuilder_ != null) {
        return caUrlsBuilder_.getMessageOrBuilderList();
      } else {
        return java.util.Collections.unmodifiableList(caUrls_);
      }
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addCaUrlsBuilder() {
      return internalGetCaUrlsFieldBuilder().addBuilder(
          dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addCaUrlsBuilder(
        int index) {
      return internalGetCaUrlsFieldBuilder().addBuilder(
          index, dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to Fulcio-compatible CAs, capable of receiving
     * Certificate Signing Requests (CSRs) and responding with
     * issued certificates.
     *
     * These URLs MUST be the "base" URL for the CAs, which clients
     * should construct an appropriate CSR endpoint on top of.
     * For example, if a CA URL is `https://example.com/ca`, then
     * the client MAY construct the CSR endpoint as
     * `https://example.com/ca/api/v2/signingCert`.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service ca_urls = 6;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service.Builder> 
         getCaUrlsBuilderList() {
      return internalGetCaUrlsFieldBuilder().getBuilderList();
    }
    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
        internalGetCaUrlsFieldBuilder() {
      if (caUrlsBuilder_ == null) {
        caUrlsBuilder_ = new com.google.protobuf.RepeatedFieldBuilder<
            dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder>(
                caUrls_,
                ((bitField0_ & 0x00000002) != 0),
                getParentForChildren(),
                isClean());
        caUrls_ = null;
      }
      return caUrlsBuilder_;
    }

    private java.util.List<dev.sigstore.proto.trustroot.v1.Service> oidcUrls_ =
      java.util.Collections.emptyList();
    private void ensureOidcUrlsIsMutable() {
      if (!((bitField0_ & 0x00000004) != 0)) {
        oidcUrls_ = new java.util.ArrayList<dev.sigstore.proto.trustroot.v1.Service>(oidcUrls_);
        bitField0_ |= 0x00000004;
       }
    }

    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> oidcUrlsBuilder_;

    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getOidcUrlsList() {
      if (oidcUrlsBuilder_ == null) {
        return java.util.Collections.unmodifiableList(oidcUrls_);
      } else {
        return oidcUrlsBuilder_.getMessageList();
      }
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public int getOidcUrlsCount() {
      if (oidcUrlsBuilder_ == null) {
        return oidcUrls_.size();
      } else {
        return oidcUrlsBuilder_.getCount();
      }
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service getOidcUrls(int index) {
      if (oidcUrlsBuilder_ == null) {
        return oidcUrls_.get(index);
      } else {
        return oidcUrlsBuilder_.getMessage(index);
      }
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder setOidcUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (oidcUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureOidcUrlsIsMutable();
        oidcUrls_.set(index, value);
        onChanged();
      } else {
        oidcUrlsBuilder_.setMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder setOidcUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (oidcUrlsBuilder_ == null) {
        ensureOidcUrlsIsMutable();
        oidcUrls_.set(index, builderForValue.build());
        onChanged();
      } else {
        oidcUrlsBuilder_.setMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder addOidcUrls(dev.sigstore.proto.trustroot.v1.Service value) {
      if (oidcUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureOidcUrlsIsMutable();
        oidcUrls_.add(value);
        onChanged();
      } else {
        oidcUrlsBuilder_.addMessage(value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder addOidcUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (oidcUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureOidcUrlsIsMutable();
        oidcUrls_.add(index, value);
        onChanged();
      } else {
        oidcUrlsBuilder_.addMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder addOidcUrls(
        dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (oidcUrlsBuilder_ == null) {
        ensureOidcUrlsIsMutable();
        oidcUrls_.add(builderForValue.build());
        onChanged();
      } else {
        oidcUrlsBuilder_.addMessage(builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder addOidcUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (oidcUrlsBuilder_ == null) {
        ensureOidcUrlsIsMutable();
        oidcUrls_.add(index, builderForValue.build());
        onChanged();
      } else {
        oidcUrlsBuilder_.addMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder addAllOidcUrls(
        java.lang.Iterable<? extends dev.sigstore.proto.trustroot.v1.Service> values) {
      if (oidcUrlsBuilder_ == null) {
        ensureOidcUrlsIsMutable();
        com.google.protobuf.AbstractMessageLite.Builder.addAll(
            values, oidcUrls_);
        onChanged();
      } else {
        oidcUrlsBuilder_.addAllMessages(values);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder clearOidcUrls() {
      if (oidcUrlsBuilder_ == null) {
        oidcUrls_ = java.util.Collections.emptyList();
        bitField0_ = (bitField0_ & ~0x00000004);
        onChanged();
      } else {
        oidcUrlsBuilder_.clear();
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public Builder removeOidcUrls(int index) {
      if (oidcUrlsBuilder_ == null) {
        ensureOidcUrlsIsMutable();
        oidcUrls_.remove(index);
        onChanged();
      } else {
        oidcUrlsBuilder_.remove(index);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder getOidcUrlsBuilder(
        int index) {
      return internalGetOidcUrlsFieldBuilder().getBuilder(index);
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getOidcUrlsOrBuilder(
        int index) {
      if (oidcUrlsBuilder_ == null) {
        return oidcUrls_.get(index);  } else {
        return oidcUrlsBuilder_.getMessageOrBuilder(index);
      }
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
         getOidcUrlsOrBuilderList() {
      if (oidcUrlsBuilder_ != null) {
        return oidcUrlsBuilder_.getMessageOrBuilderList();
      } else {
        return java.util.Collections.unmodifiableList(oidcUrls_);
      }
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addOidcUrlsBuilder() {
      return internalGetOidcUrlsFieldBuilder().addBuilder(
          dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addOidcUrlsBuilder(
        int index) {
      return internalGetOidcUrlsFieldBuilder().addBuilder(
          index, dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to OpenID Connect identity providers.
     *
     * These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
     * should perform well-known OpenID Connect discovery against.
     *
     * Clients MUST select only one Service with the highest API version
     * that the client is compatible with, that is within its
     * validity period, and has the newest validity start date.
     * Client SHOULD select the first Service that meets this requirement.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service oidc_urls = 7;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service.Builder> 
         getOidcUrlsBuilderList() {
      return internalGetOidcUrlsFieldBuilder().getBuilderList();
    }
    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
        internalGetOidcUrlsFieldBuilder() {
      if (oidcUrlsBuilder_ == null) {
        oidcUrlsBuilder_ = new com.google.protobuf.RepeatedFieldBuilder<
            dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder>(
                oidcUrls_,
                ((bitField0_ & 0x00000004) != 0),
                getParentForChildren(),
                isClean());
        oidcUrls_ = null;
      }
      return oidcUrlsBuilder_;
    }

    private java.util.List<dev.sigstore.proto.trustroot.v1.Service> rekorTlogUrls_ =
      java.util.Collections.emptyList();
    private void ensureRekorTlogUrlsIsMutable() {
      if (!((bitField0_ & 0x00000008) != 0)) {
        rekorTlogUrls_ = new java.util.ArrayList<dev.sigstore.proto.trustroot.v1.Service>(rekorTlogUrls_);
        bitField0_ |= 0x00000008;
       }
    }

    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> rekorTlogUrlsBuilder_;

    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getRekorTlogUrlsList() {
      if (rekorTlogUrlsBuilder_ == null) {
        return java.util.Collections.unmodifiableList(rekorTlogUrls_);
      } else {
        return rekorTlogUrlsBuilder_.getMessageList();
      }
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public int getRekorTlogUrlsCount() {
      if (rekorTlogUrlsBuilder_ == null) {
        return rekorTlogUrls_.size();
      } else {
        return rekorTlogUrlsBuilder_.getCount();
      }
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service getRekorTlogUrls(int index) {
      if (rekorTlogUrlsBuilder_ == null) {
        return rekorTlogUrls_.get(index);
      } else {
        return rekorTlogUrlsBuilder_.getMessage(index);
      }
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder setRekorTlogUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (rekorTlogUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.set(index, value);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.setMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder setRekorTlogUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (rekorTlogUrlsBuilder_ == null) {
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.set(index, builderForValue.build());
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.setMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder addRekorTlogUrls(dev.sigstore.proto.trustroot.v1.Service value) {
      if (rekorTlogUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.add(value);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.addMessage(value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder addRekorTlogUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (rekorTlogUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.add(index, value);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.addMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder addRekorTlogUrls(
        dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (rekorTlogUrlsBuilder_ == null) {
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.add(builderForValue.build());
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.addMessage(builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder addRekorTlogUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (rekorTlogUrlsBuilder_ == null) {
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.add(index, builderForValue.build());
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.addMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder addAllRekorTlogUrls(
        java.lang.Iterable<? extends dev.sigstore.proto.trustroot.v1.Service> values) {
      if (rekorTlogUrlsBuilder_ == null) {
        ensureRekorTlogUrlsIsMutable();
        com.google.protobuf.AbstractMessageLite.Builder.addAll(
            values, rekorTlogUrls_);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.addAllMessages(values);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder clearRekorTlogUrls() {
      if (rekorTlogUrlsBuilder_ == null) {
        rekorTlogUrls_ = java.util.Collections.emptyList();
        bitField0_ = (bitField0_ & ~0x00000008);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.clear();
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public Builder removeRekorTlogUrls(int index) {
      if (rekorTlogUrlsBuilder_ == null) {
        ensureRekorTlogUrlsIsMutable();
        rekorTlogUrls_.remove(index);
        onChanged();
      } else {
        rekorTlogUrlsBuilder_.remove(index);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder getRekorTlogUrlsBuilder(
        int index) {
      return internalGetRekorTlogUrlsFieldBuilder().getBuilder(index);
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getRekorTlogUrlsOrBuilder(
        int index) {
      if (rekorTlogUrlsBuilder_ == null) {
        return rekorTlogUrls_.get(index);  } else {
        return rekorTlogUrlsBuilder_.getMessageOrBuilder(index);
      }
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
         getRekorTlogUrlsOrBuilderList() {
      if (rekorTlogUrlsBuilder_ != null) {
        return rekorTlogUrlsBuilder_.getMessageOrBuilderList();
      } else {
        return java.util.Collections.unmodifiableList(rekorTlogUrls_);
      }
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addRekorTlogUrlsBuilder() {
      return internalGetRekorTlogUrlsFieldBuilder().addBuilder(
          dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addRekorTlogUrlsBuilder(
        int index) {
      return internalGetRekorTlogUrlsFieldBuilder().addBuilder(
          index, dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to Rekor transparency logs.
     *
     * These URL MUST be the "base" URLs for the transparency logs,
     * which clients should construct appropriate API endpoints on top of.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `rekor_tlog_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service rekor_tlog_urls = 8;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service.Builder> 
         getRekorTlogUrlsBuilderList() {
      return internalGetRekorTlogUrlsFieldBuilder().getBuilderList();
    }
    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
        internalGetRekorTlogUrlsFieldBuilder() {
      if (rekorTlogUrlsBuilder_ == null) {
        rekorTlogUrlsBuilder_ = new com.google.protobuf.RepeatedFieldBuilder<
            dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder>(
                rekorTlogUrls_,
                ((bitField0_ & 0x00000008) != 0),
                getParentForChildren(),
                isClean());
        rekorTlogUrls_ = null;
      }
      return rekorTlogUrlsBuilder_;
    }

    private dev.sigstore.proto.trustroot.v1.ServiceConfiguration rekorTlogConfig_;
    private com.google.protobuf.SingleFieldBuilder<
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder> rekorTlogConfigBuilder_;
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     * @return Whether the rekorTlogConfig field is set.
     */
    public boolean hasRekorTlogConfig() {
      return ((bitField0_ & 0x00000010) != 0);
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     * @return The rekorTlogConfig.
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfiguration getRekorTlogConfig() {
      if (rekorTlogConfigBuilder_ == null) {
        return rekorTlogConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : rekorTlogConfig_;
      } else {
        return rekorTlogConfigBuilder_.getMessage();
      }
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public Builder setRekorTlogConfig(dev.sigstore.proto.trustroot.v1.ServiceConfiguration value) {
      if (rekorTlogConfigBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        rekorTlogConfig_ = value;
      } else {
        rekorTlogConfigBuilder_.setMessage(value);
      }
      bitField0_ |= 0x00000010;
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public Builder setRekorTlogConfig(
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder builderForValue) {
      if (rekorTlogConfigBuilder_ == null) {
        rekorTlogConfig_ = builderForValue.build();
      } else {
        rekorTlogConfigBuilder_.setMessage(builderForValue.build());
      }
      bitField0_ |= 0x00000010;
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public Builder mergeRekorTlogConfig(dev.sigstore.proto.trustroot.v1.ServiceConfiguration value) {
      if (rekorTlogConfigBuilder_ == null) {
        if (((bitField0_ & 0x00000010) != 0) &&
          rekorTlogConfig_ != null &&
          rekorTlogConfig_ != dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance()) {
          getRekorTlogConfigBuilder().mergeFrom(value);
        } else {
          rekorTlogConfig_ = value;
        }
      } else {
        rekorTlogConfigBuilder_.mergeFrom(value);
      }
      if (rekorTlogConfig_ != null) {
        bitField0_ |= 0x00000010;
        onChanged();
      }
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public Builder clearRekorTlogConfig() {
      bitField0_ = (bitField0_ & ~0x00000010);
      rekorTlogConfig_ = null;
      if (rekorTlogConfigBuilder_ != null) {
        rekorTlogConfigBuilder_.dispose();
        rekorTlogConfigBuilder_ = null;
      }
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder getRekorTlogConfigBuilder() {
      bitField0_ |= 0x00000010;
      onChanged();
      return internalGetRekorTlogConfigFieldBuilder().getBuilder();
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder getRekorTlogConfigOrBuilder() {
      if (rekorTlogConfigBuilder_ != null) {
        return rekorTlogConfigBuilder_.getMessageOrBuilder();
      } else {
        return rekorTlogConfig_ == null ?
            dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : rekorTlogConfig_;
      }
    }
    /**
     * <pre>
     * Specifies how a client should select the set of Rekor transparency
     * logs to write to.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration rekor_tlog_config = 9;</code>
     */
    private com.google.protobuf.SingleFieldBuilder<
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder> 
        internalGetRekorTlogConfigFieldBuilder() {
      if (rekorTlogConfigBuilder_ == null) {
        rekorTlogConfigBuilder_ = new com.google.protobuf.SingleFieldBuilder<
            dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder>(
                getRekorTlogConfig(),
                getParentForChildren(),
                isClean());
        rekorTlogConfig_ = null;
      }
      return rekorTlogConfigBuilder_;
    }

    private java.util.List<dev.sigstore.proto.trustroot.v1.Service> tsaUrls_ =
      java.util.Collections.emptyList();
    private void ensureTsaUrlsIsMutable() {
      if (!((bitField0_ & 0x00000020) != 0)) {
        tsaUrls_ = new java.util.ArrayList<dev.sigstore.proto.trustroot.v1.Service>(tsaUrls_);
        bitField0_ |= 0x00000020;
       }
    }

    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> tsaUrlsBuilder_;

    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service> getTsaUrlsList() {
      if (tsaUrlsBuilder_ == null) {
        return java.util.Collections.unmodifiableList(tsaUrls_);
      } else {
        return tsaUrlsBuilder_.getMessageList();
      }
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public int getTsaUrlsCount() {
      if (tsaUrlsBuilder_ == null) {
        return tsaUrls_.size();
      } else {
        return tsaUrlsBuilder_.getCount();
      }
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service getTsaUrls(int index) {
      if (tsaUrlsBuilder_ == null) {
        return tsaUrls_.get(index);
      } else {
        return tsaUrlsBuilder_.getMessage(index);
      }
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder setTsaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (tsaUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureTsaUrlsIsMutable();
        tsaUrls_.set(index, value);
        onChanged();
      } else {
        tsaUrlsBuilder_.setMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder setTsaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (tsaUrlsBuilder_ == null) {
        ensureTsaUrlsIsMutable();
        tsaUrls_.set(index, builderForValue.build());
        onChanged();
      } else {
        tsaUrlsBuilder_.setMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder addTsaUrls(dev.sigstore.proto.trustroot.v1.Service value) {
      if (tsaUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureTsaUrlsIsMutable();
        tsaUrls_.add(value);
        onChanged();
      } else {
        tsaUrlsBuilder_.addMessage(value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder addTsaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service value) {
      if (tsaUrlsBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        ensureTsaUrlsIsMutable();
        tsaUrls_.add(index, value);
        onChanged();
      } else {
        tsaUrlsBuilder_.addMessage(index, value);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder addTsaUrls(
        dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (tsaUrlsBuilder_ == null) {
        ensureTsaUrlsIsMutable();
        tsaUrls_.add(builderForValue.build());
        onChanged();
      } else {
        tsaUrlsBuilder_.addMessage(builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder addTsaUrls(
        int index, dev.sigstore.proto.trustroot.v1.Service.Builder builderForValue) {
      if (tsaUrlsBuilder_ == null) {
        ensureTsaUrlsIsMutable();
        tsaUrls_.add(index, builderForValue.build());
        onChanged();
      } else {
        tsaUrlsBuilder_.addMessage(index, builderForValue.build());
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder addAllTsaUrls(
        java.lang.Iterable<? extends dev.sigstore.proto.trustroot.v1.Service> values) {
      if (tsaUrlsBuilder_ == null) {
        ensureTsaUrlsIsMutable();
        com.google.protobuf.AbstractMessageLite.Builder.addAll(
            values, tsaUrls_);
        onChanged();
      } else {
        tsaUrlsBuilder_.addAllMessages(values);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder clearTsaUrls() {
      if (tsaUrlsBuilder_ == null) {
        tsaUrls_ = java.util.Collections.emptyList();
        bitField0_ = (bitField0_ & ~0x00000020);
        onChanged();
      } else {
        tsaUrlsBuilder_.clear();
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public Builder removeTsaUrls(int index) {
      if (tsaUrlsBuilder_ == null) {
        ensureTsaUrlsIsMutable();
        tsaUrls_.remove(index);
        onChanged();
      } else {
        tsaUrlsBuilder_.remove(index);
      }
      return this;
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder getTsaUrlsBuilder(
        int index) {
      return internalGetTsaUrlsFieldBuilder().getBuilder(index);
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceOrBuilder getTsaUrlsOrBuilder(
        int index) {
      if (tsaUrlsBuilder_ == null) {
        return tsaUrls_.get(index);  } else {
        return tsaUrlsBuilder_.getMessageOrBuilder(index);
      }
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public java.util.List<? extends dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
         getTsaUrlsOrBuilderList() {
      if (tsaUrlsBuilder_ != null) {
        return tsaUrlsBuilder_.getMessageOrBuilderList();
      } else {
        return java.util.Collections.unmodifiableList(tsaUrls_);
      }
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addTsaUrlsBuilder() {
      return internalGetTsaUrlsFieldBuilder().addBuilder(
          dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public dev.sigstore.proto.trustroot.v1.Service.Builder addTsaUrlsBuilder(
        int index) {
      return internalGetTsaUrlsFieldBuilder().addBuilder(
          index, dev.sigstore.proto.trustroot.v1.Service.getDefaultInstance());
    }
    /**
     * <pre>
     * URLs to RFC 3161 Time Stamping Authorities (TSA).
     *
     * These URLs MUST be the *full* URL for the TSA, meaning that it
     * should be suitable for submitting Time Stamp Requests (TSRs) to
     * via HTTP, per RFC 3161.
     *
     * Clients MUST group Services by `operator` and select at most one
     * Service from each operator. Clients MUST select Services with the
     * highest API version that the client is compatible with, that are
     * within its validity period, and have the newest validity start dates.
     * All listed Services SHOULD be sorted by the `valid_for` window in
     * descending order, with the newest instance first.
     *
     * Clients MUST select Services based on the selector value of
     * `tsa_config`.
     * </pre>
     *
     * <code>repeated .dev.sigstore.trustroot.v1.Service tsa_urls = 10;</code>
     */
    public java.util.List<dev.sigstore.proto.trustroot.v1.Service.Builder> 
         getTsaUrlsBuilderList() {
      return internalGetTsaUrlsFieldBuilder().getBuilderList();
    }
    private com.google.protobuf.RepeatedFieldBuilder<
        dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder> 
        internalGetTsaUrlsFieldBuilder() {
      if (tsaUrlsBuilder_ == null) {
        tsaUrlsBuilder_ = new com.google.protobuf.RepeatedFieldBuilder<
            dev.sigstore.proto.trustroot.v1.Service, dev.sigstore.proto.trustroot.v1.Service.Builder, dev.sigstore.proto.trustroot.v1.ServiceOrBuilder>(
                tsaUrls_,
                ((bitField0_ & 0x00000020) != 0),
                getParentForChildren(),
                isClean());
        tsaUrls_ = null;
      }
      return tsaUrlsBuilder_;
    }

    private dev.sigstore.proto.trustroot.v1.ServiceConfiguration tsaConfig_;
    private com.google.protobuf.SingleFieldBuilder<
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder> tsaConfigBuilder_;
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     * @return Whether the tsaConfig field is set.
     */
    public boolean hasTsaConfig() {
      return ((bitField0_ & 0x00000040) != 0);
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     * @return The tsaConfig.
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfiguration getTsaConfig() {
      if (tsaConfigBuilder_ == null) {
        return tsaConfig_ == null ? dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : tsaConfig_;
      } else {
        return tsaConfigBuilder_.getMessage();
      }
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public Builder setTsaConfig(dev.sigstore.proto.trustroot.v1.ServiceConfiguration value) {
      if (tsaConfigBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        tsaConfig_ = value;
      } else {
        tsaConfigBuilder_.setMessage(value);
      }
      bitField0_ |= 0x00000040;
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public Builder setTsaConfig(
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder builderForValue) {
      if (tsaConfigBuilder_ == null) {
        tsaConfig_ = builderForValue.build();
      } else {
        tsaConfigBuilder_.setMessage(builderForValue.build());
      }
      bitField0_ |= 0x00000040;
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public Builder mergeTsaConfig(dev.sigstore.proto.trustroot.v1.ServiceConfiguration value) {
      if (tsaConfigBuilder_ == null) {
        if (((bitField0_ & 0x00000040) != 0) &&
          tsaConfig_ != null &&
          tsaConfig_ != dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance()) {
          getTsaConfigBuilder().mergeFrom(value);
        } else {
          tsaConfig_ = value;
        }
      } else {
        tsaConfigBuilder_.mergeFrom(value);
      }
      if (tsaConfig_ != null) {
        bitField0_ |= 0x00000040;
        onChanged();
      }
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public Builder clearTsaConfig() {
      bitField0_ = (bitField0_ & ~0x00000040);
      tsaConfig_ = null;
      if (tsaConfigBuilder_ != null) {
        tsaConfigBuilder_.dispose();
        tsaConfigBuilder_ = null;
      }
      onChanged();
      return this;
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder getTsaConfigBuilder() {
      bitField0_ |= 0x00000040;
      onChanged();
      return internalGetTsaConfigFieldBuilder().getBuilder();
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    public dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder getTsaConfigOrBuilder() {
      if (tsaConfigBuilder_ != null) {
        return tsaConfigBuilder_.getMessageOrBuilder();
      } else {
        return tsaConfig_ == null ?
            dev.sigstore.proto.trustroot.v1.ServiceConfiguration.getDefaultInstance() : tsaConfig_;
      }
    }
    /**
     * <pre>
     * Specifies how a client should select the set of TSAs to request
     * signed timestamps from.
     * </pre>
     *
     * <code>.dev.sigstore.trustroot.v1.ServiceConfiguration tsa_config = 11;</code>
     */
    private com.google.protobuf.SingleFieldBuilder<
        dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder> 
        internalGetTsaConfigFieldBuilder() {
      if (tsaConfigBuilder_ == null) {
        tsaConfigBuilder_ = new com.google.protobuf.SingleFieldBuilder<
            dev.sigstore.proto.trustroot.v1.ServiceConfiguration, dev.sigstore.proto.trustroot.v1.ServiceConfiguration.Builder, dev.sigstore.proto.trustroot.v1.ServiceConfigurationOrBuilder>(
                getTsaConfig(),
                getParentForChildren(),
                isClean());
        tsaConfig_ = null;
      }
      return tsaConfigBuilder_;
    }

    // @@protoc_insertion_point(builder_scope:dev.sigstore.trustroot.v1.SigningConfig)
  }

  // @@protoc_insertion_point(class_scope:dev.sigstore.trustroot.v1.SigningConfig)
  private static final dev.sigstore.proto.trustroot.v1.SigningConfig DEFAULT_INSTANCE;
  static {
    DEFAULT_INSTANCE = new dev.sigstore.proto.trustroot.v1.SigningConfig();
  }

  public static dev.sigstore.proto.trustroot.v1.SigningConfig getDefaultInstance() {
    return DEFAULT_INSTANCE;
  }

  private static final com.google.protobuf.Parser<SigningConfig>
      PARSER = new com.google.protobuf.AbstractParser<SigningConfig>() {
    @java.lang.Override
    public SigningConfig parsePartialFrom(
        com.google.protobuf.CodedInputStream input,
        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
        throws com.google.protobuf.InvalidProtocolBufferException {
      Builder builder = newBuilder();
      try {
        builder.mergeFrom(input, extensionRegistry);
      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
        throw e.setUnfinishedMessage(builder.buildPartial());
      } catch (com.google.protobuf.UninitializedMessageException e) {
        throw e.asInvalidProtocolBufferException().setUnfinishedMessage(builder.buildPartial());
      } catch (java.io.IOException e) {
        throw new com.google.protobuf.InvalidProtocolBufferException(e)
            .setUnfinishedMessage(builder.buildPartial());
      }
      return builder.buildPartial();
    }
  };

  public static com.google.protobuf.Parser<SigningConfig> parser() {
    return PARSER;
  }

  @java.lang.Override
  public com.google.protobuf.Parser<SigningConfig> getParserForType() {
    return PARSER;
  }

  @java.lang.Override
  public dev.sigstore.proto.trustroot.v1.SigningConfig getDefaultInstanceForType() {
    return DEFAULT_INSTANCE;
  }

}