### Question:
X509SvidValidator { public static void verifyChain( @NonNull final List<X509Certificate> chain, @NonNull final BundleSource<X509Bundle> x509BundleSource) throws CertificateException, BundleNotFoundException { val trustDomain = CertificateUtils.getTrustDomain(chain); val x509Bundle = x509BundleSource.getBundleForTrustDomain(trustDomain); try { CertificateUtils.validate(chain, x509Bundle.getX509Authorities()); } catch (CertPathValidatorException e) { throw new CertificateException("Cert chain cannot be verified", e); } } private  X509SvidValidator(); static void verifyChain(
            @NonNull final List<X509Certificate> chain,
            @NonNull final BundleSource<X509Bundle> x509BundleSource); static void verifySpiffeId(@NonNull final X509Certificate x509Certificate,
                                      @NonNull final Supplier<Set<SpiffeId>> acceptedSpiffeIdsSupplier);  }### Answer:
@Test void testVerifyChain_chainCanBeVerifiedWithAuthorityInBundle() throws Exception { HashSet<X509Certificate> x509Authorities = new HashSet<>(); x509Authorities.add(rootCa.getCertificate()); x509Authorities.add(otherRootCa.getCertificate()); val x509Bundle = new X509Bundle(TrustDomain.of("example.org"), x509Authorities); X509SvidValidator.verifyChain(chain, x509Bundle); }
@Test void testVerifyChain_chainCannotBeVerifiedWithAuthorityInBundle_throwsCertificateException() throws Exception { HashSet<X509Certificate> x509Authorities = new HashSet<>(); x509Authorities.add(otherRootCa.getCertificate()); val x509Bundle = new X509Bundle(TrustDomain.of("example.org"), x509Authorities); try { X509SvidValidator.verifyChain(chain, x509Bundle); fail("exception is expected"); } catch (CertificateException e) { assertEquals("Cert chain cannot be verified", e.getMessage()); } }
@Test void verifyChain_noBundleForTrustDomain_throwsBundleNotFoundException() throws Exception { HashSet<X509Certificate> x509Authorities = new HashSet<>(); x509Authorities.add(otherRootCa.getCertificate()); val x509Bundle = new X509Bundle(TrustDomain.of("other.org"), x509Authorities); try { X509SvidValidator.verifyChain(chain, x509Bundle); fail("Verify chain should have thrown validation exception"); } catch (BundleNotFoundException e) { assertEquals("No X.509 bundle found for trust domain example.org", e.getMessage()); } }
@Test void verifyChain_nullChain_throwsNullPointerException() throws CertificateException, BundleNotFoundException { try { X509SvidValidator.verifyChain(null, new X509Bundle(TrustDomain.of("example.org"))); fail("should have thrown an exception"); } catch (NullPointerException e) { assertEquals("chain is marked non-null but is null", e.getMessage()); } }
@Test void verifyChain_nullBundleSource_throwsNullPointerException() throws CertificateException, BundleNotFoundException, URISyntaxException, IOException { try { X509SvidValidator.verifyChain(chain, null); fail("should have thrown an exception"); } catch (NullPointerException e) { assertEquals("x509BundleSource is marked non-null but is null", e.getMessage()); } }