clortho

Oct 6, 2026

Changes in this version

+ const DefaultCacheTime

+ const DefaultFailureCoolDown

+ const DefaultFetchRateLimit

+ const DefaultJitterPercentage

+ const DefaultMaxCacheTime

+ const DefaultMaxRefreshInterval

+ const DefaultMaxResponseBytes

+ const DefaultMinCacheTime

+ const DefaultMinRefreshInterval

+ const DefaultNotFoundCoolDown

+ var ErrAlreadyStarted = errors.New("the provider has already been started")

+ var ErrDuplicateKeyID = errors.New("key ID is already supplied by another source")

+ var ErrInvalidFixedKey = errors.New("fixed key is not usable")

+ var ErrInvalidTemplate = errors.New("the URL template is not usable")

+ var ErrKeyAlgorithm = errors.New("key algorithm does not match the protected header")

+ var ErrKeyIDMismatch = errors.New("the key is not the one asked for")

+ var ErrKeyUsage = errors.New("key is not marked for signature use")

+ var ErrMissingAlgorithm = errors.New(`protected header must contain an "alg" field`)

+ var ErrMissingClient = errors.New("an http or https source requires a Client")

+ var ErrMissingKeyID = errors.New("no key ID")

+ var ErrNoAllowedKeyIDs = errors.New("AllowedKeyIDsOnly requires at least one allowed key ID")

+ var ErrNoFixedKeys = errors.New("at least one fixed key is required")

+ var ErrNoKeySources = errors.New("at least one source is required")

+ var ErrNotStarted = errors.New("the provider is not running")

+ var ErrResponseTooLarge = errors.New("response body exceeds the source's maximum")

+ var ErrSymmetricKey = errors.New("symmetric keys are not accepted")

+ var ErrUnsupportedScheme = errors.New("source URI scheme is not supported; use file, http, or https")

+ var ErrUnusedClient = errors.New("a file source does not use a Client")

+ type FetchEvent struct

+ Err error

+ KeyID string

+ URI string

+ type FetchListener interface

+ OnFetchEvent func(FetchEvent)

+ type FixedKey struct

+ Key string

+ KeyID string

+ type FixedKeyConfig struct

+ Keys []FixedKey

+ Verify VerifyConfig

+ type FixedKeyProvider struct

+ func NewFixedKeyProvider(cfg FixedKeyConfig) (*FixedKeyProvider, error)

+ func (p *FixedKeyProvider) FetchKeys(_ context.Context, sink jws.KeySink, sig *jws.Signature, _ *jws.Message) error

+ func (p *FixedKeyProvider) KeyIDs() []string

+ type HTTPError struct

+ Location string

+ StatusCode int

+ func (e *HTTPError) Error() string

+ type KeySetConfig struct

+ RefreshOnUnknownKeyID bool

+ Sources []RefreshSource

+ Verify VerifyConfig

+ type KeySetProvider struct

+ func NewKeySetProvider(cfg KeySetConfig) (*KeySetProvider, error)

+ func (p *KeySetProvider) AddListener(l Listener) (cancel func())

+ func (p *KeySetProvider) FetchKeys(ctx context.Context, sink jws.KeySink, sig *jws.Signature, _ *jws.Message) error

+ func (p *KeySetProvider) KeyIDs() []string

+ func (p *KeySetProvider) Start(context.Context) error

+ func (p *KeySetProvider) Status() []SourceStatus

+ func (p *KeySetProvider) Stop(ctx context.Context) error

+ type Listener interface

+ OnRefreshEvent func(RefreshEvent)

+ type PerKeyConfig struct

+ AllowedKeyIDs []string

+ AllowedKeyIDsOnly bool

+ CacheTime time.Duration

+ Client *http.Client

+ FailureCoolDown time.Duration

+ FetchRateLimit time.Duration

+ MaxCacheTime time.Duration

+ MaxResponseBytes int64

+ MinCacheTime time.Duration

+ NotFoundCoolDown time.Duration

+ Template string

+ Verify VerifyConfig

+ type PerKeyProvider struct

+ func NewPerKeyProvider(cfg PerKeyConfig) (*PerKeyProvider, error)

+ func (p *PerKeyProvider) AddListener(l FetchListener) (cancel func())

+ func (p *PerKeyProvider) FetchKeys(ctx context.Context, sink jws.KeySink, sig *jws.Signature, _ *jws.Message) error

+ func (p *PerKeyProvider) KeyIDs() []string

type RefreshEvent

+ DeletedKeyIDs []string

+ KeyIDs []string

+ KeySetBytes int64

+ NewKeyIDs []string

type RefreshSource

+ Client *http.Client

+ JitterPercentage float64

+ MaxRefreshInterval time.Duration

+ MaxResponseBytes int64

+ MinRefreshInterval time.Duration

+ RefreshInterval time.Duration

+ type SourceStatus struct

+ LastErr error

+ LastRetrieved time.Time

+ LastStatusCode int

+ URI string

+ type VerifyConfig struct

+ IgnoreKeyAlgorithm bool

+ IgnoreKeyUsage bool

Sep 20, 2026

retracted

Changes in this version

+ const DefaultRefreshMaxInterval

+ var ErrInvalidKeyID = errors.New("invalid key ID")

+ var ErrInvalidLocation = errors.New("location is not a valid URL")

+ var ErrKeyProviderSymmetricKey = errors.New("symmetric keys are not accepted for signature verification")

+ var ErrLocationOutsideTemplate = errors.New("resolved location is outside the configured template")

+ var ErrUnsafeTemplate = errors.New("URI template must have a literal scheme, host, and path before its variable")

+ func ValidateKeyID(keyID string) error

type KeyProviderOption

+ func WithAllowSymmetricKeys() KeyProviderOption

+ func WithIgnoreKeyUsage() KeyProviderOption

type RefreshSource

+ MaxInterval time.Duration

type ResolverOption

+ func WithKeyIDValidator(v func(keyID string) error) ResolverOption

Sep 20, 2026

Changes in this version

+ var ErrFetchPanicked = errors.New("the fetch for that key panicked")

+ var ErrKeyProviderKeyImport = errors.New("key provider could not import the key from its keyring")

+ var ErrKeyProviderKeyUsage = errors.New("key is not marked for signature use")

+ var ErrKeyProviderMissingAlg = errors.New(`protected header must contain an "alg" field`)

+ var ErrKeyProviderMissingKeyID = errors.New(`payload must contain a "kid" field in its protected header`)

+ var ErrNoRefreshSources = errors.New(...)

+ type ConfigOption interface

type KeyProviderOption

+ func WithEnforceKeyUsage() KeyProviderOption

+ type KeyRingOption interface

+ type ResponseTooLargeError struct

+ Limit int64

+ Location string

+ func (rtle *ResponseTooLargeError) Error() string

Sep 16, 2026

Changes in this version

+ var ErrKeyProviderNoKeyRing = errors.New("key provider requires a key ring; see WithRingKey")

Sep 11, 2026

Changes in this version

+ var ErrKeyProviderKeyNotFound = errors.New("key provider failed to find the request kid in its keyring")

Sep 10, 2026

Changes in this version

+ func NewKeyProvider(opts ...KeyProviderOption) (jws.KeyProvider, error)

+ type KeyProviderOption interface

+ func WithRingKey(kr KeyRing) KeyProviderOption

type KeyRing

+ Clone func() []Key

Sep 4, 2026

Changes in this version

+ var ErrMissingConnectionDetails = errors.New("connection tls/trust details are missing")

+ var ErrMissingConnectionTrust = errors.New("connection trust value is missing")

+ func SetContentMeta(ctx context.Context, meta ContentMeta) context.Context

type ContentMeta

+ func GetContentMeta(ctx context.Context) (meta ContentMeta, ok bool)

type HTTPLoader

+ MaxReadLimit int64

Aug 17, 2022

Changes in this version

+ type InvalidFormatError struct

+ Format string

+ func (ife InvalidFormatError) Error() string

Aug 11, 2022

Changes in this version

type Keys

+ func (ks Keys) AppendKeyIDs(v []string) []string

type ResolverRefresherOption

+ func WithConfig(cfg Config) ResolverRefresherOption

Apr 28, 2022

Changes in this version

+ const DefaultRefreshInterval

+ const DefaultRefreshJitter

+ const DefaultRefreshMinInterval

+ const KeyIDParameterName

+ const MediaTypeJSON

+ const MediaTypeJWK

+ const MediaTypeJWKSet

+ const MediaTypePEM

+ const SuffixJSON

+ const SuffixJWK

+ const SuffixJWKSet

+ const SuffixPEM

+ var ErrKeyNotFound = errors.New("No such key exists")

+ var ErrNoTemplate = errors.New("No URI template expander has been configured for that method.")

+ var ErrRefresherStarted = errors.New("That refresher has already been started")

+ var ErrRefresherStopped = errors.New("That refresher is not running")

+ type CancelListenerFunc func()

+ type Config struct

+ Refresh RefreshConfig

+ Resolve ResolveConfig

+ type ContentMeta struct

+ Format string

+ LastModified time.Time

+ TTL time.Duration

+ type Expander interface

+ Expand func(interface{}) (string, error)

+ func NewExpander(rawTemplate string) (Expander, error)

+ type Fetcher interface

+ Fetch func(ctx context.Context, location string, prev ContentMeta) (keys []Key, next ContentMeta, err error)

+ func NewFetcher(options ...FetcherOption) (Fetcher, error)

+ type FetcherOption interface

+ func WithKeyIDHash(h crypto.Hash) FetcherOption

+ func WithLoader(l Loader) FetcherOption

+ func WithParser(p Parser) FetcherOption

+ type FileLoader struct

+ Root fs.FS

+ func (fl FileLoader) LoadContent(_ context.Context, location string, meta ContentMeta) ([]byte, ContentMeta, error)

+ type HTTPClient interface

+ Do func(*http.Request) (*http.Response, error)

+ type HTTPEncoder func(context.Context, *http.Request) error

+ type HTTPLoader struct

+ Client HTTPClient

+ Encoders []HTTPEncoder

+ Timeout time.Duration

+ func (hl HTTPLoader) LoadContent(ctx context.Context, location string, meta ContentMeta) ([]byte, ContentMeta, error)

+ type HTTPLoaderError struct

+ Location string

+ StatusCode int

+ func (hle *HTTPLoaderError) Error() string

+ type JWKKeyParser struct

+ Options []jwk.ParseOption

+ func (jkp JWKKeyParser) Parse(_ string, data []byte) ([]Key, error)

+ type JWKSetParser struct

+ Options []jwk.ParseOption

+ func (jsp JWKSetParser) Parse(_ string, data []byte) ([]Key, error)

+ type Key interface

+ KeyID func() string

+ KeyType func() string

+ KeyUsage func() string

+ Public func() crypto.PublicKey

+ Raw func() interface{}

+ func EnsureKeyID(k Key, h crypto.Hash) (updated Key, err error)

+ type KeyAccessor interface

+ Get func(keyID string) (Key, bool)

+ Len func() int

+ type KeyRing interface

+ Add func(...Key) int

+ Remove func(keyIDs ...string) int

+ func NewKeyRing(initialKeys ...Key) KeyRing

+ type Keys []Key

+ func (ks Keys) Len() int

+ func (ks Keys) Less(i, j int) bool

+ func (ks Keys) Swap(i, j int)

+ type Loader interface

+ LoadContent func(ctx context.Context, location string, meta ContentMeta) ([]byte, ContentMeta, error)

+ func NewLoader(options ...LoaderOption) (Loader, error)

+ type LoaderOption interface

+ func WithSchemes(l Loader, schemes ...string) LoaderOption

+ type NotAFileError struct

+ Location string

+ func (nafe *NotAFileError) Error() string

+ type Parser interface

+ Parse func(format string, data []byte) ([]Key, error)

+ func NewParser(options ...ParserOption) (Parser, error)

+ type ParserOption interface

+ func WithFormats(p Parser, formats ...string) ParserOption

+ type RefreshConfig struct

+ Sources []RefreshSource

+ type RefreshEvent struct

+ Deleted Keys

+ Err error

+ Keys Keys

+ New Keys

+ URI string

+ type RefreshListener interface

+ OnRefreshEvent func(RefreshEvent)

+ type RefreshSource struct

+ Interval time.Duration

+ Jitter float64

+ MinInterval time.Duration

+ URI string

+ type Refresher interface

+ AddListener func(l RefreshListener) CancelListenerFunc

+ Start func(context.Context) error

+ Stop func(context.Context) error

+ func NewRefresher(options ...RefresherOption) (Refresher, error)

+ type RefresherOption interface

+ func WithSources(sources ...RefreshSource) RefresherOption

+ type ResolveConfig struct

+ Template string

+ Timeout time.Duration

+ type ResolveEvent struct

+ Err error

+ Key Key

+ KeyID string

+ URI string

+ type ResolveListener interface

+ OnResolveEvent func(ResolveEvent)

+ type Resolver interface

+ AddListener func(ResolveListener) CancelListenerFunc

+ Resolve func(ctx context.Context, keyID string) (Key, error)

+ func NewResolver(options ...ResolverOption) (Resolver, error)

+ type ResolverOption interface

+ func WithKeyIDExpander(e Expander) ResolverOption

+ func WithKeyIDTemplate(t string) ResolverOption

+ func WithKeyRing(kr KeyRing) ResolverOption

+ type ResolverRefresherOption interface

+ func WithFetcher(f Fetcher) ResolverRefresherOption

+ type Thumbprinter interface

+ Thumbprint func(crypto.Hash) ([]byte, error)

+ type UnsupportedFormatError struct

+ Format string

+ func (ufe *UnsupportedFormatError) Error() string

+ type UnsupportedSchemeError struct

+ Location string

+ func (use *UnsupportedSchemeError) Error() string