By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Check the library against an issuer that really exists Every test so far signs its own tokens with keys it generated, which says nothing about whether a real issuer's documents, keys and tokens are shaped the way this expects. A NixOS test now runs dex on the network: it holds the workload's password, signs with a key of its own, publishes that key where the library goes looking, and describes itself at the well-known url. Nothing in that path is a stand-in. Writing the driver found a gap. Fetching a key set meant decoding it, which meant depending on jose for the one type the library hands back, so parseJWKSet is here now and JWK is re-exported.