By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Take the fetch once, and keep the internals out of the way Integrating this into NixCI showed three things. A caller handed a fetch on every request and was given only an issuer to decide what to fetch, so it looked the issuer up a second time and then had a Nothing to answer that could not happen. Each issuer carries its own fetch now, handed in when the federation is built. Audience collided with jose's in every module that both signs a token and configures this, which was three of them. TokenAudience collides with nothing. KeySet exported five things only its own tests reached for, which is a public surface shaped by a test suite. They are in KeySet.Internal. The end-to-end suite allowed no clock skew, which only showed once a second issuer ran on a second host and stamped a token a fraction of a second ahead.