kubernetes/vendor/github.com/coreos/go-oidc/jwks.go

const keysExpiryDelta …

// NewRemoteKeySet returns a KeySet that can validate JSON web tokens by using HTTP
// GETs to fetch JSON web token sets hosted at a remote URL. This is automatically
// used by NewProvider using the URLs returned by OpenID Connect discovery, but is
// exposed for providers that don't support discovery or to prevent round trips to the
// discovery URL.
//
// The returned KeySet is a long lived verifier that caches keys based on cache-control
// headers. Reuse a common remote key set instead of creating new ones as needed.
//
// The behavior of the returned KeySet is undefined once the context is canceled.
func NewRemoteKeySet(ctx context.Context, jwksURL string) KeySet { … }

func newRemoteKeySet(ctx context.Context, jwksURL string, now func() time.Time) *remoteKeySet { … }

type remoteKeySet …

type inflight …

func newInflight() *inflight { … }

// wait returns a channel that multiple goroutines can receive on. Once it returns
// a value, the inflight request is done and result() can be inspected.
func (i *inflight) wait() <-chan struct{ … }

// done can only be called by a single goroutine. It records the result of the
// inflight request and signals other goroutines that the result is safe to
// inspect.
func (i *inflight) done(keys []jose.JSONWebKey, err error) { … }

// result cannot be called until the wait() channel has returned a value.
func (i *inflight) result() ([]jose.JSONWebKey, error) { … }

func (r *remoteKeySet) VerifySignature(ctx context.Context, jwt string) ([]byte, error) { … }

func (r *remoteKeySet) verify(ctx context.Context, jws *jose.JSONWebSignature) ([]byte, error) { … }

func (r *remoteKeySet) keysFromCache() (keys []jose.JSONWebKey, expiry time.Time) { … }

// keysFromRemote syncs the key set from the remote set, records the values in the
// cache, and returns the key set.
func (r *remoteKeySet) keysFromRemote(ctx context.Context) ([]jose.JSONWebKey, error) { … }

func (r *remoteKeySet) updateKeys() ([]jose.JSONWebKey, time.Time, error) { … }