The --jwks flag in verify 0.6.0 only accepts HTTP(S) URLs. For local development and CI pipelines running offline, accepting file:///path/to/jwks.json would avoid requiring a running HTTP server to serve keys.
Repro:
verify --jwks file:///tmp/test-keys/jwks.json <receipt>
→ parse error (expects http:// or https:// scheme)
This matters for test-vector validation where JWKS files live alongside the test fixtures — e.g. the sidecar approach in PR #7.
Suggested behavior: if the --jwks value starts with file://, read the JWKS from disk instead of fetching over HTTP.
The
--jwksflag in verify 0.6.0 only accepts HTTP(S) URLs. For local development and CI pipelines running offline, acceptingfile:///path/to/jwks.jsonwould avoid requiring a running HTTP server to serve keys.Repro:
→ parse error (expects
http://orhttps://scheme)This matters for test-vector validation where JWKS files live alongside the test fixtures — e.g. the sidecar approach in PR #7.
Suggested behavior: if the
--jwksvalue starts withfile://, read the JWKS from disk instead of fetching over HTTP.