func (b *Bundle) Empty() bool {
	b.mtx.RLock()
	defer b.mtx.RUnlock()
	return len(b.jwtAuthorities) == 0
}
Empty returns true if the bundle has no JWT authorities.
package jwtbundle
import (
	"crypto"
	"encoding/json"
	"io"
	"io/ioutil"
	"sync"
	"github.com/spiffe/go-spiffe/v2/internal/jwtutil"
	"github.com/spiffe/go-spiffe/v2/spiffeid"
	"github.com/zeebo/errs"
	"gopkg.in/square/go-jose.v2"
)
var (
	jwtbundleErr = errs.Class("jwtbundle")
)
type Bundle struct {
	trustDomain spiffeid.TrustDomain
	mtx            sync.RWMutex
	jwtAuthorities map[string]crypto.PublicKey
}
func New(trustDomain spiffeid.TrustDomain) *Bundle {
	return &Bundle{
		trustDomain:    trustDomain,
		jwtAuthorities: make(map[string]crypto.PublicKey),
	}
}
func FromJWTAuthorities(trustDomain spiffeid.TrustDomain, jwtAuthorities map[string]crypto.PublicKey) *Bundle {
	return &Bundle{
		trustDomain:    trustDomain,
		jwtAuthorities: jwtutil.CopyJWTAuthorities(jwtAuthorities),
	}
}
func Load(trustDomain spiffeid.TrustDomain, path string) (*Bundle, error) {
	bundleBytes, err := ioutil.ReadFile(path)
	if err != nil {
		return nil, jwtbundleErr.New("unable to read JWT bundle: %w", err)
	}
	return Parse(trustDomain, bundleBytes)
}
func Read(trustDomain spiffeid.TrustDomain, r io.Reader) (*Bundle, error) {
	b, err := ioutil.ReadAll(r)
	if err != nil {
		return nil, jwtbundleErr.New("unable to read: %v", err)
	}
	return Parse(trustDomain, b)
}
func Parse(trustDomain spiffeid.TrustDomain, bundleBytes []byte) (*Bundle, error) {
	jwks := new(jose.JSONWebKeySet)
	if err := json.Unmarshal(bundleBytes, jwks); err != nil {
		return nil, jwtbundleErr.New("unable to parse JWKS: %v", err)
	}
	bundle := New(trustDomain)
	for i, key := range jwks.Keys {
		if err := bundle.AddJWTAuthority(key.KeyID, key.Key); err != nil {
			return nil, jwtbundleErr.New("error adding authority %d of JWKS: %v", i, errs.Unwrap(err))
		}
	}
	return bundle, nil
}
func (b *Bundle) TrustDomain() spiffeid.TrustDomain {
	return b.trustDomain
}
func (b *Bundle) JWTAuthorities() map[string]crypto.PublicKey {
	b.mtx.RLock()
	defer b.mtx.RUnlock()
	return jwtutil.CopyJWTAuthorities(b.jwtAuthorities)
}
func (b *Bundle) FindJWTAuthority(keyID string) (crypto.PublicKey, bool) {
	b.mtx.RLock()
	defer b.mtx.RUnlock()
	if jwtAuthority, ok := b.jwtAuthorities[keyID]; ok {
		return jwtAuthority, true
	}
	return nil, false
}
func (b *Bundle) HasJWTAuthority(keyID string) bool {
	b.mtx.RLock()
	defer b.mtx.RUnlock()
	_, ok := b.jwtAuthorities[keyID]
	return ok
}
func (b *Bundle) AddJWTAuthority(keyID string, jwtAuthority crypto.PublicKey) error {
	if keyID == "" {
		return jwtbundleErr.New("keyID cannot be empty")
	}
	b.mtx.Lock()
	defer b.mtx.Unlock()
	b.jwtAuthorities[keyID] = jwtAuthority
	return nil
}
func (b *Bundle) RemoveJWTAuthority(keyID string) {
	b.mtx.Lock()
	defer b.mtx.Unlock()
	delete(b.jwtAuthorities, keyID)
}
func (b *Bundle) SetJWTAuthorities(jwtAuthorities map[string]crypto.PublicKey) {
	b.mtx.Lock()
	defer b.mtx.Unlock()
	b.jwtAuthorities = jwtutil.CopyJWTAuthorities(jwtAuthorities)
}