ProduceFirstOrdering Class
Orders a set of key versions so the one to produce with leads: whoever signs or encrypts takes the first key for an algorithm, while every version stays published so consumers can still verify or decrypt.
public static class ProduceFirstOrderingInheritance System.Object → ProduceFirstOrdering
Remarks
This is the whole of what makes a rollover cause no verification failure, and it is the same arithmetic wherever the versions come from: a custodian enumerating them, or a key ring the library owns. It is a pure function of the creation times and the propagation window, so every pod derives the identical answer with no coordination.
Methods
ProduceFirstOrdering.ProduceFirst<T>(this IReadOnlyList<T>, Func<T,DateTimeOffset>, DateTimeOffset, TimeSpan) Method
Returns the versions with the active one first and the rest trailing newest-first.
public static System.Collections.Generic.IEnumerable<T> ProduceFirst<T>(this System.Collections.Generic.IReadOnlyList<T> versions, System.Func<T,System.DateTimeOffset> createdAt, System.DateTimeOffset now, System.TimeSpan propagation);Type parameters
T
The version type, whatever carries a creation time.
Parameters
versions System.Collections.Generic.IReadOnlyList<T>
The versions to order.
createdAt System.Func<T,System.DateTimeOffset>
Reads a version's creation time.
now System.DateTimeOffset
The current time.
propagation System.TimeSpan
How long a version stays announced before it starts producing, which is also the max-age the server puts on its JWKS response, so a client that honours it holds the key before it meets a token signed with it.
Returns
System.Collections.Generic.IEnumerable<T>
The versions, produce-first.
Remarks
The active version is the newest one already past propagation. If none has cleared it yet (bootstrap: the very first version is still fresh), the newest overall leads, since there is no older version a client could be holding instead.