func (ctx *genericSigner) SetNonceSource(source NonceSource) {
	ctx.nonceSource = source
}
SetNonceSource provides or updates a nonce pool to the first recipients.
After this method is called, the signer will consume one nonce per
signature, returning an error it is unable to get a nonce.
package jose
import (
	"crypto/ecdsa"
	"crypto/rsa"
	"fmt"
)
type NonceSource interface {
	Nonce() (string, error)
}
type Signer interface {
	Sign(payload []byte) (*JsonWebSignature, error)
	SetNonceSource(source NonceSource)
	SetEmbedJwk(embed bool)
}
type MultiSigner interface {
	Sign(payload []byte) (*JsonWebSignature, error)
	SetNonceSource(source NonceSource)
	SetEmbedJwk(embed bool)
	AddRecipient(alg SignatureAlgorithm, signingKey interface{}) error
}
type payloadSigner interface {
	signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error)
}
type payloadVerifier interface {
	verifyPayload(payload []byte, signature []byte, alg SignatureAlgorithm) error
}
type genericSigner struct {
	recipients  []recipientSigInfo
	nonceSource NonceSource
	embedJwk    bool
}
type recipientSigInfo struct {
	sigAlg    SignatureAlgorithm
	keyID     string
	publicKey *JsonWebKey
	signer    payloadSigner
}
func NewSigner(alg SignatureAlgorithm, signingKey interface{}) (Signer, error) {
	signer := NewMultiSigner()
	err := signer.AddRecipient(alg, signingKey)
	if err != nil {
		return nil, err
	}
	return signer, nil
}
func NewMultiSigner() MultiSigner {
	return &genericSigner{
		recipients: []recipientSigInfo{},
		embedJwk:   true,
	}
}
func newVerifier(verificationKey interface{}) (payloadVerifier, error) {
	switch verificationKey := verificationKey.(type) {
	case *rsa.PublicKey:
		return &rsaEncrypterVerifier{
			publicKey: verificationKey,
		}, nil
	case *ecdsa.PublicKey:
		return &ecEncrypterVerifier{
			publicKey: verificationKey,
		}, nil
	case []byte:
		return &symmetricMac{
			key: verificationKey,
		}, nil
	case *JsonWebKey:
		return newVerifier(verificationKey.Key)
	default:
		return nil, ErrUnsupportedKeyType
	}
}
func (ctx *genericSigner) AddRecipient(alg SignatureAlgorithm, signingKey interface{}) error {
	recipient, err := makeJWSRecipient(alg, signingKey)
	if err != nil {
		return err
	}
	ctx.recipients = append(ctx.recipients, recipient)
	return nil
}
func makeJWSRecipient(alg SignatureAlgorithm, signingKey interface{}) (recipientSigInfo, error) {
	switch signingKey := signingKey.(type) {
	case *rsa.PrivateKey:
		return newRSASigner(alg, signingKey)
	case *ecdsa.PrivateKey:
		return newECDSASigner(alg, signingKey)
	case []byte:
		return newSymmetricSigner(alg, signingKey)
	case *JsonWebKey:
		recipient, err := makeJWSRecipient(alg, signingKey.Key)
		if err != nil {
			return recipientSigInfo{}, err
		}
		recipient.keyID = signingKey.KeyID
		return recipient, nil
	default:
		return recipientSigInfo{}, ErrUnsupportedKeyType
	}
}
func (ctx *genericSigner) Sign(payload []byte) (*JsonWebSignature, error) {
	obj := &JsonWebSignature{}
	obj.payload = payload
	obj.Signatures = make([]Signature, len(ctx.recipients))
	for i, recipient := range ctx.recipients {
		protected := &rawHeader{
			Alg: string(recipient.sigAlg),
		}
		if recipient.publicKey != nil && ctx.embedJwk {
			protected.Jwk = recipient.publicKey
		}
		if recipient.keyID != "" {
			protected.Kid = recipient.keyID
		}
		if ctx.nonceSource != nil {
			nonce, err := ctx.nonceSource.Nonce()
			if err != nil {
				return nil, fmt.Errorf("square/go-jose: Error generating nonce: %v", err)
			}
			protected.Nonce = nonce
		}
		serializedProtected := mustSerializeJSON(protected)
		input := []byte(fmt.Sprintf("%s.%s",
			base64URLEncode(serializedProtected),
			base64URLEncode(payload)))
		signatureInfo, err := recipient.signer.signPayload(input, recipient.sigAlg)
		if err != nil {
			return nil, err
		}
		signatureInfo.protected = protected
		obj.Signatures[i] = signatureInfo
	}
	return obj, nil
}