Add a function to fetch linked data.

6 files changed, 276 insertions, 184 deletions

diff --git a/doc/webid-oidc.texi b/doc/webid-oidc.texi
index 0fa9a42..dc83ecc 100644
--- a/doc/webid-oidc.texi
+++ b/doc/webid-oidc.texi
@@ -331,6 +331,14 @@ failed. @var{value} is the incorrect input, and @var{cause} is a
 low-level error.
 @end deftp
 
+@deftp {exception type} &not-json @var{value} @var{cause}
+Cannot decode @var{value} to a JSON object.
+@end deftp
+
+@deftp {exception type} &not-turtle @var{value} @var{cause}
+Cannot decode @var{value} to a RDF graph.
+@end deftp
+
 @deftp {exception type} &incorrect-webid-field @var{value}
 The @var{value} of the webid field in the JWT is missing (if
 @code{#f}), or not an acceptable value.
@@ -388,10 +396,6 @@ Each JWT type – access token, DPoP proof, ID token, authorization code
 (this is internal to the identity provider) has different validation
 rules, and can fail in different ways.
 
-@deftp {exception type} &not-json @var{value} @var{cause}
-Cannot decode @var{value} to a JSON object.
-@end deftp
-
 @deftp {exception type} &unsupported-crv @var{crv}
 The identifier @var{crv} does not identify an elliptic curve.
 @end deftp
@@ -525,6 +529,10 @@ It is impossible to fetch the configuration of @var{issuer}.
 It is impossible to fetch the keys of @var{issuer} at @var{uri}.
 @end deftp
 
+@deftp {exception type} &cannot-fetch-linked-data @var{uri} @var{cause}
+Could not fetch the graph referenced by @var{uri}.
+@end deftp
+
 @node Other errors in the protocol or from a reasonable implementation
 @section Other errors in the protocol or from a reasonable implementation
 The protocol does not rely solely on JWT validation, so these errors
diff --git a/po/fr.po b/po/fr.po
index e25ffb1..80c20e2 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -2,7 +2,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc 0.0.0\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-05 16:13+0200\n"
+"POT-Creation-Date: 2021-06-05 16:14+0200\n"
 "PO-Revision-Date: 2021-06-05 11:07+0200\n"
 "Last-Translator: Vivien Kraus <vivien@planete-kraus.eu>\n"
 "Language-Team: French <vivien@planete-kraus.eu>\n"
@@ -126,96 +126,101 @@ msgstr "Utilisation : generate-random [NOMBRE D'OCTETS]\n"
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr "Utilisation : generate-key [NOMBRE DE BITS | COURBE]\n"
 
-#: src/scm/webid-oidc/errors.scm:540
+#: src/scm/webid-oidc/errors.scm:560
 msgid "that’s how it is"
 msgstr "c’est comme ça"
 
-#: src/scm/webid-oidc/errors.scm:545
+#: src/scm/webid-oidc/errors.scm:565
 #, scheme-format
 msgid "the value ~s is not a base64 string (because ~a)"
 msgstr "la valeur ~s n’est pas une chaîne base64 (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:548
+#: src/scm/webid-oidc/errors.scm:568
 #, scheme-format
 msgid "the value ~s is not JSON (because ~a)"
 msgstr "la valeur ~s n’est pas du JSON (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:551
+#: src/scm/webid-oidc/errors.scm:571
+#, scheme-format
+msgid "the value ~s is not Turtle (because ~a)"
+msgstr "la valeur ~s n’est pas du Turtle (parce que ~a)"
+
+#: src/scm/webid-oidc/errors.scm:574
 #, scheme-format
 msgid "the value ~s does not identify an elleptic curve"
 msgstr "la valeur ~s n’identifie pas une courbe elliptique"
 
-#: src/scm/webid-oidc/errors.scm:556
+#: src/scm/webid-oidc/errors.scm:579
 #, scheme-format
 msgid "the value ~s does not identify a JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:558
+#: src/scm/webid-oidc/errors.scm:581
 #, scheme-format
 msgid "the value ~s does not identify a JWK"
 msgstr "la valeur ~s n’identifie pas une JWK"
 
-#: src/scm/webid-oidc/errors.scm:563
+#: src/scm/webid-oidc/errors.scm:586
 #, scheme-format
 msgid "the value ~s does not identify a public JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK publique (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:565
+#: src/scm/webid-oidc/errors.scm:588
 #, scheme-format
 msgid "the value ~s does not identify a public JWK"
 msgstr "la valeur ~s n’identifie pas une JWK publique"
 
-#: src/scm/webid-oidc/errors.scm:570
+#: src/scm/webid-oidc/errors.scm:593
 #, scheme-format
 msgid "the value ~s does not identify a private JWK (because ~a)"
 msgstr "la valeur ~s n’identifie pas une JWK privée (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:572
+#: src/scm/webid-oidc/errors.scm:595
 #, scheme-format
 msgid "the value ~s does not identify a private JWK"
 msgstr "la valeur ~s n’identifie pas une JWK privée"
 
-#: src/scm/webid-oidc/errors.scm:577
+#: src/scm/webid-oidc/errors.scm:600
 #, scheme-format
 msgid "the value ~s does not identify a JWKS (because ~a)"
 msgstr "la valeur ~s n’identifie pas un JWKS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:579
+#: src/scm/webid-oidc/errors.scm:602
 #, scheme-format
 msgid "the value ~s does not identify a JWKS"
 msgstr "la valeur ~s n’identifie pas un JWKS"
 
-#: src/scm/webid-oidc/errors.scm:582
+#: src/scm/webid-oidc/errors.scm:605
 #, scheme-format
 msgid "the value ~s does not identify a hash algorithm"
 msgstr "la valeur ~s n’identifie pas un algorithme de hachage"
 
-#: src/scm/webid-oidc/errors.scm:585
+#: src/scm/webid-oidc/errors.scm:608
 #, scheme-format
 msgid "the value ~s is not an alist or misses key ~s"
 msgstr "la valeur ~s n’est pas une alist ou il manque la clé ~s"
 
-#: src/scm/webid-oidc/errors.scm:588
+#: src/scm/webid-oidc/errors.scm:611
 #, scheme-format
 msgid "the value ~s is not a JWS header (because ~a)"
 msgstr "la valeur ~s n’est pas un header JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:591
+#: src/scm/webid-oidc/errors.scm:614
 #, scheme-format
 msgid "the value ~s is not a JWS payload (because ~a)"
 msgstr "la valeur ~s n’est pas un contenu JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:594
+#: src/scm/webid-oidc/errors.scm:617
 #, scheme-format
 msgid "the value ~s is not a JWS (because ~a)"
 msgstr "la valeur ~s n’est pas un JWS (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:597
+#: src/scm/webid-oidc/errors.scm:620
 #, scheme-format
 msgid "the string ~s cannot be split in 3 parts with ~s"
 msgstr "la chaîne ~s ne peut pas être découpée en 3 parties avec ~s"
 
-#: src/scm/webid-oidc/errors.scm:600
+#: src/scm/webid-oidc/errors.scm:623
 #, scheme-format
 msgid ""
 "all key candidates failed to verify signature ~s with algorithm ~s and "
@@ -224,17 +229,17 @@ msgstr ""
 "aucune clé candidate n’a pu vérifier la signature ~s avec l’algorithme ~s et "
 "le contenu ~a (il y en avait ~a : ~s)"
 
-#: src/scm/webid-oidc/errors.scm:603
+#: src/scm/webid-oidc/errors.scm:626
 #, scheme-format
 msgid "I cannot decode JWS ~a (because ~a)"
 msgstr "je n’ai pas pu décoder le JWS encodé par ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:606
+#: src/scm/webid-oidc/errors.scm:629
 #, scheme-format
 msgid "I cannot encode JWS ~a (because ~a)"
 msgstr "je n’ai pas pu encoder le JWS ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:609
+#: src/scm/webid-oidc/errors.scm:632
 #, scheme-format
 msgid ""
 "the server request unexpectedly failed with code ~a and reason phrase ~s"
@@ -242,307 +247,308 @@ msgstr ""
 "la requête au serveur a échoué de façon inattendue avec un code ~a et une "
 "raison ~s"
 
-#: src/scm/webid-oidc/errors.scm:614
+#: src/scm/webid-oidc/errors.scm:637
 #, scheme-format
 msgid "the header ~a should not have the value ~s"
 msgstr "l’en-tête ~a ne devrait pas avoir la valeur ~s"
 
-#: src/scm/webid-oidc/errors.scm:616
+#: src/scm/webid-oidc/errors.scm:639
 #, scheme-format
 msgid "the header ~a should be present"
 msgstr "l’en-tête ~a devrait être présent"
 
-#: src/scm/webid-oidc/errors.scm:619
+#: src/scm/webid-oidc/errors.scm:642
 #, scheme-format
 msgid "the server response wasn't expected: ~s (because ~a)"
 msgstr "la réponse du serveur est inattendue : ~s (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:625
+#: src/scm/webid-oidc/errors.scm:648
 #, scheme-format
 msgid "the value ~s is not an OIDC configuration (because ~a)"
 msgstr "la valeur ~s n’est pas une configuration OIDC (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:630
+#: src/scm/webid-oidc/errors.scm:653
 #, scheme-format
 msgid "the webid field is incorrect: ~s"
 msgstr "le champ webid est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:631
+#: src/scm/webid-oidc/errors.scm:654
 msgid "the webid field is missing"
 msgstr "le champ webid est manquant"
 
-#: src/scm/webid-oidc/errors.scm:635
+#: src/scm/webid-oidc/errors.scm:658
 #, scheme-format
 msgid "the iss field is incorrect: ~s"
 msgstr "le champ iss est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:636
+#: src/scm/webid-oidc/errors.scm:659
 msgid "the iss field is missing"
 msgstr "le champ iss est manquant"
 
-#: src/scm/webid-oidc/errors.scm:640
+#: src/scm/webid-oidc/errors.scm:663
 #, scheme-format
 msgid "the aud field is incorrect: ~s"
 msgstr "le champ aud est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:641
+#: src/scm/webid-oidc/errors.scm:664
 msgid "the aud field is missing"
 msgstr "le champ aud est manquant"
 
-#: src/scm/webid-oidc/errors.scm:645
+#: src/scm/webid-oidc/errors.scm:668
 #, scheme-format
 msgid "the iat field is incorrect: ~s"
 msgstr "le champ iat est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:646
+#: src/scm/webid-oidc/errors.scm:669
 msgid "the iat field is missing"
 msgstr "le champ iat est manquant"
 
-#: src/scm/webid-oidc/errors.scm:650
+#: src/scm/webid-oidc/errors.scm:673
 #, scheme-format
 msgid "the exp field is incorrect: ~s"
 msgstr "le champ exp est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:651
+#: src/scm/webid-oidc/errors.scm:674
 msgid "the exp field is missing"
 msgstr "le champ exp est manquant"
 
-#: src/scm/webid-oidc/errors.scm:655
+#: src/scm/webid-oidc/errors.scm:678
 #, scheme-format
 msgid "the cnf/jkt field is incorrect: ~s"
 msgstr "le champ cnf/jkt est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:656
+#: src/scm/webid-oidc/errors.scm:679
 msgid "the cnf/jkt field is missing"
 msgstr "le champ cnf/jkt est manquant"
 
-#: src/scm/webid-oidc/errors.scm:660
+#: src/scm/webid-oidc/errors.scm:683
 #, scheme-format
 msgid "the client-id field is incorrect: ~s"
 msgstr "le champ client-id est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:661
+#: src/scm/webid-oidc/errors.scm:684
 msgid "the client-id field is missing"
 msgstr "le champ client-id est manquant"
 
-#: src/scm/webid-oidc/errors.scm:665
+#: src/scm/webid-oidc/errors.scm:688
 #, scheme-format
 msgid "the typ field is incorrect: ~s"
 msgstr "le champ typ est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:666
+#: src/scm/webid-oidc/errors.scm:689
 msgid "the typ field is missing"
 msgstr "le champ typ est manquant"
 
-#: src/scm/webid-oidc/errors.scm:670
+#: src/scm/webid-oidc/errors.scm:693
 #, scheme-format
 msgid "the jwk field is incorrect: ~s (because ~a)"
 msgstr "le champ jwk est incorrect : ~s (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:672
+#: src/scm/webid-oidc/errors.scm:695
 msgid "the jwk field is missing"
 msgstr "le champ jwk est manquant"
 
-#: src/scm/webid-oidc/errors.scm:676
+#: src/scm/webid-oidc/errors.scm:699
 #, scheme-format
 msgid "the jti field is incorrect: ~s"
 msgstr "le champ jti est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:677
+#: src/scm/webid-oidc/errors.scm:700
 msgid "the jti field is missing"
 msgstr "le champ jti est manquant"
 
-#: src/scm/webid-oidc/errors.scm:681
+#: src/scm/webid-oidc/errors.scm:704
 #, scheme-format
 msgid "the htm field is incorrect: ~s"
 msgstr "le champ htm est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:682
+#: src/scm/webid-oidc/errors.scm:705
 msgid "the htm field is missing"
 msgstr "le champ htm est manquant"
 
-#: src/scm/webid-oidc/errors.scm:686
+#: src/scm/webid-oidc/errors.scm:709
 #, scheme-format
 msgid "the htu field is incorrect: ~s"
 msgstr "le champ htu est incorrect : ~s"
 
-#: src/scm/webid-oidc/errors.scm:687
+#: src/scm/webid-oidc/errors.scm:710
 msgid "the htu field is missing"
 msgstr "le champ htu est manquant"
 
-#: src/scm/webid-oidc/errors.scm:689
+#: src/scm/webid-oidc/errors.scm:712
 #, scheme-format
 msgid "~s is not an access token (because ~a)"
 msgstr "~s n’est pas un jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:692
+#: src/scm/webid-oidc/errors.scm:715
 #, scheme-format
 msgid "~s is not an access token header (because ~a)"
 msgstr "~s n’est pas un en-tête de jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:695
+#: src/scm/webid-oidc/errors.scm:718
 #, scheme-format
 msgid "~s is not an access token payload (because ~a)"
 msgstr "~s n’est pas un contenu de jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:698
+#: src/scm/webid-oidc/errors.scm:721
 #, scheme-format
 msgid "~s is not a DPoP proof (because ~a)"
 msgstr "~s n’est pas une preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:701
+#: src/scm/webid-oidc/errors.scm:724
 #, scheme-format
 msgid "~s is not a DPoP proof header (because ~a)"
 msgstr "~s n’est pas un en-tête de preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:704
+#: src/scm/webid-oidc/errors.scm:727
 #, scheme-format
 msgid "~s is not a DPoP proof payload (because ~a)"
 msgstr "~s n’est pas un contenu de preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:707
+#: src/scm/webid-oidc/errors.scm:730
 #, scheme-format
 msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
 msgstr ""
 "je n’ai pas pu récupérer la configuration de l’émetteur ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:714
+#: src/scm/webid-oidc/errors.scm:737
 #, scheme-format
 msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
 msgstr "je n’ai pas pu récupérer le JWKS de ~a à ~a (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:725
+#: src/scm/webid-oidc/errors.scm:748
 #, scheme-format
 msgid "the HTTP method is signed for ~s, but ~s was requested"
 msgstr "la méthode HTTP a été signée pour ~s, mais ~s a été demandé"
 
-#: src/scm/webid-oidc/errors.scm:728
+#: src/scm/webid-oidc/errors.scm:751
 #, scheme-format
 msgid "the HTTP uri is signed for ~a, but ~a was requested"
 msgstr "l’uri HTTP a été signé pour ~a, mais ~a a été demandé"
 
-#: src/scm/webid-oidc/errors.scm:731
+#: src/scm/webid-oidc/errors.scm:754
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
 msgstr "la date est ~a, mais la preuve DPoP a été signée dans le futur à ~a"
 
-#: src/scm/webid-oidc/errors.scm:735
+#: src/scm/webid-oidc/errors.scm:758
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
 msgstr ""
 "la date est ~a, mais la preuve DPoP a été signée il y a trop longtemps à ~a"
 
-#: src/scm/webid-oidc/errors.scm:744
+#: src/scm/webid-oidc/errors.scm:767
 #, scheme-format
 msgid "the key ~s does not hash to ~a"
 msgstr "la clé ~s ne donne pas un hash de ~a"
 
-#: src/scm/webid-oidc/errors.scm:746
+#: src/scm/webid-oidc/errors.scm:769
 #, scheme-format
 msgid "the key confirmation of ~s failed (because ~a)"
 msgstr "la confirmation de clé de ~s a échoué (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:748
+#: src/scm/webid-oidc/errors.scm:771
 #, scheme-format
 msgid "the key confirmation of ~s failed"
 msgstr "la confirmation de la clé ~s a échoué"
 
-#: src/scm/webid-oidc/errors.scm:750
+#: src/scm/webid-oidc/errors.scm:773
 #, scheme-format
 msgid "the jti ~s has already been found (because ~a)"
 msgstr "le jti ~s a déjà été trouvé (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:753
+#: src/scm/webid-oidc/errors.scm:776
 #, scheme-format
 msgid "I cannot decode ~s as an access token (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme jeton d’accès (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:756
+#: src/scm/webid-oidc/errors.scm:779
 #, scheme-format
 msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
 msgstr ""
 "je n’ai pas pu encoder ~s comme un jeton d’accès avec la clé ~s (parce que "
 "~a)"
 
-#: src/scm/webid-oidc/errors.scm:759
+#: src/scm/webid-oidc/errors.scm:782
 #, scheme-format
 msgid "I cannot decode ~s as a DPoP proof (because ~a)"
 msgstr "je n’ai pas pu décoder ~s comme preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:762
+#: src/scm/webid-oidc/errors.scm:785
 #, scheme-format
 msgid "I cannot encode ~s as a DPoP proof (because ~a)"
 msgstr "je n’ai pas pu encoder ~s comme une preuve DPoP (parce que ~a)"
 
-#: src/scm/webid-oidc/errors.scm:767
+#: src/scm/webid-oidc/errors.scm:788
+#, scheme-format
+msgid "I could not fetch a RDF graph at ~a (because ~a)"
+msgstr "je n’ai pas pu récupérer de graphe RDF à ~a (parce que ~a)"
+
+#: src/scm/webid-oidc/errors.scm:793
 msgid "that’s it"
 msgstr "c’est tout"
 
-#: src/scm/webid-oidc/errors.scm:771
+#: src/scm/webid-oidc/errors.scm:797
 #, scheme-format
 msgid "~a and ~a"
 msgstr "~a et ~a"
 
-#: src/scm/webid-oidc/errors.scm:774
+#: src/scm/webid-oidc/errors.scm:800
 #, scheme-format
 msgid "~a, ~a"
 msgstr "~a, ~a"
 
-#: src/scm/webid-oidc/errors.scm:778
+#: src/scm/webid-oidc/errors.scm:804
 #, scheme-format
 msgid "the signature ~a does not match key ~s with payload ~a"
 msgstr "la signature ~a ne correspond pas à la clé ~s avec le contenu ~a"
 
-#: src/scm/webid-oidc/errors.scm:781
+#: src/scm/webid-oidc/errors.scm:807
 msgid "there is an undefined variable"
 msgstr "il y a une variable non définie"
 
-#: src/scm/webid-oidc/errors.scm:783
+#: src/scm/webid-oidc/errors.scm:809
 #, scheme-format
 msgid "the origin is ~a"
 msgstr "l’origine est ~a"
 
-#: src/scm/webid-oidc/errors.scm:786
+#: src/scm/webid-oidc/errors.scm:812
 #, scheme-format
 msgid "a message is attached: ~a"
 msgstr "un message est attaché : ~a"
 
-#: src/scm/webid-oidc/errors.scm:789
+#: src/scm/webid-oidc/errors.scm:815
 #, scheme-format
 msgid "the values ~s are problematic"
 msgstr "les valeurs ~s sont problématiques"
 
-#: src/scm/webid-oidc/errors.scm:792
+#: src/scm/webid-oidc/errors.scm:818
 msgid "there is a kind and args"
 msgstr "il y a un type et des arguments"
 
-#: src/scm/webid-oidc/errors.scm:794
+#: src/scm/webid-oidc/errors.scm:820
 msgid "there is an assertion failure"
 msgstr "il y a un échec d’assertion"
 
-#: src/scm/webid-oidc/errors.scm:796
+#: src/scm/webid-oidc/errors.scm:822
 #, scheme-format
 msgid "the program quits with code ~a"
 msgstr "le programme quitte avec le code ~a"
 
-#: src/scm/webid-oidc/errors.scm:799
+#: src/scm/webid-oidc/errors.scm:825
 msgid "the program cannot recover from this exception"
 msgstr "le programme ne peut pas récupérer après cette exception"
 
-#: src/scm/webid-oidc/errors.scm:801
+#: src/scm/webid-oidc/errors.scm:827
 msgid "there is an error"
 msgstr "il y a une erreur"
 
-#: src/scm/webid-oidc/errors.scm:803
+#: src/scm/webid-oidc/errors.scm:829
 #, scheme-format
 msgid "Unhandled exception type ~a."
 msgstr "Type d’exception non pris en charge ~a."
 
 #, scheme-format
-#~ msgid "the value ~s is not Turtle (because ~a)"
-#~ msgstr "la valeur ~s n’est pas du Turtle (parce que ~a)"
-
-#, scheme-format
 #~ msgid "the sub field is incorrect: ~s"
 #~ msgstr "le champ sub est incorrect : ~s"
 
@@ -564,10 +570,6 @@ msgstr "Type d’exception non pris en charge ~a."
 #~ msgstr "le champ nonce est manquant"
 
 #, scheme-format
-#~ msgid "I could not fetch a RDF graph at ~a (because ~a)"
-#~ msgstr "je n’ai pas pu récupérer de graphe RDF à ~a (parce que ~a)"
-
-#, scheme-format
 #~ msgid "~s is not a client manifest (because ~a)"
 #~ msgstr "~s n’est pas un manifeste client (parce que ~a)"
 
diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot
index 1ab669d..df200d3 100644
--- a/po/webid-oidc.pot
+++ b/po/webid-oidc.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-06-05 16:13+0200\n"
+"POT-Creation-Date: 2021-06-05 16:14+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -122,406 +122,416 @@ msgstr ""
 msgid "Usage: generate-key [NUMBER OF BITS | CURVE]\n"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:540
+#: src/scm/webid-oidc/errors.scm:560
 msgid "that’s how it is"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:545
+#: src/scm/webid-oidc/errors.scm:565
 #, scheme-format
 msgid "the value ~s is not a base64 string (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:548
+#: src/scm/webid-oidc/errors.scm:568
 #, scheme-format
 msgid "the value ~s is not JSON (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:551
+#: src/scm/webid-oidc/errors.scm:571
+#, scheme-format
+msgid "the value ~s is not Turtle (because ~a)"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:574
 #, scheme-format
 msgid "the value ~s does not identify an elleptic curve"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:556
+#: src/scm/webid-oidc/errors.scm:579
 #, scheme-format
 msgid "the value ~s does not identify a JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:558
+#: src/scm/webid-oidc/errors.scm:581
 #, scheme-format
 msgid "the value ~s does not identify a JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:563
+#: src/scm/webid-oidc/errors.scm:586
 #, scheme-format
 msgid "the value ~s does not identify a public JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:565
+#: src/scm/webid-oidc/errors.scm:588
 #, scheme-format
 msgid "the value ~s does not identify a public JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:570
+#: src/scm/webid-oidc/errors.scm:593
 #, scheme-format
 msgid "the value ~s does not identify a private JWK (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:572
+#: src/scm/webid-oidc/errors.scm:595
 #, scheme-format
 msgid "the value ~s does not identify a private JWK"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:577
+#: src/scm/webid-oidc/errors.scm:600
 #, scheme-format
 msgid "the value ~s does not identify a JWKS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:579
+#: src/scm/webid-oidc/errors.scm:602
 #, scheme-format
 msgid "the value ~s does not identify a JWKS"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:582
+#: src/scm/webid-oidc/errors.scm:605
 #, scheme-format
 msgid "the value ~s does not identify a hash algorithm"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:585
+#: src/scm/webid-oidc/errors.scm:608
 #, scheme-format
 msgid "the value ~s is not an alist or misses key ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:588
+#: src/scm/webid-oidc/errors.scm:611
 #, scheme-format
 msgid "the value ~s is not a JWS header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:591
+#: src/scm/webid-oidc/errors.scm:614
 #, scheme-format
 msgid "the value ~s is not a JWS payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:594
+#: src/scm/webid-oidc/errors.scm:617
 #, scheme-format
 msgid "the value ~s is not a JWS (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:597
+#: src/scm/webid-oidc/errors.scm:620
 #, scheme-format
 msgid "the string ~s cannot be split in 3 parts with ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:600
+#: src/scm/webid-oidc/errors.scm:623
 #, scheme-format
 msgid ""
 "all key candidates failed to verify signature ~s with algorithm ~s and "
 "payload ~a (there were ~a: ~s)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:603
+#: src/scm/webid-oidc/errors.scm:626
 #, scheme-format
 msgid "I cannot decode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:606
+#: src/scm/webid-oidc/errors.scm:629
 #, scheme-format
 msgid "I cannot encode JWS ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:609
+#: src/scm/webid-oidc/errors.scm:632
 #, scheme-format
 msgid ""
 "the server request unexpectedly failed with code ~a and reason phrase ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:614
+#: src/scm/webid-oidc/errors.scm:637
 #, scheme-format
 msgid "the header ~a should not have the value ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:616
+#: src/scm/webid-oidc/errors.scm:639
 #, scheme-format
 msgid "the header ~a should be present"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:619
+#: src/scm/webid-oidc/errors.scm:642
 #, scheme-format
 msgid "the server response wasn't expected: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:625
+#: src/scm/webid-oidc/errors.scm:648
 #, scheme-format
 msgid "the value ~s is not an OIDC configuration (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:630
+#: src/scm/webid-oidc/errors.scm:653
 #, scheme-format
 msgid "the webid field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:631
+#: src/scm/webid-oidc/errors.scm:654
 msgid "the webid field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:635
+#: src/scm/webid-oidc/errors.scm:658
 #, scheme-format
 msgid "the iss field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:636
+#: src/scm/webid-oidc/errors.scm:659
 msgid "the iss field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:640
+#: src/scm/webid-oidc/errors.scm:663
 #, scheme-format
 msgid "the aud field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:641
+#: src/scm/webid-oidc/errors.scm:664
 msgid "the aud field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:645
+#: src/scm/webid-oidc/errors.scm:668
 #, scheme-format
 msgid "the iat field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:646
+#: src/scm/webid-oidc/errors.scm:669
 msgid "the iat field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:650
+#: src/scm/webid-oidc/errors.scm:673
 #, scheme-format
 msgid "the exp field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:651
+#: src/scm/webid-oidc/errors.scm:674
 msgid "the exp field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:655
+#: src/scm/webid-oidc/errors.scm:678
 #, scheme-format
 msgid "the cnf/jkt field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:656
+#: src/scm/webid-oidc/errors.scm:679
 msgid "the cnf/jkt field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:660
+#: src/scm/webid-oidc/errors.scm:683
 #, scheme-format
 msgid "the client-id field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:661
+#: src/scm/webid-oidc/errors.scm:684
 msgid "the client-id field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:665
+#: src/scm/webid-oidc/errors.scm:688
 #, scheme-format
 msgid "the typ field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:666
+#: src/scm/webid-oidc/errors.scm:689
 msgid "the typ field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:670
+#: src/scm/webid-oidc/errors.scm:693
 #, scheme-format
 msgid "the jwk field is incorrect: ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:672
+#: src/scm/webid-oidc/errors.scm:695
 msgid "the jwk field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:676
+#: src/scm/webid-oidc/errors.scm:699
 #, scheme-format
 msgid "the jti field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:677
+#: src/scm/webid-oidc/errors.scm:700
 msgid "the jti field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:681
+#: src/scm/webid-oidc/errors.scm:704
 #, scheme-format
 msgid "the htm field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:682
+#: src/scm/webid-oidc/errors.scm:705
 msgid "the htm field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:686
+#: src/scm/webid-oidc/errors.scm:709
 #, scheme-format
 msgid "the htu field is incorrect: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:687
+#: src/scm/webid-oidc/errors.scm:710
 msgid "the htu field is missing"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:689
+#: src/scm/webid-oidc/errors.scm:712
 #, scheme-format
 msgid "~s is not an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:692
+#: src/scm/webid-oidc/errors.scm:715
 #, scheme-format
 msgid "~s is not an access token header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:695
+#: src/scm/webid-oidc/errors.scm:718
 #, scheme-format
 msgid "~s is not an access token payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:698
+#: src/scm/webid-oidc/errors.scm:721
 #, scheme-format
 msgid "~s is not a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:701
+#: src/scm/webid-oidc/errors.scm:724
 #, scheme-format
 msgid "~s is not a DPoP proof header (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:704
+#: src/scm/webid-oidc/errors.scm:727
 #, scheme-format
 msgid "~s is not a DPoP proof payload (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:707
+#: src/scm/webid-oidc/errors.scm:730
 #, scheme-format
 msgid "I cannot fetch the issuer configuration of ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:714
+#: src/scm/webid-oidc/errors.scm:737
 #, scheme-format
 msgid "I cannot fetch the JWKS of ~a at ~a (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:725
+#: src/scm/webid-oidc/errors.scm:748
 #, scheme-format
 msgid "the HTTP method is signed for ~s, but ~s was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:728
+#: src/scm/webid-oidc/errors.scm:751
 #, scheme-format
 msgid "the HTTP uri is signed for ~a, but ~a was requested"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:731
+#: src/scm/webid-oidc/errors.scm:754
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof is signed in the future at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:735
+#: src/scm/webid-oidc/errors.scm:758
 #, scheme-format
 msgid "the date is ~a, but the DPoP proof was signed too long ago at ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:744
+#: src/scm/webid-oidc/errors.scm:767
 #, scheme-format
 msgid "the key ~s does not hash to ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:746
+#: src/scm/webid-oidc/errors.scm:769
 #, scheme-format
 msgid "the key confirmation of ~s failed (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:748
+#: src/scm/webid-oidc/errors.scm:771
 #, scheme-format
 msgid "the key confirmation of ~s failed"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:750
+#: src/scm/webid-oidc/errors.scm:773
 #, scheme-format
 msgid "the jti ~s has already been found (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:753
+#: src/scm/webid-oidc/errors.scm:776
 #, scheme-format
 msgid "I cannot decode ~s as an access token (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:756
+#: src/scm/webid-oidc/errors.scm:779
 #, scheme-format
 msgid "I cannot encode ~s as an access token with key ~s (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:759
+#: src/scm/webid-oidc/errors.scm:782
 #, scheme-format
 msgid "I cannot decode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:762
+#: src/scm/webid-oidc/errors.scm:785
 #, scheme-format
 msgid "I cannot encode ~s as a DPoP proof (because ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:767
+#: src/scm/webid-oidc/errors.scm:788
+#, scheme-format
+msgid "I could not fetch a RDF graph at ~a (because ~a)"
+msgstr ""
+
+#: src/scm/webid-oidc/errors.scm:793
 msgid "that’s it"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:771
+#: src/scm/webid-oidc/errors.scm:797
 #, scheme-format
 msgid "~a and ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:774
+#: src/scm/webid-oidc/errors.scm:800
 #, scheme-format
 msgid "~a, ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:778
+#: src/scm/webid-oidc/errors.scm:804
 #, scheme-format
 msgid "the signature ~a does not match key ~s with payload ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:781
+#: src/scm/webid-oidc/errors.scm:807
 msgid "there is an undefined variable"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:783
+#: src/scm/webid-oidc/errors.scm:809
 #, scheme-format
 msgid "the origin is ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:786
+#: src/scm/webid-oidc/errors.scm:812
 #, scheme-format
 msgid "a message is attached: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:789
+#: src/scm/webid-oidc/errors.scm:815
 #, scheme-format
 msgid "the values ~s are problematic"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:792
+#: src/scm/webid-oidc/errors.scm:818
 msgid "there is a kind and args"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:794
+#: src/scm/webid-oidc/errors.scm:820
 msgid "there is an assertion failure"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:796
+#: src/scm/webid-oidc/errors.scm:822
 #, scheme-format
 msgid "the program quits with code ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:799
+#: src/scm/webid-oidc/errors.scm:825
 msgid "the program cannot recover from this exception"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:801
+#: src/scm/webid-oidc/errors.scm:827
 msgid "there is an error"
 msgstr ""
 
-#: src/scm/webid-oidc/errors.scm:803
+#: src/scm/webid-oidc/errors.scm:829
 #, scheme-format
 msgid "Unhandled exception type ~a."
 msgstr ""
diff --git a/src/scm/webid-oidc/Makefile.am b/src/scm/webid-oidc/Makefile.am
index ecb3f0a..31c23ab 100644
--- a/src/scm/webid-oidc/Makefile.am
+++ b/src/scm/webid-oidc/Makefile.am
@@ -8,7 +8,8 @@ dist_webidoidcmod_DATA += \
   %reldir%/oidc-configuration.scm \
   %reldir%/access-token.scm \
   %reldir%/jti.scm \
-  %reldir%/dpop-proof.scm
+  %reldir%/dpop-proof.scm \
+  %reldir%/fetch.scm
 webidoidcgo_DATA += \
   %reldir%/errors.go \
   %reldir%/stubs.go \
@@ -19,4 +20,5 @@ webidoidcgo_DATA += \
   %reldir%/oidc-configuration.go \
   %reldir%/access-token.go \
   %reldir%/jti.go \
-  %reldir%/dpop-proof.go
+  %reldir%/dpop-proof.go \
+  %reldir%/fetch.go
diff --git a/src/scm/webid-oidc/errors.scm b/src/scm/webid-oidc/errors.scm
index 959b04e..2dc9edc 100644
--- a/src/scm/webid-oidc/errors.scm
+++ b/src/scm/webid-oidc/errors.scm
@@ -37,6 +37,16 @@
   (raise-exception
    ((record-constructor &not-json) value cause)))
 
+(define-public &not-turtle
+  (make-exception-type
+   '&not-turtle
+   &external-error
+   '(value cause)))
+
+(define-public (raise-not-turtle value cause)
+  (raise-exception
+   ((record-constructor &not-turtle) value cause)))
+
 (define-public &unsupported-crv
   (make-exception-type
    '&unsupported-crv
@@ -529,6 +539,16 @@
   (raise-exception
    ((record-constructor &cannot-encode-dpop-proof) dpop-proof key cause)))
 
+(define-public &cannot-fetch-linked-data
+  (make-exception-type
+   '&cannot-fetch-linked-data
+   &external-error
+   '(uri cause)))
+
+(define-public (raise-cannot-fetch-linked-data uri cause)
+  (raise-exception
+   ((record-constructor &cannot-fetch-linked-data) uri cause)))
+
 (define*-public (error->str err #:key (max-depth #f))
   (if (record? err)
       (let* ((type (record-type-descriptor err))
@@ -547,6 +567,9 @@
           ((&not-json)
            (format #f (G_ "the value ~s is not JSON (because ~a)")
                    (get 'value) (recurse (get 'cause))))
+          ((&not-turtle)
+           (format #f (G_ "the value ~s is not Turtle (because ~a)")
+                   (get 'value) (recurse (get 'cause))))
           ((&unsupported-crv)
            (format #f (G_ "the value ~s does not identify an elleptic curve")
                    (get 'crv)))
@@ -761,6 +784,9 @@
           ((&cannot-encode-dpop-proof)
            (format #f (G_ "I cannot encode ~s as a DPoP proof (because ~a)")
                    (get 'value) (recurse (get 'cause))))
+          ((&cannot-fetch-linked-data)
+           (format #f (G_ "I could not fetch a RDF graph at ~a (because ~a)")
+                   (uri->string (get 'uri)) (recurse (get 'cause))))
           ((&compound-exception)
            (let ((components (get 'components)))
              (if (null? components)
diff --git a/src/scm/webid-oidc/fetch.scm b/src/scm/webid-oidc/fetch.scm
new file mode 100644
index 0000000..6642ed1
--- /dev/null
+++ b/src/scm/webid-oidc/fetch.scm
@@ -0,0 +1,44 @@
+(define-module (webid-oidc fetch)
+  #:use-module (webid-oidc errors)
+  #:use-module (ice-9 optargs)
+  #:use-module (ice-9 receive)
+  #:use-module (rnrs bytevectors)
+  #:use-module (web client)
+  #:use-module (web request)
+  #:use-module (web response)
+  #:use-module (web uri)
+  #:use-module (turtle tordf))
+
+(define*-public (fetch uri #:key (http-get http-get))
+  (unless (uri? uri)
+    (set! uri (string->uri uri)))
+  (with-exception-handler
+      (lambda (error)
+        (raise-cannot-fetch-linked-data uri error))
+    (lambda ()
+      (receive (response response-body)
+          (http-get uri
+                    #:headers `((accept (text/turtle))))
+        (with-exception-handler
+            (lambda (error)
+              (raise-unexpected-response response error))
+          (lambda ()
+            (unless (eqv? (response-code response) 200)
+              (raise-request-failed-unexpectedly (response-code response)
+                                                 (response-reason-phrase response)))
+            (let ((content-type (response-content-type response)))
+              (unless (and content-type
+                           (eq? (car content-type) 'text/turtle)
+                           (or (not (assq-ref (cdr content-type) 'charset))
+                               (equal? (assq-ref (cdr content-type) 'charset) "utf-8")))
+                (raise-unexpected-header-value 'content-type content-type)))
+            (when (bytevector? response-body)
+              (set! response-body (utf8->string response-body)))
+            (with-exception-handler
+                (lambda (rdf-error)
+                  (raise-not-turtle response-body rdf-error))
+              (lambda ()
+                (turtle->rdf (string-append
+                              "# This is not a file name\n"
+                              response-body)
+                             (uri->string uri))))))))))