The server supports XML catalogs.

This will be used to set up an integration test suite with HTTPS,
without needing to provide certificates, because the test harness will
have an XML catalog mapping HTTPS targets to local HTTP mockups.

5 files changed, 545 insertions, 223 deletions

diff --git a/po/fr.po b/po/fr.po
index 8e6ed59..c9d910c 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc 0.0.0\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-07-27 16:04+0200\n"
-"PO-Revision-Date: 2021-07-27 16:12+0200\n"
+"POT-Creation-Date: 2021-07-28 16:56+0200\n"
+"PO-Revision-Date: 2021-07-28 16:58+0200\n"
 "Last-Translator: Vivien Kraus <vivien@planete-kraus.eu>\n"
 "Language-Team: French <vivien@planete-kraus.eu>\n"
 "Language: fr\n"
@@ -1012,15 +1012,15 @@ msgid "Warning: ~a\n"
 msgstr "Avertissement : ~a\n"
 
 #: src/scm/webid-oidc/hello-world.scm:48 src/scm/webid-oidc/example-app.scm:116
-#: src/scm/webid-oidc/program.scm:204
+#: src/scm/webid-oidc/program.scm:217
 msgid "command-line|version"
 msgstr "version"
 
-#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:206
+#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:219
 msgid "command-line|complete-corresponding-source"
 msgstr "code-source-correspondant-complet"
 
-#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:208
+#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:221
 msgid "command-line|help"
 msgstr "aide"
 
@@ -1028,11 +1028,11 @@ msgstr "aide"
 msgid "command-line|port"
 msgstr "port"
 
-#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:238
+#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:251
 msgid "command-line|log-file"
 msgstr "fichier-journal"
 
-#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:240
+#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:253
 msgid "command-line|error-file"
 msgstr "fichier-erreur"
 
@@ -1091,12 +1091,12 @@ msgstr ""
 "      redirige la sortie d’erreur du programme vers ce fichier.\n"
 
 #: src/scm/webid-oidc/hello-world.scm:103
-#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:544
+#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:568
 #, scheme-format
 msgid "~a version ~a\n"
 msgstr "~a version ~a\n"
 
-#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:552
+#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:576
 msgid ""
 "You are legally required to link to the complete corresponding source code.\n"
 msgstr ""
@@ -1258,12 +1258,12 @@ msgstr ""
 msgid "There was an error: ~a\n"
 msgstr "Il y a eu une erreur : ~a\n"
 
-#: src/scm/webid-oidc/program.scm:98
+#: src/scm/webid-oidc/program.scm:111
 #, scheme-format
 msgid "~a: ~a: Internal server error: ~a\n"
 msgstr "~a : ~a : Erreur interne du serveur : ~a\n"
 
-#: src/scm/webid-oidc/program.scm:112
+#: src/scm/webid-oidc/program.scm:125
 #, scheme-format
 msgid ""
 "The client locale ~s can’t be approximated by system locale ~s (because ~a), "
@@ -1272,88 +1272,88 @@ msgstr ""
 "La locale du client ~s ne peut pas être approchée par la locale système ~s "
 "(parce que ~a), on utilise C.\n"
 
-#: src/scm/webid-oidc/program.scm:136
+#: src/scm/webid-oidc/program.scm:149
 #, scheme-format
 msgid "~a: ~s ~a ~s ~a\n"
 msgstr "~a : ~s ~a ~s ~a\n"
 
-#: src/scm/webid-oidc/program.scm:138
+#: src/scm/webid-oidc/program.scm:151
 #, scheme-format
 msgid "~a: ~a (~a)"
 msgstr "~a : ~a (~a)"
 
-#: src/scm/webid-oidc/program.scm:142
+#: src/scm/webid-oidc/program.scm:155
 #, scheme-format
 msgid "~a: ~a"
 msgstr "~a : ~a"
 
-#: src/scm/webid-oidc/program.scm:152
+#: src/scm/webid-oidc/program.scm:165
 #, scheme-format
 msgid "(there was an error: ~a)"
 msgstr "(il y a eu une erreur : ~a)"
 
-#: src/scm/webid-oidc/program.scm:210
+#: src/scm/webid-oidc/program.scm:223
 msgid "command-line|server|port"
 msgstr "port"
 
-#: src/scm/webid-oidc/program.scm:212
+#: src/scm/webid-oidc/program.scm:225
 msgid "command-line|server|server-name"
 msgstr "nom-du-serveur"
 
-#: src/scm/webid-oidc/program.scm:214
+#: src/scm/webid-oidc/program.scm:227
 msgid "command-line|server|reverse-proxy|backend-uri"
 msgstr "uri-arrière-plan"
 
-#: src/scm/webid-oidc/program.scm:216
+#: src/scm/webid-oidc/program.scm:229
 msgid "command-line|server|reverse-proxy|header"
 msgstr "en-tête"
 
-#: src/scm/webid-oidc/program.scm:218
+#: src/scm/webid-oidc/program.scm:231
 msgid "command-line|server|issuer|key-file"
 msgstr "fichier-clé"
 
-#: src/scm/webid-oidc/program.scm:220
+#: src/scm/webid-oidc/program.scm:233
 msgid "command-line|server|issuer|subject"
 msgstr "sujet"
 
-#: src/scm/webid-oidc/program.scm:222
+#: src/scm/webid-oidc/program.scm:235
 msgid "command-line|server|issuer|encrypted-password"
 msgstr "mot-de-passe-chiffré"
 
-#: src/scm/webid-oidc/program.scm:224
+#: src/scm/webid-oidc/program.scm:237
 msgid "command-line|server|issuer|jwks-uri"
 msgstr "uri-jwks"
 
-#: src/scm/webid-oidc/program.scm:226
+#: src/scm/webid-oidc/program.scm:239
 msgid "command-line|server|issuer|authorization-endpoint-uri"
 msgstr "uri-terminal-autorisation"
 
-#: src/scm/webid-oidc/program.scm:228
+#: src/scm/webid-oidc/program.scm:241
 msgid "command-line|server|issuer|token-endpoint-uri"
 msgstr "uri-terminal-jeton"
 
-#: src/scm/webid-oidc/program.scm:230
+#: src/scm/webid-oidc/program.scm:243
 msgid "command-line|server|client-id"
 msgstr "id-client"
 
-#: src/scm/webid-oidc/program.scm:232
+#: src/scm/webid-oidc/program.scm:245
 msgid "command-line|server|redirect-uri"
 msgstr "uri-redirection"
 
-#: src/scm/webid-oidc/program.scm:234
+#: src/scm/webid-oidc/program.scm:247
 msgid "command-line|server|client-name"
 msgstr "nom-client"
 
-#: src/scm/webid-oidc/program.scm:236
+#: src/scm/webid-oidc/program.scm:249
 msgid "command-line|server|client-uri"
 msgstr "uri-client"
 
-#: src/scm/webid-oidc/program.scm:265
+#: src/scm/webid-oidc/program.scm:278
 #, scheme-format
 msgid "Usage: ~a COMMAND [OPTIONS]...\n"
 msgstr "Utilisation : ~a COMMANDE [OPTIONS]...\n"
 
-#: src/scm/webid-oidc/program.scm:269
+#: src/scm/webid-oidc/program.scm:282
 msgid ""
 "\n"
 "Run the webid-oidc COMMAND."
@@ -1361,7 +1361,7 @@ msgstr ""
 "\n"
 "Exécute la COMMANDE webid-oidc."
 
-#: src/scm/webid-oidc/program.scm:272
+#: src/scm/webid-oidc/program.scm:285
 msgid ""
 "\n"
 "This program is covered by the GNU Affero GPL, version 3 or\n"
@@ -1377,7 +1377,7 @@ msgstr ""
 "code source complet correspondant (avec vos modifications) sans\n"
 "frais. Le serveur ajoute un en-tête « Source: » à toutes les réponses."
 
-#: src/scm/webid-oidc/program.scm:279
+#: src/scm/webid-oidc/program.scm:292
 msgid ""
 "\n"
 "Available commands:"
@@ -1385,7 +1385,7 @@ msgstr ""
 "\n"
 "Commandes disponibles :"
 
-#: src/scm/webid-oidc/program.scm:281
+#: src/scm/webid-oidc/program.scm:294
 #, scheme-format
 msgid ""
 "\n"
@@ -1396,12 +1396,12 @@ msgstr ""
 "  ~a :\n"
 "      exécute le proxy inverse authentifiant."
 
-#: src/scm/webid-oidc/program.scm:284 src/scm/webid-oidc/program.scm:456
-#: src/scm/webid-oidc/program.scm:625
+#: src/scm/webid-oidc/program.scm:297 src/scm/webid-oidc/program.scm:480
+#: src/scm/webid-oidc/program.scm:649
 msgid "command-line|command|reverse-proxy"
 msgstr "proxy-inversé"
 
-#: src/scm/webid-oidc/program.scm:285
+#: src/scm/webid-oidc/program.scm:298
 #, scheme-format
 msgid ""
 "\n"
@@ -1412,12 +1412,12 @@ msgstr ""
 "  ~a :\n"
 "      exécute un fournisseur d’identité."
 
-#: src/scm/webid-oidc/program.scm:288 src/scm/webid-oidc/program.scm:481
-#: src/scm/webid-oidc/program.scm:647
+#: src/scm/webid-oidc/program.scm:301 src/scm/webid-oidc/program.scm:505
+#: src/scm/webid-oidc/program.scm:671
 msgid "command-line|command|identity-provider"
 msgstr "fournisseur-identité"
 
-#: src/scm/webid-oidc/program.scm:289
+#: src/scm/webid-oidc/program.scm:302
 #, scheme-format
 msgid ""
 "\n"
@@ -1428,12 +1428,12 @@ msgstr ""
 "  ~a :\n"
 "      sert les pages d’une application publique."
 
-#: src/scm/webid-oidc/program.scm:292 src/scm/webid-oidc/program.scm:502
-#: src/scm/webid-oidc/program.scm:691
+#: src/scm/webid-oidc/program.scm:305 src/scm/webid-oidc/program.scm:526
+#: src/scm/webid-oidc/program.scm:715
 msgid "command-line|command|client-service"
 msgstr "service-client"
 
-#: src/scm/webid-oidc/program.scm:293
+#: src/scm/webid-oidc/program.scm:306
 #, scheme-format
 msgid ""
 "\n"
@@ -1446,12 +1446,12 @@ msgstr ""
 "      exécute un serveur complet, avec un fournisseur d’identité et\n"
 "      une fonction de stockage de ressources."
 
-#: src/scm/webid-oidc/program.scm:297 src/scm/webid-oidc/program.scm:528
-#: src/scm/webid-oidc/program.scm:720
+#: src/scm/webid-oidc/program.scm:310 src/scm/webid-oidc/program.scm:552
+#: src/scm/webid-oidc/program.scm:744
 msgid "command-line|command|server"
 msgstr "serveur"
 
-#: src/scm/webid-oidc/program.scm:299
+#: src/scm/webid-oidc/program.scm:312
 msgid ""
 "\n"
 "General options:"
@@ -1459,7 +1459,7 @@ msgstr ""
 "\n"
 "Options générales :"
 
-#: src/scm/webid-oidc/program.scm:301
+#: src/scm/webid-oidc/program.scm:314
 #, scheme-format
 msgid ""
 "\n"
@@ -1473,7 +1473,7 @@ msgstr ""
 "      correspondant. Par exemple, MOYEN serait une URI pointant vers\n"
 "      l’archive de code."
 
-#: src/scm/webid-oidc/program.scm:306
+#: src/scm/webid-oidc/program.scm:319
 #, scheme-format
 msgid ""
 "\n"
@@ -1484,7 +1484,7 @@ msgstr ""
 "  -h, --~a :\n"
 "      affiche un court message d’aide et quitte."
 
-#: src/scm/webid-oidc/program.scm:310
+#: src/scm/webid-oidc/program.scm:323
 #, scheme-format
 msgid ""
 "\n"
@@ -1495,7 +1495,7 @@ msgstr ""
 "  -v, --~a :\n"
 "      affiche le numéro de version (~a) et quitte."
 
-#: src/scm/webid-oidc/program.scm:315
+#: src/scm/webid-oidc/program.scm:328
 #, scheme-format
 msgid ""
 "\n"
@@ -1506,7 +1506,7 @@ msgstr ""
 "  -l FICHIER.journal, --~a=FICHIER.journal :\n"
 "      redirige la sortie standard du programme vers FICHIER.journal."
 
-#: src/scm/webid-oidc/program.scm:319
+#: src/scm/webid-oidc/program.scm:332
 #, scheme-format
 msgid ""
 "\n"
@@ -1517,7 +1517,7 @@ msgstr ""
 "  -e FICHIER.erreurs, --~a=FICHIER.erreurs :\n"
 "      redirige les erreurs du programme vers FICHIER.erreurs."
 
-#: src/scm/webid-oidc/program.scm:324
+#: src/scm/webid-oidc/program.scm:337
 msgid ""
 "\n"
 "General server-side options:"
@@ -1525,7 +1525,7 @@ msgstr ""
 "\n"
 "Options générales pour un serveur :"
 
-#: src/scm/webid-oidc/program.scm:326
+#: src/scm/webid-oidc/program.scm:339
 #, scheme-format
 msgid ""
 "\n"
@@ -1536,7 +1536,7 @@ msgstr ""
 "  -p PORT, --~a=PORT :\n"
 "      définit le port à lier, 8080 par défaut."
 
-#: src/scm/webid-oidc/program.scm:330
+#: src/scm/webid-oidc/program.scm:343
 #, scheme-format
 msgid ""
 "\n"
@@ -1548,7 +1548,7 @@ msgstr ""
 "      définit l’URI publique du serveur (schéma, identifiant de\n"
 "      l’utilisateur, hôte et port)."
 
-#: src/scm/webid-oidc/program.scm:335
+#: src/scm/webid-oidc/program.scm:348
 msgid ""
 "\n"
 "Options for the resource server:"
@@ -1556,7 +1556,7 @@ msgstr ""
 "\n"
 "Options pour le serveur de ressources :"
 
-#: src/scm/webid-oidc/program.scm:337
+#: src/scm/webid-oidc/program.scm:350
 #, scheme-format
 msgid ""
 "\n"
@@ -1571,7 +1571,7 @@ msgstr ""
 "      authentifié, XXX-Agent par défaut. Pour un serveur complet, ceci\n"
 "      désactive l’authentification par webid-oidc."
 
-#: src/scm/webid-oidc/program.scm:343
+#: src/scm/webid-oidc/program.scm:356
 #, scheme-format
 msgid ""
 "\n"
@@ -1584,7 +1584,7 @@ msgstr ""
 "      définit l’URI sortante du proxy inversé, seulement pour la\n"
 "      commande proxy-inversé."
 
-#: src/scm/webid-oidc/program.scm:349
+#: src/scm/webid-oidc/program.scm:362
 msgid ""
 "\n"
 "Options for the identity provider:"
@@ -1592,7 +1592,7 @@ msgstr ""
 "\n"
 "Options du fournisseur d’identité :"
 
-#: src/scm/webid-oidc/program.scm:351
+#: src/scm/webid-oidc/program.scm:364
 #, scheme-format
 msgid ""
 "\n"
@@ -1606,7 +1606,7 @@ msgstr ""
 "      nouvelle clé sera générée. Le serveur n’offre pas de service\n"
 "      HTTPS."
 
-#: src/scm/webid-oidc/program.scm:356
+#: src/scm/webid-oidc/program.scm:369
 #, scheme-format
 msgid ""
 "\n"
@@ -1617,7 +1617,7 @@ msgstr ""
 "  -s WEBID, --~a=WEBID :\n"
 "      définit l'identité du sujet."
 
-#: src/scm/webid-oidc/program.scm:360
+#: src/scm/webid-oidc/program.scm:373
 #, scheme-format
 msgid ""
 "\n"
@@ -1628,7 +1628,7 @@ msgstr ""
 "  -w MOT_DE_PASSE_CHIFFRÉ, --~a=MOT_DE_PASSE_CHIFFRÉ :\n"
 "      définit le mot de passe chiffré pour reconnaître l’utilisateur."
 
-#: src/scm/webid-oidc/program.scm:364
+#: src/scm/webid-oidc/program.scm:377
 #, scheme-format
 msgid ""
 "\n"
@@ -1639,7 +1639,7 @@ msgstr ""
 "  -j URI, --~a=URI :\n"
 "        définit l’URI pour requêter les clés du serveur."
 
-#: src/scm/webid-oidc/program.scm:368
+#: src/scm/webid-oidc/program.scm:381
 #, scheme-format
 msgid ""
 "\n"
@@ -1651,7 +1651,7 @@ msgstr ""
 "      définit l'URI du terminal d'autorisation de l’émetteur\n"
 "      d’identité."
 
-#: src/scm/webid-oidc/program.scm:372
+#: src/scm/webid-oidc/program.scm:385
 #, scheme-format
 msgid ""
 "\n"
@@ -1662,7 +1662,7 @@ msgstr ""
 "  -t URI, --~a=URI :\n"
 "      définit le terminal de jeton de l’émetteur d’identité."
 
-#: src/scm/webid-oidc/program.scm:377
+#: src/scm/webid-oidc/program.scm:390
 msgid ""
 "\n"
 "Options for the client service:"
@@ -1670,7 +1670,7 @@ msgstr ""
 "\n"
 "Options pour le service associé à un client :"
 
-#: src/scm/webid-oidc/program.scm:379
+#: src/scm/webid-oidc/program.scm:392
 #, scheme-format
 msgid ""
 "\n"
@@ -1683,7 +1683,7 @@ msgstr ""
 "      définit l’identifiant web de l’application client, qui est\n"
 "      déréférencé pour une ressource sémantique."
 
-#: src/scm/webid-oidc/program.scm:384
+#: src/scm/webid-oidc/program.scm:397
 #, scheme-format
 msgid ""
 "\n"
@@ -1697,7 +1697,7 @@ msgstr ""
 "      d’autorisation. La page de redirection affiche le code à coller\n"
 "      dans l’application."
 
-#: src/scm/webid-oidc/program.scm:389
+#: src/scm/webid-oidc/program.scm:402
 #, scheme-format
 msgid ""
 "\n"
@@ -1709,7 +1709,7 @@ msgstr ""
 "      définit le nom de l’application visible par l’utilisateur (peut\n"
 "      être trompeur…)."
 
-#: src/scm/webid-oidc/program.scm:393
+#: src/scm/webid-oidc/program.scm:406
 #, scheme-format
 msgid ""
 "\n"
@@ -1722,7 +1722,7 @@ msgstr ""
 "      définit l’URI présentant plus d’informations à propos de\n"
 "      l’application (peut aussi être trompeur)."
 
-#: src/scm/webid-oidc/program.scm:399
+#: src/scm/webid-oidc/program.scm:412
 msgid ""
 "\n"
 "Environment variables:"
@@ -1730,18 +1730,28 @@ msgstr ""
 "\n"
 "Variables d’environnement :"
 
-#: src/scm/webid-oidc/program.scm:401
+#: src/scm/webid-oidc/program.scm:414
 msgid ""
 "\n"
-"  LANG: set the locale of the user interface (for the server commands,\n"
-"      the user is the system administrator)."
+"  XML_CATALOG_FILES: the server will fetch resources on the web. By\n"
+"      setting this environment variable to a space-separated list of\n"
+"      catalog URIs, the server will redirect these requests to another\n"
+"      server. Currently, it is not possible to load files from the\n"
+"      file system, because there is no way to specify the\n"
+"      content-type."
 msgstr ""
 "\n"
-"  LANG : définit la locale de l’interface utilisateur (pour les\n"
-"      commandes serveur, l’utilisateur est l’administrateur système)."
+"  XML_CATALOG_FILES : le serveur devra télécharger des ressources sur\n"
+"      le web. En définissant la valeur de cette variable\n"
+"      d’environnement par une liste d’URIs de catalogues séparés par\n"
+"      des espaces, le serveur redirigera ces requêtes vers un autre\n"
+"      serveur. Actuellement il n’est pas possible de charger des\n"
+"      fichiers depuis le système de fichiers, parce qu’il n’y a pas de\n"
+"      moyen de spécifier le type de contenu."
 
-#: src/scm/webid-oidc/program.scm:405 src/scm/webid-oidc/program.scm:414
-#: src/scm/webid-oidc/program.scm:422 src/scm/webid-oidc/program.scm:430
+#: src/scm/webid-oidc/program.scm:422 src/scm/webid-oidc/program.scm:429
+#: src/scm/webid-oidc/program.scm:438 src/scm/webid-oidc/program.scm:446
+#: src/scm/webid-oidc/program.scm:454
 #, scheme-format
 msgid ""
 "the-environment-variable|\n"
@@ -1750,7 +1760,17 @@ msgstr ""
 " \n"
 "      Elle vaut actuellement ~s."
 
-#: src/scm/webid-oidc/program.scm:408
+#: src/scm/webid-oidc/program.scm:425
+msgid ""
+"\n"
+"  LANG: set the locale of the user interface (for the server commands,\n"
+"      the user is the system administrator)."
+msgstr ""
+"\n"
+"  LANG : définit la locale de l’interface utilisateur (pour les\n"
+"      commandes serveur, l’utilisateur est l’administrateur système)."
+
+#: src/scm/webid-oidc/program.scm:432
 msgid ""
 "\n"
 "  XDG_DATA_HOME: where the program stores persistent data. The\n"
@@ -1765,7 +1785,7 @@ msgstr ""
 "      ici. Pour un service système, il est recommandé d’utiliser\n"
 "      /var/lib."
 
-#: src/scm/webid-oidc/program.scm:417
+#: src/scm/webid-oidc/program.scm:441
 msgid ""
 "\n"
 "  XDG_CACHE_HOME: where the program stores and updates the seed file,\n"
@@ -1778,7 +1798,7 @@ msgstr ""
 "      supprimer ce dossier n’importe quand. Le fichier de graine sera\n"
 "      initialisé à partir de /dev/random."
 
-#: src/scm/webid-oidc/program.scm:425
+#: src/scm/webid-oidc/program.scm:449
 msgid ""
 "\n"
 "  HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n"
@@ -1790,7 +1810,7 @@ msgstr ""
 "      valeur est calculée à partir de la variable d’environnement\n"
 "      HOME. Elle n’est pas utilisée autrement."
 
-#: src/scm/webid-oidc/program.scm:434
+#: src/scm/webid-oidc/program.scm:458
 msgid ""
 "\n"
 "Running a reverse proxy"
@@ -1798,7 +1818,7 @@ msgstr ""
 "\n"
 "Exécution d’un proxy inversé"
 
-#: src/scm/webid-oidc/program.scm:436
+#: src/scm/webid-oidc/program.scm:460
 msgid ""
 "\n"
 "Suppose that you operate data.provider.com. You want to run an\n"
@@ -1820,7 +1840,7 @@ msgstr ""
 "authentifié. https://private.data.provider.com ne doit accepter que\n"
 "les requêtes depuis ce proxy inversé."
 
-#: src/scm/webid-oidc/program.scm:446
+#: src/scm/webid-oidc/program.scm:470
 #, scheme-format
 msgid ""
 "\n"
@@ -1844,7 +1864,7 @@ msgstr ""
 "      --~a '/var/log/proxy.log' \\\n"
 "      --~a '/var/log/proxy.err'"
 
-#: src/scm/webid-oidc/program.scm:461
+#: src/scm/webid-oidc/program.scm:485
 msgid ""
 "\n"
 "Running an identity provider"
@@ -1852,7 +1872,7 @@ msgstr ""
 "\n"
 "Exécution d’un fournisseur d’identité"
 
-#: src/scm/webid-oidc/program.scm:463
+#: src/scm/webid-oidc/program.scm:487
 msgid ""
 "\n"
 "The identity provider running at webid-oidc-demo.planete-kraus.eu is\n"
@@ -1863,7 +1883,7 @@ msgstr ""
 "webid-oidc-demo.planete-kraus.eu est invoqué avec les options\n"
 "suivantes :"
 
-#: src/scm/webid-oidc/program.scm:467
+#: src/scm/webid-oidc/program.scm:491
 #, scheme-format
 msgid ""
 "\n"
@@ -1897,7 +1917,7 @@ msgstr ""
 "      --~a 'https://webid-oidc-demo.planete-kraus.eu/token' \\\n"
 "      --~a $PORT"
 
-#: src/scm/webid-oidc/program.scm:487
+#: src/scm/webid-oidc/program.scm:511
 msgid ""
 "\n"
 "Running the public pages for an application"
@@ -1905,7 +1925,7 @@ msgstr ""
 "\n"
 "Service des pages publiques pour une application"
 
-#: src/scm/webid-oidc/program.scm:489
+#: src/scm/webid-oidc/program.scm:513
 msgid ""
 "\n"
 "The example client application pages for\n"
@@ -1915,7 +1935,7 @@ msgstr ""
 "Les pages de l’application client d’exemple pour\n"
 "webid-oidc-demo.planete-kraus.eu sont servies de cette façon :"
 
-#: src/scm/webid-oidc/program.scm:493
+#: src/scm/webid-oidc/program.scm:517
 #, scheme-format
 msgid ""
 "\n"
@@ -1943,7 +1963,7 @@ msgstr ""
 "html#Running-a-client' \\\n"
 "      --~a $PORT"
 
-#: src/scm/webid-oidc/program.scm:507
+#: src/scm/webid-oidc/program.scm:531
 msgid ""
 "\n"
 "Running a full server"
@@ -1951,7 +1971,7 @@ msgstr ""
 "\n"
 "Exécution d’un serveur complet"
 
-#: src/scm/webid-oidc/program.scm:510
+#: src/scm/webid-oidc/program.scm:534
 msgid ""
 "\n"
 "To run the server with identity provider and\n"
@@ -1963,7 +1983,7 @@ msgstr ""
 "un serveur de ressources pour un utilisateur particulier, vous devez\n"
 "combiner les options des parties."
 
-#: src/scm/webid-oidc/program.scm:514
+#: src/scm/webid-oidc/program.scm:538
 #, scheme-format
 msgid ""
 "\n"
@@ -1997,7 +2017,7 @@ msgstr ""
 "      --~a 'https://data.planete-kraus.eu/token' \\\n"
 "      --~a '...port...'"
 
-#: src/scm/webid-oidc/program.scm:539
+#: src/scm/webid-oidc/program.scm:563
 #, scheme-format
 msgid ""
 "\n"
@@ -2006,27 +2026,27 @@ msgstr ""
 "\n"
 "Si vous trouvez une erreur, veuillez en envoyer un rapport à ~a."
 
-#: src/scm/webid-oidc/program.scm:559
+#: src/scm/webid-oidc/program.scm:583
 #, scheme-format
 msgid "The --~a argument must be a number, not ~s.\n"
 msgstr "L’argument de --~a doit être un nombre, pas ~s.\n"
 
-#: src/scm/webid-oidc/program.scm:565
+#: src/scm/webid-oidc/program.scm:589
 #, scheme-format
 msgid "The --~a argument must be an integer, not ~s.\n"
 msgstr "L’argument de --~a doit être un entier, pas ~s.\n"
 
-#: src/scm/webid-oidc/program.scm:571
+#: src/scm/webid-oidc/program.scm:595
 #, scheme-format
 msgid "The --~a argument must be positive, ~s is invalid.\n"
 msgstr "L’argument de --~a doit être positif, ~s est invalide.\n"
 
-#: src/scm/webid-oidc/program.scm:576
+#: src/scm/webid-oidc/program.scm:600
 #, scheme-format
 msgid "The --~a argument must be less than 65536, ~s is invalid.\n"
 msgstr "L’argument de --~a doit être inférieur à 65536, ~s est invalide.\n"
 
-#: src/scm/webid-oidc/program.scm:618
+#: src/scm/webid-oidc/program.scm:642
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
@@ -2035,18 +2055,18 @@ msgstr ""
 "Utilisation : ~a COMMANDE [OPTIONS]...\n"
 "Voir --~a (-h).\n"
 
-#: src/scm/webid-oidc/program.scm:628 src/scm/webid-oidc/program.scm:650
-#: src/scm/webid-oidc/program.scm:722
+#: src/scm/webid-oidc/program.scm:652 src/scm/webid-oidc/program.scm:674
+#: src/scm/webid-oidc/program.scm:746
 #, scheme-format
 msgid "You must pass --~a to set the server name.\n"
 msgstr "Vous devez passer --~a pour définir le nom du serveur.\n"
 
-#: src/scm/webid-oidc/program.scm:632
+#: src/scm/webid-oidc/program.scm:656
 #, scheme-format
 msgid "You must pass --~a to set the backend URI.\n"
 msgstr "Vous devez passer --~a pour définir l'URI du service d’arrière-plan.\n"
 
-#: src/scm/webid-oidc/program.scm:654 src/scm/webid-oidc/program.scm:726
+#: src/scm/webid-oidc/program.scm:678 src/scm/webid-oidc/program.scm:750
 #, scheme-format
 msgid ""
 "You must pass --~a to set the file where to store the identity provider "
@@ -2055,59 +2075,59 @@ msgstr ""
 "Vous devez passer --~a pour définir le nom du fichier pour sauvegarder\n"
 "la clé du fournisseur d’identité.\n"
 
-#: src/scm/webid-oidc/program.scm:658 src/scm/webid-oidc/program.scm:730
+#: src/scm/webid-oidc/program.scm:682 src/scm/webid-oidc/program.scm:754
 #, scheme-format
 msgid "You must pass --~a to set the subject of the identity provider.\n"
 msgstr ""
 "Vous devez passer --~a pour définir le sujet du fournisseur d’identité.\n"
 
-#: src/scm/webid-oidc/program.scm:662 src/scm/webid-oidc/program.scm:734
+#: src/scm/webid-oidc/program.scm:686 src/scm/webid-oidc/program.scm:758
 #, scheme-format
 msgid "You must pass --~a to set the subject’s encrypted password.\n"
 msgstr ""
 "Vous devez passer --~a pour définir le mot de passe chiffré du sujet.\n"
 
-#: src/scm/webid-oidc/program.scm:666 src/scm/webid-oidc/program.scm:738
+#: src/scm/webid-oidc/program.scm:690 src/scm/webid-oidc/program.scm:762
 #, scheme-format
 msgid "You must pass --~a to set the JWKS URI.\n"
 msgstr "Vous devez passer --~a pour définir l'URI du JWKS.\n"
 
-#: src/scm/webid-oidc/program.scm:670 src/scm/webid-oidc/program.scm:742
+#: src/scm/webid-oidc/program.scm:694 src/scm/webid-oidc/program.scm:766
 #, scheme-format
 msgid "You must pass --~a to set the authorization endpoint URI.\n"
 msgstr ""
 "Vous devez passer --~a pour définir l'URI du terminal d'autorisation.\n"
 
-#: src/scm/webid-oidc/program.scm:674 src/scm/webid-oidc/program.scm:746
+#: src/scm/webid-oidc/program.scm:698 src/scm/webid-oidc/program.scm:770
 #, scheme-format
 msgid "You must pass --~a to set the token endpoint URI.\n"
 msgstr "Vous devez passer --~a pour définir l'URI du terminal de jeton.\n"
 
-#: src/scm/webid-oidc/program.scm:694
+#: src/scm/webid-oidc/program.scm:718
 #, scheme-format
 msgid "You must pass --~a to set the application web ID.\n"
 msgstr ""
 "Vous devez passer --~a pour définir l'identifiant web de l’application.\n"
 
-#: src/scm/webid-oidc/program.scm:698
+#: src/scm/webid-oidc/program.scm:722
 #, scheme-format
 msgid "You must pass --~a to set the redirection URI.\n"
 msgstr "Vous devez passer --~a pour définir l'URI de redirection.\n"
 
-#: src/scm/webid-oidc/program.scm:702
+#: src/scm/webid-oidc/program.scm:726
 #, scheme-format
 msgid "You must pass --~a to set the informative client name.\n"
 msgstr ""
 "Vous devez passer --~a pour donner un nom pour l’application à titre "
 "informatif.\n"
 
-#: src/scm/webid-oidc/program.scm:706
+#: src/scm/webid-oidc/program.scm:730
 #, scheme-format
 msgid "You must pass --~a to set the informative client URI.\n"
 msgstr ""
 "Vous devez passer --~a pour définir l'URI du client, à titre informatif.\n"
 
-#: src/scm/webid-oidc/program.scm:793
+#: src/scm/webid-oidc/program.scm:817
 #, scheme-format
 msgid "Unknown command ~s\n"
 msgstr "Commande inconnue ~s\n"
diff --git a/po/webid-oidc.pot b/po/webid-oidc.pot
index 2507196..94c0247 100644
--- a/po/webid-oidc.pot
+++ b/po/webid-oidc.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: webid-oidc SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-07-27 16:04+0200\n"
+"POT-Creation-Date: 2021-07-28 16:56+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -969,15 +969,15 @@ msgid "Warning: ~a\n"
 msgstr ""
 
 #: src/scm/webid-oidc/hello-world.scm:48 src/scm/webid-oidc/example-app.scm:116
-#: src/scm/webid-oidc/program.scm:204
+#: src/scm/webid-oidc/program.scm:217
 msgid "command-line|version"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:206
+#: src/scm/webid-oidc/hello-world.scm:50 src/scm/webid-oidc/program.scm:219
 msgid "command-line|complete-corresponding-source"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:208
+#: src/scm/webid-oidc/hello-world.scm:52 src/scm/webid-oidc/program.scm:221
 msgid "command-line|help"
 msgstr ""
 
@@ -985,11 +985,11 @@ msgstr ""
 msgid "command-line|port"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:238
+#: src/scm/webid-oidc/hello-world.scm:56 src/scm/webid-oidc/program.scm:251
 msgid "command-line|log-file"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:240
+#: src/scm/webid-oidc/hello-world.scm:58 src/scm/webid-oidc/program.scm:253
 msgid "command-line|error-file"
 msgstr ""
 
@@ -1023,12 +1023,12 @@ msgid ""
 msgstr ""
 
 #: src/scm/webid-oidc/hello-world.scm:103
-#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:544
+#: src/scm/webid-oidc/example-app.scm:159 src/scm/webid-oidc/program.scm:568
 #, scheme-format
 msgid "~a version ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:552
+#: src/scm/webid-oidc/hello-world.scm:112 src/scm/webid-oidc/program.scm:576
 msgid ""
 "You are legally required to link to the complete corresponding source code.\n"
 msgstr ""
@@ -1147,106 +1147,106 @@ msgstr ""
 msgid "There was an error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:98
+#: src/scm/webid-oidc/program.scm:111
 #, scheme-format
 msgid "~a: ~a: Internal server error: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:112
+#: src/scm/webid-oidc/program.scm:125
 #, scheme-format
 msgid ""
 "The client locale ~s can’t be approximated by system locale ~s (because ~a), "
 "using C.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:136
+#: src/scm/webid-oidc/program.scm:149
 #, scheme-format
 msgid "~a: ~s ~a ~s ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:138
+#: src/scm/webid-oidc/program.scm:151
 #, scheme-format
 msgid "~a: ~a (~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:142
+#: src/scm/webid-oidc/program.scm:155
 #, scheme-format
 msgid "~a: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:152
+#: src/scm/webid-oidc/program.scm:165
 #, scheme-format
 msgid "(there was an error: ~a)"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:210
+#: src/scm/webid-oidc/program.scm:223
 msgid "command-line|server|port"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:212
+#: src/scm/webid-oidc/program.scm:225
 msgid "command-line|server|server-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:214
+#: src/scm/webid-oidc/program.scm:227
 msgid "command-line|server|reverse-proxy|backend-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:216
+#: src/scm/webid-oidc/program.scm:229
 msgid "command-line|server|reverse-proxy|header"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:218
+#: src/scm/webid-oidc/program.scm:231
 msgid "command-line|server|issuer|key-file"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:220
+#: src/scm/webid-oidc/program.scm:233
 msgid "command-line|server|issuer|subject"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:222
+#: src/scm/webid-oidc/program.scm:235
 msgid "command-line|server|issuer|encrypted-password"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:224
+#: src/scm/webid-oidc/program.scm:237
 msgid "command-line|server|issuer|jwks-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:226
+#: src/scm/webid-oidc/program.scm:239
 msgid "command-line|server|issuer|authorization-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:228
+#: src/scm/webid-oidc/program.scm:241
 msgid "command-line|server|issuer|token-endpoint-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:230
+#: src/scm/webid-oidc/program.scm:243
 msgid "command-line|server|client-id"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:232
+#: src/scm/webid-oidc/program.scm:245
 msgid "command-line|server|redirect-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:234
+#: src/scm/webid-oidc/program.scm:247
 msgid "command-line|server|client-name"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:236
+#: src/scm/webid-oidc/program.scm:249
 msgid "command-line|server|client-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:265
+#: src/scm/webid-oidc/program.scm:278
 #, scheme-format
 msgid "Usage: ~a COMMAND [OPTIONS]...\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:269
+#: src/scm/webid-oidc/program.scm:282
 msgid ""
 "\n"
 "Run the webid-oidc COMMAND."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:272
+#: src/scm/webid-oidc/program.scm:285
 msgid ""
 "\n"
 "This program is covered by the GNU Affero GPL, version 3 or\n"
@@ -1256,13 +1256,13 @@ msgid ""
 "to all responses."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:279
+#: src/scm/webid-oidc/program.scm:292
 msgid ""
 "\n"
 "Available commands:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:281
+#: src/scm/webid-oidc/program.scm:294
 #, scheme-format
 msgid ""
 "\n"
@@ -1270,12 +1270,12 @@ msgid ""
 "      run an authenticating reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:284 src/scm/webid-oidc/program.scm:456
-#: src/scm/webid-oidc/program.scm:625
+#: src/scm/webid-oidc/program.scm:297 src/scm/webid-oidc/program.scm:480
+#: src/scm/webid-oidc/program.scm:649
 msgid "command-line|command|reverse-proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:285
+#: src/scm/webid-oidc/program.scm:298
 #, scheme-format
 msgid ""
 "\n"
@@ -1283,12 +1283,12 @@ msgid ""
 "      run an identity provider."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:288 src/scm/webid-oidc/program.scm:481
-#: src/scm/webid-oidc/program.scm:647
+#: src/scm/webid-oidc/program.scm:301 src/scm/webid-oidc/program.scm:505
+#: src/scm/webid-oidc/program.scm:671
 msgid "command-line|command|identity-provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:289
+#: src/scm/webid-oidc/program.scm:302
 #, scheme-format
 msgid ""
 "\n"
@@ -1296,12 +1296,12 @@ msgid ""
 "      serve the pages for a public application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:292 src/scm/webid-oidc/program.scm:502
-#: src/scm/webid-oidc/program.scm:691
+#: src/scm/webid-oidc/program.scm:305 src/scm/webid-oidc/program.scm:526
+#: src/scm/webid-oidc/program.scm:715
 msgid "command-line|command|client-service"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:293
+#: src/scm/webid-oidc/program.scm:306
 #, scheme-format
 msgid ""
 "\n"
@@ -1310,18 +1310,18 @@ msgid ""
 "      facility."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:297 src/scm/webid-oidc/program.scm:528
-#: src/scm/webid-oidc/program.scm:720
+#: src/scm/webid-oidc/program.scm:310 src/scm/webid-oidc/program.scm:552
+#: src/scm/webid-oidc/program.scm:744
 msgid "command-line|command|server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:299
+#: src/scm/webid-oidc/program.scm:312
 msgid ""
 "\n"
 "General options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:301
+#: src/scm/webid-oidc/program.scm:314
 #, scheme-format
 msgid ""
 "\n"
@@ -1330,7 +1330,7 @@ msgid ""
 "      code. For instance, this would be an URI pointing to a tarball."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:306
+#: src/scm/webid-oidc/program.scm:319
 #, scheme-format
 msgid ""
 "\n"
@@ -1338,7 +1338,7 @@ msgid ""
 "      display a short help message and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:310
+#: src/scm/webid-oidc/program.scm:323
 #, scheme-format
 msgid ""
 "\n"
@@ -1346,7 +1346,7 @@ msgid ""
 "      display the version information (~a) and exit."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:315
+#: src/scm/webid-oidc/program.scm:328
 #, scheme-format
 msgid ""
 "\n"
@@ -1354,7 +1354,7 @@ msgid ""
 "      redirect the program standard output to FILE.log."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:319
+#: src/scm/webid-oidc/program.scm:332
 #, scheme-format
 msgid ""
 "\n"
@@ -1362,13 +1362,13 @@ msgid ""
 "      redirect the program errors to FILE.err."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:324
+#: src/scm/webid-oidc/program.scm:337
 msgid ""
 "\n"
 "General server-side options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:326
+#: src/scm/webid-oidc/program.scm:339
 #, scheme-format
 msgid ""
 "\n"
@@ -1376,7 +1376,7 @@ msgid ""
 "      set the server port to bind, 8080 by default."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:330
+#: src/scm/webid-oidc/program.scm:343
 #, scheme-format
 msgid ""
 "\n"
@@ -1384,13 +1384,13 @@ msgid ""
 "      set the public server URI (scheme, userinfo, host, and port)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:335
+#: src/scm/webid-oidc/program.scm:348
 msgid ""
 "\n"
 "Options for the resource server:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:337
+#: src/scm/webid-oidc/program.scm:350
 #, scheme-format
 msgid ""
 "\n"
@@ -1400,7 +1400,7 @@ msgid ""
 "      authentication."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:343
+#: src/scm/webid-oidc/program.scm:356
 #, scheme-format
 msgid ""
 "\n"
@@ -1409,13 +1409,13 @@ msgid ""
 "      reverse-proxy command."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:349
+#: src/scm/webid-oidc/program.scm:362
 msgid ""
 "\n"
 "Options for the identity provider:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:351
+#: src/scm/webid-oidc/program.scm:364
 #, scheme-format
 msgid ""
 "\n"
@@ -1424,7 +1424,7 @@ msgid ""
 "      key is generated. The server does not offer an HTTPS service."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:356
+#: src/scm/webid-oidc/program.scm:369
 #, scheme-format
 msgid ""
 "\n"
@@ -1432,7 +1432,7 @@ msgid ""
 "      set the identity of the subject."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:360
+#: src/scm/webid-oidc/program.scm:373
 #, scheme-format
 msgid ""
 "\n"
@@ -1440,7 +1440,7 @@ msgid ""
 "      set the encrypted password to recognize the user."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:364
+#: src/scm/webid-oidc/program.scm:377
 #, scheme-format
 msgid ""
 "\n"
@@ -1448,7 +1448,7 @@ msgid ""
 "      set the URI to query the key of the server."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:368
+#: src/scm/webid-oidc/program.scm:381
 #, scheme-format
 msgid ""
 "\n"
@@ -1456,7 +1456,7 @@ msgid ""
 "      set the authorization endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:372
+#: src/scm/webid-oidc/program.scm:385
 #, scheme-format
 msgid ""
 "\n"
@@ -1464,13 +1464,13 @@ msgid ""
 "      set the token endpoint of the issuer."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:377
+#: src/scm/webid-oidc/program.scm:390
 msgid ""
 "\n"
 "Options for the client service:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:379
+#: src/scm/webid-oidc/program.scm:392
 #, scheme-format
 msgid ""
 "\n"
@@ -1479,7 +1479,7 @@ msgid ""
 "      dereferenced to a semantic resource."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:384
+#: src/scm/webid-oidc/program.scm:397
 #, scheme-format
 msgid ""
 "\n"
@@ -1488,7 +1488,7 @@ msgid ""
 "      page is presented with the code to paste in the application."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:389
+#: src/scm/webid-oidc/program.scm:402
 #, scheme-format
 msgid ""
 "\n"
@@ -1496,7 +1496,7 @@ msgid ""
 "      set the user-visible application name (may be misleading...)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:393
+#: src/scm/webid-oidc/program.scm:406
 #, scheme-format
 msgid ""
 "\n"
@@ -1505,28 +1505,40 @@ msgid ""
 "      application (again, may be misleading)."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:399
+#: src/scm/webid-oidc/program.scm:412
 msgid ""
 "\n"
 "Environment variables:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:401
+#: src/scm/webid-oidc/program.scm:414
 msgid ""
 "\n"
-"  LANG: set the locale of the user interface (for the server commands,\n"
-"      the user is the system administrator)."
+"  XML_CATALOG_FILES: the server will fetch resources on the web. By\n"
+"      setting this environment variable to a space-separated list of\n"
+"      catalog URIs, the server will redirect these requests to another\n"
+"      server. Currently, it is not possible to load files from the\n"
+"      file system, because there is no way to specify the\n"
+"      content-type."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:405 src/scm/webid-oidc/program.scm:414
-#: src/scm/webid-oidc/program.scm:422 src/scm/webid-oidc/program.scm:430
+#: src/scm/webid-oidc/program.scm:422 src/scm/webid-oidc/program.scm:429
+#: src/scm/webid-oidc/program.scm:438 src/scm/webid-oidc/program.scm:446
+#: src/scm/webid-oidc/program.scm:454
 #, scheme-format
 msgid ""
 "the-environment-variable|\n"
 "      It is currently set to ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:408
+#: src/scm/webid-oidc/program.scm:425
+msgid ""
+"\n"
+"  LANG: set the locale of the user interface (for the server commands,\n"
+"      the user is the system administrator)."
+msgstr ""
+
+#: src/scm/webid-oidc/program.scm:432
 msgid ""
 "\n"
 "  XDG_DATA_HOME: where the program stores persistent data. The\n"
@@ -1535,7 +1547,7 @@ msgid ""
 "      recommended to set it to /var/lib."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:417
+#: src/scm/webid-oidc/program.scm:441
 msgid ""
 "\n"
 "  XDG_CACHE_HOME: where the program stores and updates the seed file,\n"
@@ -1543,7 +1555,7 @@ msgid ""
 "      time. The seed file will be initialized from /dev/random."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:425
+#: src/scm/webid-oidc/program.scm:449
 msgid ""
 "\n"
 "  HOME: if XDG_DATA_HOME or XDG_CACHE_HOME is not set, they are\n"
@@ -1551,13 +1563,13 @@ msgid ""
 "      not used otherwise."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:434
+#: src/scm/webid-oidc/program.scm:458
 msgid ""
 "\n"
 "Running a reverse proxy"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:436
+#: src/scm/webid-oidc/program.scm:460
 msgid ""
 "\n"
 "Suppose that you operate data.provider.com. You want to run an\n"
@@ -1570,7 +1582,7 @@ msgid ""
 "from this reverse proxy."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:446
+#: src/scm/webid-oidc/program.scm:470
 #, scheme-format
 msgid ""
 "\n"
@@ -1584,20 +1596,20 @@ msgid ""
 "      --~a '/var/log/proxy.err'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:461
+#: src/scm/webid-oidc/program.scm:485
 msgid ""
 "\n"
 "Running an identity provider"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:463
+#: src/scm/webid-oidc/program.scm:487
 msgid ""
 "\n"
 "The identity provider running at webid-oidc-demo.planete-kraus.eu is\n"
 "invoked with the following options:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:467
+#: src/scm/webid-oidc/program.scm:491
 #, scheme-format
 msgid ""
 "\n"
@@ -1616,20 +1628,20 @@ msgid ""
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:487
+#: src/scm/webid-oidc/program.scm:511
 msgid ""
 "\n"
 "Running the public pages for an application"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:489
+#: src/scm/webid-oidc/program.scm:513
 msgid ""
 "\n"
 "The example client application pages for\n"
 "webid-oidc-demo.planete-kraus.eu are served this way:"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:493
+#: src/scm/webid-oidc/program.scm:517
 #, scheme-format
 msgid ""
 "\n"
@@ -1645,13 +1657,13 @@ msgid ""
 "      --~a $PORT"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:507
+#: src/scm/webid-oidc/program.scm:531
 msgid ""
 "\n"
 "Running a full server"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:510
+#: src/scm/webid-oidc/program.scm:534
 msgid ""
 "\n"
 "To run the server with identity provider and\n"
@@ -1659,7 +1671,7 @@ msgid ""
 "options for the parts."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:514
+#: src/scm/webid-oidc/program.scm:538
 #, scheme-format
 msgid ""
 "\n"
@@ -1678,104 +1690,104 @@ msgid ""
 "      --~a '...port...'"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:539
+#: src/scm/webid-oidc/program.scm:563
 #, scheme-format
 msgid ""
 "\n"
 "If you find a bug, then please send a report to ~a."
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:559
+#: src/scm/webid-oidc/program.scm:583
 #, scheme-format
 msgid "The --~a argument must be a number, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:565
+#: src/scm/webid-oidc/program.scm:589
 #, scheme-format
 msgid "The --~a argument must be an integer, not ~s.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:571
+#: src/scm/webid-oidc/program.scm:595
 #, scheme-format
 msgid "The --~a argument must be positive, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:576
+#: src/scm/webid-oidc/program.scm:600
 #, scheme-format
 msgid "The --~a argument must be less than 65536, ~s is invalid.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:618
+#: src/scm/webid-oidc/program.scm:642
 #, scheme-format
 msgid ""
 "Usage: ~a COMMAND [OPTIONS]...\n"
 "See --~a (-h).\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:628 src/scm/webid-oidc/program.scm:650
-#: src/scm/webid-oidc/program.scm:722
+#: src/scm/webid-oidc/program.scm:652 src/scm/webid-oidc/program.scm:674
+#: src/scm/webid-oidc/program.scm:746
 #, scheme-format
 msgid "You must pass --~a to set the server name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:632
+#: src/scm/webid-oidc/program.scm:656
 #, scheme-format
 msgid "You must pass --~a to set the backend URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:654 src/scm/webid-oidc/program.scm:726
+#: src/scm/webid-oidc/program.scm:678 src/scm/webid-oidc/program.scm:750
 #, scheme-format
 msgid ""
 "You must pass --~a to set the file where to store the identity provider "
 "key.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:658 src/scm/webid-oidc/program.scm:730
+#: src/scm/webid-oidc/program.scm:682 src/scm/webid-oidc/program.scm:754
 #, scheme-format
 msgid "You must pass --~a to set the subject of the identity provider.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:662 src/scm/webid-oidc/program.scm:734
+#: src/scm/webid-oidc/program.scm:686 src/scm/webid-oidc/program.scm:758
 #, scheme-format
 msgid "You must pass --~a to set the subject’s encrypted password.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:666 src/scm/webid-oidc/program.scm:738
+#: src/scm/webid-oidc/program.scm:690 src/scm/webid-oidc/program.scm:762
 #, scheme-format
 msgid "You must pass --~a to set the JWKS URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:670 src/scm/webid-oidc/program.scm:742
+#: src/scm/webid-oidc/program.scm:694 src/scm/webid-oidc/program.scm:766
 #, scheme-format
 msgid "You must pass --~a to set the authorization endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:674 src/scm/webid-oidc/program.scm:746
+#: src/scm/webid-oidc/program.scm:698 src/scm/webid-oidc/program.scm:770
 #, scheme-format
 msgid "You must pass --~a to set the token endpoint URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:694
+#: src/scm/webid-oidc/program.scm:718
 #, scheme-format
 msgid "You must pass --~a to set the application web ID.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:698
+#: src/scm/webid-oidc/program.scm:722
 #, scheme-format
 msgid "You must pass --~a to set the redirection URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:702
+#: src/scm/webid-oidc/program.scm:726
 #, scheme-format
 msgid "You must pass --~a to set the informative client name.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:706
+#: src/scm/webid-oidc/program.scm:730
 #, scheme-format
 msgid "You must pass --~a to set the informative client URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/program.scm:793
+#: src/scm/webid-oidc/program.scm:817
 #, scheme-format
 msgid "Unknown command ~s\n"
 msgstr ""
diff --git a/src/scm/webid-oidc/Makefile.am b/src/scm/webid-oidc/Makefile.am
index 0046ca4..acd9ec9 100644
--- a/src/scm/webid-oidc/Makefile.am
+++ b/src/scm/webid-oidc/Makefile.am
@@ -45,7 +45,8 @@ dist_webidoidcmod_DATA += \
   %reldir%/example-app.scm \
   %reldir%/rdf-index.scm \
   %reldir%/http-link.scm \
-  %reldir%/offloading.scm
+  %reldir%/offloading.scm \
+  %reldir%/catalog.scm
 
 webidoidcgo_DATA += \
   %reldir%/errors.go \
@@ -78,7 +79,8 @@ webidoidcgo_DATA += \
   %reldir%/example-app.go \
   %reldir%/rdf-index.go \
   %reldir%/http-link.go \
-  %reldir%/offloading.go
+  %reldir%/offloading.go \
+  %reldir%/catalog.go
 
 EXTRA_DIST += %reldir%/ChangeLog
 
diff --git a/src/scm/webid-oidc/catalog.scm b/src/scm/webid-oidc/catalog.scm
new file mode 100644
index 0000000..11e0877
--- /dev/null
+++ b/src/scm/webid-oidc/catalog.scm
@@ -0,0 +1,264 @@
+;; webid-oidc, implementation of the Solid specification
+;; Copyright (C) 2020, 2021  Vivien Kraus
+
+;; This program is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU Affero General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+
+;; This program is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU Affero General Public License for more details.
+
+;; You should have received a copy of the GNU Affero General Public License
+;; along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+(define-module (webid-oidc catalog)
+  #:use-module (web uri)
+  #:use-module (web client)
+  #:use-module (ice-9 match)
+  #:use-module (web client)
+  #:use-module (rnrs bytevectors)
+  #:use-module (sxml simple)
+  #:use-module (sxml match)
+  #:use-module (ice-9 optargs)
+  #:use-module (ice-9 receive)
+  #:export (resolve-uri))
+
+(define useful-namespaces  
+  '((ct . "urn:oasis:names:tc:entity:xmlns:xml:catalog")
+    (xml . "http://www.w3.org/XML/1998/namespace")))
+
+(define (run-catalog-entry do-examine-catalog base first-entry rest other-entries
+                           uri
+                           candidate match-length next-catalogs-rev)
+  ;; do-examine-catalog is the recursive function to examine a new catalog.
+  ;; base is the current base.
+  ;; rest is a catalog containing the other entries.
+
+  ;; This function is there because I can’t nest two sxml pattern
+  ;; matchings.
+  (sxml-match
+   first-entry
+   ((ct:group (@ (xml:base ,new-base)) ,group-entries ...)
+    (let ((new-base (string->uri* base new-base)))
+      (receive (candidate match-length next-catalogs-rev)
+          (do-examine-catalog
+           `(*TOP*
+             (ct:catalog (@ (xml:base ,(uri->string new-base)))
+                         ,@group-entries))
+           candidate match-length next-catalogs-rev)
+        (do-examine-catalog rest candidate match-length next-catalogs-rev))))
+   ((ct:group ,group-entries ...)
+    ;; The group does not have a specific base, we can merge the
+    ;; entries with other-entries.
+    (do-examine-catalog
+     `(*TOP*
+       (ct:catalog (@ (xml:base ,(uri->string base)))
+                   ,@group-entries
+                   ,@other-entries))
+     candidate match-length next-catalogs-rev))
+   ((ct:uri (@ (name ,exact-pattern)
+               (uri ,replacement)
+               (xml:base ,new-base)))
+    ;; exact-pattern is not relative to xml:base
+    (if (equal? (string->uri exact-pattern) uri)
+        ;; Perfect replacement, stop here
+        (values
+         ;; but replacement is relative to xml:base
+         (string->uri* base new-base replacement)
+         (string-length (uri->string uri))
+         '())
+        (do-examine-catalog rest candidate match-length next-catalogs-rev)))
+   ((ct:rewriteUri (@ (name ,pattern)
+                      (uri ,replacement)
+                      (xml:base ,new-base)))
+    (when (and (string-prefix? pattern (uri->string uri))
+               (> (string-length pattern) match-length))
+      ;; The match is significant
+      (set! candidate
+            (string->uri* base
+                          new-base
+                          (string-append
+                           replacement
+                           (substring (uri->string uri)
+                                      (string-length pattern)))))
+      (set! match-length (string-length pattern)))
+    ;; Maybe the match was perfect, in which case we must stop
+    ;; there.
+    (if (eqv? match-length (string-length (uri->string uri)))
+        (values candidate match-length '())
+        (do-examine-catalog rest candidate match-length next-catalogs-rev)))
+   ((ct:uriSuffix (@ (uriSuffix ,suffix)
+                     (uri ,replacement)
+                     (base ,new-base)))
+    (when (and (string-suffix? suffix (uri->string uri))
+               (> (string-length suffix) match-length))
+      (let* ((length-kept
+              (- (string-length (uri->string uri))
+                 (string-length suffix)))
+             (part-kept (substring (uri->string uri) 0 length-kept)))
+        (set! candidate
+              (string->uri* base new-base (string-append part-kept suffix)))
+        (set! match-length (string-length suffix))))
+    (if (eqv? match-length (string-length (uri->string uri)))
+        (values candidate match-length '())
+        (do-examine-catalog rest candidate match-length next-catalogs-rev)))
+   ((ct:delegateURI (@ (uriStartString ,pattern)
+                       (catalog ,next-catalog)
+                       (base ,new-base)))
+    (if (string-prefix? pattern (uri->string uri))
+        ;; Perfect match
+        (values #f 0 (list (string->uri* base new-base next-catalog)))
+        (do-examine-catalog rest candidate match-length next-catalogs-rev)))
+   ((ct:nextCatalog (@ (catalog ,next-catalog)
+                       (base ,new-base)))
+    (do-examine-catalog rest candidate match-length
+                        (cons (string->uri* base new-base next-catalog)
+                              next-catalogs)))
+   (,else
+    (match first-entry
+      ((node-name attributes/children ...)
+       ;; The node is simply missing a base
+       (do-examine-catalog
+        `(*TOP*
+          (ct:catalog (@ (xml:base ,(uri->string base)))
+                      (,node-name (@ (xml:base ,(uri->string base))) ,@attributes/children)
+                      ,@other-entries))
+        candidate match-length next-catalogs-rev))
+      (else
+       (do-examine-catalog rest candidate match-length next-catalogs-rev))))))
+
+(define (make-absolute base uri)
+  (when (string? base)
+    (set! base (string->uri base)))
+  (let ((final-scheme (or (uri-scheme uri) (uri-scheme base)))
+        (uri-with-final-authority
+         (if (or (uri-scheme uri)
+                 (uri-userinfo uri)
+                 (uri-host uri)
+                 (uri-port uri))
+             ;; we should use that of uri
+             uri
+             ;; nothing specified, use base
+             base))
+        (final-path
+         (if (or (uri-scheme uri)
+                 (uri-userinfo uri)
+                 (uri-host uri)
+                 (uri-port uri)
+                 (string-prefix? "/" (uri-path uri)))
+             (uri-path uri)
+             (let with-absolute-relative-path
+                 ((defined '())
+                  (components
+                   (append (split-and-decode-uri-path (uri-path base))
+                           (split-and-decode-uri-path (uri-path uri)))))
+               (match components
+                 (() (string-append "/" (encode-and-join-uri-path (reverse defined))))
+                 (("" components ...) (with-absolute-relative-path defined components))
+                 (("." components ...) (with-absolute-relative-path defined components))
+                 ((".." components ...)
+                  (match defined
+                    (() (error "Invalid relative URI"))
+                    ((dropped kept ...)
+                     (with-absolute-relative-path kept components))))
+                 ((head components ...)
+                  (with-absolute-relative-path `(,head ,@defined) components))))))
+        (uri-with-final-query
+         (if (or (uri-scheme uri)
+                 (uri-userinfo uri)
+                 (uri-host uri)
+                 (uri-port uri)
+                 (not (equal? (uri-path uri) ""))
+                 (uri-query uri))
+             uri
+             base)))
+    (build-uri final-scheme
+               #:userinfo (uri-userinfo uri-with-final-authority)
+               #:host (uri-host uri-with-final-authority)
+               #:port (uri-port uri-with-final-authority)
+               #:path final-path
+               #:query (uri-query uri-with-final-query)
+               #:fragment (uri-fragment uri))))
+
+(define (string->uri** base str)
+  (make-absolute base (string->uri-reference str)))
+
+(define (string->uri* base str . rest)
+  (if (null? rest)
+      (string->uri** base str)
+      (apply string->uri* (string->uri** base str) rest)))
+
+(define (resolve-uri-in-catalog uri catalog-uri catalog other-catalog-uris)
+  (let do-examine-catalog ((catalog catalog)
+                           (candidate uri)
+                           (match-length 0)
+                           (next-catalogs-rev (reverse other-catalog-uris)))
+    (sxml-match
+     catalog
+     ((*TOP*
+       (ct:catalog))
+      ;; End of the catalog
+      (values candidate
+              match-length
+              (if (eqv? match-length 0)
+                  (reverse next-catalogs-rev)
+                  '())))
+     ((*TOP*
+       (ct:catalog (@ (xml:base ,base))
+                   ,first-entry
+                   ,other-entries ...))
+      (let* ((base (string->uri* catalog-uri base))
+             (rest `(*TOP*
+                     (ct:catalog (@ (xml:base ,(uri->string base)))
+                                 ,@other-entries))))
+        (run-catalog-entry do-examine-catalog base first-entry rest other-entries
+                           uri
+                           candidate match-length next-catalogs-rev)))
+     ((*TOP*
+       (ct:catalog ,entries ...))
+      ;; No explicit xml:base
+      (do-examine-catalog
+       `(*TOP*
+         (ct:catalog (@ (xml:base ,(uri->string catalog-uri)))
+                     ,@entries))
+       candidate
+       match-length
+       next-catalogs-rev)))))
+
+(define* (get-catalog uri #:key (http-get http-get))
+  (case (uri-scheme uri)
+    ((http https)
+     (receive (response response-body) (http-get uri)
+       (when (bytevector? response-body)
+         (set! response-body (utf8->string response-body)))
+       (xml->sxml response-body #:namespaces useful-namespaces)))
+    ((file)
+     (call-with-input-file (uri-path uri)
+       (lambda (port)
+         (xml->sxml port #:namespaces useful-namespaces))))
+    (else
+     (error (format #f "Unsupported delegate catalog URI scheme: ~s\n" (uri-scheme uri))))))
+
+(define* (resolve-uri uri #:key (http-get http-get))
+  (when (string? uri)
+    (set! uri (string->uri uri)))
+  (let do-examine ((uris
+                    (let ((var
+                           (getenv "XML_CATALOG_FILES")))
+                      (if var
+                          (map string->uri
+                               (string-split var #\space))
+                          '()))))
+    (match uris
+      (() uri)
+      ((catalog-uri uris ...)
+       (let ((catalog (get-catalog catalog-uri
+                                   #:http-get http-get)))
+         (receive (candidate match-length next-uris)
+             (resolve-uri-in-catalog uri catalog-uri catalog uris)
+           (if (null? next-uris)
+               candidate
+               (do-examine next-uris))))))))
diff --git a/src/scm/webid-oidc/program.scm b/src/scm/webid-oidc/program.scm
index 79f13cb..6b8ad29 100644
--- a/src/scm/webid-oidc/program.scm
+++ b/src/scm/webid-oidc/program.scm
@@ -24,6 +24,7 @@
   #:use-module (webid-oidc server create)
   #:use-module (webid-oidc jti)
   #:use-module (webid-oidc offloading)
+  #:use-module (webid-oidc catalog)
   #:use-module ((webid-oidc stubs) #:prefix stubs:)
   #:use-module ((webid-oidc config) #:prefix cfg:)
   #:use-module (ice-9 optargs)
@@ -55,8 +56,20 @@
   (define date (date->string (time-utc->date (current-time))))
   (define uri-string (if (uri? uri) (uri->string uri) uri))
   (with-mutex logging-mutex
+    (when (getenv "XML_CATALOG_FILES")
+      (format (current-error-port) "~a: Warning: XML_CATALOG_FILES is set to ~s.\n"
+              date
+              (getenv "XML_CATALOG_FILES")))
     (format (current-error-port) "~a: GET ~a ~s...\n"
             date uri-string headers))
+  (set! uri (resolve-uri uri
+                         #:http-get
+                         (lambda* (uri . args)
+                           (with-mutex logging-mutex
+                             (format (current-error-port) "~a: Warning: loading XML catalog from the web, ~s.\n"
+                                     date
+                                     (uri->string uri)))
+                           (apply http-get uri args))))
   (receive (response response-body)
       (in-another-thread
        (http-get uri #:headers headers))
@@ -399,6 +412,17 @@ Options for the client service:"))
         (format #t (G_ "
 Environment variables:"))
         (format #t (G_ "
+  XML_CATALOG_FILES: the server will fetch resources on the web. By
+      setting this environment variable to a space-separated list of
+      catalog URIs, the server will redirect these requests to another
+      server. Currently, it is not possible to load files from the
+      file system, because there is no way to specify the
+      content-type."))
+        (when (getenv "XML_CATALOG_FILES")
+          (format #t (G_ "the-environment-variable|
+      It is currently set to ~s.")
+                  (getenv "XML_CATALOG_FILES")))
+        (format #t (G_ "
   LANG: set the locale of the user interface (for the server commands,
       the user is the system administrator)."))
         (when (getenv "LANG")