registrystack / registrystack/registry-stack
Evidence bundle schema sources.*.baseUrl pattern is looser than the runtime validator
- Dominant language
- Rust
- Stars
- 2
- Forks
- 0
- Avg merge
- 2h 55m
- Merged PRs (30d)
- 130
Description
Found in the 0.28.0 pre-release review (2026-09-08). Line references are as of main after #926.
`products/evidence/contracts/bundle.schema.yaml:907-916` accepts `sources.*.baseUrl` values that `validate_source_origin` in `crates/registry-evidence/src/config.rs:4761-4767` refuses, while `sourceConnections.baseUrl` (schema lines 815-828) already carries the canonical origin pattern. Editor validation therefore passes a bundle the runtime rejects. Tighten the schema pattern to the runtime rule and add a fixture that fails both.
Contributor guide
Research direction
Compare products/evidence/contracts/bundle.schema.yaml:907-916 with the canonical pattern at schema lines 815-828 and validate_source_origin in crates/registry-evidence/src/config.rs:4761-4767. Add a fixture covering the rejected baseUrl and run the relevant schema and runtime validation checks; done means both validators reject the same invalid value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend-api-design, testing
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100