Evidence bundle schema sources.*.baseUrl pattern is looser than the runtime validator

Open Beginner friendly
#945 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
backend-api-design, testing

Research direction

Compare products/evidence/contracts/bundle.schema.yaml:907-916 with the canonical pattern at schema lines 815-828 and validate_source_origin in crates/registry-evidence/src/config.rs:4761-4767. Add a fixture covering the rejected baseUrl and run the relevant schema and runtime validation checks; done means both validators reject the same invalid value.

Written by the indexing model from the issue text.

Description

agent-ready area:evidence bug criticality:p3 triage:needs-implementation

Found in the 0.28.0 pre-release review (2026-09-08). Line references are as of main after #926.

products/evidence/contracts/bundle.schema.yaml:907-916 accepts sources.*.baseUrl values that validate_source_origin in crates/registry-evidence/src/config.rs:4761-4767 refuses, while sourceConnections.baseUrl (schema lines 815-828) already carries the canonical origin pattern. Editor validation therefore passes a bundle the runtime rejects. Tighten the schema pattern to the runtime rule and add a fixture that fails both.

Dominant language
Rust
Stars
2
Forks
0
Avg merge
3h 45m
Merged PRs (30d)
134

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from registrystack/registry-stack

All issues in registrystack/registry-stack

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.