Update URLs to https #915
Update URLs to https #915
Conversation
Signed-off-by: Brandon Mitchell <[email protected]>
sudo-bmitch
requested review from
brendandburns,
jonjohnsonjr,
jstarks,
jonboulle,
stevvooe,
vbatts and
cyphar
as code owners
|
For CI failure, see #916 |
| @@ -1,6 +1,6 @@ | |||
| { | |||
| "description": "OpenContainer Image Manifest Specification", | |||
| "$schema": "http://json-schema.org/draft-04/schema#", | |||
| "$schema": "https://json-schema.org/draft-04/schema#", | |||
There was a problem hiding this comment.
Is this valid? The draft 04 spec defines HTTP and make no mention of HTTPS. This trips up some lookups that downstream libraries do: https://github.com/davishmcclurg/json_schemer/blob/bbfed4ccdcab85c540568effefcbef308c5bb6a4/lib/json_schemer.rb#L34-L37
The move from HTTP to HTTPS happened in draft 2019-09 (aka draft 8), so I think it's safer to only update this to HTTPS if also updating to that draft.
There was a problem hiding this comment.
Https support is on the entire webserver, isn't it?
There was a problem hiding this comment.
Sure, it needs to be anyway for newer drafts. But then you can also equally say dropping the # works or having a URL redirect service works.
The $schema isn't just a place you can go download the schema file. It doubles up as an identifier:
The "$schema" keyword is both used as a JSON Schema version
identifier and the location of a resource which is itself a JSON
Schema, which describes any schema written for this particular
version.
http://json-schema.org/draft-04/schema# is explicitly predefined in the draft (as well as here: https://json-schema.org/understanding-json-schema/reference/schema.html, which shows the HTTPS change in 2019-09). Other forms are not defined. While it's not illegal to have different URIs (in fact, this is needed for people to extend the core JSON schema), the whole point of an identifier does diminish if we need to consider the nature of internet protocols, redirects etc, effectively turning this from an offline ID check to an online fetch. I don't think anything deviating from the predefined values should be expected to work.
There was a problem hiding this comment.
Got it. Since I'm not using that field, I'll leave the call up to others if it makes sense to go to a newer draft or revert back to http.
Fixes #913
I didn't touch the licensing links, and the broken link in the README.md (see #914).
Signed-off-by: Brandon Mitchell [email protected]