D-006 Which URL schemes may a URL field carry?

Gap Decision 6 on the supporting page of #121. Cited on main and with the open PRs.

What the schemas do

An absolute https URL.

Options

https-only Chosen
An absolute https URL.
http-or-https
An absolute http or https URL.
any-uri
Any absolute URI, whatever its scheme.

Why

Every URL in the specification is one an agent fetches: the § 2.3 manifest, a store listing, and the terms a buyer assents to. Over plain http, a network attacker can substitute what the agent reads, and the § 2.3 manifest URL is already https. A name that is never fetched, such as an extension identifier, is a Uri, not a Url. The initial conventions § 2 already stated the https rule.

What we ask the specification to state

State that every URL field carries an absolute https URL.

The specification lines it rests on

Each line is quoted as the record pins it. Expand an item to read the quote.

With the open PRs

§ 2.3, a requirement L115 in #76
A seller MAY publish https://<seller domain>/.well-known/openproposal.json.
§ 5.2, the apps[].storeurl key row L237 in #17
storeurl | OPTIONAL | Store listing URL. As app.storeurl
§ 5.8, the terms_ref row L333 in #75
terms_ref | Object | seller-set | OPTIONAL; REQUIRED when terms_acceptance_required is true. { url, sha256, version }: the legal terms or IO template the buyer accepts at assent. Hash-pinned, so assent (§ 4.1) binds to an exact document

Examples that disagree with the text

Example	Where	Why	Input
`code:5.5:1`	`/exclusions/list_ref/url`	A URL is an absolute `https` URL. The § 5.5 block writes the placeholder `<url>`.	open PRs

What it shapes

main: Url

With the open PRs: Url, AppsEntry.storeurl, LineItem.terms_ref

The record's YAML file