{"record":{"id":"e971eb4bf030ac0d","repo":"github/spec-kit","slug":"network-access-disabled-cannot-download-bundle","errorCode":null,"errorMessage":"Network access disabled; cannot download bundle '{resolved.entry.id}' from {url}.","messagePattern":"Network access disabled; cannot download bundle '(.+?)' from (.+?)\\.","errorType":"exception","errorClass":"BundlerError","httpStatus":null,"severity":"error","filePath":"src/specify_cli/commands/bundle/__init__.py","lineNumber":893,"sourceCode":"    if scheme in (\"\", \"file\") or re.match(r\"^[A-Za-z]:[\\\\/]\", url):\n        raise BundlerError(\n            f\"Catalog entry '{resolved.entry.id}' has a non-HTTP(S) download_url \"\n            f\"({url}); catalog download URLs must be HTTPS (http for localhost) — \"\n            \"a file:// URL, a local filesystem path, or a scheme-less value \"\n            \"(e.g. 'example.com/bundle.zip') is not accepted. \"\n            \"To install a bundle from disk, pass the path directly: \"\n            \"'specify bundle install <path-to-bundle.yml | bundle-dir | .zip>'.\"\n        )\n\n    # Validate the scheme/host *before* the offline gate so an invalid or\n    # non-HTTPS download_url reports the real problem in every mode, rather\n    # than a misleading \"Network access disabled\" under --offline.\n    # (_download_remote_manifest re-checks this, but only once network access\n    # is permitted.) HTTPS-only, http allowed for localhost.\n    _require_https(f\"bundle '{resolved.entry.id}'\", url)\n\n    if offline:\n        raise BundlerError(\n            f\"Network access disabled; cannot download bundle '{resolved.entry.id}' \"\n            f\"from {url}.\"\n        )\n    manifest = _download_remote_manifest(\n        resolved.entry.id,\n        url,\n        expected_sha256=getattr(resolved.entry, \"sha256\", None),\n    )\n    _validate_catalog_manifest(resolved.entry, manifest)\n    return manifest\n\n\ndef _require_https(label: str, url: str) -> None:\n    from urllib.parse import urlparse\n\n    # urlparse / hostname access raise ValueError on a malformed authority;\n    # keep the documented BundlerError contract (older Pythons surface this via\n    # the .hostname access below rather than at the urlparse call).","sourceCodeStart":875,"sourceCodeEnd":911,"githubUrl":"https://github.com/github/spec-kit/blob/bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c/src/specify_cli/commands/bundle/__init__.py#L875-L911","documentation":"The offline gate in _download_manifest: the catalog entry's download_url is a valid remote HTTPS URL, but the command was run with --offline (or allow_network is otherwise disabled), so the manifest cannot be downloaded. The scheme/host were validated first, so this message means the URL is fine — only the network prohibition blocks it.","triggerScenarios":"specify bundle install <catalog-id> --offline (or bundle update --offline) where the bundle resolves to a remote catalog entry with a download_url; there is no local cache path for catalog manifests.","commonSituations":"Air-gapped or firewalled machines; CI jobs pinned to --offline for determinism; users trying to avoid surprise downloads.","solutions":["Pre-fetch the artifact on a networked machine and install from disk: specify bundle install ./bundle.zip (or the bundle dir / bundle.yml).","Drop --offline if network access is actually allowed.","For repeated offline installs, mirror the bundle as a local file source and pass its path."],"exampleFix":"# before\nspecify bundle install my-bundle --offline\n\n# after\n# (on a networked machine) download the artifact, then offline:\nspecify bundle install ./my-bundle.zip --offline","handlingStrategy":"fallback","validationCode":"if offline and resolved.entry.download_url and not resolved.source.is_local:\n    raise SystemExit(\"Offline mode cannot fetch remote manifests; install from ./bundle.zip instead\")","typeGuard":null,"tryCatchPattern":"try:\n    manifest = _download_manifest(resolved, offline=offline)\nexcept BundlerError as exc:\n    if \"Network access disabled\" in str(exc):\n        # fallback: install from a pre-fetched local artifact path\n        ...","preventionTips":["Pre-download bundle artifacts on networked machines for air-gapped use.","Do not pass --offline when you actually want catalog installs.","Keep a local mirror of bundles used in offline environments."],"tags":["bundler","offline","network","download"],"backgroundTag":null,"analyzedSha":"bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c","analyzedAt":"2026-08-14T19:43:37.150Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}