github/spec-kit · error · BundlerError

Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme

Error message

Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme}://). HTTP is only allowed for localhost.

What it means

Error "Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme}://). HTTP is only allowed for localhost." thrown in github/spec-kit.

Source

Thrown at src/specify_cli/bundler/services/adapters.py:88

    Mirrors ``specify_cli.catalogs`` URL validation to avoid MITM/downgrade
    issues before any network call.
    """
    # A malformed authority (e.g. an unclosed IPv6 bracket ``https://[::1``)
    # makes urlparse / hostname access raise ValueError. This function's
    # contract is to raise BundlerError for a bad URL, so surface that as a
    # clean error rather than leaking a raw ValueError to the caller.
    try:
        parsed = urlparse(url)
        hostname = parsed.hostname
        # Accessing ``port`` performs urllib's syntax/range validation.
        _ = parsed.port
    except ValueError:
        raise BundlerError(
            f"Catalog '{source_id}' URL is malformed: {url}"
        ) from None
    is_localhost = hostname in ("localhost", "127.0.0.1", "::1")
    if parsed.scheme != "https" and not (parsed.scheme == "http" and is_localhost):
        raise BundlerError(
            f"Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme}://). "
            "HTTP is only allowed for localhost."
        )
    # Check hostname, not netloc: netloc is truthy for host-less URLs like
    # "https://:8080" or "https://user@...", so requiring netloc would let
    # those through even though they carry no host. hostname is None in those
    # cases. Mirrors the fix in ``specify_cli.catalogs`` (#3210).
    if not hostname:
        raise BundlerError(
            f"Catalog '{source_id}' URL must be a valid URL with a host: {url}"
        )


def _load_packaged_community_catalog() -> dict:
    core_pack = _locate_core_pack()
    path = (
        core_pack / "bundles" / "catalog.community.json"
        if core_pack is not None

View on GitHub (pinned to bf88c9f9a8)

Solutions

1. Change the catalog source URL to use https:// (http:// is only allowed for localhost).

When it happens

Trigger: Thrown at src/specify_cli/bundler/services/adapters.py:88 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of github/spec-kit@bf88c9f9a8 (2026-08-14). Data as JSON: /api/errors/a377c0c04e95edce. Report an issue: GitHub.