Require HTTPS for remote Star-Lang specifications #7

Merged

lost-rob0t merged 5 commits from agent/research-006-https-imports into main

2026-08-02 18:41:12 +00:00

lost-rob0t commented

2026-08-02 18:39:47 +00:00

(Migrated from github.com)

What changed

reject plain HTTP import URLs
reject plain HTTP root specification URLs
restrict curl requests and redirects to HTTPS
add regression tests for import and root URL rejection
remove the temporary direct-main HTTPS workflow

Why

Approved STAR-LANG-RESEARCH-006 permits pinned remote specification artifacts over HTTPS, not unencrypted HTTP. The existing loader accepted both schemes and allowed HTTP redirects.

Validation

The existing star-lang CI workflow will run the full SBCL suite for this PR. The focused loader tests now cover both import declarations and root URLs.

Related to #6.

## What changed - reject plain HTTP import URLs - reject plain HTTP root specification URLs - restrict curl requests and redirects to HTTPS - add regression tests for import and root URL rejection - remove the temporary direct-main HTTPS workflow ## Why Approved `STAR-LANG-RESEARCH-006` permits pinned remote specification artifacts over HTTPS, not unencrypted HTTP. The existing loader accepted both schemes and allowed HTTP redirects. ## Validation The existing `star-lang CI` workflow will run the full SBCL suite for this PR. The focused loader tests now cover both import declarations and root URLs. Related to #6.