registry: validate catalog updated date used as Nix aggregate version #209

New issue

Closed

opened 2026-09-08 02:03:14 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:14 +00:00

Owner

Problem

plugins.json.updated is consumed as the generated zara-plugins aggregate package version, but the registry validator currently does not validate its type or shape. A malformed/missing value can therefore pass registry validation and fail or mis-version downstream Nix packaging.

Scope

require an exact canonical YYYY-MM-DD string
reject impossible calendar dates and surrounding whitespace
deterministic RED-first tests
no catalog migration if current metadata is valid
no Zara Core/runtime changes

Gate

Registry tests, compatibility, full nix flake check, generated package builds.

## Problem `plugins.json.updated` is consumed as the generated `zara-plugins` aggregate package version, but the registry validator currently does not validate its type or shape. A malformed/missing value can therefore pass registry validation and fail or mis-version downstream Nix packaging. ## Scope - require an exact canonical `YYYY-MM-DD` string - reject impossible calendar dates and surrounding whitespace - deterministic RED-first tests - no catalog migration if current metadata is valid - no Zara Core/runtime changes ## Gate Registry tests, compatibility, full `nix flake check`, generated package builds.

nsaspy closed this issue

2026-09-08 02:03:14 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:36 +00:00

coding: validate repository inspection HEAD object IDs #376