Suggestion: Add a Draft 05 redirect

70 views
Skip to first unread message

Nathan Herring

unread,
Oct 30, 2019, 5:45:41 AM10/30/19
to JSON Schema
For schemas using Draft-05, I expect that most will have a line like OpenAPI v3's "$schema" that expressly refers to http://json-schema.org/draft-04/schema#. Although they're equivalent schema with different validation IIUC, they cannot place a reference to https://json-schema.org/draft-05/schema# because that 404s. Is there a reason not to place a 303 redirect there?

Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? 

Ben Hutton (@Relequestual)

unread,
Oct 31, 2019, 5:18:50 AM10/31/19
to JSON Schema
Hi Nathan,


Q: What happened to draft-05?

The draft-05 core and validation specifications were intended to be more clear and readable rewrites of draft-04, to give us a strong base for draft-06 changes. Implementors should not implement or advertise support for “draft-05”.

Implementations that supported “draft-05” by implementing proposals from right after the publication of draft-04 should either remove that support or give it a different name to avoid confusion.



Essentially, don't use draft-5, and you shouldn't even find an implementation that supports it.

We certinly don't want to add confusion over that by allowing a draft-5 URL.


"Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? "


I'm a little confused by this. Could you maybe expand a little to make sure I'm not making any incorrect assumptions please?


Cheers

Ben

Nathan Herring

unread,
Oct 31, 2019, 6:14:46 AM10/31/19
to json-...@googlegroups.com
On Thu, Oct 31, 2019 at 10:18 AM Ben Hutton (@Relequestual) <b...@sanger.ac.uk> wrote:
Hi Nathan,


Q: What happened to draft-05?

The draft-05 core and validation specifications were intended to be more clear and readable rewrites of draft-04, to give us a strong base for draft-06 changes. Implementors should not implement or advertise support for “draft-05”.

Implementations that supported “draft-05” by implementing proposals from right after the publication of draft-04 should either remove that support or give it a different name to avoid confusion.



Essentially, don't use draft-5, and you shouldn't even find an implementation that supports it.

We certinly don't want to add confusion over that by allowing a draft-5 URL.

Makes sense. I can follow up with OpenAPI, since they specifically advertise they use Wright Draft 00 here.


"Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? "


I'm a little confused by this. Could you maybe expand a little to make sure I'm not making any incorrect assumptions please?


This is about ensuring that parsers/validators chasing off-document links use TLS where available. None of the $schema entries I've found have used "https://json-schema/draft-04/schema#" and at least the one validator I'm familiar with (https://github.com/java-json-tools/json-schema-validator) will chase links directly without an option to enforce TLS on all "http" scheme URIs. https://github.com/java-json-tools/json-schema-core/blob/master/src/main/java/com/github/fge/jsonschema/core/load/download/DefaultURIDownloader.java


Cheers

Ben


On Wednesday, 30 October 2019 09:45:41 UTC, Nathan Herring wrote:
For schemas using Draft-05, I expect that most will have a line like OpenAPI v3's "$schema" that expressly refers to http://json-schema.org/draft-04/schema#. Although they're equivalent schema with different validation IIUC, they cannot place a reference to https://json-schema.org/draft-05/schema# because that 404s. Is there a reason not to place a 303 redirect there?

Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? 

--
You received this message because you are subscribed to the Google Groups "JSON Schema" group.
To unsubscribe from this group and stop receiving emails from it, send an email to json-schema...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/json-schema/78a68712-8535-4ed1-b5f5-3e9a316b0474%40googlegroups.com.


--
Nathan Herring | Software Engineer | nher...@google.com | 616-466-4646

Nathan Herring

unread,
Oct 31, 2019, 6:30:08 AM10/31/19
to json-...@googlegroups.com
On Thu, Oct 31, 2019 at 11:14 AM Nathan Herring <nher...@google.com> wrote:


On Thu, Oct 31, 2019 at 10:18 AM Ben Hutton (@Relequestual) <b...@sanger.ac.uk> wrote:
Hi Nathan,


Q: What happened to draft-05?

The draft-05 core and validation specifications were intended to be more clear and readable rewrites of draft-04, to give us a strong base for draft-06 changes. Implementors should not implement or advertise support for “draft-05”.

Implementations that supported “draft-05” by implementing proposals from right after the publication of draft-04 should either remove that support or give it a different name to avoid confusion.



Essentially, don't use draft-5, and you shouldn't even find an implementation that supports it.

We certinly don't want to add confusion over that by allowing a draft-5 URL.

Makes sense. I can follow up with OpenAPI, since they specifically advertise they use Wright Draft 00 here.

Ben Hutton (@Relequestual)

unread,
Oct 31, 2019, 6:36:10 AM10/31/19
to JSON Schema
" Implementors should not implement or advertise support for “draft-05” "

Draft 5, as far as anyone not writing the specification should be concerned, should not exist.

OpenAPI 3.1 SHOULD bring support of draft 2019-09.

Henry Andrews

unread,
Oct 31, 2019, 5:25:55 PM10/31/19
to JSON Schema
Hi Nathan,
  OpenAPI forbids "$schema", so a "draft-05" URI wouldn't be used anyway.  We do not want it to redirect, as that would imply that it is in some way usable, which it is not.  It is also years and several drafts out-of-date, and the JSON Schema community as a whole has moved on.  OpenAPI 3.1 will be moving to the just-published JSON Schema draft 2019-09 as well.  This is a leftover weirdness due to some historical oddities around JSON Schema between draft-04 and the current set of editors, and it's best to just leave it look to the future for better solutions.

thanks,
-henry


On Thursday, October 31, 2019, 03:36:13 AM PDT, Ben Hutton (@Relequestual) <b...@sanger.ac.uk> wrote:


" Implementors should not implement or advertise support for “draft-05” "

Draft 5, as far as anyone not writing the specification should be concerned, should not exist.

OpenAPI 3.1 SHOULD bring support of draft 2019-09.


On Thursday, 31 October 2019 10:30:08 UTC, Nathan Herring wrote:
On Thu, Oct 31, 2019 at 11:14 AM Nathan Herring <nher...@google.com> wrote:


On Thu, Oct 31, 2019 at 10:18 AM Ben Hutton (@Relequestual) <b...@sanger.ac.uk> wrote:
Hi Nathan,


Q: What happened to draft-05?

The draft-05 core and validation specifications were intended to be more clear and readable rewrites of draft-04, to give us a strong base for draft-06 changes. Implementors should not implement or advertise support for “draft-05”.

Implementations that supported “draft-05” by implementing proposals from right after the publication of draft-04 should either remove that support or give it a different name to avoid confusion.



Essentially, don't use draft-5, and you shouldn't even find an implementation that supports it.

We certinly don't want to add confusion over that by allowing a draft-5 URL.

Makes sense. I can follow up with OpenAPI, since they specifically advertise they use Wright Draft 00 here.


"Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? "


I'm a little confused by this. Could you maybe expand a little to make sure I'm not making any incorrect assumptions please?


This is about ensuring that parsers/validators chasing off-document links use TLS where available. None of the $schema entries I've found have used "https://json-schema/draft-04/ schema#" and at least the one validator I'm familiar with (https://github.com/java-json- tools/json-schema-validator) will chase links directly without an option to enforce TLS on all "http" scheme URIs. https://github.com/java- json-tools/json-schema-core/ blob/master/src/main/java/com/ github/fge/jsonschema/core/ load/download/ DefaultURIDownloader.java


Cheers

Ben


On Wednesday, 30 October 2019 09:45:41 UTC, Nathan Herring wrote:
For schemas using Draft-05, I expect that most will have a line like OpenAPI v3's "$schema" that expressly refers to http://json-schema.org/draft- 04/schema#. Although they're equivalent schema with different validation IIUC, they cannot place a reference to https://json-schema.org/ draft-05/schema# because that 404s. Is there a reason not to place a 303 redirect there?

Also, is there any reason not to suggest that https links be used everywhere ($schema/$ref/id)? 

--
You received this message because you are subscribed to the Google Groups "JSON Schema" group.
To unsubscribe from this group and stop receiving emails from it, send an email to json-schema...@googlegroups.com.
To view this discussion on the web visit
Reply all
Reply to author
Forward
0 new messages