Replace hand-written format checkers with jsonschema[format-nongpl]

[LukasOro]

src/oold/validation/formats.py is 233 lines implementing 18 format assertions by hand. jsonschema[format-nongpl] supplies 19, covering all 18, with identical behaviour on the cases that matter here.

Measured

Same seven inputs through both, across iri, iri-reference, uri, uri-reference - identical in every cell, including the compact-IRI case that motivated the hand-written versions:

ex:alice                       iri=True   iri-reference=True   uri=True   uri-reference=True
schema:Person                  iri=True   iri-reference=True   uri=True   uri-reference=True
urn:uuid:1234...               iri=True   iri-reference=True   uri=True   uri-reference=True
alice                          iri=False  iri-reference=True   uri=False  uri-reference=True
../Thing.schema.json           iri=False  iri-reference=True   uri=False  uri-reference=True
http://exa mple.org            iri=False  iri-reference=False  uri=False  uri-reference=False

The non-ASCII behaviour asserted by test_iri_allows_non_ascii_but_uri_does_not also matches: iri-reference=True, uri=False.

Coverage: all 18 of this package's formats appear in format-nongpl's 19.

Licence constraint

Use jsonschema[format-nongpl], not jsonschema[format]. The latter pulls in rfc3987, which is GNU GPLv3+; this package is Apache-2.0. rfc3987 is correct on every case tested, but its licence rules it out.

Cost

format-nongpl installs 20 transitive packages. That is the main argument for keeping the hand-written module.

Work

• Swap OOLD_FORMAT_CHECKER onto the library checkers, keeping the module as the seam so callers do not change
• Gate on tests/test_validation/test_formats.py in full, not the sample above, plus OOLD_SCHEMA_DIR=../oold-schema uv run pytest -m parity
• If any format diverges, keep that one hand-written and document which and why

Raised from review of #114 (#114 (comment)).

[simontaurus]

Agreed, take the swap.

Two additions:

• format-nongpl is not fully permissive either: fqdn is MPL-2.0. Weak, file-level copyleft with no obligation on the combined work, but it should be named rather than found later. The rest is Apache-2.0 / MIT / BSD / ISC.
• The 20 transitive packages land on an optional extra, not the core, which makes the trade easier than the raw number suggests.

Verified the resolution rather than the docs: jsonschema[format] pulls rfc3987==1.3.8 (GPLv3+); jsonschema[format-nongpl] pulls rfc3986-validator + rfc3987-syntax + lark and no rfc3987.

Worth pinning the extra explicitly and asserting in CI that rfc3987 never enters the lock. Someone typing jsonschema[format] gets a working build and a licence change nobody reviews.

[LukasOro]

Agreed, and the fqdn catch is a real gap in the description - it said "the rest is Apache-2.0 / MIT / BSD / ISC", which was wrong. Re-checked the four packages against PyPI metadata rather than repeating it:

Package	License	Classifier
fqdn	MPL 2.0	Mozilla Public License 2.0
rfc3986-validator	MIT	MIT License
rfc3987-syntax	Apache-2.0	Apache Software License
rfc3987	GNU GPLv3+	GPL v3 or later

So your split holds exactly: format-nongpl pulls the first three and never rfc3987, and MPL-2.0 is file-level copyleft with no obligation on the combined work - it needs naming in the licence notes, not avoiding.

Agreed on the extra landing on an optional extra rather than the core, which is the answer to the 20-transitive-packages objection.

Taking the CI assertion too. The failure mode you describe is the dangerous one precisely because it works: someone types jsonschema[format], the build is green, the tests pass, and the distribution has quietly become GPLv3+. An assertion that rfc3987 never appears in the lock catches it at the only moment anyone would look. Cheap to write against uv.lock and worth doing in the same change as the swap rather than after it.

[LukasGold]

Implemented in #140, but the swap is partial, and the reason is a correction to this issue's premise.

The description says the library supplies 19 formats "covering all 18, with identical behaviour on the cases that matter here". Checked against tests/data/format_parity.json, the 98-case table already in the repository rather than the 7 rows measured above, 9 cases mismatch across 5 formats. Those 5 stay hand-written, with the reason in the module docstring:

Format	Why the library checker was not taken
date-time, time	rfc3339_validator rejects the space separator, offsets without a colon (+0200), and the leap second 23:59:60, all accepted by the reference toolchain
email, idn-email	the library's checker for both is "@" in instance, far looser than ajv-formats' pattern
uuid	parses via uuid.UUID, which strips a urn:uuid: prefix, then range-checks dash positions assuming no prefix, so a prefixed UUID is wrongly rejected

The uuid one is a genuine defect in the library rather than a difference of taste, and urn:uuid: is a form this package's own fixtures use, so it would have been a live regression.

The 13 that did match exactly were swapped, including every row measured in the description, the compact-IRI cases among them, and the non-ASCII behaviour asserted by test_iri_allows_non_ascii_but_uri_does_not. formats.py goes from 234 lines to 194 rather than disappearing.

Everything else in the issue holds unchanged: format-nongpl never pulls rfc3987, the extra lands on the optional dependency groups rather than the core, and the CI assertion that rfc3987 never enters uv.lock is in the same change. That assertion was confirmed to actually fail by running it against a synthetic lock fragment, not just by watching it pass.

Recording it here so the divergence is not rediscovered and fixed a second time.