Replace hand-written format checkers with jsonschema[format-nongpl]

[LukasOro]

src/oold/validation/formats.py is 233 lines implementing 18 format assertions by hand. jsonschema[format-nongpl] supplies 19, covering all 18, with identical behaviour on the cases that matter here.

Measured

Same seven inputs through both, across iri, iri-reference, uri, uri-reference - identical in every cell, including the compact-IRI case that motivated the hand-written versions:

ex:alice                       iri=True   iri-reference=True   uri=True   uri-reference=True
schema:Person                  iri=True   iri-reference=True   uri=True   uri-reference=True
urn:uuid:1234...               iri=True   iri-reference=True   uri=True   uri-reference=True
alice                          iri=False  iri-reference=True   uri=False  uri-reference=True
../Thing.schema.json           iri=False  iri-reference=True   uri=False  uri-reference=True
http://exa mple.org            iri=False  iri-reference=False  uri=False  uri-reference=False

The non-ASCII behaviour asserted by test_iri_allows_non_ascii_but_uri_does_not also matches: iri-reference=True, uri=False.

Coverage: all 18 of this package's formats appear in format-nongpl's 19.

Licence constraint

Use jsonschema[format-nongpl], not jsonschema[format]. The latter pulls in rfc3987, which is GNU GPLv3+; this package is Apache-2.0. rfc3987 is correct on every case tested, but its licence rules it out.

Cost

format-nongpl installs 20 transitive packages. That is the main argument for keeping the hand-written module.

Work

• Swap OOLD_FORMAT_CHECKER onto the library checkers, keeping the module as the seam so callers do not change
• Gate on tests/test_validation/test_formats.py in full, not the sample above, plus OOLD_SCHEMA_DIR=../oold-schema uv run pytest -m parity
• If any format diverges, keep that one hand-written and document which and why

Raised from review of #114 (#114 (comment)).

[simontaurus]

Agreed, take the swap.

Two additions:

• format-nongpl is not fully permissive either: fqdn is MPL-2.0. Weak, file-level copyleft with no obligation on the combined work, but it should be named rather than found later. The rest is Apache-2.0 / MIT / BSD / ISC.
• The 20 transitive packages land on an optional extra, not the core, which makes the trade easier than the raw number suggests.

Verified the resolution rather than the docs: jsonschema[format] pulls rfc3987==1.3.8 (GPLv3+); jsonschema[format-nongpl] pulls rfc3986-validator + rfc3987-syntax + lark and no rfc3987.

Worth pinning the extra explicitly and asserting in CI that rfc3987 never enters the lock. Someone typing jsonschema[format] gets a working build and a licence change nobody reviews.

[LukasOro]

Agreed, and the fqdn catch is a real gap in the description - it said "the rest is Apache-2.0 / MIT / BSD / ISC", which was wrong. Re-checked the four packages against PyPI metadata rather than repeating it:

Package	License	Classifier
fqdn	MPL 2.0	Mozilla Public License 2.0
rfc3986-validator	MIT	MIT License
rfc3987-syntax	Apache-2.0	Apache Software License
rfc3987	GNU GPLv3+	GPL v3 or later

So your split holds exactly: format-nongpl pulls the first three and never rfc3987, and MPL-2.0 is file-level copyleft with no obligation on the combined work - it needs naming in the licence notes, not avoiding.

Agreed on the extra landing on an optional extra rather than the core, which is the answer to the 20-transitive-packages objection.

Taking the CI assertion too. The failure mode you describe is the dangerous one precisely because it works: someone types jsonschema[format], the build is green, the tests pass, and the distribution has quietly become GPLv3+. An assertion that rfc3987 never appears in the lock catches it at the only moment anyone would look. Cheap to write against uv.lock and worth doing in the same change as the swap rather than after it.